Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 601:

  HOTSPOT

  You have an Azure subscription named Subscription1 that contains the resources shown in the following table.

  

  You plan to configure Azure Backup reports for Vault1. You are configuring the Diagnostics settings for the AzureBackupReports log. Which storage accounts and which Log Analytics workspaces can you use for the Azure Backup reports of Vault1?

  To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: storage3 only

  Vault1 and storage3 are both in West Europe.

  Box 2: Analytics1, Analytics2, Analytics3

  https://docs.microsoft.com/en-us/azure/backup/backup-create-rs-vault

  https://docs.microsoft.com/de-de/azure/backup/configure-reports

• Question 602:

  HOTSPOT

  You have a sync group named Sync1 that has a cloud endpoint. The cloud endpoint includes a file named File1.txt.

  

  Your on-premises network contains servers that run Windows Server 2016. The servers are configured as shown in the following table.

  You add Share1 as an endpoint for Sync1. One hour later, you add Share2 as an endpoint for Sync1.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Statement 1: Yes

  If you add an Azure file share that has an existing set of files as a cloud endpoint to a sync group, the existing files are merged with any other files that are already on other endpoints in the sync group.

  Statement 2: No

  Files present in any server endpoint will not be overwritten by the files present in cloud endpoint.

  Hence this statement is false.

  If you add a server location with an existing set of files as a server endpoint to a sync group, those files will be merged with any other files already on other endpoints in the sync group but not vice versa.

  Statement 3: Yes

  Azure File Sync has a simple architecture : cloud endpoints, which is the Azure File Sync service and server endpoints, which are the registered servers with the service. On top of that, we have Sync Groups, which combine one cloud

  endpoint with one or more server endpoints. All members of this group will receive the replicated data where the central location will be the cloud endpoint.

  References:

  https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-planning http://techgenix.com/azure-file-sync-replicating-data/

• Question 603:

  HOTSPOT

  You have an Azure subscription that contains an Azure Availability Set named WEBPROD-AS-USE2 as shown in the following exhibit.

  

  You add 14 virtual machines to WEBPROD-AS-USE2.

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

• Question 604:

  HOTSPOT

  You have an Azure virtual network named VNet1 that connects to your on-premises network by using a site-to-site VPN. VNet1 contains one subnet named Sunet1.

  Subnet1 is associated to a network security group (NSG) named NSG1. Subnet1 contains a basic internal load balancer named ILB1. ILB1 has three Azure virtual machines in the backend pool.

  You need to collect data about the IP addresses that connects to ILB1. You must be able to run interactive queries from the Azure portal against the collected data.

  What should you do? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: An Azure Log Analytics workspace

  In the Azure portal you can set up a Log Analytics workspace, which is a unique Log Analytics environment with its own data repository, data sources, and solutions.

  Box 2: NSG1

  NSG flow logs allow viewing information about ingress and egress IP traffic through a Network security group. Through this, the IP addresses that connect to the ILB can be monitored when the diagnostics are enabled on a Network Security

  Group.

  We cannot enable diagnostics on an internal load balancer to check for the IP addresses.

  As for Internal LB, it is basic one. Basic can only connect to storage account. Also, Basic LB has only activity logs, which doesn't include the connectivity workflow. So, we need to use NSG to meet the mentioned requirements.

• Question 605:

  HOTSPOT

  You have an Azure virtual machine named VM1 and a Recovery Services vault named Vault1.

  You create a backup policy named Policy1 as shown in the exhibit. (Click the Exhibit tab.)

  

  You configure the backup of VM1 to use Policy1 on Thursday, January 1.

  You need to identify the number of available recovery points for VM1.

  How many recovery points are available on January 8 and January 15? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: 6

  5 latest daily recovery points, which includes the weekly backup from the previous Sunday, plus the monthly recovery point.

  Box 2: 8

  5 latest daily recovery points, plus two weekly backups, plus the monthly recovery point.

  Reference:

  https://social.technet.microsoft.com/Forums/en-US/854ab6ae-79aa-4bad-ac65-471c4d422e94/daily-monthly-yearly-recovery-points-and-storage-used?forum=windowsazureonlinebackup

• Question 606:

  HOTSPOT

  You have Azure subscriptions named Subscription1 and Subscription2. Subscription1 has following resource groups:

  

  RG1 includes a web app named App1 in the West Europe location. Subscription2 contains the following resource groups:

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  App1 present in RG1 and in RG1 there is no lock available. So you can move App1 to other resource groups, RG2, RG3, RG4.

  Note:

  App Service resources can only be moved from the resource group in which they were originally created. If an App Service resource is no longer in its original resource group, move it back to its original resource group.

  Reference:

  https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move- limitations/app-service-move-limitations

• Question 607:

  HOTSPOT

  You have an Azure subscription named Subscription1 that contains a resource group named RG1.

  In RG1, you create an internal load balancer named LB1 and a public load balancer named LB2.

  You need to ensure that an administrator named Admin1 can manage LB1 and LB2. The solution must follow the principle of least privilege.

  Which role should you assign to Admin1 for each task? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: Network Contributor on RG1

  To add to the backend pool, write permission is required on the Resource Group because it writes deployment information. To add a backend pool, you need network contributor role on the LB and on the VMs that will be part of the backend

  pool.

  For this reason the network contributor role must be assigned to the RG where the LB and the VM resides. So the correct answer is Network Contributor on RG1 .

  Box 2: Network Contributor on RG1

  For Health Probe also, without having access to RG1, no health probe can be added. If only Network Contributor role is assigned to LB then the user would not be able to access the IP addresses of the member pools.

  Owner/Contributor can give the user access for everything. So it will not fit into the the principle of least privilege. Hence Owner and contributor role is incorrect choices for the question.

  Reference:

  https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

• Question 608:

  HOTSPOT

  You deploy an Azure Kubernetes Service (AKS) cluster that has the network profile shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: 10.244.0.0/16

  The Pod CIDR.

  Note: The --pod-cidr should be a large address space that isn't in use elsewhere in your network environment. This range includes any on-premises network ranges if you connect, or plan to connect, your Azure virtual networks using Express

  Route or a Site-to-Site VPN connection.

  This address range must be large enough to accommodate the number of nodes that you expect to scale up to. You can't change this address range once the cluster is deployed if you need more addresses for additional nodes.

  Box 2: 10.0.0.0/16

  The --service-cidr is used to assign internal services in the AKS cluster an IP address.

  Reference:

  https://docs.microsoft.com/en-us/azure/aks/configure-kubenet

• Question 609:

  HOTSPOT

  You have peering configured as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  Hot Area:

  

  Correct Answer:

  

  Box 1: vNET6 only

  Peering status to both VNet1 and Vnet2 are disconnected.

  Box 2: delete peering1

  Peering to Vnet1 is Enabled but disconnected. We need to update or re-create the remote peering to get it back to Initiated state.

  Reference:

  https://blog.kloud.com.au/2018/10/19/address-space-maintenance-with-vnet-peering/

• Question 610:

  HOTSPOT

  You plan to deploy an Azure container instance by using the following Azure Resource Manager template.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the template.

  Hot Area:

  

  Correct Answer:

  

  Box 1: can connect to the container from any device

  In the policy "osType": "window" refer that it will create a container in a container group that runs Windows but it won't block access depending on device type.

  Box 2: the container will restart automatically

  Docker provides restart policies to control whether your containers start automatically when they exit, or when Docker restarts. Restart policies ensure that linked containers are started in the correct order. Docker recommends that you use

  restart policies, and avoid using process managers to start containers.

  on-failure : Restart the container if it exits due to an error, which manifests as a non-zero exit code. As the flag is mentioned as "on-failure" in the policy, so it will restart automatically

  Reference:

  https://docs.microsoft.com/en-us/cli/azure/container?view=azure-cli-latest

  https://docs.docker.com/config/containers/start-containers-automatically/