Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 661:

  You have an Azure subscription that contains a Recovery Services vault named Vault1.

  You need to enable multi-user authorization (MAU) for Vault1.

  Which resource should you create first?

  A. an administrative unit

  B. a managed identity

  C. a resource guard

  D. a custom Azure role

  Correct Answer: C

  https://learn.microsoft.com/en-us/azure/backup/multi-user-authorization?tabs=azure-portalandpivots=vaults-recovery-services-vault

  Before you start Testing scenarios Create a Resource Guard Enable MUA on a Recovery Services vault Protected operations on a vault using MUA Authorize critical operations on a vault Disable MUA on a Recovery Services vault

• Question 662:

  You have 15 Azure subscriptions.

  You have an Azure Active Directory (Azure AD) tenant that contains a security group named Group1.

  You plan to purchase additional Azure subscription.

  You need to ensure that Group1 can manage role assignments for the existing subscriptions and the planned

  subscriptions.

  The solution must meet the following requirements:

  1.

  Use the principle of least privilege.

  2.

  Minimize administrative effort. What should you do?

  A. Assign Group1 the Owner role for the root management group.

  B. Assign Group1 the User Access Administrator role for the root management group.

  C. Create a new management group and assign Group1 the User Access Administrator role for the group.

  D. Create a new management group and assign Group1 the Owner role for the group.

  Correct Answer: B

  The User Access Administrator role enables the user to grant other users access to Azure resources. This switch can be helpful to regain access to a subscription.

  Management groups give you enterprise-grade management at scale no matter what type of subscriptions you might have.

  Each directory is given a single top-level management group called the "Root" management group. This root management group is built into the hierarchy to have all management groups and subscriptions fold up to it. This root management

  group allows for global policies and Azure role assignments to be applied at the directory level.

  Incorrect:

  Not C: A few directories that started using management groups early in the preview before June 25 2018 could see an issue where not all the subscriptions were within the hierarchy. The process to have all subscriptions in the hierarchy was

  put in place after a role or policy assignment was done on the root management group in the directory.

  Reference:

  https://docs.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles https://docs.microsoft.com/en-us/azure/governance/management-groups/overview

• Question 663:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to assign Workspace1 a role to allow read, write, and delete operations for the data stored in the containers of storage1. Which role should you assign?

  A. Storage Account Contributor

  B. Contributor

  C. Storage Blob Data Contributor

  D. Reader and Data Access

  Correct Answer: C

  Storage Blob Data Contributor Read, write, and delete Azure Storage containers and blobs. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#storage-blob-data-contributor

• Question 664:

  You have an Azure AD tenant that contains the groups shown in the following table.

  

  You purchase Azure Active Directory Premium P2 licenses. To which groups can you assign a license?

  A. Group1 only

  B. Group1 and Group3 only

  C. Group3 and Group4 only

  D. Group1, Group2, and Group3 only

  E. Group1, Group2, Group3, and Group4

  Correct Answer: B

• Question 665:

  You have an Azure subscription that contains a storage account named account1.

  You plan to upload the disk files of a virtual machine to account1 from your on-premises network. The on-premises network uses a public IP address space of 131.107.1.0/24.

  You plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be attached to a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24.

  You need to configure account1 to meet the following requirements:

  1.

  Ensure that you can upload the disk files to account1.

  2.

  Ensure that you can attach the disks to VM1.

  3.

  Prevent all other access to account1.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. From the Networking blade of account1, select Selected networks.

  B. From the Networking blade of account1, select Allow trusted Microsoft services to access this storage account.

  C. From the Networking blade of account1, add the 131.107.1.0/24 IP address range.

  D. From the Networking blade of account1, add VNet1.

  E. From the Service endpoints blade of VNet1, add a service endpoint.

  Correct Answer: AC

• Question 666:

  You have an Azure App Service app named App1 that contains two running instances. You have an autoscale rule configured as shown in the following exhibit.

  

  For the Instance limits scale condition setting, you set Maximum to 5.

  During a 30-minute period, App1 uses 80 percent of the available memory.

  What is the maximum number of instances for App1 during the 30-minute period?

  A. 2

  B. 3

  C. 4

  D. 5

  Correct Answer: D

• Question 667:

  You have an Azure AD tenant named contoso.com.

  You have an Azure subscription that contains an Azure App Service web app named App1 and an Azure key vault named KV1. KV1 contains a wildcard certificate for contoso.com.

  You have a user named [email protected] that is assigned the Owner role for App1 and KV1.

  You need to configure App1 to use the wildcard certificate of KV1.

  What should you do first?

  A. Create an access policy for KV1 and assign the Microsoft Azure App Service principal to the policy.

  B. Assign a managed user identity to App1.

  C. Configure KV1 to use the role-based access control (RBAC) authorization system.

  D. Create an access policy for KV1 and assign the policy to User1.

  Correct Answer: A

  In order to read secrets from a key vault, you need to have a vault created and give your app permission to access it.

  Create a key vault by following the Key Vault quickstart.

  Create a managed identity for your application.

  Key vault references use the app's system-assigned identity by default, but you can specify a user-assigned identity.

  Authorize read access to secrets your key vault for the managed identity you created earlier. How you do it depends on the permissions model of your key vault:

  Azure role-based access control: Assign the Key Vault Secrets User role to the managed identity. For instructions, see Provide access to Key Vault keys, certificates, and secrets with an Azure role-based access control. Vault access policy:

  Assign the Get secrets permission to the managed identity. For instructions, see Assign a Key Vault access policy.

  https://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references?tabs=azure-cli

• Question 668:

  You have an on-premises network that contains a database server named dbserver1.

  You have an Azure subscription.

  You plan to deploy three Azure virtual machines. Each virtual machine will be deployed to a separate availability zone.

  You need to configure an Azure VPN gateway for a site-to-site VPN. The solution must ensure that the virtual machines can connect to dbserver1.

  Which type of public IP address SKU and assignment should you use for the gateway?

  A. a basic SKU and a static IP address assignment

  B. a standard SKU and a static IP address assignment

  C. a basic SKU and a dynamic IP address assignment

  Correct Answer: B

  Azure VPN gateways support both dynamic and static IP address assignment options.

  By using a Standard SKU public IP address with a static IP address assignment, you can ensure a reliable and consistent VPN gateway configuration for your site-to-site VPN. This will allow the virtual machines deployed across different

  availability zones in Azure to connect securely to dbserver1 in your on-premises network.

• Question 669:

  You have an on-premises datacenter and an Azure subscription.

  You plan to connect the datacenter to Azure by using ExpressRoute.

  You need to deploy an ExpressRoute gateway. The solution must meet the following requirements:

  1.

  Support up to 10 Gbps of traffic.

  2.

  Support availability zones.

  3.

  Support FastPath.

  4.

  Minimize costs.

  Which SKU should you deploy?

  A. ERGw1AZ

  B. ERGw2

  C. ErGw3

  D. ErGw3AZ

  Correct Answer: D

  https://learn.microsoft.com/en-us/answers/questions/885158/whats-the-difference-between-ergw3az-vs-ultraperfo

• Question 670:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You configure Azure Site Recovery to replicate VM1 between the US East and West US regions.

  You perform a test failover of VM1 and specify VNET2 as the target virtual network.

  When the test version of VM1 is created, to which subnet will the virtual machine be connected?

  A. TestSubnet1

  B. DemoSubnet1

  C. RecoverySubnetA

  D. RecoverySubnetB

  Correct Answer: B

  https://learn.microsoft.com/en-us/azure/site-recovery/azure-to-azure-network-mapping The subnet of the target VM is selected based on the name of the subnet of the source VM.

  -

  If a subnet with the same name as the source VM subnet is available in the target network, that subnet is set for the target VM.

  -

  If a subnet with the same name doesn't exist in the target network, the first subnet in the alphabetical order is set as the target subnet.