Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 681:

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  All the virtual networks are peered. Each virtual network contains nine virtual machines.

  You need to configure secure RDP connections to the virtual machines by using Azure Bastion.

  What is the minimum number of Bastion hosts required?

  A. 1

  B. 3

  C. 9

  D. 10

  Correct Answer: B

  One in each region.

  Note: VNet peering and Azure Bastion

  Azure Bastion and VNet peering can be used together. When VNet peering is configured, you don't have to deploy Azure Bastion in each peered VNet. This means if you have an Azure Bastion host configured in one virtual network (VNet), it

  can be used to connect to VMs deployed in a peered VNet without deploying an additional bastion host.

  How do I incorporate Azure Bastion in my Disaster Recovery plan?

  Azure Bastion is deployed within VNets or peered VNets, and is associated to an Azure region. You're responsible for deploying Azure Bastion to a Disaster Recovery (DR) site VNet. In the event of an Azure region failure, perform a failover

  operation for your VMs to the DR region. Then, use the Azure Bastion host that's deployed in the DR region to connect to the VMs that are now deployed there.

  Reference:

  https://learn.microsoft.com/en-us/azure/bastion/vnet-peering

• Question 682:

  You have an Azure subscription that contains a resource group named RG1 and a virtual network named VNet1.

  You plan to create an Azure container instance named container1.

  You need to be able to configure DNS name label scope reuse for container1.

  What should you configure for container1?

  A. the private networking type

  B. the public networking type

  C. a new subnet on VNet1

  D. a confidential SKU

  Correct Answer: B

  Public networking type allows you to assign a DNS name label to the container instance that is globally unique within Azure, and it's accessible from the internet. This is typically used when you want to expose a service hosted in a container

  to the public.

  Private networking type would not allow you to configure DNS name label scope reuse because it doesn't expose the container instance to the public internet, and it typically operates within a virtual network (VNet) for private communication.

  Creating a new subnet on VNet1 (Option C) is related to configuring the network settings of the virtual network and isn't directly related to configuring DNS name label scope reuse for the container instance.

  A confidential SKU (Option D) is not related to DNS name label scope reuse or networking configurations. It is used for specific security and confidentiality requirements.

  Reference:

  https://learn.microsoft.com/en-us/azure/container-instances/how-to-reuse-dns-names

• Question 683:

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  The subscription contains the virtual machines shown in the following table.

  

  All the virtual machines have only private IP addresses.

  You deploy an Azure Bastion host named Bastion1 to VNet1.

  To which virtual machines can you connect through Bastion1?

  A. VM1 only

  B. VM1 and VM2 only

  C. VM1 and VM3 only

  D. VM1, VM2, and VM3

  Correct Answer: B

  VNet1 and VNet are peered and VNet2 and VNet3 are also peered. However VNet1 and VNet3 are not peered with each other. If gateway transit is not allowed - and it is not stated -, then there is no connection between VNet1 and VNet3. Bastion is deployed in VNet1.

• Question 684:

  You have an Azure subscription that contains an Azure SQL database named DB1.

  You plan to use Azure Monitor to monitor the performance of DB1. You must be able to run queries to analyze log data.

  Which destination should you configure in the Diagnostic settings of DB1?

  A. Send to a Log Analytics workspace.

  B. Archive to a storage account.

  C. Stream to an Azure event hub.

  Correct Answer: A

  Log Analytics is a tool in the Azure portal to edit and run log queries from data collected by Azure Monitor logs and interactively analyze their results. You can use Log Analytics queries to retrieve records that match particular criteria, identify trends, analyze patterns, and provide various insights into your data.

  Reference: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-tutorial

• Question 685:

  You have an Azure subscription. The subscription contains virtual machines that run Windows Server.

  You have a data collection rule (DCR) named Rule1.

  You plan to use the Azure Monitor Agent to collect events from Windows System event logs.

  You only need to collect system events that have an ID of 1001.

  Which type of query should you use for the data source in Rule1?

  A. SQL

  B. XPath

  C. KQL

  Correct Answer: B

  Filter events using XPath queries

  You're charged for any data you collect in a Log Analytics workspace. Therefore, you should only collect the event data you need. The basic configuration in the Azure portal provides you with a limited ability to filter out events.

  To specify more filters, use custom configuration and specify an XPath that filters out the events you don't need. XPath entries are written in the form LogName!XPathQuery. For example, you might want to return only events from the

  Application event log with an event ID of 1035. The XPathQuery for these events would be *[System[EventID=1035]]. Because you want to retrieve the events from the Application event log, the XPath is Application!*[System[EventID=1035]]

  Reference:

  https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent

• Question 686:

  You have an Azure subscription that contains a virtual machine named VM1.

  You have an on-premises datacenter that contains a domain controller named DC1. ExpressRoute is used to connect the on-premises datacenter to Azure.

  You need to use Connection Monitor to identify network latency between VM1 and DC1.

  What should you install on DC1?

  A. the Azure Connected Machine agent for Azure Arc-enabled servers

  B. the Azure Network Watcher Agent virtual machine extension

  C. the Log Analytics agent

  D. an Azure Monitor agent extension

  Correct Answer: D

  Reference: https://learn.microsoft.com/en-us/azure/expressroute/how-to-configure-connection-monitor

• Question 687:

  You have an Azure subscription that has Traffic Analytics configured.

  You deploy a new virtual machine named VM1 that has the following settings:

  1.

  Region: East US

  2.

  Virtual network: VNet1

  3.

  NIC network security group: NSG1

  You need to monitor VM1 traffic by using Traffic Analytics.

  Which settings should you configure?

  A. Diagnostic settings for VM1

  B. NSG flow logs for NSG1

  C. Diagnostic settings for NSG1

  D. Insights for VM1

  Correct Answer: B

  Traffic analytics Prerequisites

  Traffic analytics requires:

  A Network Watcher enabled subscription.

  *-> NSG flow logs enabled for the network security groups you want to monitor.

  An Azure Log Analytics workspace with read and write access.

  Reference:

  https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics

• Question 688:

  You have an Azure subscription. The subscription contains 10 virtual machines that run Windows Server. Each virtual machine hosts a website in IIS and has the Azure Monitor Agent installed.

  You need to collect the IIS logs from each virtual machine and store them in a Log Analytics workspace.

  What should you configure first?

  A. a data collection endpoint

  B. an Azure Monitor Private Link Scope (AMPLS)

  C. Diagnostic settings

  D. VM insights

  E. a private endpoint

  Correct Answer: A

  Collect IIS logs with Azure Monitor Agent

  The Internet Information Service (IIS) logs data to the local disk of Windows machines. Collect IIS logs from monitored machines with Azure Monitor Agent by creating a data collection rule (DCR).

  Prerequisites

  To complete this procedure, you need:

  Log Analytics workspace where you have at least contributor rights.

  Data collection endpoint.

  Permissions to create Data Collection Rule objects in the workspace.

  A VM, Virtual Machine Scale Set, or Arc-enabled on-premises server that runs IIS.

  Reference:

  https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-iis

• Question 689:

  You have a Microsoft 365 tenant and an Azure Active Directory (Azure AD) tenant named contoso.com.

  You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft SharePoint document library named Library1.

  You need to create groups for the users. The solution must ensure that the groups are deleted automatically after 180 days.

  Which two groups should you create? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. a Microsoft 365 group that uses the Assigned membership type

  B. a Security group that uses the Assigned membership type

  C. a Microsoft 365 group that uses the Dynamic User membership type

  D. a Security group that uses the Dynamic User membership type

  E. a Security group that uses the Dynamic Device membership type

  Correct Answer: AC

• Question 690:

  You have an Azure Active Directory (Azure AD) tenant named contosocloud.onmicrosoft.com.

  Your company has a public DNS zone for contoso.com.

  You add contoso.com as a custom domain name to Azure AD.

  You need to ensure that Azure can verify the domain name.

  Which type of DNS record should you create?

  A. MX

  B. NSEC

  C. PTR

  D. RRSIG

  Correct Answer: A

  To verify your custom domain name (example)

  1.

  Sign in to the Azure portal using a Global administrator account for the directory.

  2.

  Select Azure Active Directory, and then select Custom domain names.

  3.

  On the Fabrikam - Custom domain names page, select the custom domain name, Contoso.

  4.

  On the Contoso page, select Verify to make sure your custom domain is properly registered and is valid for Azure AD. Use either the TXT or the MX record type.

  Note:

  There are several versions of this question in the exam. The question can have two correct answers:

  1.

  MX

  2.

  TXT

  The question can also have other incorrect answer options, including the following:

  1.

  SRV

  2.

  NSEC3

  Reference:

  https://docs.microsoft.com/en-us/azure/dns/dns-web-sites-custom-domain