Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 61:

  You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.

  You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.

  You need to ensure that visitors are serviced by the same web server for each request.

  What should you configure?

  A. Session persistence to Client IP and protocol

  B. Protocol to UDP

  C. Session persistence to None

  D. Floating IP (direct server return) to Disabled

  Correct Answer: A

  Azure Load Balancer supports the following distribution modes for routing connections to instances in the backend pool:

  *

  Session persistence: Client IP

  Traffic from the same client IP is routed to the same backend instance.

  *

  Hash based

  Traffic from the same client IP routed to any healthy instance in the backend pool.

  Note: Session persistence Session persistence is also known session affinity, source IP affinity, or client IP affinity. This distribution mode uses a two-tuple (source IP and destination IP) or three-tuple (source IP, destination IP, and protocol type) hash to route to backend instances. When using session persistence, connections from the same client will go to the same backend instance within the backend pool.

  Incorrect:

  * Floating IP Floating IP is Azure's terminology for a portion of what is known as Direct Server Return (DSR). DSR consists of two parts: a flow topology and an IP address mapping scheme. At a platform level, Azure Load Balancer always operates in a DSR flow topology regardless of whether Floating IP is enabled or not. This means that the outbound part of a flow is always correctly rewritten to flow directly back to the origin.

  With the default rule type, Azure exposes a traditional load balancing IP address mapping scheme for ease of use. Enabling Floating IP changes, the IP address mapping scheme to allow for more flexibility.

  Reference: https://learn.microsoft.com/en-us/azure/load-balancer/distribution-mode-concepts

• Question 62:

  You have an Azure subscription that has the public IP addresses shown in the following table.

  

  You plan to deploy an Instance of Azure Firewall Premium named FW1.

  Which IP addresses can you use?

  A. IP2 only

  B. IP1 and IP2 only

  C. IP1, IP2, and IP5 only

  D. IP1, IP2, IP4, and IP5 only

  Correct Answer: B

  https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses#at-a-glance Azure Firewall

  -Dynamic IPv4: No

  -Static IPv4: Yes

  -Dynamic IPv6: No

  -Static IPv6: No

  https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/configure-public-ip-firewall Azure Firewall is a cloud-based network security service that protects your Azure Virtual Network resources. Azure Firewall requires at least one public static IP address to be configured. This IP or set of IPs are used as the external connection point to the firewall. Azure Firewall supports standard SKU public IP addresses. Basic SKU public IP address and public IP prefixes aren't supported.

• Question 63:

  You have an Azure subscription that contains a storage account named storage1 in the North Europe Azure region.

  You need to ensure that when blob data is added to storage1, a secondary copy is created in the East US region. The solution must minimize administrative effort.

  What should you configure?

  A. operational backup

  B. object replication

  C. geo-redundant storage (GRS)

  D. a lifecycle management rule

  Correct Answer: B

• Question 64:

  You have an Azure subscription.

  You need to receive an email alert when a resource lock is removed from any resource in the subscription.

  What should you use to create an activity log alert in Azure Monitor?

  A. a resource, a condition, and an action group

  B. a resource, a condition, and a Microsoft 365 group

  C. a Log Analytics workspace, a resource, and an action group

  D. a data collection endpoint, an application security group, and a resource group

  Correct Answer: A

  Setting up alert on accidental removal of Resource locks Configure alerts This can be achieved in 3 simple steps

  1.

  Configure Alert Rule for the resource

  2.

  Create Action group for notification

  3.

  Test the configuration

  Following are the detailed steps Configure Alert Rule for the resource

  1.

  Select the Resource Group wherein deletion of lock needs to be monitored. Select "Alerts" and create a "New alert rules"

  2.

  Check the scope, click "Add condition" and type lock in search to select "Delete management locks (Microsoft Authorization/locks)

  Create Action Group for notification

  3.

  Click "Add action groups" and "Create action group"

  4.

  Enter "Action group name" and "Display name" and click "Next: Notifications". Action group is a collection of notification preferences defined by the owner of an Azure subscription.

  5.

  Enter "Notification name" and "Email" to provide notification. Once done click on "Review + create". Please note -- In your case this could be an email group as well.

  6.

  Enter "Alert rule name", "Description" and select "Enable alert rule upon creation"

  Note - Please wait for few minutes for changes to be shown.

  Reference:

  https://rkniyer999.medium.com/setting-up-alert-on-accidental-removal-of-resource-locks-2d451c5848d8

• Question 65:

  You have an Azure subscription.

  You plan to deploy the Azure container instances shown in the following table.

  

  Which instances can you deploy to a container group?

  A. Instance1 only

  B. Instance2 only

  C. Instance1 and Instance2 only

  D. Instance3 and Instance4 only

  Correct Answer: D

  https://learn.microsoft.com/en-us/azure/container-instances/container-instances-container-groups Multi-container groups currently support only Linux containers. For Windows containers, Azure Container Instances only supports deployment of a single container instance. While we are working to bring all features to Windows containers, you can find current platform differences in the service

• Question 66:

  You have an Azure subscription named Subscription1.

  You have 5 TB of data that you need to transfer to Subscription1.

  You plan to use an Azure Import/Export job.

  What can you use as the destination of the imported data?

  A. Azure Blob Storage

  B. Azure Data Lake Store

  C. Azure SQL Database

  D. a virtual machine

  Correct Answer: A

  Azure Import/Export service is used to securely import large amounts of data to Azure Blob storage and Azure Files by shipping disk drives to an Azure datacenter. This service can also be used to transfer data from Azure Blob storage to disk drives and ship to your on-premises sites. Data from one or more disk drives can be imported either to Azure Blob storage or Azure Files.

  Reference: https://learn.microsoft.com/en-us/azure/import-export/storage-import-export-service

• Question 67:

  You have an Azure subscription that contains 10 virtual machines and the resources shown in the following table.

  

  You need to ensure that Bastion1 can support 100 concurrent SSH users. The solution must minimize administrative effort. What should you do first?

  A. Resize the subnet of Bastion1

  B. Configure host scaling.

  C. Create a network security group (NSG)

  D. Upgrade Bastion1 to the Standard SKU

  Correct Answer: D

  Need to configure host scaling (see below). Azure Bastion supports up to 50 host instances. This feature is available for the Azure Bastion Standard SKU only. Incorrect:

  *

  Resize the subnet of Bastion1

  First updated to the Standard SKU, then increase the subnet size.

  Note: With a subnet size of /26 you have 64 hosts, but in fact only 62 useable hosts.

  If the network size is increased to /25, you will have 112 hosts, and 110 useable hosts.

  *

  Configure host scaling Host scaling Azure Bastion supports manual host scaling. You can configure the number of host instances (scale units) in order to manage the number of concurrent RDP/SSH connections that Azure Bastion can support. Increasing the number of host instances lets Azure Bastion manage more concurrent sessions. Decreasing the number of instances decreases the number of concurrent supported sessions. Azure Bastion supports up to 50 host instances. This feature is available for the Azure Bastion Standard SKU only.

  Reference: https://learn.microsoft.com/en-us/azure/bastion/bastion-overview https://www.calculator.net/ip-subnet-calculator.html

• Question 68:

  You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.

  You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.

  You need to ensure that visitors are serviced by the same web server for each request.

  What should you configure?

  A. Session persistence to None

  B. a health probe

  C. Session persistence to Client IP and protocol

  D. Idle Time-out (minutes) to 20

  Correct Answer: C

  Azure Load Balancer distribution modes

  Azure Load Balancer supports the following distribution modes for routing connections to instances in the backend pool:

  *

  Session persistence: Client IP Traffic from the same client IP is routed to the same backend instance

  *

  Session persistence: Client IP and protocol Traffic from the same client IP and protocol is routed to the same backend instance

  *

  Etc.

  Reference: https://learn.microsoft.com/en-us/azure/load-balancer/distribution-mode-concepts

• Question 69:

  You have an Azure subscription that uses the public IP addresses shown in the following table.

  

  You need to create a public Azure Standard Load Balancer. Which public IP addresses can you use?

  A. IP1, IP2, and IP3

  B. IP2 only

  C. IP3 only

  D. IP1 and IP3 only

  Correct Answer: C

  Matching SKUs are required for load balancer and public IP resources. You can't have a mixture of Basic SKU resources and standard SKU resources.

  Reference: https://docs.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses

• Question 70:

  You have an Azure subscription.

  You are deploying an Azure Kubernetes Service (AKS) cluster that will contain multiple pods. The pods will use kubernet networking.

  You need to restrict network traffic between the pods.

  What should you configure on the AKS cluster?

  A. the Azure network policy

  B. the Calico network policy

  C. pod security policies

  D. an application security group

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/azure/aks/use-network-policies