Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 711:

  You need to prepare the environment to meet the authentication requirements.

  Which two actions should you perform? Each correct answer presents part of the solution. NOTE Each correct selection is worth one point.

  A. Azure Active Directory (AD) Identity Protection and an Azure policy

  B. a Recovery Services vault and a backup policy

  C. an Azure Key Vault and an access policy

  D. an Azure Storage account and an access policy

  Correct Answer: BD

  D: Seamless SSO works with any method of cloud authentication - Password Hash Synchronization or Pass-through Authentication, and can be enabled via Azure AD Connect.

  B: You can gradually roll out Seamless SSO to your users. You start by adding the following Azure AD URL to all or selected users' Intranet zone settings by using Group Policy in Active Directory:

  https://autologon.microsoftazuread-sso.com Incorrect Answers:

  A: Seamless SSO needs the user's device to be domain-joined, but doesn't need for the device to be Azure AD Joined.

  C: Azure AD connect does not port 8080. It uses port 443.

  E: Seamless SSO is not applicable to Active Directory Federation Services (ADFS). Scenario: Users in the Miami office must use Azure Active Directory Seamless Single Sign-on (Azure AD Seamless SSO) when accessing resources in

  Azure.

  Planned Azure AD Infrastructure include: The on-premises Active Directory domain will be synchronized to Azure AD.

  References: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directory- aadconnect-sso-quick-start

• Question 712:

  You need to define a custom domain name for Azure AD to support the planned infrastructure. Which domain name should you use?

  A. Join the client computers in the Miami office to Azure AD.

  B. Add http://autologon.microsoftazuread-sso.com to the intranet zone of each client computer in the Miami office.

  C. Allow inbound TCP port 8080 to the domain controllers in the Miami office.

  D. Install Azure AD Connect on a server in the Miami office and enable Pass-through Authentication

  E. Install the Active Directory Federation Services (AD FS) role on a domain controller in the Miami office.

  Correct Answer: BD

  Every Azure AD directory comes with an initial domain name in the form of domainname.onmicrosoft.com. The initial domain name cannot be changed or deleted, but you can add your corporate domain name to Azure AD as well. For example, your organization probably has other domain names used to do business and users who sign in using your corporate domain name. Adding custom domain names to Azure AD allows you to assign user names in the directory that are familiar to your users, such as '[email protected].' instead of 'alice@domain name.onmicrosoft.com'. Scenario: Network Infrastructure: Each office has a local data center that contains all the servers for that office. Each office has a dedicated connection to the Internet. Humongous Insurance has a single-domain Active Directory forest named humongousinsurance.com Planned Azure AD Infrastructure: The on-premises Active Directory domain will be synchronized to Azure AD. References: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-custom- domain

• Question 713:

  You need to resolve the Active Directory issue. What should you do?

  A. From Active Directory Users and Computers, select the user accounts, and then modify the User Principal Name value.

  B. Run idfix.exe, and then use the Edit action.

  C. From Active Directory Domains and Trusts, modify the list of UPN suffixes.

  D. From Azure AD Connect, modify the outbound synchronization rule.

  Correct Answer: B

  IdFix is used to perform discovery and remediation of identity objects and their attributes in an on- premises Active Directory environment in preparation for migration to Azure Active Directory. IdFix is intended for the Active Directory

  administrators responsible for directory synchronization with Azure Active Directory.

  Scenario: Active Directory Issue

  Several users in humongousinsurance.com have UPNs that contain special characters.

  You suspect that some of the characters are unsupported in Azure AD.

  References: https://www.microsoft.com/en-us/download/details.aspx?id=36832

• Question 714:

  Which blade should you instruct the finance department auditors to use?

  A. invoices

  B. partner information

  C. cost analysis

  D. External services

  Correct Answer: C

  Cost analysis: Correct Option

  In cost analysis blade of Azure, you can see all the detail for custom time span. You can use this to determine expenditure of last few day, weeks, and month. Below options are available in Cost analysis blade for filtering information by time

  span: last 7 days, last 30 days, and custom date range. Choosing the first option (last 7 days) auditors can view the costs by time span.

  Cost analysis shows data for the current month by default. Use the date selector to switch to common date ranges quickly. Examples include the last seven days, the last month, the current year,

  or a custom date range. Pay-as-you-go subscriptions also include date ranges based on your billing period, which isn't bound to the calendar month, like the current billing period or last invoice. Use

  the links at the top of the menu to jump to the previous or next period, respectively. For example,

  

  Invoice: Incorrect Option Invoices can only be used for past billing periods not for current billing period, i.e. if your requirement is to know the last week's cost then that also not filled by invoices because Azure generates invoice at the end of the month. Even though Invoices have custom timespan, but when you put in dates for a week, the pane would be empty. Below is from Microsoft document:

  

  Resource Provider: Incorrect Option When deploying resources, you frequently need to retrieve information about the resource providers and types. For example, if you want to store keys and secrets, you work with the Microsoft.KeyVault resource provider. This resource provider offers a resource type called vaults for creating the key vault. This is not useful for reviewing all Azure costs from the past week which is required for audit. Payment method: Incorrect Option Payment methods is not useful for reviewing all Azure costs from the past week which is required for audit.

  Reference: https://docs.microsoft.com/en-us/azure/cost-management-billing/costs/quick-acm-cost-analysis https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/download-azure-invoicedaily-usage-date

• Question 715:

  You need to define a custom domain name for Azure AD to support the planned infrastructure. Which domain name should you use?

  A. ad.humongousinsurance.com

  B. humongousinsurance.onmicrosoft.com

  C. humongousinsurance.local

  D. humongousinsurance.com

  Correct Answer: D

  Every Azure AD directory comes with an initial domain name in the form of domainname.onmicrosoft.com. The initial domain name cannot be changed or deleted, but you can add your corporate domain name to Azure AD as well. For example, your organization probably has other domain names used to do business and users who sign in using your corporate domain name. Adding custom domain names to Azure AD allows you to assign user names in the directory that are familiar to your users, such as '[email protected].' instead of 'alice@domain name.onmicrosoft.com'. Scenario: Network Infrastructure: Each office has a local data center that contains all the servers for that office. Each office has a dedicated connection to the Internet. Humongous Insurance has a single-domain Active Directory forest named humongousinsurance.com Planned Azure AD Infrastructure: The on-premises Active Directory domain will be synchronized to Azure AD. References: https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-custom- domain

• Question 716:

  You need to prepare the environment to meet the authentication requirements. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

  A. Allow inbound TCP port 8080 to the domain controllers in the Miami office.

  B. Add http://autogon.microsoftazuread-sso.com to the intranet zone of each client computer in the Miami office.

  C. Join the client computers in the Miami office to Azure AD.

  D. Install the Active Directory Federation Services (AD FS) role on a domain controller in the Miami office.

  E. Install Azure AD Connect on a server in the Miami office and enable Pass-through Authentication.

  Correct Answer: BE

  B: You can gradually roll out Seamless SSO to your users. You start by adding the following Azure AD URL to all or selected users' Intranet zone settings by using Group Policy in Active Directory:

  https://autologon.microsoftazuread-sso.com E: Seamless SSO works with any method of cloud authentication - Password Hash Synchronization or Pass-through Authentication, and can be enabled via Azure AD Connect.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso-quick-start

• Question 717:

  You need to resolve the licensing issue before you attempt to assign the license again. What should you do?

  A. From the Groups blade, invite the user accounts to a new group.

  B. From the Profile blade, modify the usage location.

  C. From the Directory role blade, modify the directory role.

  Correct Answer: B

  Scenario: Licensing Issue

  1.

  You attempt to assign a license in Azure to several users and receive the following error message: "Licenses not assigned. License agreement failed for one user."

  2.

  You verify that the Azure subscription has the available licenses.

  Solution:

  License cannot be assigned to a user without a usage location specified.

  Some Microsoft services aren't available in all locations because of local laws and regulations. Before you can assign a license to a user, you must specify the Usage location property for the user. You can specify the location under the User > Profile > Settings section in the Azure portal.

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/licensing-groupsresolve-problems

• Question 718:

  You need to ensure that VM1 can communicate with VM4. The solution must minimize the administrative effort.

  What should you do?

  A. Create an NSG and associate the NSG to VM1 and VM4.

  B. Establish peering between VNET1 and VNET3.

  C. Assign VM4 an IP address of 10.0.1.5/24.

  D. Create a user-defined route from VNET1 to VNET3.

  Correct Answer: B

  We need a VPN site-to-site to communicate between Azure and on-premises.

  Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-portaloft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-portal

• Question 719:

  You discover that VM3 does NOT meet the technical requirements. You need to verify whether the issue relates to the NSGs.

  What should you use?

  A. Diagram in VNet1

  B. the security recommendations in Azure Advisor

  C. Diagnostic settings in Azure Monitor

  D. Diagnose and solve problems in Traffic Manager Profiles

  E. IP flow verify in Azure Network Watcher

  Correct Answer: E

  Scenario: Litware must meet technical requirements including:

  Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in the Montreal office.

  IP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of direction, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a security group, the name of the rule

  that denied the packet is returned. While any source or destination IP can be chosen, IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to the on-premises environment.

  References:

  https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview

• Question 720:

  You need to meet the technical requirement for VM4.

  What should you create and configure?

  A. an Azure Notification Hub

  B. an Azure Event Hub

  C. an Azure Logic App

  D. an Azure services Bus

  Correct Answer: B

  Scenario: Create a workflow to send an email message when the settings of VM4 are modified. You can start an automated logic app workflow when specific events happen in Azure resources or third-party resources. These resources can publish those events to an Azure event grid. In turn, the event grid pushes those events to subscribers that have queues, webhooks, or event hubs as endpoints. As a subscriber, your logic app can wait for those events from the event grid before running automated workflows to perform tasks - without you writing any code. References: https://docs.microsoft.com/en-us/azure/event-grid/monitor-virtual-machine-changes-event-grid- logic-app