Microsoft Microsoft Certifications AZ-104 Questions & Answers

• Question 81:

  You have three offices and an Azure subscription that contains an Azure Active Directory (Azure AD) tenant.

  You need to grant user management permissions to a local administrator in each office.

  What should you use?

  A. Azure AD roles

  B. administrative units

  C. access packages in Azure AD entitlement management

  D. Azure roles

  Correct Answer: B

  Reference: https://docs.microsoft.com/en-us/azure/active-directory/roles/administrative-units

• Question 82:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named Dev.

  You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.

  Solution: On Dev, you assign the Logic App Contributor role to the Developers group.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Reference: https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

• Question 83:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You manage a virtual network named VNet1 that is hosted in the West US Azure region.

  VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.

  You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.

  Solution: From Azure Monitor, you create a metric on Network In and Network Out.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Reference: https://azure.microsoft.com/en-us/updates/general-availability-azure-network-watcher-connection-monitor-in-all-public-regions/

• Question 84:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer.

  The effective network security configurations for VM2 are shown in the following exhibit.

  

  You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail.

  You verify that the Load Balancer rules are configured correctly.

  You need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port 443.

  Solution: You create an inbound security rule that denies all traffic from the 131.107.100.50 source and has a priority of 64999.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  When an Azure Load Balancer get created, it will probe backend to detect if the backend service is healthy or not, the probe packet is sent from source address "AzureLoadBalancer", the IP address of "AzureLoadBalancer" is always

  168.63.129.16. https://msazure.club/addendum-of-azure-load-balancer-and-nsg-rules/

  What is happening here is the LB Health Probe of TCP 443 to VM1 and VM2 are getting blocked by Rule 200 so it thinks both VM1 and VM2 are down. Hence App1 is failing as the LB won't direct any 443 traffic anywhere as it considers all Hosts are down.

  Make a new rule above 200 or move rule 65001 up to <200, so the Health Probe will start working again, it will find a health host and start to direct 443 traffic from 131.107.100.50 to it.

  Reference: https://fastreroute.com/azure-network-security-groups-explained/

• Question 85:

  You have a virtual network named VNet1 as shown in the exhibit. (Click the Exhibit tab.)

  

  No devices are connected to VNet1.

  You plan to peer VNet1 to another virtual network named VNet2. VNet2 has an address space of 10.2.0.0/16.

  You need to create the peering.

  What should you do first?

  A. Modify the address space of VNet1.

  B. Add a gateway subnet to VNet1.

  C. Create a subnet on VNet1 and VNet2.

  D. Configure a service endpoint on VNet2.

  Correct Answer: A

  The virtual networks you peer must have non-overlapping IP address spaces. The exhibit indicates that VNet1 has an address space of 10.2.0.0/16, which is the same as VNet2, and thus overlaps. We need to change the address space for VNet1.

  Reference: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering#requirements-and-constraints https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq

• Question 86:

  You have a registered DNS domain named contoso.com.

  You create a public Azure DNS zone named contoso.com.

  You need to ensure that records created in the contoso.com zone are resolvable from the internet.

  What should you do?

  A. Create NS records in contoso.com.

  B. Modify the SOA record in the DNS domain registrar.

  C. Create the SOA record in contoso.com.

  D. Modify the NS records in the DNS domain registrar.

  Correct Answer: D

  Reference: https://docs.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns

• Question 87:

  You have an Azure Storage account named storage1 that contains a blob container named container1.

  You need to prevent new content added to container1 from being modified for one year.

  What should you configure?

  A. the access tier

  B. an access policy

  C. the Access control (IAM) settings

  D. the access level

  Correct Answer: B

  Time-based retention policies: With a time-based retention policy, users can set policies to store data for a specified interval. When a time-based retention policy is set, objects can be created and read, but not modified or deleted. After the retention period has expired, objects can be deleted but not overwritten.

  Reference: https://docs.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview?tabs=azure-portal

• Question 88:

  You create an Azure Storage account named contosostorage.

  You plan to create a file share named data.

  Users need to map a drive to the data file share from home computers that run Windows 10.

  Which outbound port should be open between the home computers and the data file share?

  A. 80

  B. 443

  C. 445

  D. 3389

  Correct Answer: C

  Server Message Block (SMB) is used to connect to an Azure file share over the internet. The SMB protocol requires TCP port 445 to be open. Incorrect Answers:

  A: Port 80 is required for HTTP to a web server

  B: Port 443 is required for HTTPS to a web server

  D: Port 3389443 is required for Remote desktop protocol (RDP) connections

  Reference: https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows

• Question 89:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure virtual machine named VM1 that runs Windows Server 2016.

  You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour.

  Solution: You create an Azure Log Analytics workspace and configure the Agent configuration settings. You install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the Log Analytics workspace as the

  source.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: A

  Alerts in Azure Monitor can identify important information in your Log Analytics repository. They are created by alert rules that automatically run log searches at regular intervals, and if results of the log search match particular criteria, then an alert record is created and it can be configured to perform an automated response.

  The Log Analytics agent collects monitoring data from the guest operating system and workloads of virtual machines in Azure, other cloud providers, and on-premises. It collects data into a Log Analytics workspace.

  References: https://docs.microsoft.com/en-us/azure/azure-monitor/learn/tutorial-response https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agents-overview

• Question 90:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json.

  You receive a notification that VM1 will be affected by maintenance.

  You need to move VM1 to a different host immediately.

  Solution: From the Overview blade, you move the virtual machine to a different resource group.

  Does this meet the goal?

  A. Yes

  B. No

  Correct Answer: B

  Changing Subscription won't affect the downtime, it will just you change the billing. You would need to redeploy the VM. After you redeploy a VM, the temporary disk is lost, and dynamic IP addresses associated with virtual network interface

  are updated.

  From Overview there is no option to move the VM to another hardware to skip the maintenance.

  Ideally you need an Availability Set and defining the Update Domains.

  Reference:

  https://docs.microsoft.com/en-us/azure/virtual-machines/windows/redeploy-to-new-node