[ { "seq": 1, "pdfId": 90001, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/90001" }, "markersInGap": [], "questionText": "Your company has serval departments. Each department has a number of virtual machines (VMs).\nThe company has an Azure subscription that contains a resource group named RG1.\nAll VMs are located in RG1.\nYou want to associate each VM with its respective department.\nWhat should you do?\nA.\nCreate Azure Management Groups for each department.\nB.\nCreate a resource group for each department.\nC.\nAssign tags to the virtual machines.\nD.\nModify the settings of the virtual machines.", "stem": "Your company has serval departments. Each department has a number of virtual machines (VMs). The company has an Azure subscription that contains a resource group named RG1. All VMs are located in RG1. You want to associate each VM with its respective department. What should you do", "options": [ { "key": "A", "text": "Create Azure Management Groups for each department." }, { "key": "B", "text": "Create a resource group for each department." }, { "key": "C", "text": "Assign tags to the virtual machines." }, { "key": "D", "text": "Modify the settings of the virtual machines." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C. Assign tags to the virtual machines.\nBy assigning tags, you can organize resources in a way that makes sense for your organization, which will\nallow you to easily filter and view resources based on criteria such as department, environment, or cost\ncenter. In this case, you can create a tag called \"Department\" and assign the appropriate value to each VM.", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-using-tags", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-using-tags" ], "note": "The question is included in a number of questions that depicts the identical set-up. However, every question\nhas a distinctive result. Establish if the solution satisfies the requirements.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 2, "pdfId": 90002, "exam": "AZ-104", "type": "yes_no", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/90002" }, "markersInGap": [], "questionText": "Your company has an Azure Active Directory (Azure AD) subscription.\nYou want to implement an Azure AD conditional access policy.\nThe policy must be configured to require members of the Global Administrators group to use Multi-Factor\nAuthentication and an Azure AD-joined device when they connect to Azure AD from untrusted locations.\nSolution: You access the multi-factor authentication page to alter the user settings.\nDoes the solution meet the goal?\nA.\nYes\nB.\nNo", "stem": "Your company has an Azure Active Directory (Azure AD) subscription. You want to implement an Azure AD conditional access policy. The policy must be configured to require members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when they connect to Azure AD from untrusted locations. Solution: You access the multi-factor authentication page to alter the user settings. Does the solution meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "No" ] }, "explanation": "B. The solution does not meet the goal. While accessing the multi-factor authentication page allows you to\nconfigure multi-factor authentication for users, it does not specifically target the members of the Global\nAdministrators group. To meet the goal of requiring Global Administrators to use Multi-Factor Authentication\nand an Azure AD-joined device when connecting from untrusted locations, you need to set up an Azure AD\nconditional access policy.", "reference": null, "references": [], "note": "The question is included in a number of questions that depicts the identical set-up. However, every question", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 3, "pdfId": 3, "exam": "AZ-104", "type": "yes_no", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/3" }, "markersInGap": [], "questionText": "Your company has an Azure Active Directory (Azure AD) subscription.\nYou want to implement an Azure AD conditional access policy.\nThe policy must be configured to require members of the Global Administrators group to use Multi-Factor\nAuthentication and an Azure AD-joined device when they connect to Azure AD from untrusted locations.\nSolution: You access the Azure portal to alter the session control of the Azure AD conditional access policy.\nDoes the solution meet the goal?\nA.\nYes\nB.\nNo", "stem": "Your company has an Azure Active Directory (Azure AD) subscription. You want to implement an Azure AD conditional access policy. The policy must be configured to require members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when they connect to Azure AD from untrusted locations. Solution: You access the Azure portal to alter the session control of the Azure AD conditional access policy. Does the solution meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "No" ] }, "explanation": "B. No.\nAzure AD Conditional Access policies allow you to control how users access resources based on conditions\nlike location, device compliance, and risk level.\nSession controls in Conditional Access define how long sessions remain valid or restrict access based on\nsecurity signals.\nHowever, altering session control does not directly enforce or change authentication behavior for specific\napplications or services beyond session duration and restrictions.", "reference": null, "references": [], "note": "The question is included in a number of questions that depicts the identical set-up. However, every question\nhas a distinctive result. Establish if the solution satisfies the requirements.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 4, "pdfId": 4, "exam": "AZ-104", "type": "yes_no", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/4" }, "markersInGap": [], "questionText": "Your company has an Azure Active Directory (Azure AD) subscription.\nYou want to implement an Azure AD conditional access policy.\nThe policy must be configured to require members of the Global Administrators group to use Multi-Factor\nAuthentication and an Azure AD-joined device when they connect to Azure AD from untrusted locations.\nSolution: You access the Azure portal to alter the grant control of the Azure AD conditional access policy.\nDoes the solution meet the goal?\nA.\nYes\nB.\nNo", "stem": "Your company has an Azure Active Directory (Azure AD) subscription. You want to implement an Azure AD conditional access policy. The policy must be configured to require members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when they connect to Azure AD from untrusted locations. Solution: You access the Azure portal to alter the grant control of the Azure AD conditional access policy. Does the solution meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "Yes" ] }, "explanation": "A .YES.\nWithin a Conditional Access policy:\nAccess Control GRANT: an administrator can use access controls to grant or block access to resources.\nAccess Control SESSION: an administrator can make use of session controls to enable limited experiences\nwithin specific cloud applications.", "reference": "https://docs.google.com/document/d/1LFqUi7YcKI2d8cs8LnHLGjyHtuXUnz0xik4bpAvZ5fg/edit?usp=sharing\nhttps://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-grant\nYou are planning to deploy an Ubuntu Server virtual machine to your company's Azure subscription.", "references": [ "https://docs.google.com/document/d/1LFqUi7YcKI2d8cs8LnHLGjyHtuXUnz0xik4bpAvZ5fg/edit?usp=sharing", "https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-grant" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 5, "pdfId": 5, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/5" }, "markersInGap": [], "questionText": "You are required to implement a custom deployment that includes adding a particular trusted root certification\nauthority (CA).\nWhich of the following should you use to create the virtual machine?\nA.\nThe New-AzureRmVm cmdlet.\nB.\nThe New-AzVM cmdlet.\nC.\nThe Create-AzVM cmdlet.\nD.\nThe az vm create command.", "stem": "You are required to implement a custom deployment that includes adding a particular trusted root certification authority (CA). Which of the following should you use to create the virtual machine", "options": [ { "key": "A", "text": "The New-AzureRmVm cmdlet." }, { "key": "B", "text": "The New-AzVM cmdlet." }, { "key": "C", "text": "The Create-AzVM cmdlet." }, { "key": "D", "text": "The az vm create command." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "The az vm create command. you need to create an Ubuntu Linux VM using a cloud-init script for configuration.\nFor example, az vm create -g MyResourceGroup -n MyVm --image debian --custom-data\nMyCloudInitScript.yml", "reference": "https://docs.microsoft.com/en-us/cli/azure/vm?view=azure-cli-latest\nhttps://cloudinit.readthedocs.io/en/latest/topics/examples.html", "references": [ "https://docs.microsoft.com/en-us/cli/azure/vm?view=azure-cli-latest", "https://cloudinit.readthedocs.io/en/latest/topics/examples.html" ], "note": "The question is included in a number of questions that depicts the identical set-up. However, every question\nhas a distinctive result. Establish if the solution satisfies the requirements.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 6, "pdfId": 6, "exam": "AZ-104", "type": "yes_no", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/6" }, "markersInGap": [], "questionText": "Your company makes use of Multi-Factor Authentication for when users are not in the office. The Per\nAuthentication option has been configured as the usage model.\nAfter the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD)\nobtains a different company and adding the new employees to Azure Active Directory (Azure AD), you are informed\nthat these employees should also make use of Multi-Factor Authentication.\nTo achieve this, the Per Enabled User setting must be set for the usage model.\nSolution: You reconfigure the existing usage model via the Azure portal.\nDoes the solution meet the goal?\nA.\nYes\nB.\nNo", "stem": "Your company makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option has been configured as the usage model. After the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD) obtains a different company and adding the new employees to Azure Active Directory (Azure AD), you are informed that these employees should also make use of Multi-Factor Authentication. To achieve this, the Per Enabled User setting must be set for the usage model. Solution: You reconfigure the existing usage model via the Azure portal. Does the solution meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "No" ] }, "explanation": "Since it is not possible to change the usage model of an existing provider as it is right now, you have to create\na new one and reactivate your existing server with activation credentials from the new provider.", "reference": "https://365lab.net/2015/04/11/switch-usage-model-in-azure-multi-factor-authentication-server/\nNote: The question is included in a number of questions that depicts the identical set-up. However, every question\nhas a distinctive result. Establish if the solution satisfies the requirements.\nYour company's Azure solution makes use of Multi-Factor Authentication for when users are not in the office. The\nPer Authentication option has been configured as the usage model.\nAfter the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD)\nobtains a different company and adding the new employees to Azure Active Directory (Azure AD), you are informed\nthat these employees should also make use of Multi-Factor Authentication.\nTo achieve this, the Per Enabled User setting must be set for the usage model.\nSolution: You reconfigure the existing usage model via the Azure CLI.", "references": [ "https://365lab.net/2015/04/11/switch-usage-model-in-azure-multi-factor-authentication-server/" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 7, "pdfId": 7, "exam": "AZ-104", "type": "yes_no", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/7" }, "markersInGap": [], "questionText": "Does the solution meet the goal?\nA.\nYes\nB.\nNo", "stem": "Does the solution meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "No" ] }, "explanation": "The solution provided does not meet the goal of configuring the Per Enabled User setting for the new\nemployees to use Multi-Factor Authentication. To achieve the desired outcome, the Per Enabled User setting\nshould be configured directly for the new employees, not by reconfiguring the existing usage model via the\nAzure CLI.\nSince it is not possible to change the usage model of an existing provider as it is right now, you have to create\na new one and reactivate your existing server with activation credentials from the new provider.", "reference": "https://365lab.net/2015/04/11/switch-usage-model-in-azure-multi-factor-authentication-server/", "references": [ "https://365lab.net/2015/04/11/switch-usage-model-in-azure-multi-factor-authentication-server/" ], "note": "The question is included in a number of questions that depicts the identical set-up. However, every question\nhas a distinctive result. Establish if the solution satisfies the requirements.\nYour company's Azure solution makes use of Multi-Factor Authentication for when users are not in the office. The\nPer Authentication option has been configured as the usage model.\nAfter the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD)\nobtains a different company and adding the new employees to Azure Active Directory (Azure AD), you are informed\nthat these employees should also make use of Multi-Factor Authentication.\nTo achieve this, the Per Enabled User setting must be set for the usage model.\nSolution: You create a new Multi-Factor Authentication provider with a backup from the existing Multi-Factor\nAuthentication provider data.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 8, "pdfId": 8, "exam": "AZ-104", "type": "yes_no", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/8" }, "markersInGap": [], "questionText": "Does the solution meet the goal?\nA.\nYes\nB.\nNo", "stem": "Does the solution meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "No" ] }, "explanation": "Effective September 1st, 2018 new auth providers may no longer be created. Existing auth providers may\ncontinue to be used and updated, but migration is no longer possible. Multi-factor authentication will continue\nto be available as a feature in Azure AD Premium licenses.\nhttps://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-authprovider\nNote: The question is included in a number of questions that depicts the identical set-up. However, every question\nhas a distinctive result. Establish if the solution satisfies the requirements.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 9, "pdfId": 9, "exam": "AZ-104", "type": "yes_no", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/9" }, "markersInGap": [], "questionText": "Your company has an Azure Active Directory (Azure AD) tenant named weyland.com that is configured for hybrid\ncoexistence with the on-premises Active\nDirectory domain.\nYou have a server named DirSync1 that is configured as a DirSync server.\nYou create a new user account in the on-premise Active Directory. You now need to replicate the user information\nto Azure AD immediately.\nSolution: You run the Start-ADSyncSyncCycle -PolicyType Initial PowerShell cmdlet.\nDoes the solution meet the goal?\nA.\nYes\nB.\nNo", "stem": "Your company has an Azure Active Directory (Azure AD) tenant named weyland.com that is configured for hybrid coexistence with the on-premises Active Directory domain. You have a server named DirSync1 that is configured as a DirSync server. You create a new user account in the on-premise Active Directory. You now need to replicate the user information to Azure AD immediately. Solution: You run the Start-ADSyncSyncCycle -PolicyType Initial PowerShell cmdlet. Does the solution meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "No" ] }, "explanation": "NO Initial will perform a full sync and add the user account created but it will take time,\nDelta, will kick off a delta sync and bring only the last change, so it will be \"immediately\" and will fulfill the\nrequirements.", "reference": null, "references": [], "note": "The question is included in a number of questions that depicts the identical set-up. However, every question\nhas a distinctive result. Establish if the solution satisfies the requirements.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 10, "pdfId": 10, "exam": "AZ-104", "type": "yes_no", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/10" }, "markersInGap": [], "questionText": "Your company has an Azure Active Directory (Azure AD) tenant named weyland.com that is configured for hybrid\ncoexistence with the on-premises Active\nDirectory domain.\nYou have a server named DirSync1 that is configured as a DirSync server.\nYou create a new user account in the on-premise Active Directory. You now need to replicate the user information\nto Azure AD immediately.\nSolution: You use Active Directory Sites and Services to force replication of the Global Catalog on a domain\ncontroller.\nDoes the solution meet the goal?\nA.\nYes\nB.\nNo", "stem": "Your company has an Azure Active Directory (Azure AD) tenant named weyland.com that is configured for hybrid coexistence with the on-premises Active Directory domain. You have a server named DirSync1 that is configured as a DirSync server. You create a new user account in the on-premise Active Directory. You now need to replicate the user information to Azure AD immediately. Solution: You use Active Directory Sites and Services to force replication of the Global Catalog on a domain controller. Does the solution meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "No" ] }, "explanation": "Using Active Directory Sites and Services to force replication of the Global Catalog on a domain controller\ndoes not directly impact the synchronization process between the on-premises Active Directory and Azure AD.\nTo replicate the new user information to Azure AD immediately, you should use Azure AD Connect, the\nsynchronization tool for integrating on-premises Active Directory with Azure AD. Azure AD Connect is\nresponsible for synchronizing changes between the on-premises environment and Azure AD.\nNote: The question is included in a number of questions that depicts the identical set-up. However, every question\nhas a distinctive result. Establish if the solution satisfies the requirements.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 11, "pdfId": 11, "exam": "AZ-104", "type": "yes_no", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/11" }, "markersInGap": [], "questionText": "Your company has an Azure Active Directory (Azure AD) tenant named weyland.com that is configured for hybrid\ncoexistence with the on-premises Active\nDirectory domain.\nYou have a server named DirSync1 that is configured as a DirSync server.\nYou create a new user account in the on-premise Active Directory. You now need to replicate the user information\nto Azure AD immediately.\nSolution: You restart the NetLogon service on a domain controller.\nDoes the solution meet the goal?\nA.\nYes\nB.\nNo", "stem": "Your company has an Azure Active Directory (Azure AD) tenant named weyland.com that is configured for hybrid coexistence with the on-premises Active Directory domain. You have a server named DirSync1 that is configured as a DirSync server. You create a new user account in the on-premise Active Directory. You now need to replicate the user information to Azure AD immediately. Solution: You restart the NetLogon service on a domain controller. Does the solution meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "No" ] }, "explanation": "If you need to manually run a sync cycle, then from PowerShell run Start-ADSyncSyncCycle -PolicyType\nDelta.\nTo initiate a full sync cycle, run Start-ADSyncSyncCycle -PolicyType Initial from a PowerShell prompt.\nRunning a full sync cycle can be very time consuming, so if you need to replicate the user information to Azure\nAD immediately then run Start-ADSyncSyncCycle -PolicyType Delta.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-feature-scheduler", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sync-feature-scheduler" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 12, "pdfId": 12, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/12" }, "markersInGap": [], "questionText": "Your company has a Microsoft Azure subscription.\nThe company has datacenters in Los Angeles and New York.\nYou are configuring the two datacenters as geo-clustered sites for site resiliency.\nYou need to recommend an Azure storage redundancy option.\nYou have the following data storage requirements:\n✑\n Data must be stored on multiple nodes.\n✑\n Data must be stored on nodes in separate geographic locations.\n✑\n Data can be read from the secondary location as well as from the primary location.\nWhich of the following Azure stored redundancy options should you recommend?\nA.\nGeo-redundant storage\nB.\nRead-only geo-redundant storage\nC.\nZone-redundant storage\nD.\nLocally redundant storage", "stem": "Your company has a Microsoft Azure subscription. The company has datacenters in Los Angeles and New York. You are configuring the two datacenters as geo-clustered sites for site resiliency. You need to recommend an Azure storage redundancy option. You have the following data storage requirements: ✑ Data must be stored on multiple nodes. ✑ Data must be stored on nodes in separate geographic locations. ✑ Data can be read from the secondary location as well as from the primary location. Which of the following Azure stored redundancy options should you recommend", "options": [ { "key": "A", "text": "Geo-redundant storage" }, { "key": "B", "text": "Read-only geo-redundant storage" }, { "key": "C", "text": "Zone-redundant storage" }, { "key": "D", "text": "Locally redundant storage" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "RA-GRS allows you to have higher read availability for your storage account by providing read only access to\nthe data replicated to the secondary location. Once you enable this feature, the secondary location may be\nused to achieve higher availability in the event the data is not available in the primary region. This is an\nopt-in feature which requires the storage account be geo-replicated.\nReference:\nhttps://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy", "reference": null, "references": [], "note": "The question is included in a number of questions that depicts the identical set-up. However, every question\nhas a distinctive result. Establish if the solution satisfies the requirements.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 13, "pdfId": 13, "exam": "AZ-104", "type": "yes_no", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/13" }, "markersInGap": [], "questionText": "Your company has an azure subscription that includes a storage account, a resource group, a blob container and a\nfile share.\nA colleague named Jon Ross makes use of a solitary Azure Resource Manager (ARM) template to deploy a virtual\nmachine and an additional Azure Storage account.\nYou want to review the ARM template that was used by Jon Ross.\nSolution: You access the Virtual Machine blade.\nDoes the solution meet the goal?\nA.\nYes\nB.\nNo", "stem": "Your company has an azure subscription that includes a storage account, a resource group, a blob container and a file share. A colleague named Jon Ross makes use of a solitary Azure Resource Manager (ARM) template to deploy a virtual machine and an additional Azure Storage account. You want to review the ARM template that was used by Jon Ross. Solution: You access the Virtual Machine blade. Does the solution meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "No" ] }, "explanation": "No, accessing the Virtual Machine blade does not provide access to the ARM template used by Jon Ross to\ndeploy the virtual machine and an additional Azure Storage account. The Virtual Machine blade only displays\ninformation about the virtual machine itself and its related resources, but not the ARM template used to\ndeploy it.\nTo review the ARM template used by Jon Ross, you need to access the deployment history of the resource\ngroup where the virtual machine and additional storage account were deployed. This will show all\ndeployments made to the resource group, including the ARM template used for the deployment.", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-export-template", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-export-template" ], "note": "The question is included in a number of questions that depicts the identical set-up. However, every question\nhas a distinctive result. Establish if the solution satisfies the requirements.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 14, "pdfId": 14, "exam": "AZ-104", "type": "yes_no", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/14" }, "markersInGap": [], "questionText": "Your company has an azure subscription that includes a storage account, a resource group, a blob container and a\nfile share.\nA colleague named Jon Ross makes use of a solitary Azure Resource Manager (ARM) template to deploy a virtual\nmachine and an additional Azure Storage account.\nYou want to review the ARM template that was used by Jon Ross.\nSolution: You access the Resource Group blade.\nDoes the solution meet the goal?\nA.\nYes\nB.\nNo", "stem": "Your company has an azure subscription that includes a storage account, a resource group, a blob container and a file share. A colleague named Jon Ross makes use of a solitary Azure Resource Manager (ARM) template to deploy a virtual machine and an additional Azure Storage account. You want to review the ARM template that was used by Jon Ross. Solution: You access the Resource Group blade. Does the solution meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "Yes" ] }, "explanation": "To view a template from deployment history:\n1. Go to the resource group for your new resource group. Notice that the portal shows the result of the last\ndeployment. Select this link.\n2. You see a history of deployments for the group. In your case, the portal probably lists only one deployment.\nSelect this deployment.\n3. The portal displays a summary of the deployment. The summary includes the status of the deployment and\nits operations and the values that you provided for parameters. To see the template that you used for the\ndeployment, select View template.", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-export-template", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-export-template" ], "note": "The question is included in a number of questions that depicts the identical set-up. However, every question\nhas a distinctive result. Establish if the solution satisfies the requirements.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 15, "pdfId": 15, "exam": "AZ-104", "type": "yes_no", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/15" }, "markersInGap": [], "questionText": "Your company has an azure subscription that includes a storage account, a resource group, a blob container and a\nfile share.\nA colleague named Jon Ross makes use of a solitary Azure Resource Manager (ARM) template to deploy a virtual\nmachine and an additional Azure Storage account.\nYou want to review the ARM template that was used by Jon Ross.\nSolution: You access the Container blade.\nDoes the solution meet the goal?\nA.\nYes\nB.\nNo", "stem": "Your company has an azure subscription that includes a storage account, a resource group, a blob container and a file share. A colleague named Jon Ross makes use of a solitary Azure Resource Manager (ARM) template to deploy a virtual machine and an additional Azure Storage account. You want to review the ARM template that was used by Jon Ross. Solution: You access the Container blade. Does the solution meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "No" ] }, "explanation": "You should use the Resource Group blade.\nNo, accessing the Container blade does not provide access to the ARM template used by Jon Ross to deploy\nthe virtual machine and an additional Azure Storage account. The Container blade displays information about\nthe blob container within the storage account, but it does not provide access to the deployment history or\nARM templates.\nTo review the ARM template used by Jon Ross, you need to access the deployment history of the resource\ngroup where the virtual machine and additional storage account were deployed. This will show all\ndeployments made to the resource group, including the ARM template used for the deployment.", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-export-template", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-export-template" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 16, "pdfId": 16, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/16" }, "markersInGap": [], "questionText": "Your company has three virtual machines (VMs) that are included in an availability set.\nYou try to resize one of the VMs, which returns an allocation failure message.\nIt is imperative that the VM is resized.\nWhich of the following actions should you take?\nA.\nYou should only stop one of the VMs.\nB.\nYou should stop two of the VMs.\nC.\nYou should stop all three VMs.\nD.\nYou should remove the necessary VM from the availability set.", "stem": "Your company has three virtual machines (VMs) that are included in an availability set. You try to resize one of the VMs, which returns an allocation failure message. It is imperative that the VM is resized. Which of the following actions should you take", "options": [ { "key": "A", "text": "You should only stop one of the VMs." }, { "key": "B", "text": "You should stop two of the VMs." }, { "key": "C", "text": "You should stop all three VMs." }, { "key": "D", "text": "You should remove the necessary VM from the availability set." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "If the VM you wish to resize is part of an availability set, then you must stop all VMs in the availability set\nbefore changing the size of any VM in the availability set.\nThe reason all VMs in the availability set must be stopped before performing the resize operation to a size that\nrequires different hardware is that all running VMs in the availability set must be using the same physical\nhardware cluster. Therefore, if a change of physical hardware cluster is required to change the VM size then\nall VMs must be first stopped and then restarted one-by-one to a different physical hardware clusters.", "reference": "https://azure.microsoft.com/es-es/blog/resize-virtual-machines/", "references": [ "https://azure.microsoft.com/es-es/blog/resize-virtual-machines/" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 17, "pdfId": 17, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/17" }, "markersInGap": [], "questionText": "You have an Azure virtual machine (VM) that has a single data disk. You have been tasked with attaching this data\ndisk to another Azure VM.\nYou need to make sure that your strategy allows for the virtual machines to be offline for the least amount of time\npossible.\nWhich of the following is the action you should take FIRST?\nA.\nStop the VM that includes the data disk.\nB.\nStop the VM that the data disk must be attached to.\nC.\nDetach the data disk.\nD.\nDelete the VM that includes the data disk.", "stem": "You have an Azure virtual machine (VM) that has a single data disk. You have been tasked with attaching this data disk to another Azure VM. You need to make sure that your strategy allows for the virtual machines to be offline for the least amount of time possible. Which of the following is the action you should take FIRST", "options": [ { "key": "A", "text": "Stop the VM that includes the data disk." }, { "key": "B", "text": "Stop the VM that the data disk must be attached to." }, { "key": "C", "text": "Detach the data disk." }, { "key": "D", "text": "Delete the VM that includes the data disk." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "You can simply detach a data disk from one VM and attach it to the other VM without stopping either of the\nVMs.\nDetaching the data disk first ensures that the current VM (Virtual Machine) that includes the data disk can\nquickly be brought back online, minimizing its downtime. This action allows you to then attach the disk to the\nnew VM with minimal interruption.\nDetaching a disk does not require you to stop or delete the VM, ensuring that the VM itself remains\noperational for other tasks or configurations that do not involve the detached disk.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 18, "pdfId": 18, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/18" }, "markersInGap": [], "questionText": "Your company has an Azure subscription.\nYou need to deploy a number of Azure virtual machines (VMs) using Azure Resource Manager (ARM) templates.\nYou have been informed that the VMs will be included in a single availability set.\nYou are required to make sure that the ARM template you configure allows for as many VMs as possible to remain\naccessible in the event of fabric failure or maintenance.\nWhich of the following is the value that you should configure for the platformFaultDomainCount property?\nA.\n10\nB.\n30\nC.\nMin Value\nD.\nMax Value", "stem": "Your company has an Azure subscription. You need to deploy a number of Azure virtual machines (VMs) using Azure Resource Manager (ARM) templates. You have been informed that the VMs will be included in a single availability set. You are required to make sure that the ARM template you configure allows for as many VMs as possible to remain accessible in the event of fabric failure or maintenance. Which of the following is the value that you should configure for the platformFaultDomainCount property", "options": [ { "key": "A", "text": "10" }, { "key": "B", "text": "30" }, { "key": "C", "text": "Min Value" }, { "key": "D", "text": "Max Value" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "The number of fault domains for managed availability sets varies by region - either two or three per region.\nThe platformFaultDomainCount property specifies the number of fault domains to be used by the availability\nset. A fault domain is a group of underlying hardware resources in a data center that share a common power\nsource and network switch, but are physically separated from each other. By distributing virtual machines\nacross fault domains, you can ensure that no single point of failure can take down all of the virtual machines\nat once.\nIn Azure, the maximum value for platformFaultDomainCount is 3. This means that an availability set can have\nup to 3 fault domains. The minimum value for platformFaultDomainCount is 1.\nTo make sure that the ARM template allows for as many VMs as possible to remain accessible in the event of\nfabric failure or maintenance, you should set the platformFaultDomainCount property to its maximum value of\n3.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/manage-availability", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/manage-availability" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 19, "pdfId": 19, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/19" }, "markersInGap": [ 18, 19 ], "questionText": "Your company has an Azure subscription.\nYou need to deploy a number of Azure virtual machines (VMs) using Azure Resource Manager (ARM) templates.\nYou have been informed that the VMs will be included in a single availability set.\nYou are required to make sure that the ARM template you configure allows for as many VMs as possible to remain\naccessible in the event of fabric failure or maintenance.\nWhich of the following is the value that you should configure for the platformUpdateDomainCount property?\n A.\n10\nB.\n20\nC.\n30\nD.\n40", "stem": "Your company has an Azure subscription. You need to deploy a number of Azure virtual machines (VMs) using Azure Resource Manager (ARM) templates. You have been informed that the VMs will be included in a single availability set. You are required to make sure that the ARM template you configure allows for as many VMs as possible to remain accessible in the event of fabric failure or maintenance. Which of the following is the value that you should configure for the platformUpdateDomainCount property", "options": [ { "key": "A", "text": "10" }, { "key": "B", "text": "20" }, { "key": "C", "text": "30" }, { "key": "D", "text": "40" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Each virtual machine in your availability set is assigned an update domain and a fault domain by the\nunderlying Azure platform. For a given availability set, five non-user-configurable update domains are\nassigned by default (Resource Manager deployments can then be increased to provide up to 20 update\ndomains) to indicate groups of virtual machines and underlying physical hardware that can be rebooted at the\nsame time.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/availability-set-overview", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/availability-set-overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 20, "pdfId": 20, "exam": "AZ-104", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/20" }, "markersInGap": [ 20 ], "questionText": "DRAG DROP -\nYou have downloaded an Azure Resource Manager (ARM) template to deploy numerous virtual machines (VMs).\nThe ARM template is based on a current VM, but must be adapted to reference an administrative password.\nYou need to make sure that the password cannot be stored in plain text.\nYou are preparing to create the necessary components to achieve your goal.\nWhich of the following should you create to achieve your goal? Answer by dragging the correct option from the list\nto the answer area.\nSelect and Place:", "stem": "You have downloaded an Azure Resource Manager (ARM) template to deploy numerous virtual machines (VMs). The ARM template is based on a current VM, but must be adapted to reference an administrative password. You need to make sure that the password cannot be stored in plain text. You are preparing to create the necessary components to achieve your goal. Which of the following should you create to achieve your goal? Answer by dragging the correct option from the list to the answer area. Select and Place:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1.\nAn Azure Key Vault:\n you can store the administrative password in an Azure Key Vault, which provides\nsecure storage and management of cryptographic keys, certificates, and secrets. Storing the password in a\nKey Vault ensures that it is not stored in plain text and provides an additional layer of security to protect the\npassword.\n2.\n An access policy\n: You should create an access policy to control access to the Key Vault secrets. An access\npolicy specifies who can perform operations on the secrets stored in the Key Vault. You can grant permissions\nto users, applications, and services to access the Key Vault and its secrets, and you can specify the level of\naccess that they have. By creating an access policy, you can control who has access to the administrative\npassword and ensure that it is used only by authorized entities.\nTherefore, to achieve your goal, you should create an Azure Key Vault to store the administrative password,\nand an access policy to control access to the Key Vault secrets.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 21, "pdfId": 21, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/21" }, "markersInGap": [ 21 ], "questionText": "Your company has an Azure Active Directory (Azure AD) tenant that is configured for hybrid coexistence with the\non-premises Active Directory domain.\nThe on-premise virtual environment consists of virtual machines (VMs) running on Windows Server 2012 R2 Hyper-\n V host servers.\nYou have created some PowerShell scripts to automate the configuration of newly created VMs. You plan to create\nseveral new VMs.\nYou need a solution that ensures the scripts are run on the new VMs.\nWhich of the following is the best solution?\nA.\nConfigure a SetupComplete.cmd batch file in the %windir%\\setup\\scripts directory.\nB.\nConfigure a Group Policy Object (GPO) to run the scripts as logon scripts.\nC.\nConfigure a Group Policy Object (GPO) to run the scripts as startup scripts.\nD.\nPlace the scripts in a new virtual hard disk (VHD).", "stem": "Your company has an Azure Active Directory (Azure AD) tenant that is configured for hybrid coexistence with the on-premises Active Directory domain. The on-premise virtual environment consists of virtual machines (VMs) running on Windows Server 2012 R2 Hyper- V host servers. You have created some PowerShell scripts to automate the configuration of newly created VMs. You plan to create several new VMs. You need a solution that ensures the scripts are run on the new VMs. Which of the following is the best solution", "options": [ { "key": "A", "text": "Configure a SetupComplete.cmd batch file in the %windir%\\setup\\scripts directory." }, { "key": "B", "text": "Configure a Group Policy Object (GPO) to run the scripts as logon scripts." }, { "key": "C", "text": "Configure a Group Policy Object (GPO) to run the scripts as startup scripts." }, { "key": "D", "text": "Place the scripts in a new virtual hard disk (VHD)." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "After you deploy a Virtual Machine you typically need to make some changes before it's ready to use. This is\nsomething you can do manually or you could use\nRemote PowerShell to automate the configuration of your VM after deployment for example.\nBut now there's a third alternative available allowing you customize your VM: the CustomScriptextension.\nThis CustomScript extension is executed by the VM Agent and it's very straightforward: you specify which\nfiles it needs to download from your storage account and which file it needs to execute. You can even specify\narguments that need to be passed to the script. The only requirement is that you execute a .ps1 file.", "reference": "https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/add-a-custom-script-to-windows-\nsetup https://azure.microsoft.com/en-us/blog/automating-vm-customization-tasks-using-custom-script-\nextension/", "references": [ "https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/add-a-custom-script-to-windows-", "https://azure.microsoft.com/en-us/blog/automating-vm-customization-tasks-using-custom-script-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 22, "pdfId": 22, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/22" }, "markersInGap": [], "questionText": "Your company has an Azure Active Directory (Azure AD) tenant that is configured for hybrid coexistence with the\non-premises Active Directory domain.\nYou plan to deploy several new virtual machines (VMs) in Azure. The VMs will have the same operating system and\ncustom software requirements.\nYou configure a reference VM in the on-premise virtual environment. You then generalize the VM to create an\nimage.\nYou need to upload the image to Azure to ensure that it is available for selection when you create the new Azure\nVMs.\nWhich PowerShell cmdlets should you use?\nA.\nAdd-AzVM\nB.\nAdd-AzVhd\nC.\nAdd-AzImage\nD.\nAdd-AzImageDataDisk", "stem": "Your company has an Azure Active Directory (Azure AD) tenant that is configured for hybrid coexistence with the on-premises Active Directory domain. You plan to deploy several new virtual machines (VMs) in Azure. The VMs will have the same operating system and custom software requirements. You configure a reference VM in the on-premise virtual environment. You then generalize the VM to create an image. You need to upload the image to Azure to ensure that it is available for selection when you create the new Azure VMs. Which PowerShell cmdlets should you use", "options": [ { "key": "A", "text": "Add-AzVM" }, { "key": "B", "text": "Add-AzVhd" }, { "key": "C", "text": "Add-AzImage" }, { "key": "D", "text": "Add-AzImageDataDisk" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "The Add-AzVhd cmdlet uploads on-premises virtual hard disks, in .vhd file format, to a blob storage account\nas fixed virtual hard disks.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/upload-generalized-managed", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/upload-generalized-managed" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 23, "pdfId": 23, "exam": "AZ-104", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/23" }, "markersInGap": [], "questionText": "DRAG DROP -\nYour company has an Azure subscription that includes a number of Azure virtual machines (VMs), which are all part\nof the same virtual network.\nYour company also has an on-premises Hyper-V server that hosts a VM, named VM1, which must be replicated to\nAzure.\nWhich of the following objects that must be created to achieve this goal? Answer by dragging the correct option\nfrom the list to the answer area.\nSelect and Place:", "stem": "Your company has an Azure subscription that includes a number of Azure virtual machines (VMs), which are all part of the same virtual network. Your company also has an on-premises Hyper-V server that hosts a VM, named VM1, which must be replicated to Azure. Which of the following objects that must be created to achieve this goal? Answer by dragging the correct option from the list to the answer area. Select and Place:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Hyper-V site:Represents the on-premises Hyper-V servers that will be protected.\nAzure Recovery Services Vault: A key component in ASR that stores recovery points and orchestrates\nreplication, failover, and failback.\nReplication policy :Defines the replication settings, including frequency and retention.", "reference": null, "references": [], "note": "The question is included in a number of questions that depicts the identical set-up. However, every question\nhas a distinctive result. Establish if the solution satisfies the requirements.\nYour company's Azure subscription includes two Azure networks named VirtualNetworkA and VirtualNetworkB.\nVirtualNetworkA includes a VPN gateway that is configured to make use of static routing. Also, a site-to-site VPN\nconnection exists between your company's on- premises network and VirtualNetworkA.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 24, "pdfId": 24, "exam": "AZ-104", "type": "yes_no", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/24" }, "markersInGap": [ 24 ], "questionText": "You have configured a point-to-site VPN connection to VirtualNetworkA from a workstation running Windows 10.\nAfter configuring virtual network peering between\nVirtualNetworkA and VirtualNetworkB, you confirm that you are able to access VirtualNetworkB from the\ncompany's on-premises network. However, you find that you cannot establish a connection to VirtualNetworkB\nfrom the Windows 10 workstation.\nYou have to make sure that a connection to VirtualNetworkB can be established from the Windows 10 workstation.\nSolution: You choose the Allow gateway transit setting on VirtualNetworkA.\n Does the solution meet the goal?\nA.\nYes\nB.\nNo", "stem": "You have configured a point-to-site VPN connection to VirtualNetworkA from a workstation running Windows 10. After configuring virtual network peering between VirtualNetworkA and VirtualNetworkB, you confirm that you are able to access VirtualNetworkB from the company's on-premises network. However, you find that you cannot establish a connection to VirtualNetworkB from the Windows 10 workstation. You have to make sure that a connection to VirtualNetworkB can be established from the Windows 10 workstation. Solution: You choose the Allow gateway transit setting on VirtualNetworkA. Does the solution meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "No" ] }, "explanation": "After configuring virtual network peering between\nVirtualNetworkA and VirtualNetworkB, you confirm that you are able to access VirtualNetworkB from the\ncompany's on-premises network.\" This indicates the Allow/Use gateway transit is set up working. The next\nstep will be restart/reinstall the VPN-Client config at the windows 10 WS.", "reference": "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing", "references": [ "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing" ], "note": "The question is included in a number of questions that depicts the identical set-up. However, every question\nhas a distinctive result. Establish if the solution satisfies the requirements.\nYour company's Azure subscription includes two Azure networks named VirtualNetworkA and VirtualNetworkB.\nVirtualNetworkA includes a VPN gateway that is configured to make use of static routing. Also, a site-to-site VPN\nconnection exists between your company's on- premises network and VirtualNetworkA.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 25, "pdfId": 25, "exam": "AZ-104", "type": "yes_no", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/25" }, "markersInGap": [], "questionText": "You have configured a point-to-site VPN connection to VirtualNetworkA from a workstation running Windows 10.\nAfter configuring virtual network peering between\nVirtualNetworkA and VirtualNetworkB, you confirm that you are able to access VirtualNetworkB from the\ncompany's on-premises network. However, you find that you cannot establish a connection to VirtualNetworkB\nfrom the Windows 10 workstation.\nYou have to make sure that a connection to VirtualNetworkB can be established from the Windows 10 workstation.\nSolution: You choose the Allow gateway transit setting on VirtualNetworkB.\nDoes the solution meet the goal?\nA.\nYes\nB.\nNo", "stem": "You have configured a point-to-site VPN connection to VirtualNetworkA from a workstation running Windows 10. After configuring virtual network peering between VirtualNetworkA and VirtualNetworkB, you confirm that you are able to access VirtualNetworkB from the company's on-premises network. However, you find that you cannot establish a connection to VirtualNetworkB from the Windows 10 workstation. You have to make sure that a connection to VirtualNetworkB can be established from the Windows 10 workstation. Solution: You choose the Allow gateway transit setting on VirtualNetworkB. Does the solution meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "No" ] }, "explanation": "If you make a change to the topology of your network and have Windows VPN clients, the VPN client package\nfor Windows clients must be downloaded and installed again in order for the changes to be applied to the\nclient.\nhttps://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing", "reference": "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing", "references": [ "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing" ], "note": "The question is included in a number of questions that depicts the identical set-up. However, every question\nhas a distinctive result. Establish if the solution satisfies the requirements.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 26, "pdfId": 26, "exam": "AZ-104", "type": "yes_no", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/26" }, "markersInGap": [], "questionText": "You have configured a point-to-site VPN connection to VirtualNetworkA from a workstation running Windows 10.\nAfter configuring virtual network peering between\nVirtualNetworkA and VirtualNetworkB, you confirm that you are able to access VirtualNetworkB from the\ncompany's on-premises network. However, you find that you cannot establish a connection to VirtualNetworkB\nfrom the Windows 10 workstation.\nYou have to make sure that a connection to VirtualNetworkB can be established from the Windows 10 workstation.\nSolution: You download and re-install the VPN client configuration package on the Windows 10 workstation.\nDoes the solution meet the goal?\nA.\nYes\nB.\nNo", "stem": "You have configured a point-to-site VPN connection to VirtualNetworkA from a workstation running Windows 10. After configuring virtual network peering between VirtualNetworkA and VirtualNetworkB, you confirm that you are able to access VirtualNetworkB from the company's on-premises network. However, you find that you cannot establish a connection to VirtualNetworkB from the Windows 10 workstation. You have to make sure that a connection to VirtualNetworkB can be established from the Windows 10 workstation. Solution: You download and re-install the VPN client configuration package on the Windows 10 workstation. Does the solution meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "No" ] }, "explanation": "A. Yes\n\n❌\n Incorrect.\nRe-downloading and reinstalling the VPN client package does not resolve the issue because the problem is\nrelated to routing and gateway configuration, not the client software.\nB. No\n\n✅\n Correct.\nTo allow a Point-to-Site (P2S) client to access a peered virtual network, you must enable\n\"Use remote\ngateways\"\n on the peered VNet and\n\"Allow gateway transit\"\n on the gateway VNet. Simply reinstalling the\nVPN client will not enable this connectivity.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 27, "pdfId": 27, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/27" }, "markersInGap": [], "questionText": "Your company has virtual machines (VMs) hosted in Microsoft Azure. The VMs are located in a single Azure virtual\nnetwork named VNet1.\nThe company has users that work remotely. The remote workers require access to the VMs on VNet1.\nYou need to provide access for the remote workers.\nWhat should you do?\nA.\nConfigure a Site-to-Site (S2S) VPN.\nB.\nConfigure a VNet-toVNet VPN.\nC.\nConfigure a Point-to-Site (P2S) VPN.\nD.\nConfigure DirectAccess on a Windows Server 2012 server VM.\nE.\nConfigure a Multi-Site VPN", "stem": "Your company has virtual machines (VMs) hosted in Microsoft Azure. The VMs are located in a single Azure virtual network named VNet1. The company has users that work remotely. The remote workers require access to the VMs on VNet1. You need to provide access for the remote workers. What should you do", "options": [ { "key": "A", "text": "Configure a Site-to-Site (S2S) VPN." }, { "key": "B", "text": "Configure a VNet-toVNet VPN." }, { "key": "C", "text": "Configure a Point-to-Site (P2S) VPN." }, { "key": "D", "text": "Configure DirectAccess on a Windows Server 2012 server VM." }, { "key": "E", "text": "Configure a Multi-Site VPN" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network\nfrom an individual client computer.\nTo provide access for remote workers to virtual machines (VMs) hosted in Microsoft Azure, you can use a\nPoint-to-Site (P2S) VPN connection. This type of connection enables individual remote clients to securely\nconnect to an Azure virtual network (VNet) over the Internet.\nA Site-to-Site (S2S) VPN connection is used to connect two or more on-premises networks to an Azure virtual\nnetwork (VNet), while a VNet-to-VNet VPN connection is used to connect two or more Azure virtual networks\n(VNets) together.", "reference": "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways", "references": [ "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways" ], "note": "The question is included in a number of questions that depicts the identical set-up. However, every question\nhas a distinctive result. Establish if the solution satisfies the requirements.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 28, "pdfId": 28, "exam": "AZ-104", "type": "yes_no", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/28" }, "markersInGap": [], "questionText": "Your company has a Microsoft SQL Server Always On availability group configured on their Azure virtual machines\n(VMs).\nYou need to configure an Azure internal load balancer as a listener for the availability group.\nSolution: You create an HTTP health probe on port 1433.\nDoes the solution meet the goal?\nA.\nYes\nB.\nNo", "stem": "Your company has a Microsoft SQL Server Always On availability group configured on their Azure virtual machines (VMs). You need to configure an Azure internal load balancer as a listener for the availability group. Solution: You create an HTTP health probe on port 1433. Does the solution meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "No" ] }, "explanation": "No, creating an HTTP health probe on port 1433 does not meet the goal of configuring an Azure internal load\nbalancer as a listener for the SQL Server Always On availability group.\nIn order to configure an Azure internal load balancer as a listener for the availability group, you need to create\na TCP health probe on port 1433. SQL Server uses TCP to communicate on port 1433, so a TCP health probe is\nthe appropriate choice to ensure the availability and health of the SQL Server instances in the availability\ngroup.", "reference": null, "references": [], "note": "The question is included in a number of questions that depicts the identical set-up. However, every question\nhas a distinctive result. Establish if the solution satisfies the requirements.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 29, "pdfId": 29, "exam": "AZ-104", "type": "yes_no", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/29" }, "markersInGap": [], "questionText": "Your company has a Microsoft SQL Server Always On availability group configured on their Azure virtual machines\n(VMs).\nYou need to configure an Azure internal load balancer as a listener for the availability group.\nSolution: You set Session persistence to Client IP.\nDoes the solution meet the goal?\nA.\nYes\nB.\nNo", "stem": "Your company has a Microsoft SQL Server Always On availability group configured on their Azure virtual machines (VMs). You need to configure an Azure internal load balancer as a listener for the availability group. Solution: You set Session persistence to Client IP. Does the solution meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "No" ] }, "explanation": "FYI: Session persistence ensures that a client will remain connected to the same server throughout a session\nor period of time. Because load balancing may, by default, send users to unique servers each time they\nconnect, this can mean that complicated or repeated requests are slowed down.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/sql/virtual-machines-windows-portal-sql-\nalwayson-int-listener", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/sql/virtual-machines-windows-portal-sql-" ], "note": "The question is included in a number of questions that depicts the identical set-up. However, every question\nhas a distinctive result. Establish if the solution satisfies the requirements.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 30, "pdfId": 30, "exam": "AZ-104", "type": "yes_no", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/30" }, "markersInGap": [], "questionText": "Your company has a Microsoft SQL Server Always On availability group configured on their Azure virtual machines\n(VMs).\nYou need to configure an Azure internal load balancer as a listener for the availability group.\nSolution: You enable Floating IP.\nDoes the solution meet the goal?\nA.\nYes\nB.\nNo", "stem": "Your company has a Microsoft SQL Server Always On availability group configured on their Azure virtual machines (VMs). You need to configure an Azure internal load balancer as a listener for the availability group. Solution: You enable Floating IP. Does the solution meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "Yes" ] }, "explanation": "Yes\n, enabling Floating IP on the Azure internal load balancer as a listener for the availability group can meet\nthe goal. By enabling Floating IP, the load balancer will use a floating IP address as the source IP address for\noutbound flows from the backend pool. This will ensure that the IP address used by the backend pool remains\nthe same even if a VM is restarted or replaced, which is important for maintaining the listener for the\navailability group.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 31, "pdfId": 31, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/31" }, "markersInGap": [], "questionText": "Your company has two on-premises servers named SRV01 and SRV02. Developers have created an application that\nruns on SRV01. The application calls a service on SRV02 by IP address.\nYou plan to migrate the application on Azure virtual machines (VMs). You have configured two VMs on a single\nsubnet in an Azure virtual network.\nYou need to configure the two VMs with static internal IP addresses.\nWhat should you do?\nA.\nRun the New-AzureRMVMConfig PowerShell cmdlet.\nB.\nRun the Set-AzureSubnet PowerShell cmdlet.\nC.\nModify the VM properties in the Azure Management Portal.\nD.\nModify the IP properties in Windows Network and Sharing Center.\nE.\nRun the Set-AzureStaticVNetIP PowerShell cmdlet.", "stem": "Your company has two on-premises servers named SRV01 and SRV02. Developers have created an application that runs on SRV01. The application calls a service on SRV02 by IP address. You plan to migrate the application on Azure virtual machines (VMs). You have configured two VMs on a single subnet in an Azure virtual network. You need to configure the two VMs with static internal IP addresses. What should you do", "options": [ { "key": "A", "text": "Run the New-AzureRMVMConfig PowerShell cmdlet." }, { "key": "B", "text": "Run the Set-AzureSubnet PowerShell cmdlet." }, { "key": "C", "text": "Modify the VM properties in the Azure Management Portal." }, { "key": "D", "text": "Modify the IP properties in Windows Network and Sharing Center." }, { "key": "E", "text": "Run the Set-AzureStaticVNetIP PowerShell cmdlet." } ], "answer": { "raw": "E", "keys": [ "E" ] }, "explanation": "Specify a static internal IP for a previously created VM", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 32, "pdfId": 32, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/32" }, "markersInGap": [ 30, 31 ], "questionText": "If you want to set a static IP address for a VM that you previously created, you can do so by using the\nfollowing cmdlets. If you already set an IP address for the\nVM and you want to change it to a different IP address, you'll need to remove the existing static IP address\nbefore running these cmdlets. See the instructions below to remove a static IP.\nFor this procedure, you'll use the Update-AzureVM cmdlet. The Update-AzureVM cmdlet restarts the VM as\npart of the update process. The DIP that you specify will be assigned after the VM restarts. In this example,\n we set the IP address for VM2, which is located in cloud service StaticDemo.\nGet-AzureVM -ServiceName StaticDemo -Name VM2 | Set-AzureStaticVNetIP -IPAddress 192.168.4.7 |\nUpdate-AzureVM\nYour company has an Azure Active Directory (Azure AD) subscription.\nYou need to deploy five virtual machines (VMs) to your company's virtual network subnet.\nThe VMs will each have both a public and private IP address. Inbound and outbound security rules for all of these\nvirtual machines must be identical.\nWhich of the following is the least amount of network interfaces needed for this configuration?\nA.\n5\nB.\n10\nC.\n20\nD.\n40", "stem": "If you want to set a static IP address for a VM that you previously created, you can do so by using the following cmdlets. If you already set an IP address for the VM and you want to change it to a different IP address, you'll need to remove the existing static IP address before running these cmdlets. See the instructions below to remove a static IP. For this procedure, you'll use the Update-AzureVM cmdlet. The Update-AzureVM cmdlet restarts the VM as part of the update process. The DIP that you specify will be assigned after the VM restarts. In this example, we set the IP address for VM2, which is located in cloud service StaticDemo. Get-AzureVM -ServiceName StaticDemo -Name VM2 | Set-AzureStaticVNetIP -IPAddress 192.168.4.7 | Update-AzureVM Your company has an Azure Active Directory (Azure AD) subscription. You need to deploy five virtual machines (VMs) to your company's virtual network subnet. The VMs will each have both a public and private IP address. Inbound and outbound security rules for all of these virtual machines must be identical. Which of the following is the least amount of network interfaces needed for this configuration", "options": [ { "key": "B", "text": "10" }, { "key": "C", "text": "20" }, { "key": "D", "text": "40" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "To deploy five VMs with both public and private IP addresses, you would need at least five network interfaces\n(one for each VM). Each VM requires a network interface to connect to the virtual network, and since each VM\nwill have both a public and a private IP address, you would typically assign one network interface per VM.\n5 VM so 5 NIC Cards .we have public and private ip address set to them .however they needs same inbound\nand outbound rule so create NSG and attach to NIC and this req can be fulfilled 5 NIC hence 5 is right answer.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 33, "pdfId": 33, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/33" }, "markersInGap": [], "questionText": "Your company has an Azure Active Directory (Azure AD) subscription.\nYou need to deploy five virtual machines (VMs) to your company's virtual network subnet.\nThe VMs will each have both a public and private IP address. Inbound and outbound security rules for all of these\nvirtual machines must be identical.\nWhich of the following is the least amount of security groups needed for this configuration?\nA.\n4\nB.\n3\nC.\n2\nD.\n1", "stem": "Your company has an Azure Active Directory (Azure AD) subscription. You need to deploy five virtual machines (VMs) to your company's virtual network subnet. The VMs will each have both a public and private IP address. Inbound and outbound security rules for all of these virtual machines must be identical. Which of the following is the least amount of security groups needed for this configuration", "options": [], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. 1 In Azure, Network Security Groups (NSGs) are used to control inbound and outbound traffic to network\ninterfaces (NICs), subnets, or both.\nFor the given scenario:\nThere are five virtual machines (VMs).", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": true } }, { "seq": 34, "pdfId": 34, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/34" }, "markersInGap": [ 32, 33 ], "questionText": "Each VM has both a public and private IP address.\n All VMs must have identical inbound and outbound security rules.\nSince all VMs require the same security rules, you can assign a single NSG at the subnet level. This ensures\nthat the security rules apply uniformly to all VMs within that subnet.\nall identical security groups so you will only require 1 security group as all the settings are the same\nYour company's Azure subscription includes Azure virtual machines (VMs) that run Windows Server 2016.\nOne of the VMs is backed up every day using Azure Backup Instant Restore.\nWhen the VM becomes infected with data encrypting ransomware, you decide to recover the VM's files.\nWhich of the following is TRUE in this scenario?\nA.\nYou can only recover the files to the infected VM.\nB.\nYou can recover the files to any VM within the company's subscription.\nC.\nYou can only recover the files to a new VM.\nD.\nYou will not be able to recover the files.", "stem": "Each VM has both a public and private IP address. All VMs must have identical inbound and outbound security rules. Since all VMs require the same security rules, you can assign a single NSG at the subnet level. This ensures that the security rules apply uniformly to all VMs within that subnet. all identical security groups so you will only require 1 security group as all the settings are the same Your company's Azure subscription includes Azure virtual machines (VMs) that run Windows Server 2016. One of the VMs is backed up every day using Azure Backup Instant Restore. When the VM becomes infected with data encrypting ransomware, you decide to recover the VM's files. Which of the following is TRUE in this scenario", "options": [ { "key": "A", "text": "You can only recover the files to the infected VM." }, { "key": "B", "text": "You can recover the files to any VM within the company's subscription." }, { "key": "C", "text": "You can only recover the files to a new VM." }, { "key": "D", "text": "You will not be able to recover the files." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "1. You can restore files by mounting the backup to your own local machine if you like, just like you could on any\nof the VMs in Azure as they are all 2016. It just uses an iSCSI connection to the backup image.\n2. The answer is B.Recovery of files, you cannot restore files to an older or newer version of the OS, It must be\na compatible client OS. Therefore, restoring files back to the same subscription is the best option but it has to\nbe the same OS version. Although answer A is possible but restoring files back to an infected VM doesn't\nsound right to me.\nYour company's Azure subscription includes Azure virtual machines (VMs) that run Windows Server 2016.\nOne of the VMs is backed up every day using Azure Backup Instant Restore.\nWhen the VM becomes infected with data encrypting ransomware, you are required to restore the VM.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 35, "pdfId": 35, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/35" }, "markersInGap": [], "questionText": "Which of the following actions should you take?\nA.\nYou should restore the VM after deleting the infected VM.\nB.\nYou should restore the VM to any VM within the company's subscription.\nC.\nYou should restore the VM to a new Azure VM.\nD.\nYou should restore the VM to an on-premise Windows device.", "stem": "Which of the following actions should you take", "options": [ { "key": "A", "text": "You should restore the VM after deleting the infected VM." }, { "key": "B", "text": "You should restore the VM to any VM within the company's subscription." }, { "key": "C", "text": "You should restore the VM to a new Azure VM." }, { "key": "D", "text": "You should restore the VM to an on-premise Windows device." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C. You should restore the VM to a new Azure VM.\nAzure Backup provides Instant Restore for virtual machines, which allows you to quickly recover your VM in\ncase of issues such as ransomware attacks.\nFor a ransomware infection, the best approach is to restore the VM to a new Azure VM rather than overwriting\nor restoring to an existing VM. This ensures that the infected VM does not affect the restored system.\nYou administer a solution in Azure that is currently having performance issues.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 36, "pdfId": 36, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/36" }, "markersInGap": [], "questionText": "You need to find the cause of the performance issues pertaining to metrics on the Azure infrastructure.\nWhich of the following is the tool you should use?\nA.\nAzure Traffic Analytics\nB.\nAzure Monitor\nC.\nAzure Activity Log\nD.\nAzure Advisor", "stem": "You need to find the cause of the performance issues pertaining to metrics on the Azure infrastructure. Which of the following is the tool you should use", "options": [ { "key": "A", "text": "Azure Traffic Analytics" }, { "key": "B", "text": "Azure Monitor" }, { "key": "C", "text": "Azure Activity Log" }, { "key": "D", "text": "Azure Advisor" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Metrics in Azure Monitor are stored in a time-series database which is optimized for analyzing time-stamped\ndata. This makes metrics particularly suited for alerting and fast detection of issues.", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-platform", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/platform/data-platform" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 37, "pdfId": 37, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/37" }, "markersInGap": [], "questionText": "Your company has an Azure subscription that includes a Recovery Services vault.\nYou want to use Azure Backup to schedule a backup of your company's virtual machines (VMs) to the Recovery\nServices vault.\nWhich of the following VMs can you back up? Choose all that apply.\nA.\nVMs that run Windows 10.\nB.\nVMs that run Windows Server 2012 or higher.\nC.\nVMs that have NOT been shut down.\nD.\nVMs that run Debian 8.2+.\nE.\nVMs that have been shut down.", "stem": "Your company has an Azure subscription that includes a Recovery Services vault. You want to use Azure Backup to schedule a backup of your company's virtual machines (VMs) to the Recovery Services vault. Which of the following VMs can you back up? Choose all that apply.", "options": [ { "key": "A", "text": "VMs that run Windows 10." }, { "key": "B", "text": "VMs that run Windows Server 2012 or higher." }, { "key": "C", "text": "VMs that have NOT been shut down." }, { "key": "D", "text": "VMs that run Debian 8.2+." }, { "key": "E", "text": "VMs that have been shut down." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Azure Backup supports backup of 64-bit Windows server operating system from Windows Server 2008.\nAzure Backup supports backup of 64-bit Windows 10 operating system.\nAzure Backup supports backup of 64-bit Debian operating system from Debian 7.9+.\nAzure Backup supports backup of VM that are shutdown or offline.", "reference": "https://docs.microsoft.com/en-us/azure/backup/backup-support-matrix-iaas https://docs.microsoft.com/en-\nus/azure/virtual-machines/linux/endorsed-distros\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "references": [ "https://docs.microsoft.com/en-us/azure/backup/backup-support-matrix-iaas", "https://docs.microsoft.com/en-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 38, "pdfId": 38, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/38" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure Active Directory (Azure AD) tenant named contoso.com.\nYou have a CSV file that contains the names and email addresses of 500 external users.\nYou need to create a guest user account in contoso.com for each of the 500 external users.\nSolution: You create a PowerShell script that runs the New-AzureADUser cmdlet for each user.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Active Directory (Azure AD) tenant named contoso.com. You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: You create a PowerShell script that runs the New-AzureADUser cmdlet for each user. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "The New-AzureADUser cmdlet creates a user in Azure Active Directory (Azure AD).\nInstead use the New-AzureADMSInvitation cmdlet which is used to invite a new external user to your\ndirectory.", "reference": "https://docs.microsoft.com/en-us/powershell/module/azuread/new-azureadmsinvitation", "references": [ "https://docs.microsoft.com/en-us/powershell/module/azuread/new-azureadmsinvitation" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 39, "pdfId": 39, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/39" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure Active Directory (Azure AD) tenant named contoso.com.\nYou have a CSV file that contains the names and email addresses of 500 external users.\nYou need to create a guest user account in contoso.com for each of the 500 external users.\nSolution: From Azure AD in the Azure portal, you use the Bulk create user operation.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Active Directory (Azure AD) tenant named contoso.com. You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: From Azure AD in the Azure portal, you use the Bulk create user operation. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "\"Bulk Create\" is for new Azure AD Users.\nFor Guests:\n- Use \"Bulk invite users\" to prepare a comma-separated value (.csv) file with the user information and\ninvitation preferences\n- Upload the .csv file to Azure AD\n- Verify the users were added to the directory\nInstead use the New-AzureADMSInvitation cmdlet which is used to invite a new external user to your\ndirectory.", "reference": "https://docs.microsoft.com/en-us/powershell/module/azuread/new-azureadmsinvitation", "references": [ "https://docs.microsoft.com/en-us/powershell/module/azuread/new-azureadmsinvitation" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 40, "pdfId": 40, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/40" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure Active Directory (Azure AD) tenant named contoso.com.\nYou have a CSV file that contains the names and email addresses of 500 external users.\nYou need to create a guest user account in contoso.com for each of the 500 external users.\nSolution: You create a PowerShell script that runs the New-AzureADMSInvitation cmdlet for each external user.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Active Directory (Azure AD) tenant named contoso.com. You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: You create a PowerShell script that runs the New-AzureADMSInvitation cmdlet for each external user. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Use the New-AzureADMSInvitation cmdlet which is used to invite a new external user to your directory.\nYes, this solution should meet the goal. The New-AzureADMSInvitation cmdlet can be used to send invitations\nto external users to become guest users in an Azure AD tenant. By running the cmdlet for each external user\nlisted in the CSV file, a guest user account can be created in the contoso.com Azure AD tenant for each of the\n500 external users.", "reference": "https://docs.microsoft.com/en-us/powershell/module/azuread/new-azureadmsinvitation", "references": [ "https://docs.microsoft.com/en-us/powershell/module/azuread/new-azureadmsinvitation" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 41, "pdfId": 41, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/41" }, "markersInGap": [ 40, 41 ], "questionText": "You have the Azure virtual machines shown in the following table:\nYou have a Recovery Services vault that protects VM1 and VM2.\nYou need to protect VM3 and VM4 by using Recovery Services.\nWhat should you do first?\n A.\nCreate a new Recovery Services vault\nB.\nCreate a storage account\nC.\nConfigure the extensions for VM3 and VM4\nD.\nCreate a new backup policy", "stem": "You have the Azure virtual machines shown in the following table: You have a Recovery Services vault that protects VM1 and VM2. You need to protect VM3 and VM4 by using Recovery Services. What should you do first", "options": [ { "key": "A", "text": "Create a new Recovery Services vault" }, { "key": "B", "text": "Create a storage account" }, { "key": "C", "text": "Configure the extensions for VM3 and VM4" }, { "key": "D", "text": "Create a new backup policy" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A Recovery Services vault is a storage entity in Azure that houses data. The data is typically copies of data, or\nconfiguration information for virtual machines\n(VMs), workloads, servers, or workstations. You can use Recovery Services vaults to hold backup data for\nvarious Azure services", "reference": "https://docs.microsoft.com/en-us/azure/site-recovery/azure-to-azure-tutorial-enable-replicatio", "references": [ "https://docs.microsoft.com/en-us/azure/site-recovery/azure-to-azure-tutorial-enable-replicatio" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 42, "pdfId": 42, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/42" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Network Contributor on LB1\nNetwork Contributor on LB2\nNetwork Contributor role on LB1 and LB2 is the correct answer. With this role user can add create a backend\naddress without actually adding the actual IP addresses. Network contributor can also create and modify\nhealth probe.\nIf the user wants to add address to backend pools (eg: IPs from a VNet or entire subnet) then a Network\nContributor role is required at the resource group level (or atleast on VNet)", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 43, "pdfId": 43, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/43" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com and\nan Azure Kubernetes Service (AKS) cluster named AKS1.\nAn administrator reports that she is unable to grant access to AKS1 to the users in contoso.com.\nYou need to ensure that access to AKS1 can be granted to the contoso.com users.\nWhat should you do first?\nA.\nFrom contoso.com, modify the Organization relationships settings.\nB.\nFrom contoso.com, create an OAuth 2.0 authorization endpoint.\nC.\nRecreate AKS1.\nD.\nFrom AKS1, create a namespace.", "stem": "You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com and an Azure Kubernetes Service (AKS) cluster named AKS1. An administrator reports that she is unable to grant access to AKS1 to the users in contoso.com. You need to ensure that access to AKS1 can be granted to the contoso.com users. What should you do first", "options": [ { "key": "A", "text": "From contoso.com, modify the Organization relationships settings." }, { "key": "B", "text": "From contoso.com, create an OAuth 2.0 authorization endpoint." }, { "key": "C", "text": "Recreate AKS1." }, { "key": "D", "text": "From AKS1, create a namespace." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Cluster administrators can configure Kubernetes role-based access control (Kubernetes RBAC) based on a\nuser's identity or directory group membership. Azure AD authentication is provided to AKS clusters with\nOpenID Connect. OpenID Connect is an identity layer built on top of the OAuth 2.0 protocol\nhttps://docs.microsoft.com/en-us/azure/aks/managed-aad\nYou have a Microsoft 365 tenant and an Azure Active Directory (Azure AD) tenant named contoso.com.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nA.\na Microsoft 365 group that uses the Assigned membership type\nB.\na Security group that uses the Assigned membership type\nC.\na Microsoft 365 group that uses the Dynamic User membership type\nD.\na Security group that uses the Dynamic User membership type\nE.\na Security group that uses the Dynamic Device membership type", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 44, "pdfId": 44, "exam": "AZ-104", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/44" }, "markersInGap": [], "questionText": "You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft SharePoint\ndocument library named Library1.\nYou need to create groups for the users. The solution must ensure that the groups are deleted automatically after\n180 days.\nWhich two groups should you create? Each correct answer presents a complete solution.\nNOTE: Each correct selection is worth one point.\nA.\na Microsoft 365 group that uses the Assigned membership type\nB.\na Security group that uses the Assigned membership type\nC.\na Microsoft 365 group that uses the Dynamic User membership type\nD.\na Security group that uses the Dynamic User membership type\nE.\na Security group that uses the Dynamic Device membership type", "stem": "You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft SharePoint document library named Library1. You need to create groups for the users. The solution must ensure that the groups are deleted automatically after 180 days. Which two groups should you create? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "a Microsoft 365 group that uses the Assigned membership type" }, { "key": "B", "text": "a Security group that uses the Assigned membership type" }, { "key": "C", "text": "a Microsoft 365 group that uses the Dynamic User membership type" }, { "key": "D", "text": "a Security group that uses the Dynamic User membership type" }, { "key": "E", "text": "a Security group that uses the Dynamic Device membership type" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "You can set expiration policy only for Office 365 groups in Azure Active Directory (Azure AD).", "reference": "https://docs.microsoft.com/en-us/office365/admin/create-groups/office-365-groups-expiration-policy?\nview=o365-worldwide", "references": [ "https://docs.microsoft.com/en-us/office365/admin/create-groups/office-365-groups-expiration-policy?" ], "note": "With the increase in usage of Office 365 Groups, administrators and users need a way to clean up\nunused groups. Expiration policies can help remove inactive groups from the system and make things cleaner.\nWhen a group expires, all of its associated services (the mailbox, Planner, SharePoint site, etc.) are also\ndeleted.\nYou can set up a rule for dynamic membership on security groups or Office 365 groups.\nIncorrect Answers:\nB, D, E: You can set expiration policy only for Office 365 groups in Azure Active Directory (Azure AD).\nReference:\nhttps://docs.microsoft.com/en-us/office365/admin/create-groups/office-365-groups-expiration-policy?\nview=o365-worldwide", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 45, "pdfId": 45, "exam": "AZ-104", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/45" }, "markersInGap": [ 44, 45 ], "questionText": "HOTSPOT -\nYou have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the\nfollowing table:\n User3 is the owner of Group1.\nGroup2 is a member of Group1.\nYou configure an access review named Review1 as shown in the following exhibit:\nFor each of the following statements, select Yes if the statement is true. Otherwise, select No.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table: User3 is the owner of Group1. Group2 is a member of Group1. You configure an access review named Review1 as shown in the following exhibit: For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "User3 can perform an access review of User1 =\nNo\nUser1 is a Member and not a Guest Account, Access Review specified Guests only.\nUser3 can perform an access review of UserA =\n No\nUser1 is a Member and not a Guest Account, Access Review specified Guests only.\nUser3 can perform an access review of UserB =\n No\nCreated Group 1 and Group 2, added Group 2 as a member in Group 1,\nAdded guest Accounts to Group 1 and Group 2,\nIn the Access Review results only the Guest Accounts in Group 1 appeared for review and \"Not\" the Guest\naccounts in Group 2.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 46, "pdfId": 46, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/46" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: No -\nVirtual networks are not allowed at the root and is inherited. Deny overrides allowed.\nBox 2: No-\nSubscription 2: Allowed to create a VNET which restricts anything else.\nBox 3: No -\nAlready in one Management group called 21, so cannot add into another. A Subscription can be assigned to 1\nManagement Group", "reference": "https://docs.microsoft.com/en-us/azure/governance/management-groups/overview\nhttps://docs.microsoft.com/en-us/azure/governance/management-groups/manage#moving-management-\ngroups-and-subscriptions", "references": [ "https://docs.microsoft.com/en-us/azure/governance/management-groups/overview", "https://docs.microsoft.com/en-us/azure/governance/management-groups/manage#moving-management-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 47, "pdfId": 47, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/47" }, "markersInGap": [ 47 ], "questionText": "You have an Azure policy as shown in the following exhibit:\nWhat is the effect of the policy?\nA.\nYou are prevented from creating Azure SQL servers anywhere in Subscription 1.\nB.\nYou can create Azure SQL servers in ContosoRG1 only.\n C.\nYou are prevented from creating Azure SQL Servers in ContosoRG1 only.\nD.\nYou can create Azure SQL servers in any resource group within Subscription 1.", "stem": "You have an Azure policy as shown in the following exhibit: What is the effect of the policy", "options": [ { "key": "A", "text": "You are prevented from creating Azure SQL servers anywhere in Subscription 1." }, { "key": "B", "text": "You can create Azure SQL servers in ContosoRG1 only." }, { "key": "C", "text": "You are prevented from creating Azure SQL Servers in ContosoRG1 only." }, { "key": "D", "text": "You can create Azure SQL servers in any resource group within Subscription 1." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "You are prevented from creating Azure SQL servers anywhere in Subscription 1 with the exception of", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 48, "pdfId": 48, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/48" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "VNET1: Department: D1 only.\nRG tags are not inherited to resources\nVNET2: Label:Value1 only.\nIncorrect Answers:\nTags are not inherited. The tag was only applied to the resource group, the VNET2 resource won't inherit it", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 49, "pdfId": 49, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/49" }, "markersInGap": [], "questionText": "You have an Azure subscription named AZPT1 that contains the resources shown in the following table:\nYou create a new Azure subscription named AZPT2.\nYou need to identify which resources can be moved to AZPT2.\nWhich resources should you identify?\nA.\nVM1, storage1, VNET1, and VM1Managed only\nB.\nVM1 and VM1Managed only\nC.\nVM1, storage1, VNET1, VM1Managed, and RVAULT1\nD.\nRVAULT1 only", "stem": "You have an Azure subscription named AZPT1 that contains the resources shown in the following table: You create a new Azure subscription named AZPT2. You need to identify which resources can be moved to AZPT2. Which resources should you identify", "options": [ { "key": "A", "text": "VM1, storage1, VNET1, and VM1Managed only" }, { "key": "B", "text": "VM1 and VM1Managed only" }, { "key": "C", "text": "VM1, storage1, VNET1, VM1Managed, and RVAULT1" }, { "key": "D", "text": "RVAULT1 only" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "You can move a VM and its associated resources to a different subscription by using the Azure portal.\nYou can now move an Azure Recovery Service (ASR) Vault to either a new resource group within the current\nsubscription or to a new subscription.", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-\nsubscription\nYou recently created a new Azure subscription that contains a user named Admin1.\nAdmin1 attempts to deploy an Azure Marketplace resource by using an Azure Resource Manager template. Admin1\ndeploys the template by using Azure\nPowerShell and receives the following error message: `User failed validation to purchase resources. Error\nmessage: `Legal terms have not been accepted for this item on this subscription. To accept legal terms, please go\nto the Azure portal (http://go.microsoft.com/fwlink/?LinkId=534873) and configure programmatic deployment for\nthe Marketplace item or create it there for the first time.`", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-", "http://go.microsoft.com/fwlink/?LinkId=534873" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 50, "pdfId": 50, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/50" }, "markersInGap": [ 49, 50 ], "questionText": "You need to ensure that Admin1 can deploy the Marketplace resource successfully.\nWhat should you do?\nA.\nFrom Azure PowerShell, run the Set-AzApiManagementSubscription cmdlet\nB.\nFrom the Azure portal, register the Microsoft.Marketplace resource provider\nC.\nFrom Azure PowerShell, run the Set-AzMarketplaceTerms cmdlet\nD.\nFrom the Azure portal, assign the Billing administrator role to Admin1", "stem": "You need to ensure that Admin1 can deploy the Marketplace resource successfully. What should you do", "options": [ { "key": "A", "text": "From Azure PowerShell, run the Set-AzApiManagementSubscription cmdlet" }, { "key": "B", "text": "From the Azure portal, register the Microsoft.Marketplace resource provider" }, { "key": "C", "text": "From Azure PowerShell, run the Set-AzMarketplaceTerms cmdlet" }, { "key": "D", "text": "From the Azure portal, assign the Billing administrator role to Admin1" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Set-AzMarketplaceTerms -Publisher -Product -Name [-Accept] [-Terms\n] [-DefaultProfile ] [-WhatIf] [-Confirm]\n[]", "reference": "https://docs.microsoft.com/en-us/powershell/module/Az.MarketplaceOrdering/Set-AzMarketplaceTerms?\nview=azps-4.6.0\nReference:\nhttps://docs.microsoft.com/en-us/powershell/module/az.marketplaceordering/set-azmarketplaceterms?\nview=azps-4.1.0", "references": [ "https://docs.microsoft.com/en-us/powershell/module/Az.MarketplaceOrdering/Set-AzMarketplaceTerms?", "https://docs.microsoft.com/en-us/powershell/module/az.marketplaceordering/set-azmarketplaceterms?" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 51, "pdfId": 51, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/51" }, "markersInGap": [], "questionText": "You have an Azure Active Directory (Azure AD) tenant that contains 5,000 user accounts.\nYou create a new user account named AdminUser1.\nYou need to assign the User administrator administrative role to AdminUser1.\nWhat should you do from the user account properties?\nA.\nFrom the Licenses blade, assign a new license\nB.\nFrom the Directory role blade, modify the directory role\nC.\nFrom the Groups blade, invite the user account to a new group", "stem": "You have an Azure Active Directory (Azure AD) tenant that contains 5,000 user accounts. You create a new user account named AdminUser1. You need to assign the User administrator administrative role to AdminUser1. What should you do from the user account properties", "options": [ { "key": "A", "text": "From the Licenses blade, assign a new license" }, { "key": "B", "text": "From the Directory role blade, modify the directory role" }, { "key": "C", "text": "From the Groups blade, invite the user account to a new group" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Assign a role to a user -\n1. Sign in to the Azure portal with an account that's a global admin or privileged role admin for the directory.\n2. Select Azure Active Directory, select Users, and then select a specific user from the list.\n3. For the selected user, select Directory role, select Add role, and then pick the appropriate admin roles from\nthe Directory roles list, such as Conditional access administrator.\n4. Press Select to save.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-users-assign-role-\nazure-portal", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-users-assign-role-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 52, "pdfId": 52, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/52" }, "markersInGap": [ 51, 52 ], "questionText": "You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com that contains 100 user\naccounts.\nYou purchase 10 Azure AD Premium P2 licenses for the tenant.\nYou need to ensure that 10 users can use all the Azure AD Premium features.\n What should you do?\nA.\nFrom the Licenses blade of Azure AD, assign a license\nB.\nFrom the Groups blade of each user, invite the users to a group\nC.\nFrom the Azure AD domain, add an enterprise application\nD.\nFrom the Directory role blade of each user, modify the directory role", "stem": "You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com that contains 100 user accounts. You purchase 10 Azure AD Premium P2 licenses for the tenant. You need to ensure that 10 users can use all the Azure AD Premium features. What should you do", "options": [ { "key": "A", "text": "From the Licenses blade of Azure AD, assign a license" }, { "key": "B", "text": "From the Groups blade of each user, invite the users to a group" }, { "key": "C", "text": "From the Azure AD domain, add an enterprise application" }, { "key": "D", "text": "From the Directory role blade of each user, modify the directory role" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. From the Licenses blade of Azure AD, assign a license.\nTo ensure that the 10 users can use all the Azure AD Premium P2 features, you need to assign each of these\nusers a Premium P2 license. This is done from the Licenses blade in the Azure Active Directory section of the\nAzure portal. Here, you can manage and assign licenses directly to individual users or to a group that these\nusers are part of. Assigning the license enables the users to access Premium features such as Identity\nProtection, Privileged Identity Management, and more.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/license-users-groups", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/license-users-groups" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 53, "pdfId": 53, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/53" }, "markersInGap": [], "questionText": "You have an Azure subscription named Subscription1 and an on-premises deployment of Microsoft System Center\nService Manager.\nSubscription1 contains a virtual machine named VM1.\nYou need to ensure that an alert is set in Service Manager when the amount of available memory on VM1 is below\n10 percent.\nWhat should you do first?\nA.\nCreate an automation runbook\nB.\nDeploy a function app\nC.\nDeploy the IT Service Management Connector (ITSM)\nD.\nCreate a notification", "stem": "You have an Azure subscription named Subscription1 and an on-premises deployment of Microsoft System Center Service Manager. Subscription1 contains a virtual machine named VM1. You need to ensure that an alert is set in Service Manager when the amount of available memory on VM1 is below 10 percent. What should you do first", "options": [ { "key": "A", "text": "Create an automation runbook" }, { "key": "B", "text": "Deploy a function app" }, { "key": "C", "text": "Deploy the IT Service Management Connector (ITSM)" }, { "key": "D", "text": "Create a notification" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "The IT Service Management Connector (ITSMC) allows you to connect Azure and a supported IT Service\nManagement (ITSM) product/service, such as the\nMicrosoft System Center Service Manager.\nWith ITSMC, you can create work items in ITSM tool, based on your Azure alerts (metric alerts, Activity Log\nalerts and Log Analytics alerts).", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/platform/itsmc-overview\nYou sign up for Azure Active Directory (Azure AD) Premium P2.", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/platform/itsmc-overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 54, "pdfId": 54, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/54" }, "markersInGap": [], "questionText": "You need to add a user named\n[email protected]\n as an administrator on all the computers that will be joined to the\nAzure AD domain.\nWhat should you configure in Azure AD?\nA.\nDevice settings from the Devices blade\nB.\nProviders from the MFA Server blade\nC.\nUser settings from the Users blade\nD.\nGeneral settings from the Groups blade", "stem": "You need to add a user named [email protected] as an administrator on all the computers that will be joined to the Azure AD domain. What should you configure in Azure AD", "options": [ { "key": "A", "text": "Device settings from the Devices blade" }, { "key": "B", "text": "Providers from the MFA Server blade" }, { "key": "C", "text": "User settings from the Users blade" }, { "key": "D", "text": "General settings from the Groups blade" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "When you connect a Windows device with Azure AD using an Azure AD join, Azure AD adds the following\nsecurity principles to the local administrators group on the device:\n✑\n The Azure AD global administrator role\n✑\n The Azure AD device administrator role\n✑\n The user performing the Azure AD join\nIn the Azure portal, you can manage the device administrator role on the Devices page. To open the Devices\npage:\n1. Sign in to your Azure portal as a global administrator or device administrator.\n2. On the left navbar, click Azure Active Directory.\n3. In the Manage section, click Devices.\n4. On the Devices page, click Device settings.\n5. To modify the device administrator role, configure Additional local administrators on Azure AD joined\ndevices.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/devices/assign-local-admin", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/devices/assign-local-admin" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 55, "pdfId": 55, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/55" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "User1 can add Device2 to Group1: No\nUser2 can add Device1 to Group1: Yes\nUser2 can add Device2 to Group2: No\nGroups can contain both registered and joined devices as members.\nAs a global administrator or cloud device administrator, you can manage the registered or joined devices.\nIntune Service administrators can update and delete devices. User administrator can manage users but not\ndevices.\nUser1 is a cloud device administrator. Users in this role can enable, disable, and delete devices in Azure AD\nand read Windows 10 BitLocker keys (if present) in the Azure portal. The role does not grant permissions to\nmanage any other properties on the device.\nUser2 is the owner of Group1. He can add Device1 to Group1.\nGroup2 is configured for dynamic membership. The properties on which the membership of a device in a group\nof the type dynamic device are defined cannot be changed by either an end user or an user administrator.\nUser2 cannot add any device to Group2.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 56, "pdfId": 56, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/56" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains a resource group named RG26.\nRG26 is set to the West Europe location and is used to create temporary resources for a project. RG26 contains the\nresources shown in the following table.\nSQLDB01 is backed up to RGV1.\nWhen the project is complete, you attempt to delete RG26 from the Azure portal. The deletion fails.\nYou need to delete RG26.\nWhat should you do first?\nA.\nDelete VM1\nB.\nStop VM1\nC.\nStop the backup of SQLDB01\nD.\nDelete sa001", "stem": "You have an Azure subscription that contains a resource group named RG26. RG26 is set to the West Europe location and is used to create temporary resources for a project. RG26 contains the resources shown in the following table. SQLDB01 is backed up to RGV1. When the project is complete, you attempt to delete RG26 from the Azure portal. The deletion fails. You need to delete RG26. What should you do first", "options": [ { "key": "A", "text": "Delete VM1" }, { "key": "B", "text": "Stop VM1" }, { "key": "C", "text": "Stop the backup of SQLDB01" }, { "key": "D", "text": "Delete sa001" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Stop the backup of SQLDB01\"\nVM's running or not would not block the deletion of a Resource Group.\nStorage Accounts also don't block the deletion of a Resource Group.", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/delete-resource-group?\ntabs=azure-powershell#required-access-and-deletion-failures\nhttps://docs.microsoft.com/en-us/azure/backup/backup-azure-delete-vault?tabs=portal#before-you-start\nYou have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a\nresource group named RG1.\nSubscription1 has a user named User1. User1 has the following roles:\n✑\n Reader\n✑\n Security Admin\n✑\n Security Reader", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/delete-resource-group?", "https://docs.microsoft.com/en-us/azure/backup/backup-azure-delete-vault?tabs=portal#before-you-start" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 57, "pdfId": 57, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/57" }, "markersInGap": [], "questionText": "You need to ensure that User1 can assign the Reader role for VNet1 to other users.\nWhat should you do?\nA.\nRemove User1 from the Security Reader and Reader roles for Subscription1.\nB.\nAssign User1 the User Access Administrator role for VNet1.\nC.\nAssign User1 the Network Contributor role for VNet1.\nD.\nAssign User1 the Network Contributor role for RG1.", "stem": "You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do", "options": [ { "key": "A", "text": "Remove User1 from the Security Reader and Reader roles for Subscription1." }, { "key": "B", "text": "Assign User1 the User Access Administrator role for VNet1." }, { "key": "C", "text": "Assign User1 the Network Contributor role for VNet1." }, { "key": "D", "text": "Assign User1 the Network Contributor role for RG1." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Has full access to all resources including the right to delegate access to others.", "reference": "https://docs.microsoft.com/en-us/azure/role-based-access-control/overview", "references": [ "https://docs.microsoft.com/en-us/azure/role-based-access-control/overview" ], "note": "There are several versions of this question in the exam. The question has two possible correct answers:\n✑\n Assign User1 the User Access Administrator role for VNet1.\n✑\n Assign User1 the Owner role for VNet1.\nOther incorrect answer options you may see on the exam include the following:\n✑\n Assign User1 the Contributor role for VNet1.\n✑\n Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor\nrole for Subscription1.\n✑\n Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.\nReference:\nhttps://docs.microsoft.com/en-us/azure/role-based-access-control/overview", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 58, "pdfId": 58, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/58" }, "markersInGap": [ 57, 58 ], "questionText": "You have an Azure Active Directory (Azure AD) tenant named contosocloud.onmicrosoft.com.\nYour company has a public DNS zone for contoso.com.\nYou add contoso.com as a custom domain name to Azure AD.\nYou need to ensure that Azure can verify the domain name.\nWhich type of DNS record should you create?\nA.\nMX\nB.\nNSEC\nC.\nPTR\n D.\nRRSIG", "stem": "You have an Azure Active Directory (Azure AD) tenant named contosocloud.onmicrosoft.com. Your company has a public DNS zone for contoso.com. You add contoso.com as a custom domain name to Azure AD. You need to ensure that Azure can verify the domain name. Which type of DNS record should you create", "options": [ { "key": "A", "text": "MX" }, { "key": "B", "text": "NSEC" }, { "key": "C", "text": "PTR" }, { "key": "D", "text": "RRSIG" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "To verify your custom domain name (example)\n1. Sign in to the Azure portal using a Global administrator account for the directory.\n2. Select Azure Active Directory, and then select Custom domain names.\n3. On the Fabrikam - Custom domain names page, select the custom domain name, Contoso.\n4. On the Contoso page, select Verify to make sure your custom domain is properly registered and is valid for\nAzure AD. Use either the TXT or the MX record type.", "reference": "https://docs.microsoft.com/en-us/azure/dns/dns-web-sites-custom-domain\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "references": [ "https://docs.microsoft.com/en-us/azure/dns/dns-web-sites-custom-domain" ], "note": "There are several versions of this question in the exam. The question can have two correct answers:\n1. MX\n2. TXT\nThe question can also have other incorrect answer options, including the following:\n1. SRV\n2. NSEC3\nReference:\nhttps://docs.microsoft.com/en-us/azure/dns/dns-web-sites-custom-domain\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 59, "pdfId": 59, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/59" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1.\nAdatum contains a group named Developers.\nSubscription1 contains a resource group named Dev.\nYou need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.\nSolution: On Subscription1, you assign the DevTest Labs User role to the Developers group.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named Dev. You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group. Solution: On Subscription1, you assign the DevTest Labs User role to the Developers group. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "DevTest Labs User role only lets you connect, start, restart, and shutdown virtual machines in your Azure\nDevTest Labs.\nThe Logic App Contributor role lets you manage logic app, but not access to them. It provides access to view,\nedit, and update a logic app.", "reference": "https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles\nhttps://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app", "references": [ "https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles", "https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 60, "pdfId": 60, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/60" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1.\nAdatum contains a group named Developers.\nSubscription1 contains a resource group named Dev.\nYou need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.\nSolution: On Subscription1, you assign the Logic App Operator role to the Developers group.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named Dev. You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group. Solution: On Subscription1, you assign the Logic App Operator role to the Developers group. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. No\nThe Logic App Operator role only allows users to view and manage logic apps. It does not allow them to create\nnew ones. Therefore, assigning the Logic App Operator role to the Developers group will not meet the goal of\nproviding them with the ability to create Azure logic apps in the Dev resource group.\nYou would need the Logic App Contributor role.", "reference": "https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles\nhttps://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app", "references": [ "https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles", "https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 61, "pdfId": 61, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/61" }, "markersInGap": [ 60, 61 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1.\nAdatum contains a group named Developers.\nSubscription1 contains a resource group named Dev.\nYou need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.\nSolution: On Dev, you assign the Contributor role to the Developers group.\nDoes this meet the goal?\nA.\nYes\n B.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named Dev. You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group. Solution: On Dev, you assign the Contributor role to the Developers group. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Yes, a\nssigning the Contributor role to the Developers group on the Dev resource group would meet the goal of\nproviding the group with the ability to create Azure logic apps in the Dev resource group.\nThe Contributor role grants full access to manage all resources in the resource group, including the ability to\ncreate and manage logic apps. By assigning the Contributor role to the Developers group, you are giving them\nthe necessary permissions to create and manage logic apps in the Dev resource group.\nThe Contributor role can manage all resources (and add resources) in a Resource Group.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 62, "pdfId": 62, "exam": "AZ-104", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/62" }, "markersInGap": [], "questionText": "DRAG DROP -\nYou have an Azure subscription that is used by four departments in your company. The subscription contains 10\nresource groups. Each department uses resources in several resource groups.\nYou need to send a report to the finance department. The report must detail the costs for each department.\nWhich three actions should you perform in sequence? To answer, move the appropriate actions from the list of\nactions to the answer area and arrange them in the correct order.\nSelect and Place:", "stem": "You have an Azure subscription that is used by four departments in your company. The subscription contains 10 resource groups. Each department uses resources in several resource groups. You need to send a report to the finance department. The report must detail the costs for each department. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Assign a tag to each resource.\nYou apply tags to your Azure resources giving metadata to logically organize them into a taxonomy. After you\napply tags, you can retrieve all the resources in your subscription with that tag name and value. Each resource\nor resource group can have a maximum of 15 tag name/value pairs. Tags applied to the resource group are not\ninherited by the resources in that resource group.\nBox 2: From the Cost analysis blade, filter the view by tag", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-using-tags\nhttps://docs.microsoft.com/en-us/azure/billing/billing-getting-started", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-using-tags", "https://docs.microsoft.com/en-us/azure/billing/billing-getting-started" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 63, "pdfId": 63, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/63" }, "markersInGap": [ 63 ], "questionText": "You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named\nWorkspace1.\nYou need to view the error events from a table named Event.\nWhich query should you run in Workspace1?\n A.\nGet-Event Event | where\n$_.EventType == \"error\"\nB.\nsearch in (Event) \"error\"\nC.\nselect * from Event where EventType == \"error\"\nD.\nsearch in (Event) * | where EventType -eq \"error\"", "stem": "You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1. You need to view the error events from a table named Event. Which query should you run in Workspace1", "options": [ { "key": "A", "text": "Get-Event Event | where $_.EventType == \"error\"" }, { "key": "B", "text": "search in (Event) \"error\"" }, { "key": "C", "text": "select * from Event where EventType == \"error\"" }, { "key": "D", "text": "search in (Event) * | where EventType -eq \"error\"" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "To search a term in a specific table, add the table-name just after the search operator", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/search-queries\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/log-query/get-started-portal\nhttps://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/searchoperator?pivots=azuredataexplorer", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/search-queries", "https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/get-started-portal", "https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/searchoperator?pivots=azuredataexplorer" ], "note": "There are several versions of this question in the exam. The question has two possible correct answers:\n1. Event | search \"error\"\n2. Event | where EventType == \"error\"\n3. search in (Event) \"error\"\nOther incorrect answer options you may see on the exam include the following:\n1. Get-Event Event | where\n$_.EventTye \"eq \"error\"\n2. Event | where EventType is \"error\"\n3. search in (Event) * | where EventType \"eq \"error\"\n4. select * from Event where EventType is \"error\"\nReference:\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/log-query/search-queries\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/log-query/get-started-portal\nhttps://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/searchoperator?pivots=azuredataexplorer", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 64, "pdfId": 64, "exam": "AZ-104", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/64" }, "markersInGap": [ 64 ], "questionText": "HOTSPOT -\nYou have an Azure subscription that contains a virtual network named VNET1 in the East US 2 region. A network\ninterface named VM1-NI is connected to\nVNET1.\nYou successfully deploy the following Azure Resource Manager template.\n For each of the following statements, select Yes if the statement is true. Otherwise, select No.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You have an Azure subscription that contains a virtual network named VNET1 in the East US 2 region. A network interface named VM1-NI is connected to VNET1. You successfully deploy the following Azure Resource Manager template. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Yes -\nBox 2: Yes -\nVM1 is in Zone1, while VM2 is on Zone2.\nBox 3: No -", "reference": "https://docs.microsoft.com/en-us/azure/architecture/resiliency/recovery-loss-azure-region", "references": [ "https://docs.microsoft.com/en-us/azure/architecture/resiliency/recovery-loss-azure-region" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 65, "pdfId": 65, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/65" }, "markersInGap": [], "questionText": "You have an Azure subscription named Subscription1. Subscription1 contains the resource groups in the following\ntable.\nRG1 has a web app named WebApp1. WebApp1 is located in West Europe.\nYou move WebApp1 to RG2.\nWhat is the effect of the move?\nA.\nThe App Service plan for WebApp1 remains in West Europe. Policy2 applies to WebApp1.\nB.\nThe App Service plan for WebApp1 moves to North Europe. Policy2 applies to WebApp1.\nC.\nThe App Service plan for WebApp1 remains in West Europe. Policy1 applies to WebApp1.\nD.\nThe App Service plan for WebApp1 moves to North Europe. Policy1 applies to WebApp1.", "stem": "You have an Azure subscription named Subscription1. Subscription1 contains the resource groups in the following table. RG1 has a web app named WebApp1. WebApp1 is located in West Europe. You move WebApp1 to RG2. What is the effect of the move", "options": [ { "key": "A", "text": "The App Service plan for WebApp1 remains in West Europe. Policy2 applies to WebApp1." }, { "key": "B", "text": "The App Service plan for WebApp1 moves to North Europe. Policy2 applies to WebApp1." }, { "key": "C", "text": "The App Service plan for WebApp1 remains in West Europe. Policy1 applies to WebApp1." }, { "key": "D", "text": "The App Service plan for WebApp1 moves to North Europe. Policy1 applies to WebApp1." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "You can move an app to another App Service plan, as long as the source plan and the target plan are in the\nsame resource group and geographical region.\nThe region in which your app runs is the region of the App Service plan it's in. However, you cannot change an\nApp Service plan's region.\nReference:\nhttps://docs.microsoft.com/en-us/azure/app-service/app-service-plan-manage", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 66, "pdfId": 66, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/66" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1) \"/subscriptions/c276fc76-9cd4-44c9-99a7-4fd71546436e\"\n2) \"Microsoft.Authorization/*\"\n\"assignableScopes\" must be the Subscription, so that this Custom Role can be only assignable to Resources\nGroups under the same Subscription.\n\"notActions\" must deny only the actions that interact with the Authorization API Endpoints. Everything else\nmust\\can be allowed.", "reference": "https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles\nhttps://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-\noperations#microsoftresources", "references": [ "https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles", "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 67, "pdfId": 67, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/67" }, "markersInGap": [ 67 ], "questionText": "You have an Azure subscription.\nUsers access the resources in the subscription from either home or from customer sites. From home, users must\nestablish a point-to-site VPN to access the Azure resources. The users on the customer sites access the Azure\nresources by using site-to-site VPNs.\nYou have a line-of-business-app named App1 that runs on several Azure virtual machine. The virtual machines run\nWindows Server 2016.\nYou need to ensure that the connections to App1 are spread across all the virtual machines.\nWhat are two possible Azure services that you can use? Each correct answer presents a complete solution.\n NOTE: Each correct selection is worth one point.\nA.\nan internal load balancer\nB.\na public load balancer\nC.\nan Azure Content Delivery Network (CDN)\nD.\nTraffic Manager\nE.\nan Azure Application Gateway", "stem": "You have an Azure subscription. Users access the resources in the subscription from either home or from customer sites. From home, users must establish a point-to-site VPN to access the Azure resources. The users on the customer sites access the Azure resources by using site-to-site VPNs. You have a line-of-business-app named App1 that runs on several Azure virtual machine. The virtual machines run Windows Server 2016. You need to ensure that the connections to App1 are spread across all the virtual machines. What are two possible Azure services that you can use? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "an internal load balancer" }, { "key": "B", "text": "a public load balancer" }, { "key": "C", "text": "an Azure Content Delivery Network (CDN)" }, { "key": "D", "text": "Traffic Manager" }, { "key": "E", "text": "an Azure Application Gateway" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. an internal load balancer: An internal load balancer can be used to distribute traffic among the virtual\nmachines running App1. It can distribute traffic based on various algorithms such as round-robin, least\nconnections, and IP hash. The internal load balancer is a layer 4 (Transport Layer) load balancer that can\ndistribute traffic within a virtual network.\nE. an Azure Application Gateway: An Azure Application Gateway is a layer 7 (Application Layer) load balancer\nthat can distribute traffic based on various criteria such as URL path, host headers, and cookie. It can also\nperform SSL offloading, session affinity, and URL-based routing. It is typically used to route traffic to\ndifferent backend services based on the incoming request's contents. It is a more advanced option than the\ninternal load balancer but requires a public IP address.", "reference": "https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/vpn\nhttps://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview https://docs.microsoft.com/en-\nus/azure/application-gateway/overview", "references": [ "https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/vpn", "https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview", "https://docs.microsoft.com/en-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 68, "pdfId": 68, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/68" }, "markersInGap": [], "questionText": "You have an Azure subscription.\nYou have 100 Azure virtual machines.\nYou need to quickly identify underutilized virtual machines that can have their service tier changed to a less\nexpensive offering.\nWhich blade should you use?\nA.\nMonitor\nB.\nAdvisor\nC.\nMetrics\nD.\nCustomer insights", "stem": "You have an Azure subscription. You have 100 Azure virtual machines. You need to quickly identify underutilized virtual machines that can have their service tier changed to a less expensive offering. Which blade should you use", "options": [ { "key": "A", "text": "Monitor" }, { "key": "B", "text": "Advisor" }, { "key": "C", "text": "Metrics" }, { "key": "D", "text": "Customer insights" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Advisor helps you optimize and reduce your overall Azure spend by identifying idle and underutilized\nresources. You can get cost recommendations from the Cost tab on the Advisor dashboard.", "reference": "https://docs.microsoft.com/en-us/azure/advisor/advisor-cost-recommendations", "references": [ "https://docs.microsoft.com/en-us/azure/advisor/advisor-cost-recommendations" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 69, "pdfId": 69, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/69" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Select Users & Groups : Where you have to choose all users.\n- Select Cloud apps or actions: to specify the Azure portal\n- Grant: to grant the MFA.\nThose are the minimum requirements to create MFA policy. No conditions are required in the question.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/app-based-mfa\nhttps://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-\npolicies", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/app-based-mfa", "https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 70, "pdfId": 70, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/70" }, "markersInGap": [], "questionText": "You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com.\nThe User administrator role is assigned to a user named Admin1.\nAn external partner has a Microsoft account that uses the\n[email protected]\n sign in.\nAdmin1 attempts to invite the external partner to sign in to the Azure AD tenant and receives the following error\nmessage: `Unable to invite user\n[email protected]\n `\" Generic authorization exception.`\nYou need to ensure that Admin1 can invite the external partner to sign in to the Azure AD tenant.\nWhat should you do?\nA.\nFrom the Users settings blade, modify the External collaboration settings.\nB.\nFrom the Custom domain names blade, add a custom domain.\nC.\nFrom the Organizational relationships blade, add an identity provider.\nD.\nFrom the Roles and administrators blade, assign the Security administrator role to Admin1.", "stem": "You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com. The User administrator role is assigned to a user named Admin1. An external partner has a Microsoft account that uses the [email protected] sign in. Admin1 attempts to invite the external partner to sign in to the Azure AD tenant and receives the following error message: `Unable to invite user [email protected] `\" Generic authorization exception.` You need to ensure that Admin1 can invite the external partner to sign in to the Azure AD tenant. What should you do", "options": [ { "key": "A", "text": "From the Users settings blade, modify the External collaboration settings." }, { "key": "B", "text": "From the Custom domain names blade, add a custom domain." }, { "key": "C", "text": "From the Organizational relationships blade, add an identity provider." }, { "key": "D", "text": "From the Roles and administrators blade, assign the Security administrator role to Admin1." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. From the Users settings blade, modify the External collaboration settings.\nThe error message indicates that there's an issue with the external collaboration settings in your Azure Active\nDirectory. These settings dictate who can invite external users and under what circumstances.\nTo address this issue, you need to adjust the external collaboration settings to allow Admin1 to invite external\npartners. These settings can be found in the \"Users settings\" blade in Azure Active Directory.", "reference": "https://techcommunity.microsoft.com/t5/Azure-Active-Directory/Generic-authorization-exception-inviting-\nAzure-AD-gests/td-p/274742", "references": [ "https://techcommunity.microsoft.com/t5/Azure-Active-Directory/Generic-authorization-exception-inviting-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 71, "pdfId": 71, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/71" }, "markersInGap": [ 70, 71 ], "questionText": "You have an Azure subscription linked to an Azure Active Directory tenant. The tenant includes a user account\nnamed User1.\nYou need to ensure that User1 can assign a policy to the tenant root management group.\nWhat should you do?\nA.\nAssign the Owner role for the Azure Subscription to User1, and then modify the default conditional access\npolicies.\nB.\nAssign the Owner role for the Azure subscription to User1, and then instruct User1 to configure access\nmanagement for Azure resources.\nC.\nAssign the Global administrator role to User1, and then instruct User1 to configure access management for\n Azure resources.\nD.\nCreate a new management group and delegate User1 as the owner of the new management group.", "stem": "You have an Azure subscription linked to an Azure Active Directory tenant. The tenant includes a user account named User1. You need to ensure that User1 can assign a policy to the tenant root management group. What should you do", "options": [ { "key": "A", "text": "Assign the Owner role for the Azure Subscription to User1, and then modify the default conditional access policies." }, { "key": "B", "text": "Assign the Owner role for the Azure subscription to User1, and then instruct User1 to configure access management for Azure resources." }, { "key": "C", "text": "Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources." }, { "key": "D", "text": "Create a new management group and delegate User1 as the owner of the new management group." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "No one is given default access to the root management group. Azure AD Global Administrators are the only\nusers that can elevate themselves to gain access. Once they have access to the root management group, the\nglobal administrators can assign any Azure role to other users to manage it.", "reference": "https://docs.microsoft.com/en-us/azure/governance/management-groups/overview#important-facts-about-\nthe-root-management-group\nhttps://docs.microsoft.com/en-us/azure/governance/management-groups/overview", "references": [ "https://docs.microsoft.com/en-us/azure/governance/management-groups/overview#important-facts-about-", "https://docs.microsoft.com/en-us/azure/governance/management-groups/overview" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 72, "pdfId": 72, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/72" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Group 1 only .\nFirst rule applies -\nBox 2: Group1 and Group2 only .\nBoth membership rules apply.", "reference": "https://docs.microsoft.com/en-us/sccm/core/clients/manage/collections/create-collections", "references": [ "https://docs.microsoft.com/en-us/sccm/core/clients/manage/collections/create-collections" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 73, "pdfId": 73, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/73" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1:User1 and User3 only", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-users-profile-azure-\nportal", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-users-profile-azure-" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 74, "pdfId": 74, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/74" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to\nenable Traffic Analytics for an Azure subscription.\nSolution: You assign the Network Contributor role at the subscription level to Admin1.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription. Solution: You assign the Network Contributor role at the subscription level to Admin1. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Your account must meet one of the following to enable traffic analytics:\nYour account must have any one of the following Azure roles at the subscription scope: owner, contributor,\nreader, or network contributor.", "reference": "https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq", "references": [ "https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 75, "pdfId": 75, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/75" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to\nenable Traffic Analytics for an Azure subscription.\nSolution: You assign the Owner role at the subscription level to Admin1.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription. Solution: You assign the Owner role at the subscription level to Admin1. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Your account must meet one of the following to enable traffic analytics:\nYour account must have any one of the following Azure roles at the subscription scope: owner, contributor,\nreader, or network contributor.", "reference": "https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq", "references": [ "https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 76, "pdfId": 76, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/76" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to\nenable Traffic Analytics for an Azure subscription.\nSolution: You assign the Reader role at the subscription level to Admin1.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription. Solution: You assign the Reader role at the subscription level to Admin1. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. No\nAssigning the Reader role at the subscription level to Admin1 does not meet the goal of enabling Traffic\nAnalytics for an Azure subscription. The Reader role has permissions to view resources but does not allow for\nany write operations, which are required to enable Traffic Analytics. To enable Traffic Analytics, Admin1 would\nneed to be assigned a role that has write permissions, such as the Owner, Contributor, or a custom role with\nspecific permissions for Traffic Analytics.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 77, "pdfId": 77, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/77" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains a user named User1.\nYou need to ensure that User1 can deploy virtual machines and manage virtual networks. The solution must use the\nprinciple of least privilege.\nWhich role-based access control (RBAC) role should you assign to User1?\nA.\nOwner\nB.\nVirtual Machine Contributor\nC.\nContributor\nD.\nVirtual Machine Administrator Login", "stem": "You have an Azure subscription that contains a user named User1. You need to ensure that User1 can deploy virtual machines and manage virtual networks. The solution must use the principle of least privilege. Which role-based access control (RBAC) role should you assign to User1", "options": [ { "key": "A", "text": "Owner" }, { "key": "B", "text": "Virtual Machine Contributor" }, { "key": "C", "text": "Contributor" }, { "key": "D", "text": "Virtual Machine Administrator Login" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Contributor: Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC\nIncorrect Answers:\nA: Owner: Grants full access to manage all resources, including the ability to assign roles in Azure RBAC.\nB: Virtual Machine Contributor: Lets you manage virtual machines, but not access to them, and not the virtual\nnetwork or storage account they're connected to.\nD: Virtual Machine Administrator Login: View Virtual Machines in the portal and login as administrator.", "reference": "https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles", "references": [ "https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 78, "pdfId": 78, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/78" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Azure (RBAC) and Azure AD roles are independent. AD roles do not grant access to resources and Azure roles\ndo not grant access to Azure AD. However, a Global Administrator in AD can elevate access to all\nsubscriptions and will be User Access Administrator in Azure root scope.\nAll 3 users are GA (AD) and Admin3 is owner of the subscription (RBAC).\nAdmin1 has elevated access, so he is also User Access Admin (RBAC).\nTo assign a user the owner role at the Subscription scope, you require permissions, such as User Access\nAdmin or Owner.\nBox 1: Yes\nAdmin1 has elevated access, so he is User Access Admin. This is valid.\nBox 2: Yes\nAdmi3 is Owner of the Subscription. This is valid.\nBox 3: No\nAdmin2 is just a GA in Azure AD scope. He doesn’t have permission in the Subscription.", "reference": "https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin\nhttps://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal-subscription-\nadmin", "references": [ "https://docs.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin", "https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal-subscription-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 79, "pdfId": 79, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/79" }, "markersInGap": [ 79 ], "questionText": "You have an Azure subscription named Subscription1 that contains an Azure virtual machine named VM1. VM1 is in\na resource group named RG1.\nVM1 runs services that will be used to deploy resources to RG1.\nYou need to ensure that a service running on VM1 can manage the resources in RG1 by using the identity of VM1.\nWhat should you do first?\nA.\nFrom the Azure portal, modify the Managed Identity settings of VM1\nB.\nFrom the Azure portal, modify the Access control (IAM) settings of RG1\nC.\nFrom the Azure portal, modify the Access control (IAM) settings of VM1\n D.\nFrom the Azure portal, modify the Policies settings of RG1", "stem": "You have an Azure subscription named Subscription1 that contains an Azure virtual machine named VM1. VM1 is in a resource group named RG1. VM1 runs services that will be used to deploy resources to RG1. You need to ensure that a service running on VM1 can manage the resources in RG1 by using the identity of VM1. What should you do first", "options": [ { "key": "A", "text": "From the Azure portal, modify the Managed Identity settings of VM1" }, { "key": "B", "text": "From the Azure portal, modify the Access control (IAM) settings of RG1" }, { "key": "C", "text": "From the Azure portal, modify the Access control (IAM) settings of VM1" }, { "key": "D", "text": "From the Azure portal, modify the Policies settings of RG1" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Managed identities for Azure resources provides Azure services with an automatically managed identity in\nAzure Active Directory. You can use this identity to authenticate to any service that supports Azure AD\nauthentication, without having credentials in your code.\nYou can enable and disable the system-assigned managed identity for VM using the Azure portal.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-\nportal-windows-vm", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 80, "pdfId": 80, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/80" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains a resource group named TestRG.\nYou use TestRG to validate an Azure deployment.\nTestRG contains the following resources:\nYou need to delete TestRG.\nWhat should you do first?\nA.\nModify the backup configurations of VM1 and modify the resource lock type of VNET1\nB.\nRemove the resource lock from VNET1 and delete all data in Vault1\nC.\nTurn off VM1 and remove the resource lock from VNET1\nD.\nTurn off VM1 and delete all data in Vault1", "stem": "You have an Azure subscription that contains a resource group named TestRG. You use TestRG to validate an Azure deployment. TestRG contains the following resources: You need to delete TestRG. What should you do first", "options": [ { "key": "A", "text": "Modify the backup configurations of VM1 and modify the resource lock type of VNET1" }, { "key": "B", "text": "Remove the resource lock from VNET1 and delete all data in Vault1" }, { "key": "C", "text": "Turn off VM1 and remove the resource lock from VNET1" }, { "key": "D", "text": "Turn off VM1 and delete all data in Vault1" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "When you delete a resource group, all of its resources are also deleted. Deleting a resource group deletes all\nof its template deployments and currently stored operations.\nAs an administrator, you can lock a subscription, resource group, or resource to prevent other users in your\norganization from accidentally deleting or modifying critical resources. The lock overrides any permissions\nthe user might have.\nYou can't delete a vault that contains backup data. Once backup data is deleted, it will go into the soft deleted\nstate.\nSo you have to remove the lock on order to delete the VNET and delete the backups in order to delete the\nvault.", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/delete-resource-group?\ntabs=azure-powershell\nhttps://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources\nhttps://docs.microsoft.com/en-us/azure/backup/backup-azure-delete-vault#before-you-start", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/delete-resource-group?", "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources", "https://docs.microsoft.com/en-us/azure/backup/backup-azure-delete-vault#before-you-start" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 81, "pdfId": 81, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/81" }, "markersInGap": [], "questionText": "You have an Azure DNS zone named adatum.com.\nYou need to delegate a subdomain named research.adatum.com to a different DNS server in Azure.\nWhat should you do?\nA.\nCreate an NS record named research in the adatum.com zone.\nB.\nCreate a PTR record named research in the adatum.com zone.\nC.\nModify the SOA record of adatum.com.\nD.\nCreate an A record named *.research in the adatum.com zone.", "stem": "You have an Azure DNS zone named adatum.com. You need to delegate a subdomain named research.adatum.com to a different DNS server in Azure. What should you do", "options": [ { "key": "A", "text": "Create an NS record named research in the adatum.com zone." }, { "key": "B", "text": "Create a PTR record named research in the adatum.com zone." }, { "key": "C", "text": "Modify the SOA record of adatum.com." }, { "key": "D", "text": "Create an A record named *.research in the adatum.com zone." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. Create an NS record named research in the adatum.com zone.\nTo delegate a subdomain named research.adatum.com to a different DNS server in Azure, you should create\nan NS (Name Server) record named \"research\" in the adatum.com zone.\nThe NS record is used to delegate authority for a subdomain to a different set of name servers. By creating an\nNS record named \"research\" in the adatum.com zone and specifying the name server(s) for the subdomain,\nyou can delegate the management of the research.adatum.com subdomain to the specified DNS server(s) in\nAzure.", "reference": "https://docs.microsoft.com/en-us/azure/dns/delegate-subdomain", "references": [ "https://docs.microsoft.com/en-us/azure/dns/delegate-subdomain" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 82, "pdfId": 82, "exam": "AZ-104", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/82" }, "markersInGap": [ 81, 82 ], "questionText": "DRAG DROP -\nYou have an Azure Active Directory (Azure AD) tenant that has the contoso.onmicrosoft.com domain name.\nYou have a domain name of contoso.com registered at a third-party registrar.\nYou need to ensure that you can create Azure AD users that have names containing a suffix of @contoso.com.\nWhich three actions should you perform in sequence? To answer, move the appropriate actions from the list of\nactions to the answer area and arrange them in the correct order.\nSelect and Place:", "stem": "You have an Azure Active Directory (Azure AD) tenant that has the contoso.onmicrosoft.com domain name. You have a domain name of contoso.com registered at a third-party registrar. You need to ensure that you can create Azure AD users that have names containing a suffix of @contoso.com. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Add a custom name: Register the contoso.com domain in your Azure AD tenant.\nAdd a record to the public contoso.com DNS zone: Add the necessary DNS records at the domain registrar to\nverify the domain.\nVerify the domain: Complete the verification process in Azure AD to confirm ownership of the contoso.com\ndomain.", "reference": "https://docs.microsoft.com/en-us/azure/dns/dns-web-sites-custom-domain\nYou have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named\nWorkspace1.", "references": [ "https://docs.microsoft.com/en-us/azure/dns/dns-web-sites-custom-domain" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 83, "pdfId": 83, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/83" }, "markersInGap": [], "questionText": "You need to view the error events from a table named Event.\nWhich query should you run in Workspace1?\nA.\nGet-Event Event | where\n$_.EventType == \"error\"\nB.\nEvent | search \"error\"\nC.\nselect * from Event where EventType == \"error\"\nD.\nsearch in (Event) * | where EventType \"eq error", "stem": "You need to view the error events from a table named Event. Which query should you run in Workspace1", "options": [ { "key": "A", "text": "Get-Event Event | where $_.EventType == \"error\"" }, { "key": "B", "text": "Event | search \"error\"" }, { "key": "C", "text": "select * from Event where EventType == \"error\"" }, { "key": "D", "text": "search in (Event) * | where EventType \"eq error" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "The search operator provides a multi-table/multi-column search experience.\nThe syntax is:\nTable_name | search \"search term\"", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/search-queries\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/log-query/get-started-portal\nhttps://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/searchoperator?pivots=azuredataexplorer", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/search-queries", "https://docs.microsoft.com/en-us/azure/azure-monitor/log-query/get-started-portal", "https://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/searchoperator?pivots=azuredataexplorer" ], "note": "There are several versions of this question in the exam. The question has three possible correct answers:\n1. search in (Event) \"error\"\n2. Event | search \"error\"\n3. Event | where EventType == \"error\"\nOther incorrect answer options you may see on the exam include the following:\n1. Get-Event Event | where\n$_.EventTye \"eq \"error\"\n2. Event | where EventType is \"error\"\n3. select * from Event where EventType is \"error\"\n4. search in (Event) * | where EventType \"eq \"error\"\nReference:\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/log-query/search-queries\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/log-query/get-started-portal\nhttps://docs.microsoft.com/en-us/azure/data-explorer/kusto/query/searchoperator?pivots=azuredataexplorer", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 84, "pdfId": 84, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/84" }, "markersInGap": [ 84 ], "questionText": "You have a registered DNS domain named contoso.com.\nYou create a public Azure DNS zone named contoso.com.\nYou need to ensure that records created in the contoso.com zone are resolvable from the internet.\nWhat should you do?\nA.\nCreate NS records in contoso.com.\nB.\nModify the SOA record in the DNS domain registrar.\nC.\nCreate the SOA record in contoso.com.\nD.\nModify the NS records in the DNS domain registrar.", "stem": "You have a registered DNS domain named contoso.com. You create a public Azure DNS zone named contoso.com. You need to ensure that records created in the contoso.com zone are resolvable from the internet. What should you do", "options": [ { "key": "A", "text": "Create NS records in contoso.com." }, { "key": "B", "text": "Modify the SOA record in the DNS domain registrar." }, { "key": "C", "text": "Create the SOA record in contoso.com." }, { "key": "D", "text": "Modify the NS records in the DNS domain registrar." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. Modify the NS records in the DNS domain registrar.\nTo ensure that records created in the contoso.com zone are resolvable from the internet, you need to modify\nthe NS (Name Server) records in the DNS domain registrar.\nWhen you create a public Azure DNS zone named contoso.com, Azure assigns a set of NS records for that\nzone. These NS records specify the name servers responsible for handling DNS queries for the contoso.com\ndomain. To make the records in the Azure DNS zone resolvable from the internet, you need to update the NS\nrecords at the DNS domain registrar to point to the name servers provided by Azure.\nRegistrar “owns” the tld and will have their NS registered against the domain by default. By changing the\nregistrar NS records to point to your Azure DNS NS records you take ownership into your Azure DNS.", "reference": "https://docs.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns", "references": [ "https://docs.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 85, "pdfId": 85, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/85" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1.You can assign the Storage File Data SMB Share Contributor role to User1 for share1.\nYes.\n The Storage File Data SMB Share Contributor role allows a user to read, write, and delete files and\ndirectories in an Azure file share over SMB (Server Message Block). This role can be assigned to individual\nusers.\n2. You can assign the Storage File Data SMB Share Reader role to Computer1 for share1.\nNO\n. Azure RBAC roles apply to Azure AD users, groups, or managed identities, but not directly to computers\n(e.g., Computer1). Azure does not support assigning roles directly to devices.\n3. You can assign the Storage File Data SMB Share Elevated Contributor role to User2 for share1.\nYes.\nThe Storage File Data SMB Share Elevated Contributor role is similar to Contributor but allows assigning\nNTFS permissions on the file share. It can be assigned to users.", "reference": "https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-assign-permissions?\ntabs=azure-portal", "references": [ "https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-assign-permissions?" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 86, "pdfId": 86, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/86" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: User1 and User3 only.\nUser1: The Owner Role lets you manage everything, including access to resources.\nUser3: The Network Contributor role lets you manage networks, including creating subnets.\nBox 2: User1 only.\nThe Security Admin role: In Security Center only: Can view security policies, view security states, edit security\npolicies, view alerts and recommendations, dismiss alerts and recommendations.", "reference": "https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles\nhttps://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-\noperations#microsoftnetwork", "references": [ "https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles", "https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 87, "pdfId": 87, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/87" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Sub1, RG1, and VM1 only -\nYou can lock a subscription, resource group, or resource to prevent other users in your organization from\naccidentally deleting or modifying critical resources.\nBox 2: Sub1, RG1, and VM1 only -\nYou apply tags to your Azure resources, resource groups, and subscriptions.", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json\nhttps://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources?tabs=json", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json", "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources?tabs=json" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 88, "pdfId": 88, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/88" }, "markersInGap": [ 88 ], "questionText": "You have an Azure Active Directory (Azure AD) tenant.\nYou plan to delete multiple users by using Bulk delete in the Azure Active Directory admin center.\nYou need to create and upload a file for the bulk delete.\nWhich user attributes should you include in the file?\nA.\nThe user principal name and usage location of each user only\nB.\nThe user principal name of each user only\nC.\nThe display name of each user only\nD.\nThe display name and usage location of each user only\nE.\nThe display name and user principal name of each user only", "stem": "You have an Azure Active Directory (Azure AD) tenant. You plan to delete multiple users by using Bulk delete in the Azure Active Directory admin center. You need to create and upload a file for the bulk delete. Which user attributes should you include in the file", "options": [ { "key": "A", "text": "The user principal name and usage location of each user only" }, { "key": "B", "text": "The user principal name of each user only" }, { "key": "C", "text": "The display name of each user only" }, { "key": "D", "text": "The display name and usage location of each user only" }, { "key": "E", "text": "The display name and user principal name of each user only" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. The user principal name of each user only.\nThe user principal name (UPN) uniquely identifies each user in Azure AD. It is commonly used as the primary\nidentifier for user-related operations, including deletion. When performing a bulk delete, including the UPN of", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/users-bulk-delete", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/users-bulk-delete" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 89, "pdfId": 89, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/89" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: No -\nThe Azure Policy will add Tag4 to RG1.\nBox 2: No -\nTags applied to the resource group or subscription aren't inherited by the resources although you can enable\ninheritance with Azure Policy. Storage1 has Tag3:\nValue1 and the Azure Policy will add Tag4.\nBox 3: No -\nTags applied to the resource group or subscription aren't inherited by the resources so VNET1 does not have\nTag2.\nVNET1 has Tag3:value2. VNET1 is excluded from the Azure Policy so Tag4 will not be added to VNET1.", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources?tabs=json\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources?tabs=json" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 90, "pdfId": 90, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/90" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to\nenable Traffic Analytics for an Azure subscription.\nSolution: You assign the Traffic Manager Contributor role at the subscription level to Admin1.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription. Solution: You assign the Traffic Manager Contributor role at the subscription level to Admin1. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "One of the following Azure built-in roles needs to be assigned to your account:\n- Owner\n- Contributor\n- Reader\n- Network Contributor", "reference": "https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics#user-access-requirements", "references": [ "https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics#user-access-requirements" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 91, "pdfId": 91, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/91" }, "markersInGap": [], "questionText": "You have three offices and an Azure subscription that contains an Azure Active Directory (Azure AD) tenant.\nYou need to grant user management permissions to a local administrator in each office.\nWhat should you use?\nA.\nAzure AD roles\nB.\nadministrative units\nC.\naccess packages in Azure AD entitlement management\nD.\nAzure roles", "stem": "You have three offices and an Azure subscription that contains an Azure Active Directory (Azure AD) tenant. You need to grant user management permissions to a local administrator in each office. What should you use", "options": [ { "key": "A", "text": "Azure AD roles" }, { "key": "B", "text": "administrative units" }, { "key": "C", "text": "access packages in Azure AD entitlement management" }, { "key": "D", "text": "Azure roles" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Administrative units restrict permissions in a role to any portion of your organization that you define. You\ncould, for example, use administrative units to delegate the Helpdesk Administrator role to regional support\nspecialists, so they can manage users only in the region that they support.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/roles/administrative-units\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/roles/administrative-units" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 92, "pdfId": 92, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/92" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1.\nAdatum contains a group named Developers.\nSubscription1 contains a resource group named Dev.\nYou need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.\nSolution: On Dev, you assign the Logic App Contributor role to the Developers group.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named Dev. You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group. Solution: On Dev, you assign the Logic App Contributor role to the Developers group. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "\"Yes\" is correct. Logic App Contributor role will allow you to create Logic Apps.\nYour Azure subscription requires Contributor permissions for the resource group that contains that logic app\nresource. If you create a logic app resource, you automatically have Contributor access.\"", "reference": "https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app?tabs=azure-portal", "references": [ "https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app?tabs=azure-portal" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 93, "pdfId": 93, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/93" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1. assign access to other users for.\n2. delete a Virtual machine from.\nhttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator\nLets you manage user access to Azure resources.\nhttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-contributor\nCreate and manage virtual machines, manage disks, install and run software, reset password of the root user\nof the virtual machine using VM extensions, and manage local user accounts using VM extensions. This role\ndoes not grant you management access to the virtual network or storage account the virtual machines are\nconnected to. This role does not allow you to assign roles in Azure RBAC.", "reference": "https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-contributor\nhttps://docs.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles", "references": [ "https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-contributor", "https://docs.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 94, "pdfId": 94, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/94" }, "markersInGap": [ 94 ], "questionText": "You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a\nresource group named RG1.\n Subscription1 has a user named User1. User1 has the following roles:\n✑\n Reader\n✑\n Security Admin\n✑\n Security Reader\nYou need to ensure that User1 can assign the Reader role for VNet1 to other users.\nWhat should you do?\nA.\nRemove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.\nB.\nAssign User1 the Owner role for VNet1.\nC.\nAssign User1 the Contributor role for VNet1.\nD.\nAssign User1 the Network Contributor role for VNet1.", "stem": "You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1. Subscription1 has a user named User1. User1 has the following roles: ✑ Reader ✑ Security Admin ✑ Security Reader You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do", "options": [ { "key": "A", "text": "Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1." }, { "key": "B", "text": "Assign User1 the Owner role for VNet1." }, { "key": "C", "text": "Assign User1 the Contributor role for VNet1." }, { "key": "D", "text": "Assign User1 the Network Contributor role for VNet1." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Has full access to all resources including the right to delegate access to others.", "reference": null, "references": [], "note": "There are several versions of this question in the exam. The question has two possible correct answers:\n✑\n Assign User1 the User Access Administrator role for VNet1.\n✑\n Assign User1 the Owner role for VNet1.\nOther incorrect answer options you may see on the exam include the following:\n✑\n Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor\nrole for Subscription1.\n✑\n Remove User1 from the Security Reader and Reader roles for Subscription1.\n✑\n Assign User1 the Network Contributor role for RG1.\nReferences:\nhttps://docs.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles\nhttps://docs.microsoft.com/en-us/azure/role-based-access-control/overview", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 95, "pdfId": 95, "exam": "AZ-104", "type": "dropdown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/95" }, "markersInGap": [ 95 ], "questionText": "HOTSPOT -\nYou configure the custom role shown in the following exhibit.\n Use the drop-down menus to select the answer choice that completes each statement based on the information\npresented in the graphic.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You configure the custom role shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: dataActions -\nAn array of strings that specifies the data plane actions that the role allows to be performed to your data\nwithin that object.\nassignableScopes: An array of strings that specifies the scopes that the role is available for assignment.\nhttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-definitions.\nBox 2: assignableScopes -\nAzure role-based access control (Azure RBAC) is the authorization system you use to manage access to Azure\nresources. To grant access, you assign roles to users, groups, service principals, or managed identities at a\nparticular scope.\nWhen you assign roles, you must specify a scope. Scope is the set of resources the access applies to. In Azure,\nyou can specify a scope at four levels from broad to narrow: management group, subscription, resource group,\nand resource.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-windows\nhttps://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles\nhttps://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-windows", "https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles", "https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 96, "pdfId": 96, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/96" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains a storage account named storage1. The storage1 account contains a\nfile share named share1.\nThe subscription is linked to a hybrid Azure Active Directory (Azure AD) tenant that contains a security group\nnamed Group1.\nYou need to grant Group1 the Storage File Data SMB Share Elevated Contributor role for share1.\nWhat should you do first?\nA.\nEnable Active Directory Domain Service (AD DS) authentication for storage1.\nB.\nGrant share-level permissions by using File Explorer.\nC.\nMount share1 by using File Explorer.\nD.\nCreate a private endpoint.", "stem": "You have an Azure subscription that contains a storage account named storage1. The storage1 account contains a file share named share1. The subscription is linked to a hybrid Azure Active Directory (Azure AD) tenant that contains a security group named Group1. You need to grant Group1 the Storage File Data SMB Share Elevated Contributor role for share1. What should you do first", "options": [ { "key": "A", "text": "Enable Active Directory Domain Service (AD DS) authentication for storage1." }, { "key": "B", "text": "Grant share-level permissions by using File Explorer." }, { "key": "C", "text": "Mount share1 by using File Explorer." }, { "key": "D", "text": "Create a private endpoint." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Before you enable Azure AD over SMB for Azure file shares, make sure you have completed the following\nprerequisites:\n1. Select or create an Azure AD tenant.\n2. To support authentication with Azure AD credentials, you must enable Azure AD Domain Services for your\nAzure AD tenant.\nEtc.", "reference": "https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-domain-\nservice-enable\nYou have 15 Azure subscriptions.", "references": [ "https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-domain-" ], "note": "The Storage File Data SMB Share Elevated Contributor allows read, write, delete and modify NTFS\npermissions in Azure Storage file shares over SMB.\nReference:\nhttps://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-domain-\nservice-enable", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 97, "pdfId": 97, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/97" }, "markersInGap": [], "questionText": "You have an Azure Active Directory (Azure AD) tenant that contains a security group named Group1.\nYou plan to purchase additional Azure subscription.\nYou need to ensure that Group1 can manage role assignments for the existing subscriptions and the planned\nsubscriptions. The solution must meet the following requirements:\n✑\n Use the principle of least privilege.\n✑\n Minimize administrative effort.\nWhat should you do?\nA.\nAssign Group1 the Owner role for the root management group.\nB.\nAssign Group1 the User Access Administrator role for the root management group.\nC.\nCreate a new management group and assign Group1 the User Access Administrator role for the group.\nD.\nCreate a new management group and assign Group1 the Owner role for the group.", "stem": "You have an Azure Active Directory (Azure AD) tenant that contains a security group named Group1. You plan to purchase additional Azure subscription. You need to ensure that Group1 can manage role assignments for the existing subscriptions and the planned subscriptions. The solution must meet the following requirements: ✑ Use the principle of least privilege. ✑ Minimize administrative effort. What should you do", "options": [ { "key": "A", "text": "Assign Group1 the Owner role for the root management group." }, { "key": "B", "text": "Assign Group1 the User Access Administrator role for the root management group." }, { "key": "C", "text": "Create a new management group and assign Group1 the User Access Administrator role for the group." }, { "key": "D", "text": "Create a new management group and assign Group1 the Owner role for the group." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "The User Access Administrator role is the required role to manage role assignments using the least privileged\nmodel. The Owner role provides more elevated privileges than required and does not follow the least\nprivileged model making answers A and D incorrect. Per requirements\n✑\n Use the principle of least privilege\nand\n✑\n Minimize administrative effort, assigning Group1 the User Access Administrator role for the root\nmanagement group satisfies both requirements. It allows for all subscriptions (current and planned) to inherit\nthe permissions granted to Group1. C is incorrect because in addition to creating a new management group\nand assigning Group1 the User Access Administrator role for the group you will have to move the current\nsubscriptions and newly planned subscriptions to the new management group that you created. This does not\nsatisfy the\n✑\n Minimize administrative effort requirement.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 98, "pdfId": 98, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/98" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Tenant Root Group, ManagementGroup1, Subscription1, RG1, and VM1\nOnce your business rules have been formed, the policy definition or initiative is assigned to any scope of\nresources that Azure supports, such as management groups, subscriptions, resource groups, or individual\nresources.", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview" ], "note": "Azure provides four levels of scope: management groups, subscriptions, resource groups, and\nresources. The following image shows an example of these layers.\nBox 2: ManagementGroup1, Subscription1, RG1, and VM1\nYou can exclude a subscope from the assignment.\nReference:\nhttps://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 99, "pdfId": 99, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/99" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription that contains the following users in an Azure Active Directory tenant named\ncontoso.onmicrosoft.com:\nUser1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.\nYou need to create new user accounts in external.contoso.onmicrosoft.com.\nSolution: You instruct User2 to create the user accounts.\nDoes that meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com: User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com. You need to create new user accounts in external.contoso.onmicrosoft.com. Solution: You instruct User2 to create the user accounts. Does that meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "After User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com, User-1\nbecomes owner and Global Administrator of external.contoso.onmicrosoft.com.\nBUT User-2 doesn't have any authorization in new tenant. User-2's Global Administrator Role applies to", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 100, "pdfId": 100, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/100" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription that contains the following users in an Azure Active Directory tenant named\ncontoso.onmicrosoft.com:\nUser1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.\nYou need to create new user accounts in external.contoso.onmicrosoft.com.\nSolution: You instruct User4 to create the user accounts.\nDoes that meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com: User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com. You need to create new user accounts in external.contoso.onmicrosoft.com. Solution: You instruct User4 to create the user accounts. Does that meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "when you create a new tenant, the creator is the only global admin and owner, he must first give access to\nothers to allow anything.\nhttps://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-access-create-new-\ntenant#your-user-account-in-the-new-tenant", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 101, "pdfId": 101, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/101" }, "markersInGap": [ 100, 101 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription that contains the following users in an Azure Active Directory tenant named\ncontoso.onmicrosoft.com:\n User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.\nYou need to create new user accounts in external.contoso.onmicrosoft.com.\nSolution: You instruct User3 to create the user accounts.\nDoes that meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com: User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com. You need to create new user accounts in external.contoso.onmicrosoft.com. Solution: You instruct User3 to create the user accounts. Does that meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Only a global administrator can add users to this tenant.", "reference": "https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/add-users-to-azure-ad", "references": [ "https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/add-users-to-azure-ad" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 102, "pdfId": 102, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/102" }, "markersInGap": [], "questionText": "You have two Azure subscriptions named Sub1 and Sub2.\nAn administrator creates a custom role that has an assignable scope to a resource group named RG1 in Sub1.\nYou need to ensure that you can apply the custom role to any resource group in Sub1 and Sub2. The solution must\nminimize administrative effort.\nWhat should you do?\nA.\nSelect the custom role and add Sub1 and Sub2 to the assignable scopes. Remove RG1 from the assignable\nscopes.\nB.\nCreate a new custom role for Sub1. Create a new custom role for Sub2. Remove the role from RG1.\nC.\nCreate a new custom role for Sub1 and add Sub2 to the assignable scopes. Remove the role from RG1.\nD.\nSelect the custom role and add Sub1 to the assignable scopes. Remove RG1 from the assignable scopes.\nCreate a new custom role for Sub2.", "stem": "You have two Azure subscriptions named Sub1 and Sub2. An administrator creates a custom role that has an assignable scope to a resource group named RG1 in Sub1. You need to ensure that you can apply the custom role to any resource group in Sub1 and Sub2. The solution must minimize administrative effort. What should you do", "options": [ { "key": "A", "text": "Select the custom role and add Sub1 and Sub2 to the assignable scopes. Remove RG1 from the assignable scopes." }, { "key": "B", "text": "Create a new custom role for Sub1. Create a new custom role for Sub2. Remove the role from RG1." }, { "key": "C", "text": "Create a new custom role for Sub1 and add Sub2 to the assignable scopes. Remove the role from RG1." }, { "key": "D", "text": "Select the custom role and add Sub1 to the assignable scopes. Remove RG1 from the assignable scopes. Create a new custom role for Sub2." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Can be used as:\n\"AssignableScopes\": [\n\"/subscriptions/ Sub1 \",\n\"/subscriptions/ Sub2 \",", "reference": "https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles", "references": [ "https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles" ], "note": "Custom role example:\nThe following shows what a custom role looks like as displayed using Azure PowerShell in JSON format. This\ncustom role can be used for monitoring and restarting virtual machines.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 103, "pdfId": 103, "exam": "AZ-104", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/103" }, "markersInGap": [ 103 ], "questionText": "You have an Azure Subscription that contains a storage account named storageacct1234 and two users named\nUser1 and User2.\nYou assign User1 the roles shown in the following exhibit.\n Which two actions can User1 perform? Each correct answer presents a complete solution.\nNOTE: Each correct selection is worth one point.\nA.\nAssign roles to User2 for storageacct1234.\nB.\nUpload blob data to storageacct1234.\nC.\nModify the firewall of storageacct1234.\nD.\nView blob data in storageacct1234.\nE.\nView file shares in storageacct1234.", "stem": "You have an Azure Subscription that contains a storage account named storageacct1234 and two users named User1 and User2. You assign User1 the roles shown in the following exhibit. Which two actions can User1 perform? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "Assign roles to User2 for storageacct1234." }, { "key": "B", "text": "Upload blob data to storageacct1234." }, { "key": "C", "text": "Modify the firewall of storageacct1234." }, { "key": "D", "text": "View blob data in storageacct1234." }, { "key": "E", "text": "View file shares in storageacct1234." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Upload blob data to storageacct1234: User1 has been assigned the “Storage Blob Data Contributor” role for\nthe storage account named storageacct1234. This role allows them to upload data to blob containers within\nthat storage account.\nView blob data in storageacct1234: Additionally, User1 has the “Reader” role at the Resource group (inherited)\nscope. While this role doesn’t provide read permissions to data in Azure Storage, it does allow User1 to view\nstorage account resources, including blob containers. Therefore, User1 can view blob data within the\nstorageacct1234 storage account.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 104, "pdfId": 104, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/104" }, "markersInGap": [ 104 ], "questionText": "You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named\nWorkspace1.\nYou need to view the error events from a table named Event.\nWhich query should you run in Workspace1?\nA.\nselect * from Event where EventType == \"error\"\nB.\nEvent | search \"error\"\nC.\nEvent | where EventType is \"error\"\nD.\nGet-Event Event | where\n$_.EventType == \"error\"", "stem": "You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1. You need to view the error events from a table named Event. Which query should you run in Workspace1", "options": [ { "key": "A", "text": "select * from Event where EventType == \"error\"" }, { "key": "B", "text": "Event | search \"error\"" }, { "key": "C", "text": "Event | where EventType is \"error\"" }, { "key": "D", "text": "Get-Event Event | where $_.EventType == \"error\"" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Both B & C are OK, other possibilities are:\n1) Event | search \"Error\"\n2) Event | where eventType = \"Error\"\n3) Search in (Event) \"Error\"", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 105, "pdfId": 106, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/106" }, "markersInGap": [], "questionText": "You have an Azure App Services web app named App1.\nYou plan to deploy App1 by using Web Deploy.\nYou need to ensure that the developers of App1 can use their Azure AD credentials to deploy content to App1. The\nsolution must use the principle of least privilege.\nWhat should you do?\nA.\nAssign the Owner role to the developers\nB.\nConfigure app-level credentials for FTPS\nC.\nAssign the Website Contributor role to the developers\nD.\nConfigure user-level credentials for FTPS", "stem": "You have an Azure App Services web app named App1. You plan to deploy App1 by using Web Deploy. You need to ensure that the developers of App1 can use their Azure AD credentials to deploy content to App1. The solution must use the principle of least privilege. What should you do", "options": [ { "key": "A", "text": "Assign the Owner role to the developers" }, { "key": "B", "text": "Configure app-level credentials for FTPS" }, { "key": "C", "text": "Assign the Website Contributor role to the developers" }, { "key": "D", "text": "Configure user-level credentials for FTPS" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C. Assign the Website Contributor role to the developers.\nAssigning the Website Contributor role to the developers would grant them the necessary permissions to\ndeploy content to the Azure App Services web app (App1) without giving them excessive privileges. This role\nprovides the necessary permissions for managing the website, including deployment, without granting\nownership or administrative rights, thus adhering to the principle of least privilege.", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 106, "pdfId": 105, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/105" }, "markersInGap": [ 105, 106 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure Active Directory (Azure AD) tenant named contoso.com.\nYou have a CSV file that contains the names and email addresses of 500 external users.\nYou need to create a guest user account in contoso.com for each of the 500 external users.\nSolution: From Azure AD in the Azure portal, you use the Bulk invite users operation.\n Does this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Active Directory (Azure AD) tenant named contoso.com. You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: From Azure AD in the Azure portal, you use the Bulk invite users operation. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "The\nBulk invite users\n operation is the specific feature designed to handle large-scale onboarding of external\n(B2B) guest users.\nCSV Integration:\n The Azure portal provides a downloadable CSV template specifically for this purpose. You\ncan populate this template with the names and email addresses of your 500 external users.\nAutomation:\n Instead of manually inviting users one by one, you upload the completed CSV. Azure AD then\nprocesses the file and sends invitation emails to all 500 users simultaneously.\nEfficiency:\n This is the most efficient manual method within the Azure portal to handle hundreds of guest\naccounts at once.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 107, "pdfId": 107, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/107" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Role3: Role1 and built-in Azure AD roles only.\nRole4: Role2 only\nThere's a difference between Built-in AD roles and Built-in Subscription roles.\n**Built-in AD roles can't be cloned, but built-in subscription roles can be. Custom roles of either type can be\ncloned.**\nTo clone the Bulit-in subscription Role, you open the subscription or the Resource group where you want to\ncreate the custom role and assign the permissions --> Go to Access Control (IAM) --> Roles tab --> Search for\nthe subscription Role then clone it from the three dots in the right of the role.", "reference": "https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles-portal", "references": [ "https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles-portal" ], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 108, "pdfId": 108, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/108" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Reader and Data Access\":\n\"Lets you view everything but will not let you delete or create a storage account or contained resource. It will\nalso allow read/write access to all data contained in a storage account via access to storage account keys.\"\n\"Owner\" is needed to manage permissions, as \"User Access Administrator\" is not offered as an option.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 109, "pdfId": 109, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/109" }, "markersInGap": [ 109 ], "questionText": "You have an Azure subscription that contains 10 virtual machines, a key vault named Vault1, and a network security\ngroup (NSG) named NSG1. All the resources are deployed to the East US Azure region.\nThe virtual machines are protected by using NSG1. NSG1 is configured to block all outbound traffic to the internet.\n You need to ensure that the virtual machines can access Vault1. The solution must use the principle of least\nprivilege and minimize administrative effort\nWhat should you configure as the destination of the outbound security rule for NSG1?\nA.\nan application security group\nB.\na service tag\nC.\nan IP address range", "stem": "You have an Azure subscription that contains 10 virtual machines, a key vault named Vault1, and a network security group (NSG) named NSG1. All the resources are deployed to the East US Azure region. The virtual machines are protected by using NSG1. NSG1 is configured to block all outbound traffic to the internet. You need to ensure that the virtual machines can access Vault1. The solution must use the principle of least privilege and minimize administrative effort What should you configure as the destination of the outbound security rule for NSG1", "options": [ { "key": "A", "text": "an application security group" }, { "key": "B", "text": "a service tag" }, { "key": "C", "text": "an IP address range" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. a service tag.\nIn order to ensure that the virtual machines can access Vault1 while also using the principle of least privilege\nand minimizing administrative effort, you should configure a service tag as the destination of the outbound\nsecurity rule for NSG1. Service tags represent a group of IP addresses associated with Azure PaaS and SaaS\nservices. By specifying a service tag as the destination of the outbound security rule, you can allow the virtual\nmachines to access Vault1 without having to manually specify the IP addresses of Vault1. This reduces\nadministrative effort and ensures that the virtual machines are only able to access Vault1, rather than any\nother internet destination.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 110, "pdfId": 110, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/110" }, "markersInGap": [ 110 ], "questionText": "You have an Azure AD tenant named adatum.com that contains the groups shown in the following table.\nAdatum.com contains the users shown in the following table.\nYou assign the Azure Active Directory Premium Plan 2 license to Group1 and User4.\nWhich users are assigned the Azure Active Directory Premium Plan 2 license?\nA.\nUser4 only\nB.\nUser1 and User4 only\nC.\nUser1, User2, and User4 only\n D.\nUser1, User2, User3, and User4", "stem": "You have an Azure AD tenant named adatum.com that contains the groups shown in the following table. Adatum.com contains the users shown in the following table. You assign the Azure Active Directory Premium Plan 2 license to Group1 and User4. Which users are assigned the Azure Active Directory Premium Plan 2 license", "options": [ { "key": "A", "text": "User4 only" }, { "key": "B", "text": "User1 and User4 only" }, { "key": "C", "text": "User1, User2, and User4 only" }, { "key": "D", "text": "User1, User2, User3, and User4" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "User1 and User4 only.\nhttps://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/licensing-group-advanced\n\"Group-based licensing currently doesn't support groups that contain other groups (nested groups). If you\napply a license to a nested group, only the immediate first-level user members of the group have the licenses\napplied.\"", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 111, "pdfId": 111, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/111" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "N Litware is not a connected organization\nN expired, not remove\nY 365 + 30 = 395 removed\nhttps://learn.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-external-\nusers\nYou can select what happens when an external user, who was invited to your directory through making an\naccess package request, no longer has any access package assignments. This can happen if the user\nrelinquishes all their access package assignments, or their last access package assignment expires. By\ndefault, when an external user no longer has any access package assignments, they're blocked from signing\nin to your directory. After 30 days, their guest user account is removed from your directory.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 112, "pdfId": 112, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/112" }, "markersInGap": [], "questionText": "If you want to remove the guest user account in this directory, you can set the number of days before it's\nremoved. If you want to remove the guest user account as soon as they lose their last assignment to any\naccess packages, set Number of days before removing external user from this directory to 0.\nhttps://learn.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-external-\nusers\nYou have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a\nresource group named RG1.\nSubscription1 has a user named User1. User1 has the following roles:\n• Reader\n• Security Admin\n• Security Reader\nYou need to ensure that User1 can assign the Reader role for VNet1 to other users.\nWhat should you do?\nA.\nAssign User1 the Network Contributor role for VNet1.\nB.\nRemove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.\nC.\nAssign User1 the Owner role for VNet1.\nD.\nAssign User1 the Network Contributor role for RG1.", "stem": "If you want to remove the guest user account in this directory, you can set the number of days before it's removed. If you want to remove the guest user account as soon as they lose their last assignment to any access packages, set Number of days before removing external user from this directory to 0. https://learn.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-external- users You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1. Subscription1 has a user named User1. User1 has the following roles: • Reader • Security Admin • Security Reader You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do", "options": [ { "key": "A", "text": "Assign User1 the Network Contributor role for VNet1." }, { "key": "B", "text": "Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1." }, { "key": "C", "text": "Assign User1 the Owner role for VNet1." }, { "key": "D", "text": "Assign User1 the Network Contributor role for RG1." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C. Assign User1 the Owner role for VNet1.\nUser1 currently has the following roles:\nReader: Can view resources but cannot modify or assign roles.\nSecurity Admin: Can manage security policies but cannot assign roles.\nSecurity Reader: Can view security-related information but cannot assign roles.\nTo allow User1 to assign the Reader role for VNet1 to other users, User1 must have RBAC permissions to grant\nroles. This requires the Owner or User Access Administrator role.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 113, "pdfId": 113, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/113" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1. No, role assignments do not automatically propagate to nested groups in Azure. Azure Role-Based Access\nControl (RBAC) does not support the automatic inheritance of role assignments for nested groups.\n2. No, a Microsoft 365 group cannot be a member of a security group in Azure AD. Microsoft 365 groups\n(formerly known as Office 365 groups) are designed primarily for collaboration purposes and integrate with\ntools like Outlook, Teams, SharePoint, and others. They are different from security groups, which are used for\nmanaging permissions to resources within Azure and other Microsoft services.\n3.Yes, a Microsoft 365 group can be assigned as the owner of a resource group in Azure. In Azure Role-Based\nAccess Control (RBAC), you can assign roles, including the \"Owner\" role, to users, security groups, or\nMicrosoft 365 groups.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 114, "pdfId": 114, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/114" }, "markersInGap": [], "questionText": "You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a\nresource group named RG1.\nSubscription1 has a user named User1. User1 has the following roles:\n• Reader\n• Security Admin\n• Security Reader\nYou need to ensure that User1 can assign the Reader role for VNet1 to other users.\nWhat should you do?\nA.\nRemove User1 from the Security Reader role for Subscript on 1. Assign User1 the Contributor role for RG1.\nB.\nAssign User1 the Owner role for VNet1.\nC.\nRemove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor\nrole for Subscription 1.\nD.\nAssign User1 the Contributor role for VNet1.", "stem": "You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1. Subscription1 has a user named User1. User1 has the following roles: • Reader • Security Admin • Security Reader You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do", "options": [ { "key": "A", "text": "Remove User1 from the Security Reader role for Subscript on 1. Assign User1 the Contributor role for RG1." }, { "key": "B", "text": "Assign User1 the Owner role for VNet1." }, { "key": "C", "text": "Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription 1." }, { "key": "D", "text": "Assign User1 the Contributor role for VNet1." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. Assign User1 the Owner role for VNet1.\nUser1 currently has the following roles:\nReader: Can view resources but cannot modify or assign roles.\nSecurity Admin: Can manage security policies but cannot assign roles.\nSecurity Reader: Can view security-related information but cannot assign roles.\nTo allow User1 to assign the Reader role for VNet1 to other users, User1 must have permission to manage\nRBAC (role-based access control) assignments. This requires the Owner or User Access Administrator role.\nYour on-premises network contains a VPN gateway.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 115, "pdfId": 115, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/115" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\nYou need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network.\nWhat should you configure?\nA.\nAzure Application Gateway\nB.\nprivate endpoints\nC.\na network security group (NSG)\nD.\nAzure Virtual WAN", "stem": "You have an Azure subscription that contains the resources shown in the following table. You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network. What should you configure", "options": [ { "key": "A", "text": "Azure Application Gateway" }, { "key": "B", "text": "private endpoints" }, { "key": "C", "text": "a network security group (NSG)" }, { "key": "D", "text": "Azure Virtual WAN" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Private endpoints are used to provide secure and private connectivity from a virtual network to Azure storage.\nWhen you configure a private endpoint, a private IP address is assigned to the storage account within the\nvirtual network. All traffic to the storage account goes over the Microsoft backbone network, rather than over\nthe public internet, providing increased security and reliability. By configuring a private endpoint for the\nstorage account in this scenario, you can ensure that all the traffic from VM1 to storage1 travels across the\nMicrosoft backbone network.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 116, "pdfId": 116, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/116" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "YES, No, Yes\n(YES)User1 can create a storage account in RG1, since User1 has Storage Account Contribute Role inherited\nfrom Resource Group.\n(NO) User1 can modify the DNS settings of networkinterface1, since it requires Network Contribute role\nreferring to the following link.\nhttps://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface?tabs=network-\ninterface-portal#permissions\n(YES) User1 can create an inbound security rule to filter inbound traffic to networkinterface1, since User1 has\nContributor role for NSG1", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 117, "pdfId": 117, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/117" }, "markersInGap": [], "questionText": "You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a\nresource group named RG1.\nSubscription1 has a user named User1. User1 has the following roles:\n• Reader\n• Security Admin\n• Security Reader\nYou need to ensure that User1 can assign the Reader role for VNet1 to other users.\nWhat should you do?\nA.\nRemove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.\nB.\nAssign User1 the Access Administrator role for VNet1.\nC.\nRemove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor\nrole for Subscription1.\nD.\nAssign User1 the Network Contributor role for RG1.", "stem": "You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1. Subscription1 has a user named User1. User1 has the following roles: • Reader • Security Admin • Security Reader You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do", "options": [ { "key": "A", "text": "Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1." }, { "key": "B", "text": "Assign User1 the Access Administrator role for VNet1." }, { "key": "C", "text": "Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1." }, { "key": "D", "text": "Assign User1 the Network Contributor role for RG1." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. Assign User1 the Access Administrator role for VNet1.\nUser1 currently has the following roles:\nReader: Can view resources but cannot modify or assign roles.\nSecurity Admin: Can manage security policies but cannot assign roles.\nSecurity Reader: Can view security-related information but cannot assign roles.\nTo assign roles to other users, User1 must have permission to manage access control (RBAC). This requires the\n\"User Access Administrator\" role, which is often referred to as Access Administrator.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 118, "pdfId": 118, "exam": "AZ-104", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/118" }, "markersInGap": [ 117, 118 ], "questionText": "HOTSPOT\n-\nYou have three Azure subscriptions named Sub1, Sub2, and Sub3 that are linked to an Azure AD tenant.\nThe tenant contains a user named User1, a security group named Group1, and a management group named MG1.\nUser is a member of Group1.\nSub1 and Sub2 are members of MG1. Sub1 contains a resource group named RG1. RG1 contains five Azure\nfunctions.\nYou create the following role assignments for MG1:\n•Group1: Reader\n•User1: User Access Administrator\n You assign User the Virtual Machine Contributor role for Sub1 and Sub2.", "stem": "You have three Azure subscriptions named Sub1, Sub2, and Sub3 that are linked to an Azure AD tenant. The tenant contains a user named User1, a security group named Group1, and a management group named MG1. User is a member of Group1. Sub1 and Sub2 are members of MG1. Sub1 contains a resource group named RG1. RG1 contains five Azure functions. You create the following role assignments for MG1: •Group1: Reader •User1: User Access Administrator You assign User the Virtual Machine Contributor role for Sub1 and Sub2.", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "YYN.\n1) GROUP1 Reader access, provides access to view all items, except secrets\nhttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#reader\n2) To Assign OWNER role, you need to either Owner role or User Administrator Access Role\nhttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal-subscription-\nadmin#prerequisites\n3) Neither User Access Admin Role nor the Reader Role allows to create new resources.\nhttps://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-steps", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 119, "pdfId": 119, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/119" }, "markersInGap": [ 119 ], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\n You need to assign User1 the Storage File Data SMB Share Contributor role for share1.\nWhat should you do first?\nA.\n Enable identity-based data access for the file shares in storage1.\nB.\n Modify the security profile for the file shares in storage1.\nC.\n Select Default to Azure Active Directory authorization in the Azure portal for storage1.\nD.\n Configure Access control (IAM) for share1.", "stem": "You have an Azure subscription that contains the resources shown in the following table. You need to assign User1 the Storage File Data SMB Share Contributor role for share1. What should you do first", "options": [ { "key": "A", "text": "Enable identity-based data access for the file shares in storage1." }, { "key": "B", "text": "Modify the security profile for the file shares in storage1." }, { "key": "C", "text": "Select Default to Azure Active Directory authorization in the Azure portal for storage1." }, { "key": "D", "text": "Configure Access control (IAM) for share1." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A.Enable identity-based data access for the file shares in storage1.\nEnabling identity-based data access for file shares is a prerequisite for assigning roles like the Storage File\nData SMB Share Contributor role. Without enabling this feature, Azure AD authentication and authorization\nfor accessing file shares would not be possible.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 120, "pdfId": 120, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/120" }, "markersInGap": [], "questionText": "You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a\nresource group named RG1.\nSubscription1 has a user named User1. User1 has the following roles:\n• Reader\n• Security Admin\n• Security Reader\nYou need to ensure that User1 can assign the Reader role for VNet1 to other users.\nWhat should you do?\nA.\nRemove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.\nB.\nAssign User1 the User Access Administrator role for VNet1.\nC.\nRemove User1 from the Security Reader and Reader roles for Subscription1.\nD.\nAssign User1 the Contributor role for VNet1.", "stem": "You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1. Subscription1 has a user named User1. User1 has the following roles: • Reader • Security Admin • Security Reader You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do", "options": [ { "key": "A", "text": "Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1." }, { "key": "B", "text": "Assign User1 the User Access Administrator role for VNet1." }, { "key": "C", "text": "Remove User1 from the Security Reader and Reader roles for Subscription1." }, { "key": "D", "text": "Assign User1 the Contributor role for VNet1." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. Assign User1 the User Access Administrator role for VNet1.\nUser1 currently has the following roles:\nReader\n→\n Can view resources but cannot modify or assign roles.\nSecurity Admin\n→\n Can manage security policies but cannot assign roles.\nSecurity Reader\n→\n Can view security-related information but cannot assign roles.\nTo assign the Reader role for VNet1 to other users, User1 must have permission to manage role assignments\n(RBAC).\nThis requires the \"User Access Administrator\" role, which allows users to assign roles without granting full\nownership permissions.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 121, "pdfId": 121, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/121" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "YNN\n1) Y, You can assign users MS Defender for Cloud Apps on a per user basis.\n2) N, You cannot remove the P2 license as User1 is in Group1.\n3) N, nested group assignments don't work", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 122, "pdfId": 122, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/122" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "JobTitle :\nUser1 and User3 only.\nThis means only User1 and User3 are associated with the job title, excluding User2.\nUsageLocation :\nUser1, User2, and User3\n.\nThis means all three users (User1, User2, and User3) are associated with the UsageLocation field.", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 123, "pdfId": 123, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/123" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure Active Directory (Azure AD) tenant named contoso.com.\nYou have a CSV file that contains the names and email addresses of 500 external users.\nYou need to create a guest user account in contoso.com for each of the 500 external users.\nSolution: You create a PowerShell script that runs the New-MgUser cmdlet for each external user.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Active Directory (Azure AD) tenant named contoso.com. You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: You create a PowerShell script that runs the New-MgUser cmdlet for each external user. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "New-AzureADMSInvitation or New-MgInvitation can be used to invite users, Not New-MgUser\nhttps://learn.microsoft.com/en-us/powershell/microsoftgraph/azuread-msoline-cmdlet-map?view=graph-\npowershell-1.0#users", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 124, "pdfId": 124, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/124" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure Active Directory (Azure AD) tenant named contoso.com.\nYou have a CSV file that contains the names and email addresses of 500 external users.\nYou need to create a guest user account in contoso.com for each of the 500 external users.\nSolution: You create a PowerShell script that runs the New-MgInvitation cmdlet for each external user.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Active Directory (Azure AD) tenant named contoso.com. You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: You create a PowerShell script that runs the New-MgInvitation cmdlet for each external user. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "New-AzureADMSInvitation or New-MgInvitation can be used to invite users, Not New-MgUser\nhttps://learn.microsoft.com/en-us/powershell/microsoftgraph/azuread-msoline-cmdlet-map?view=graph-\npowershell-1.0#users\nhttps://learn.microsoft.com/en-us/azure/active-directory/external-identities/bulk-invite-powershell#send-\nbulk-invitations describes exactly the same task required by this question, and the proposed script uses New-\nAzureADMSInvitation cmdlet. But page https://learn.microsoft.com/en-\nus/powershell/microsoftgraph/overview?view=graph-powershell-1.0 says: \"Microsoft Graph PowerShell is the\nreplacement for the Azure AD PowerShell and MSOnline modules and is recommended for interacting with\nAzure AD.\". By searching the Microsoft Graph PowerShell command equivalent of New-AzureADMSInvitation\nin this page https://learn.microsoft.com/en-us/powershell/microsoftgraph/azuread-msoline-cmdlet-map?\nview=graph-powershell-1.0#users I find the command New-MgInvitation. So my reply to this question is \"A\" :\nyes.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 125, "pdfId": 125, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/125" }, "markersInGap": [], "questionText": "You have an Azure subscription named Subscription1 that contains virtual network named VNet1. VNet1 is in a\nresource group named RG1.\nA user named User1 has the following roles for Subscription1:\n•Reader\n•Security Admin\n•Security Reader\nYou need to ensure that User1 can assign the Reader role for VNet1 to other users.\nWhat should you do?\nA.\nAssign User1 the Contributor role for VNet1.\nB.\nAssign User1 the Network Contributor role for VNet1.\nC.\nAssign User1 the User Access Administrator role for VNet1.\nD.\nRemove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role\nfor Subscription1.", "stem": "You have an Azure subscription named Subscription1 that contains virtual network named VNet1. VNet1 is in a resource group named RG1. A user named User1 has the following roles for Subscription1: •Reader •Security Admin •Security Reader You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do", "options": [ { "key": "A", "text": "Assign User1 the Contributor role for VNet1." }, { "key": "B", "text": "Assign User1 the Network Contributor role for VNet1." }, { "key": "C", "text": "Assign User1 the User Access Administrator role for VNet1." }, { "key": "D", "text": "Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Network Contributor - Lets you manage networks, but not access to them.https://learn.microsoft.com/en-\nus/azure/role-based-access-control/built-in-roles#network-contributorUser Access Administrator - Lets you\nmanage user access to Azure resources.https://learn.microsoft.com/en-us/azure/role-based-access-\ncontrol/built-in-roles#user-access-administratorContributor - Grants full access to manage all resources, but\ndoes not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image\ngalleries.T2Q71 - similar question with another possible solution - Assign User1 the Owner role for VNet1.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 126, "pdfId": 126, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/126" }, "markersInGap": [ 125, 126 ], "questionText": "You have an Azure subscription named Subscription1 that contains virtual network named VNet1. VNet1 is in a\nresource group named RG1.\n User named User1 has the following roles for Subscription1:\n•Reader\n•Security Admin\n•Security Reader\nYou need to ensure that User1 can assign the Reader role for VNet1 to other users.\nWhat should you do?\nA.\nRemove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role\nfor Subscription1.\nB.\nRemove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.\nC.\nAssign User1 the Network Contributor role for VNet1.\nD.\nAssign User1 the User Access Administrator role for VNet1.", "stem": "You have an Azure subscription named Subscription1 that contains virtual network named VNet1. VNet1 is in a resource group named RG1. User named User1 has the following roles for Subscription1: •Reader •Security Admin •Security Reader You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do", "options": [ { "key": "A", "text": "Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1." }, { "key": "B", "text": "Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1." }, { "key": "C", "text": "Assign User1 the Network Contributor role for VNet1." }, { "key": "D", "text": "Assign User1 the User Access Administrator role for VNet1." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Network Contributor - Lets you manage networks, but not access to them.https://learn.microsoft.com/en-\nus/azure/role-based-access-control/built-in-roles#network-contributorUser Access Administrator - Lets you\nmanage user access to Azure resources.https://learn.microsoft.com/en-us/azure/role-based-access-\ncontrol/built-in-roles#user-access-administratorOnly User Access Administrator or Owner could assign roles\nto other users.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 127, "pdfId": 127, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/127" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Blob Storage Selection:\nThe selected option is \"Azure AD and shared access signatures (SAS)\".\nThis means both Azure Active Directory (Azure AD) authentication and SAS tokens can be used to access the\nblob storage.\nAzure AD provides identity-based authentication, while SAS tokens provide temporary, delegated access.\nFile Storage Selection:\nThe selected option is \"Shared access signatures (SAS) only\".\nThis indicates that only SAS tokens can be used to access the file storage, and Azure AD authentication is not\nenabled for this resource.", "reference": null, "references": [], "note": "Each correct answer is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 128, "pdfId": 128, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/128" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Identities Section (Mail)\nThe Identities field shows \"mail\", indicating that the user is authenticated using their email identity.\nThis means the external user is using their email-based authentication (possibly via Microsoft, Google, or\nanother identity provider) to access the organization's resources.\nB2B Collaboration\nIn the bottom right, the tag \"B2B collaboration\" is visible.\nB2B collaboration is a feature in Azure AD that allows organizations to securely share applications and\nservices with users from other organizations.\nExternal users are typically added via guest invitations and can use their existing credentials from their home\norganization to sign in.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 129, "pdfId": 129, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/129" }, "markersInGap": [ 129 ], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\n You need to assign Workspace1 a role to allow read, write, and delete operations for the data stored in the\ncontainers of storage1.\nWhich role should you assign?\nA.\nStorage Account Contributor\nB.\nContributor\nC.\nStorage Blob Data Contributor\nD.\nReader and Data Access", "stem": "You have an Azure subscription that contains the resources shown in the following table. You need to assign Workspace1 a role to allow read, write, and delete operations for the data stored in the containers of storage1. Which role should you assign", "options": [ { "key": "A", "text": "Storage Account Contributor" }, { "key": "B", "text": "Contributor" }, { "key": "C", "text": "Storage Blob Data Contributor" }, { "key": "D", "text": "Reader and Data Access" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Storage Blob Data Contributor.\nThis role specifically grants permissions to read, write, and delete blobs in Azure Storage containers.\nIt does not allow managing the storage account settings but provides full control over the stored data, which\nis exactly what is required in the question.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 130, "pdfId": 130, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/130" }, "markersInGap": [ 130 ], "questionText": "You have an Azure subscription named Subscription1 that contains virtual network named VNet1. VNet1 is in a\nresource group named RG1.\nA user named User1 has the following roles for Subscription1:\n•Reader\n•Security Admin\n•Security Reader\nYou need to ensure that User1 can assign the Reader role for VNet1 to other users.\nWhat should you do?\nA.\nRemove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role\nfor Subscription1.\nB.\nAssign User1 the Contributor role for VNet1.\nC.\nAssign User1 the Owner role for VNet1.\nD.\nAssign User1 the Network Contributor role for RG1.", "stem": "You have an Azure subscription named Subscription1 that contains virtual network named VNet1. VNet1 is in a resource group named RG1. A user named User1 has the following roles for Subscription1: •Reader •Security Admin •Security Reader You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do", "options": [ { "key": "A", "text": "Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1." }, { "key": "B", "text": "Assign User1 the Contributor role for VNet1." }, { "key": "C", "text": "Assign User1 the Owner role for VNet1." }, { "key": "D", "text": "Assign User1 the Network Contributor role for RG1." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C. Assign User1 the Owner role for VNet1.\nTo assign roles in Azure, a user needs to have Owner or User Access Administrator permissions. Currently,\nUser1 has the following roles for Subscription1:\nReader\n→\n Can only view resources but cannot assign roles.\nSecurity Admin\n→\n Manages security policies but cannot assign roles.\nSecurity Reader\n→\n Can view security settings but cannot assign roles.\nSince none of these roles provide RBAC (Role-Based Access Control) management permissions, User1 cannot\ncurrently assign the Reader role to others for VNet1.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 131, "pdfId": 131, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/131" }, "markersInGap": [], "questionText": "You have an Azure AD tenant that contains the groups shown in the following table.\nYou purchase Azure Active Directory Premium P2 licenses.\nTo which groups can you assign a license?\nA.\nGroup1 only\nB.\nGroup1 and Group3 only\nC.\nGroup3 and Group4 only\nD.\nGroup1, Group2, and Group3 only\nE.\nGroup1, Group2, Group3, and Group4", "stem": "You have an Azure AD tenant that contains the groups shown in the following table. You purchase Azure Active Directory Premium P2 licenses. To which groups can you assign a license", "options": [ { "key": "A", "text": "Group1 only" }, { "key": "B", "text": "Group1 and Group3 only" }, { "key": "C", "text": "Group3 and Group4 only" }, { "key": "D", "text": "Group1, Group2, and Group3 only" }, { "key": "E", "text": "Group1, Group2, Group3, and Group4" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. Group1 and Group3 only.\nAzure AD licenses can be assigned to user accounts. When you want to assign licenses to a group, the\nintention is to assign those licenses to the members of the group.\nYou can assign licenses to Microsoft 365 groups and security groups, but not to mail-enabled security groups.\nFurthermore, the group should be security-enabled to get the licenses assigned.\nFrom the given list:\nGroup1: Security group (Security Enabled) - You can assign licenses.\nGroup2: Mail-enabled security group (Security Enabled) - You cannot assign licenses to mail-enabled security\ngroups.\nGroup3: Microsoft 365 group (Security Enabled) - You can assign licenses.\nGroup4: Microsoft 365 group (Security Disabled) - You cannot assign licenses to security-disabled groups.", "reference": null, "references": [], "note": "Each correct answer is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 132, "pdfId": 132, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/132" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "First Condition: user.department -\nThe user.department attribute is checked to see if it equals \"Marketing\".\nThis ensures that only users belonging to the Marketing department are considered.\nLogical Operator: and\nThe and operator means both conditions must be true for the rule to apply.\nIf it were or, only one condition would need to be true.\nSecond Condition: user.country -eq \"France\"\nThe user.country attribute is checked to see if it equals \"France\".\nThis ensures that only users located in France are considered.\nhttps://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-\nmembership#operator-precedence", "reference": null, "references": [], "note": "Each correct answer is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 133, "pdfId": 133, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/133" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1.Users can register applications\" (Enabled - \"Yes\")\nThis setting allows regular (non-admin) users to register applications in Azure AD.\nIf enabled (Yes), users can:\nCreate and register Azure AD applications.\nGenerate service principals.\nIntegrate applications with Azure AD authentication.\nSecurity Concern:\nEnabling this could pose security risks if users register applications without oversight.\nOrganizations may disable this setting (No) to restrict application registration to administrators only.\n2. \"Restrict access to Azure AD administration portal\" (Disabled - \"No\")\nThis setting controls whether non-admin users can access the Azure AD admin portal\n(https://aad.portal.azure.com).\nIf set to \"No\" (as shown in the image), all users can access the portal but with limited permissions.\nIf set to \"Yes\", only administrators can access the Azure AD admin portal.\nImplications:\nWith \"No\" (Disabled)\n→\n Regular users can view limited information in Azure AD but cannot make\nadministrative changes.\nWith \"Yes\" (Enabled)\n→\n Blocks non-admin users from accessing the portal entirely.\nSecurity Best Practice:\nIn many organizations, setting this to \"Yes\" (enabled) restricts access to ensure that only administrators can\naccess Azure AD settings.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 134, "pdfId": 134, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/134" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "No\nNo\nYes\nThe conditions are difficult to read, but they mean (according to reference 1):\na. If the user performs a reading operation, then he may only read from “cont1”\nb. If the user performs a writing operation, then he may only write to blobs like “*2*”", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 135, "pdfId": 135, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/135" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure Active Directory (Azure AD) tenant named contoso.com.\nYou have a CSV file that contains the names and email addresses of 500 external users.\nYou need to create a guest user account in contoso.com for each of the 500 external users.\nSolution: You create a PowerShell script that runs the New-MgUser cmdlet for each user.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Active Directory (Azure AD) tenant named contoso.com. You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: You create a PowerShell script that runs the New-MgUser cmdlet for each user. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "New-Mg Invitation' is the command to add external users to the organization.\nInstead use the New-AzureADMSInvitation cmdlet which is used to invite a new external user to your\ndirectory.", "reference": "https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.identity.signins/new-mginvitation?\nview=graph-powershell-1.0", "references": [ "https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.identity.signins/new-mginvitation?" ], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 136, "pdfId": 136, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/136" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "No\nNo\nYes\nI run the ARM template in a lab environment. Before go to the explanation, it's valid to say that there are some\nerrors in the script format and I have to fix it to run successfully.1- It's N, because it creates 4 Resource\nGroups and not 3 Resource Groups (RGS0, RGS1, RGroup4 and ResGrp8);1.1: The Resource Group named with\n\"[concat('RGS', copyIndex())]\", creates RGS0 and RGS1;1.2: The Resource Group named with \"[concat('ResGrp',\n'8')]\", creates ResGrp8;1.3: The Resource Group named with \"[concat('RGroup', length(parameters('obj1')))]\",\ncreates RGroup4 (As we can see, obj1 parameter has a length of 4 'propA', 'propB', 'propC' and 'propD');2 - It's\nN, because it doesn't create a resourcer group named RGroup5;3 - It's Y, because all resource groups were\ncreated in the East US Azure Region.\nYour on-premises network contains a VPN gateway.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 137, "pdfId": 137, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/137" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\nYou need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network.\nWhat should you configure?\nA.\nAzure AD Application Proxy\nB.\nprivate endpoints\nC.\na network security group (NSG)\nD.\nAzure Peering Service", "stem": "You have an Azure subscription that contains the resources shown in the following table. You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network. What should you configure", "options": [ { "key": "A", "text": "Azure AD Application Proxy" }, { "key": "B", "text": "private endpoints" }, { "key": "C", "text": "a network security group (NSG)" }, { "key": "D", "text": "Azure Peering Service" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "A private endpoint is a network interface that uses a private IP address from your virtual network. This\nnetwork interface connects you privately and securely to a service that's powered by Azure Private Link. By\nenabling a private endpoint, you're bringing the service into your virtual\nnetwork.\"https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview\nYour on-premises network contains a VPN gateway.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 138, "pdfId": 138, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/138" }, "markersInGap": [ 137, 138 ], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\nYou need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network.\n What should you configure?\nA.\nAzure AD Application Proxy\nB.\nservice endpoints\nC.\na network security group (NSG)\nD.\nAzure Firewall", "stem": "You have an Azure subscription that contains the resources shown in the following table. You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network. What should you configure", "options": [ { "key": "A", "text": "Azure AD Application Proxy" }, { "key": "B", "text": "service endpoints" }, { "key": "C", "text": "a network security group (NSG)" }, { "key": "D", "text": "Azure Firewall" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "\"Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over an\noptimized route over the Azure backbone network.\n\"https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview\nYour on-premises network contains a VPN gateway.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 139, "pdfId": 139, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/139" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\nYou need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network.\nWhat should you configure?\nA.\nAzure Application Gateway\nB.\nservice endpoints\nC.\na network security group (NSG)\nD.\nAzure Peering Service", "stem": "You have an Azure subscription that contains the resources shown in the following table. You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network. What should you configure", "options": [ { "key": "A", "text": "Azure Application Gateway" }, { "key": "B", "text": "service endpoints" }, { "key": "C", "text": "a network security group (NSG)" }, { "key": "D", "text": "Azure Peering Service" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B: service endpoints.\nService endpoints allow you to secure Azure service resources to your virtual network by extending the\nidentity of your VNet to the service. By doing this, the traffic from your virtual machine (VM1) to the storage\naccount (Storage1) remains within the Microsoft backbone network, rather than traversing the public internet.\nThis ensures secure and fast traffic between your VM and storage account.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 140, "pdfId": 140, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/140" }, "markersInGap": [ 139, 140 ], "questionText": "You have an Azure subscription named Sub1 that contains the resources shown in the following table.\n You create a user named Admin1.\nTo what can you add Admin1 as a co-administrator?\nA.\nRG1\nB.\nMG1\nC.\nSub1\nD.\nVM1", "stem": "You have an Azure subscription named Sub1 that contains the resources shown in the following table. You create a user named Admin1. To what can you add Admin1 as a co-administrator", "options": [ { "key": "A", "text": "RG1" }, { "key": "B", "text": "MG1" }, { "key": "C", "text": "Sub1" }, { "key": "D", "text": "VM1" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "The correct answer is: C. Sub1You can add Admin1 as a co-administrator to the Sub1 subscription.You cannot\nadd Admin1 as a co-administrator to the RG1 resource group, MG1 management group, or VM1 virtual\nmachine.Co-administrators have full access to all resources in a subscription, including the ability to create,\nread, update, and delete resources.To add Admin1 as a co-administrator to Sub1:In the Azure portal, navigate\nto Sub1.Click Access control (IAM).Click Assign role.Select the Co-Administrator role.Select Admin1 in the\nSelect drop-down list.Click Assign.Once the role has been assigned, Admin1 will have full access to all\nresources in Sub1.Note: Co-administrators can only be assigned at the subscription scope. You cannot assign\nco-administrators to resource groups, management groups, or virtual machines.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 141, "pdfId": 141, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/141" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Users = User1, User2, User3, User4 (can delete all users whether a license is assigned directly or via\ninheritance from a group membership)\nGroups = Group 2 and Group 4 only. (Groups with active license assignments cannot be deleted. You get an\nerror)", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 142, "pdfId": 142, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/142" }, "markersInGap": [ 142 ], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\nYou need to ensure that data transfers between storage1 and VM1 do NOT traverse the internet\nWhat should you configure for storage1?\nA.\ndata protection\nB.\na private endpoint\nC.\nPublic network access in the Firewalls and virtual networks settings\n D.\na shared access signature (SAS)", "stem": "You have an Azure subscription that contains the resources shown in the following table. You need to ensure that data transfers between storage1 and VM1 do NOT traverse the internet What should you configure for storage1", "options": [ { "key": "A", "text": "data protection" }, { "key": "B", "text": "a private endpoint" }, { "key": "C", "text": "Public network access in the Firewalls and virtual networks settings" }, { "key": "D", "text": "a shared access signature (SAS)" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B:a private endpoint.\nTo ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network without\ngoing out to the public internet, you should use a private endpoint.\nA private endpoint uses a private IP address from your VNet, effectively bringing the service into your VNet.\nAny traffic between your virtual machine and the storage account will traverse over the VNet and stay on the\nMicrosoft backbone network, without ever leaving it.", "reference": "https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints", "references": [ "https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints" ], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 143, "pdfId": 143, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/143" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "YES: user 1 is contributor to the scope MG2, which is linked to sub3 and contains RG3 and VM1. contributor\nrole can resize vm in its scope.\nNO: User2 is storage account contributor to the storage1 scope only not RG1.\nYES: User3 is user access admin to the scope tenant root group that contains all the subscriptions and\ntherefore sub3 that contains RG3, so he can assign roles to any users and to user1.\nYour on-premises network contains a VPN gateway.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 144, "pdfId": 144, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/144" }, "markersInGap": [ 144 ], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\nYou need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network.\n What should you configure?\nA.\na network security group (NSG)\nB.\nprivate endpoints\nC.\nMicrosoft Entra Application Proxy\nD.\nAzure Virtual WAN", "stem": "You have an Azure subscription that contains the resources shown in the following table. You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network. What should you configure", "options": [ { "key": "A", "text": "a network security group (NSG)" }, { "key": "B", "text": "private endpoints" }, { "key": "C", "text": "Microsoft Entra Application Proxy" }, { "key": "D", "text": "Azure Virtual WAN" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B: private endpoints.\nPrivate endpoints enable you to connect to Azure services privately over a private IP address within your\nvirtual network. By setting up a private endpoint for your storage account (Storage1), all traffic from VM1 to\nthe storage account will travel through the private IP address within the Azure network, ensuring that the\ntraffic remains on the Microsoft backbone network and does not traverse the public internet.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nA.\nCreate groups that use the Assigned membership type.\nB.\nCreate an Azure Resource Manager (ARM) template.\nC.\nCreate groups that use the Dynamic User membership type.\nD.\nWrite a PowerShell script that parses an import file.\nE.\nCreate an XML file that contains user information and the appropriate attributes.\nF.\nCreate a CSV file that contains user information and the appropriate attributes.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 145, "pdfId": 145, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/145" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C:\nCreate groups that use the Dynamic User membership type.\nDynamic groups automatically add and remove members based on user attributes, such as department,\nwithout any manual intervention.\nBy setting up dynamic membership rules based on department attributes, you can ensure that users are\nautomatically added to the appropriate group upon import.\nF:\nCreate a CSV file that contains user information and the appropriate attributes.\nCSV files are commonly used for bulk importing user data into Microsoft Entra (formerly known as Azure AD).\nYou can specify attributes like department in the CSV file, ensuring that the imported users have the\nnecessary information for dynamic group membership.\nYou have an Azure subscription that contains a storage account named storage1.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 146, "pdfId": 146, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/146" }, "markersInGap": [], "questionText": "You need to ensure that the access keys for storage1 rotate automatically.\nWhat should you configure?\nA.\na backup vault\nB.\nredundancy for storage1\nC.\nlifecycle management for storage1\nD.\nan Azure key vault\nE.\na Recovery Services vault", "stem": "You need to ensure that the access keys for storage1 rotate automatically. What should you configure", "options": [ { "key": "A", "text": "a backup vault" }, { "key": "B", "text": "redundancy for storage1" }, { "key": "C", "text": "lifecycle management for storage1" }, { "key": "D", "text": "an Azure key vault" }, { "key": "E", "text": "a Recovery Services vault" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D: Use Azure Key Vault for Key ManagementAzure Key Vault is a service that helps manage secrets, keys, and\ncertificates. You can store and manage your storage account keys securely in Key Vault and use its features\nto automate key rotation.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 147, "pdfId": 147, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/147" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the Microsoft Entra identities shown in the following table.\nYou need to enable self-service password reset (SSPR).\nFor which identities can you enable SSPR in the Azure portal?\nA.\nUser1 only\nB.\nGroup1 only\nC.\nUser1 and Group1 only\nD.\nGroup1 and Group2 only\nE.\nUser1, Group1, and Group2", "stem": "You have an Azure subscription that contains the Microsoft Entra identities shown in the following table. You need to enable self-service password reset (SSPR). For which identities can you enable SSPR in the Azure portal", "options": [ { "key": "A", "text": "User1 only" }, { "key": "B", "text": "Group1 only" }, { "key": "C", "text": "User1 and Group1 only" }, { "key": "D", "text": "Group1 and Group2 only" }, { "key": "E", "text": "User1, Group1, and Group2" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Group1 and Group2: These groups can be configured with SSPR settings. By enabling SSPR for these groups,\nall members within the groups will have the ability to reset their passwords.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 148, "pdfId": 148, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/148" }, "markersInGap": [], "questionText": "You have a Microsoft Entra tenant.\nYou need to ensure that when a new Microsoft 365 group is created, the group name is automatically formatted as\nfollows:\nWhich three actions should you perform in sequence in the Microsoft Entra admin center? To answer, move the\nappropriate actions from the list of actions to the answer area and arrange them in the correct order.", "stem": "You have a Microsoft Entra tenant. You need to ensure that when a new Microsoft 365 group is created, the group name is automatically formatted as follows: Which three actions should you perform in sequence in the Microsoft Entra admin center? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1- Create a group naming policy: This is the first step to establish the framework for naming groups.\n2- Set Add prefix to Attribute: This step specifies that the prefix will be an attribute rather than a static string.\n3- Set Select type to Department: Finally, you specify that the 'Department' attribute will be used as the\nprefix.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 149, "pdfId": 149, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/149" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Users: \"User1, User2, User3, and User4\"\nThis selection implies that all four users are included in the specified operation (e.g., assignment, permission,\naccess control).\nThis might be relevant in scenarios where multiple users need permissions or access in a system like\nMicrosoft Entra ID (Azure AD).\nGroups: \"Group1 and Group3 only\"\nThis selection indicates that the chosen operation applies only to Group1 and Group3.\nOther groups (e.g., Group2, Group4) are not included in this selection.\nThis is useful in cases like role assignments, access policies, or security group filtering.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 150, "pdfId": 150, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/150" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Create a:\nManaged identity.\nA Managed Identity is an Azure feature that provides an automatically managed identity in Azure Active\nDirectory (Azure AD) for applications to use when connecting to resources.\nIt eliminates the need to manually manage credentials, improving security.\nUse the secret from:\nVault1, Vault2, or Vault3.\nThis implies that the system or service has access to secrets stored in multiple Azure Key Vaults (Vault1,\nVault2, or Vault3).\nAzure Key Vault is a cloud service for securely storing and accessing secrets, such as API keys, passwords,\nand certificates.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 151, "pdfId": 151, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/151" }, "markersInGap": [ 151 ], "questionText": "You have a Microsoft Entra tenant named contoso.com.\nYou collaborate with an external partner named fabrikam.com.\nYou plan to invite users in fabrikam.com to the contoso.com tenant.\nYou need to ensure that invitations can be sent only to fabrikam.com users.\nWhat should you do in the Microsoft Entra admin center?\nA.\nFrom Cross-tenant access settings, configure the Tenant restrictions settings.\nB.\nFrom Cross-tenant access settings, configure the Microsoft cloud settings.\nC.\nFrom External collaboration settings, configure the Guest user access restrictions settings.\nD.\nFrom External collaboration settings, configure the Collaboration restrictions settings.", "stem": "You have a Microsoft Entra tenant named contoso.com. You collaborate with an external partner named fabrikam.com. You plan to invite users in fabrikam.com to the contoso.com tenant. You need to ensure that invitations can be sent only to fabrikam.com users. What should you do in the Microsoft Entra admin center", "options": [ { "key": "A", "text": "From Cross-tenant access settings, configure the Tenant restrictions settings." }, { "key": "B", "text": "From Cross-tenant access settings, configure the Microsoft cloud settings." }, { "key": "C", "text": "From External collaboration settings, configure the Guest user access restrictions settings." }, { "key": "D", "text": "From External collaboration settings, configure the Collaboration restrictions settings." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D: From External collaboration settings, configure the Collaboration restrictions settings.\nIn Microsoft Entra (formerly known as Azure AD), if you want to restrict invitations to users from a specific\nexternal domain, you need to configure collaboration restrictions. Here's how:\nCollaboration restrictions settings: These settings allow you to specify which external domains can be invited\nas guests to your directory. By setting up these restrictions, you can ensure that only users from\nfabrikam.comcan receive invitations to your contoso.comtenant.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nA.\nOwner\nB.\nStorage Account Contributor\nC.\nStorage Account Backup Contributor\nD.\nStorage Blob Data Contributor\nE.\nStorage Blob Data Owner\nF.\nStorage Blob Delegator", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 152, "pdfId": 152, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/152" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. Storage Blob Data Contributor.\nThis role allows the user to read, write, and delete blob data. It supports conditions, which means you can use\nAzure Role-Based Access Control (RBAC) to set conditions on the role assignment if necessary.\nE. Storage Blob Data Owner.\nThis role allows the user to manage blob data including reading, writing, and deleting, and also managing the\nblob container and data. It supports conditions, making it possible to apply RBAC conditions on the role\nassignment.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 153, "pdfId": 153, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/153" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Admin1 (Global Admin) can assign Attribute1 to Group1: No\nGlobal Administrators do not have permissions to read, define, or assign custom security attributes by\ndefault1.\nAdmin2 (Attribute Definition Admin) can assign Attribute1 to User1: No\nThe Attribute Definition Admin role can define and manage attribute definitions but cannot assign attributes\nto users or groups1.\nAdmin3 (Attribute Assignment Admin) can assign Attribute1 to Group2: No", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 154, "pdfId": 154, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/154" }, "markersInGap": [ 154 ], "questionText": "You have a Microsoft Entra tenant configured as shown in the following exhibit.\n The tenant contains the identities shown in the following table.\nYou purchase a Microsoft Fabric license.\nTo which identities can you assign the license?\nA.\nUser1 only\nB.\nUser1 and Group1 only\nC.\nUser1 and Group2 only\nD.\nUser1, Group1, and Group2", "stem": "You have a Microsoft Entra tenant configured as shown in the following exhibit. The tenant contains the identities shown in the following table. You purchase a Microsoft Fabric license. To which identities can you assign the license", "options": [ { "key": "A", "text": "User1 only" }, { "key": "B", "text": "User1 and Group1 only" }, { "key": "C", "text": "User1 and Group2 only" }, { "key": "D", "text": "User1, Group1, and Group2" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A: User1 only.\nMicrosoft Fabric licenses are assigned to individual user accounts, not to groups. When you purchase a\nMicrosoft Fabric license, you can assign it directly to a specific user, like User1, who will then have access to\nthe services provided by the license.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 155, "pdfId": 155, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/155" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains a storage account named storage. The storage account contains a\nblob that stores images.\nClient access to storage1 is granted by using a shared access signature (SAS).\nYou need to ensure that users receive a warning message when they generate a SAS that exceeds a seven-day\ntime period.\nWhat should you do for storage?\nA.\nEnable a read-only lock.\nB.\nConfigure an alert rule.\nC.\nAdd a lifecycle management rule.\nD.\nSet Allow recommended upper limit for shared access signature (SAS) expiry interval to Enabled.", "stem": "You have an Azure subscription that contains a storage account named storage. The storage account contains a blob that stores images. Client access to storage1 is granted by using a shared access signature (SAS). You need to ensure that users receive a warning message when they generate a SAS that exceeds a seven-day time period. What should you do for storage", "options": [ { "key": "A", "text": "Enable a read-only lock." }, { "key": "B", "text": "Configure an alert rule." }, { "key": "C", "text": "Add a lifecycle management rule." }, { "key": "D", "text": "Set Allow recommended upper limit for shared access signature (SAS) expiry interval to Enabled." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D: Set Allow recommended upper limit for shared access signature (SAS) expiry interval to Enabled.\nAzure allows you to configure a recommended upper limit for the expiry interval of shared access signatures\n(SAS) for storage accounts. By setting this option to \"Enabled,\" you can specify the maximum period a SAS\ntoken can be valid for, such as seven days. When users attempt to generate a SAS that exceeds this limit,\nthey will receive a warning message.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 156, "pdfId": 156, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/156" }, "markersInGap": [], "questionText": "You have an Azure subscription named Subscription1 that contains the storage accounts shown in the following\ntable:\nYou plan to use the Azure Import/Export service to export data from Subscription1.\nYou need to identify which storage account can be used to export the data.\nWhat should you identify?\nA.\nstorage1\nB.\nstorage2\nC.\nstorage3\nD.\nstorage4", "stem": "You have an Azure subscription named Subscription1 that contains the storage accounts shown in the following table: You plan to use the Azure Import/Export service to export data from Subscription1. You need to identify which storage account can be used to export the data. What should you identify", "options": [ { "key": "A", "text": "storage1" }, { "key": "B", "text": "storage2" }, { "key": "C", "text": "storage3" }, { "key": "D", "text": "storage4" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Azure Import/Export service supports the following of storage accounts:\n✑\n Standard General Purpose v2 storage accounts (recommended for most scenarios)\n✑\n Blob Storage accounts\n✑\n General Purpose v1 storage accounts (both Classic or Azure Resource Manager deployments),\nAzure Import/Export service supports the following storage types:\n✑\n Import supports Azure Blob storage and Azure File storage\n✑\n Export supports Azure Blob storage", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-requirements", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-requirements" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 157, "pdfId": 157, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/157" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: storageaccount1 and storageaccount2 only\nBox 2: All the storage accounts .", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-account-options", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-account-options" ], "note": "The three different storage account options are: General-purpose v2 (GPv2) accounts, General-purpose\nv1 (GPv1) accounts, and Blob storage accounts.\n✑\n General-purpose v2 (GPv2) accounts are storage accounts that support all of the latest features for blobs,\nfiles, queues, and tables.\n✑\n Blob storage accounts support all the same block blob features as GPv2, but are limited to supporting only\nblock blobs.\n✑\n General-purpose v1 (GPv1) accounts provide access to all Azure Storage services, but may not have the\nlatest features or the lowest per gigabyte pricing.\nReference:\nhttps://docs.microsoft.com/en-us/azure/storage/common/storage-account-options", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 158, "pdfId": 158, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/158" }, "markersInGap": [ 158 ], "questionText": "You have Azure subscription that includes data in following locations:\nYou plan to export data by using Azure import/export job named Export1.\nYou need to identify the data that can be exported by using Export1.\nWhich data should you identify?\n A.\nDB1\nB.\ncontainer1\nC.\nshare1\nD.\nTable1", "stem": "You have Azure subscription that includes data in following locations: You plan to export data by using Azure import/export job named Export1. You need to identify the data that can be exported by using Export1. Which data should you identify", "options": [ { "key": "A", "text": "DB1" }, { "key": "B", "text": "container1" }, { "key": "C", "text": "share1" }, { "key": "D", "text": "Table1" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. container1\nThe following list of storage types is supported with Azure Import/Export service.\nExport: Azure Blob Storage -> Block blobs, Page blobs, and Append blobs supported.\nAzure Files not supported & Export from archive tier not supported", "reference": "https://docs.microsoft.com/en-us/azure/import-export/storage-import-export-requirements#supported-\nstorage-types", "references": [ "https://docs.microsoft.com/en-us/azure/import-export/storage-import-export-requirements#supported-" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 159, "pdfId": 159, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/159" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Access Control (IAM)\nSince the App1 uses Managed Identity, App1 can access the Storage Account via IAM. As per requirement, we\nneed to minimize the number of secrets used, so Access keys is not ideal.\nBox 2: Shared access signatures (SAS)\nWe need temp access for App2, so we need to use SAS.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-auth", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-auth" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 160, "pdfId": 160, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/160" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: StorageV2 -\nYou may only tier your object storage data to hot, cool, or archive in Blob storage and General Purpose v2\n(GPv2) accounts. General Purpose v1 (GPv1) accounts do not support tiering.\nGeneral-purpose v2 accounts deliver the lowest per-gigabyte capacity prices for Azure Storage, as well as\nindustry-competitive transaction prices.\nBox 2: Standard_GRS -\nGeo-redundant storage (GRS): Cross-regional replication to protect against region-wide unavailability.\nIncorrect Answers:\nLocally-redundant storage (LRS): A simple, low-cost replication strategy. Data is replicated within a single\nstorage scale unit.\nRead-access geo-redundant storage (RA-GRS): Cross-regional replication with read access to the replica. RA-\nGRS provides read-only access to the data in the secondary location, in addition to geo-replication across two\nregions, but is more expensive compared to GRS.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy-grs\nhttps://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy-grs", "https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers" ], "note": "Each correct selection is worth one point.\nA.\nCreate a container instance\nB.\nRegister Server1\nC.\nInstall the Azure File Sync agent on Server1\nD.\nDownload an automation script\nE.\nCreate a sync group", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 161, "pdfId": 161, "exam": "AZ-104", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/161" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the resources in the following table.\nStore1 contains a file share named data. Data contains 5,000 files.\nYou need to synchronize the files in the file share named data to an on-premises server named Server1.\nWhich three actions should you perform? Each correct answer presents part of the solution.\nNOTE: Each correct selection is worth one point.\nA.\nCreate a container instance\nB.\nRegister Server1\nC.\nInstall the Azure File Sync agent on Server1\nD.\nDownload an automation script\nE.\nCreate a sync group", "stem": "You have an Azure subscription that contains the resources in the following table. Store1 contains a file share named data. Data contains 5,000 files. You need to synchronize the files in the file share named data to an on-premises server named Server1. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "Create a container instance" }, { "key": "B", "text": "Register Server1" }, { "key": "C", "text": "Install the Azure File Sync agent on Server1" }, { "key": "D", "text": "Download an automation script" }, { "key": "E", "text": "Create a sync group" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Step 1 (C): Install the Azure File Sync agent on Server1\nThe Azure File Sync agent is a downloadable package that enables Windows Server to be synced with an\nAzure file share\nStep 2 (B): Register Server1.\nRegister Windows Server with Storage Sync Service\nRegistering your Windows Server with a Storage Sync Service establishes a trust relationship between your\nserver (or cluster) and the Storage Sync Service.\nStep 3 (E): Create a sync group and a cloud endpoint.\nA sync group defines the sync topology for a set of files. Endpoints within a sync group are kept in sync with", "reference": "https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide", "references": [ "https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 162, "pdfId": 162, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/162" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1. An administrator can move VNET1 to RG2 :\nYes.\nVirtual Networks (VNETs) in Azure can be moved from one Resource Group (RG) to another, provided that:\nThe move follows Azure’s resource move constraints.\nThe administrator has sufficient permissions (like Owner or Contributor).\nThere are no dependencies preventing the move.\nSince \"Yes\" is selected, this indicates that the move is possible.\n2. The state of VM1 changed to deallocated :\nNo.\nA Virtual Machine (VM) in Azure enters a deallocated state when:\nIt is explicitly stopped using Azure PowerShell, CLI, or Portal.\nIt is not assigned to a running resource group.\nIf \"No\" is selected, it implies that:\nThe VM has not been deallocated.\nIt might still be in a stopped (but allocated) state.\nIt could still be consuming resources, meaning billing continues.\n3. An administrator can modify the address space of VNET2\n:No\nIn Azure Virtual Networks (VNETs):\nThe address space can be modified only if there are no subnet dependencies.\nIf subnets already exist and are in use, modifying the address space is restricted.\nSince \"No\" is selected, it suggests that:\nThe VNET has existing subnets or dependencies preventing modifications.\nThe administrator cannot change the address space directly.", "reference": null, "references": [], "note": "More than one order of answer choices is correct. You will receive credit for any of the correct orders you\nselect.\nSelect and Place:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 163, "pdfId": 163, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/163" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "At a high level, an import job involves the following steps:\nStep 1: Attach an external disk to Server1 and then run waimportexport.exe\nDetermine data to be imported, number of drives you need, destination blob location for your data in Azure\nstorage.\nUse the WAImportExport tool to copy data to disk drives. Encrypt the disk drives with BitLocker.\nStep 2: From the Azure portal, create an import job.\nCreate an import job in your target storage account in Azure portal. Upload the drive journal files.\nStep 3: Detach the external disks from Server1 and ship the disks to an Azure data center.\nProvide the return address and carrier account number for shipping the drives back to you.\nShip the disk drives to the shipping address provided during job creation.\nStep 4: From the Azure portal, update the import job\nUpdate the delivery tracking number in the import job details and submit the import job.\nThe drives are received and processed at the Azure data center.\nThe drives are shipped using your carrier account to the return address provided in the import job.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-service", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-service" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 164, "pdfId": 164, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/164" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box1: No.\nAn Azure file synchronization group can only have one cloud endpoint. Group1 uses share1 as a cloud\nendpoint.\nBox2: No.\nAn Azure file synchronization group can have multiple server endpoints and a single server can be a member\nof multiple file synchronization groups within a single storage synchronization service. However, a single\nserver can only have a single endpoint in a single file synchronization group. Server1 already has an endpoint\nin Group1. We cannot add a second folder path from Server1 as a server endpoint to Group1.\nBox3: yes.\nServer2 is registered in Sync1 and does not yet have an endpoint in Group1. We can include the D:\\Data folder\nin the Group1 file synchronization group.\nThe following Technet article contains more information on the subject:\nhttps://docs.microsoft.com/en-us/azure/storage/file-sync/file-sync-deployment-guide?tabs=azure-\nportal%2Cproactive-portal", "reference": "https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide", "references": [ "https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide" ], "note": "Each correct selection is worth one point.\nSelect and Place:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 165, "pdfId": 165, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/165" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: contosostorage -\nThe name of account -\nBox 2: file.core.windows.net -\nBox 3: data -\nThe name of the file share is data.\nExample:\nReference:\nhttps://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 166, "pdfId": 166, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/166" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "azcopy\n make.\nhttps://mystorageaccount.\nblob.\ncore.windows.net/vmimages'\nSimilar to OS Images, a VM Image is a collection of metadata and pointers to a set of VHDs (one VHD per disk)\nstored as page blobs in Azure Storage.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-ref-azcopy-make", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-ref-azcopy-make" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 167, "pdfId": 167, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/167" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "File1: Endpoint1 only.\nIt is a cloud endpoint, and it is scanned by the detection job every 24 hours.\nFile2: Endpoint1, Endpoint2 and Endpoint3.\nWith the on-premises servers the file is scanned and synced automatically after it's being added.", "reference": "https://docs.microsoft.com/en-us/learn/modules/extend-share-capacity-with-azure-file-sync/2-what-azure-\nfile-sync", "references": [ "https://docs.microsoft.com/en-us/learn/modules/extend-share-capacity-with-azure-file-sync/2-what-azure-" ], "note": "They changed the question in Exam from \"within 24 hours\" to \"after 24 hours\".\nReference:\nhttps://docs.microsoft.com/en-us/learn/modules/extend-share-capacity-with-azure-file-sync/2-what-azure-\nfile-sync", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 168, "pdfId": 168, "exam": "AZ-104", "type": "dropdown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/168" }, "markersInGap": [ 168 ], "questionText": "HOTSPOT -\nYou have several Azure virtual machines on a virtual network named VNet1.\nYou configure an Azure Storage account as shown in the following exhibit.\nUse the drop-down menus to select the answer choice that completes each statement based on the information\npresented in the graphic.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You have several Azure virtual machines on a virtual network named VNet1. You configure an Azure Storage account as shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: never -\nThe 10.2.9.0/24 subnet is not whitelisted.\nBox 2: never -", "reference": "https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows\nhttps://azure.microsoft.com/en-us/blog/azure-backup-now-supports-storage-accounts-secured-with-azure-\nstorage-firewalls-and-virtual-networks/", "references": [ "https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows", "https://azure.microsoft.com/en-us/blog/azure-backup-now-supports-storage-accounts-secured-with-azure-" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 169, "pdfId": 169, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/169" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1) On the cloud endpoint, File1.txt is overwritten by File1.txt from Share1: \"No\"\n2) On Server1, File1.txt is overwritten by File1.txt from the cloud endpoint: \"No\"\n3) File1.txt from Share1 replicates to Share2: \"Yes\"\nIf the same file is changed on two servers at approximately the same time, what happens?\nAzure File Sync uses a simple conflict-resolution strategy: we keep both changes to files that are changed in\ntwo endpoints at the same time. The most recently written change keeps the original file name. The older file\n(determined by LastWriteTime) has the endpoint name and the conflict number appended to the filename. For\nserver endpoints, the endpoint name is the name of the server. For cloud endpoints, the endpoint name is\nCloud. The name follows this taxonomy:\n-[-#].\nFor example, the first conflict of CompanyReport.docx would become CompanyReport-CentralServer.docx if\nCentralServer is where the older write occurred. The second conflict would be named CompanyReport-\nCentralServer-1.docx. Azure File Sync supports 100 conflict files per file. Once the maximum number of\nconflict files has been reached, the file will fail to sync until the number of conflict files is less than 100.", "reference": "https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-planning", "references": [ "https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-planning" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 170, "pdfId": 170, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/170" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the storage accounts shown in the following table.\nYou need to identify which storage account can be converted to zone-redundant storage (ZRS) replication by\nrequesting a live migration from Azure support.\nWhat should you identify?\nA.\nstorage1\nB.\nstorage2\nC.\nstorage3\nD.\nstorage4", "stem": "You have an Azure subscription that contains the storage accounts shown in the following table. You need to identify which storage account can be converted to zone-redundant storage (ZRS) replication by requesting a live migration from Azure support. What should you identify", "options": [ { "key": "A", "text": "storage1" }, { "key": "B", "text": "storage2" }, { "key": "C", "text": "storage3" }, { "key": "D", "text": "storage4" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "ZRS currently supports standard general-purpose v2, FileStorage and BlockBlobStorage storage account\ntypes.\nIncorrect Answers:\nA, not C: Live migration is supported only for storage accounts that use LRS replication. If your account uses\nGRS or RA-GRS, then you need to first change your account's replication type to LRS before proceeding. This\nintermediary step removes the secondary endpoint provided by GRS/RA-GRS.\nAlso, only standard storage account types support live migration. Premium storage accounts must be\nmigrated manually.\nD: ZRS currently supports standard general-purpose v2, FileStorage and BlockBlobStorage storage account\ntypes.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy-zrs", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy-zrs" ], "note": "Each correct selection is worth one point.\nA.\nFrom the Networking blade of account1, select Selected networks.\nB.\nFrom the Networking blade of account1, select Allow trusted Microsoft services to access this storage\naccount.\nC.\nFrom the Networking blade of account1, add the 131.107.1.0/24 IP address range.\nD.\nFrom the Networking blade of account1, add VNet1.\nE.\nFrom the Service endpoints blade of VNet1, add a service endpoint.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 171, "pdfId": 171, "exam": "AZ-104", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/171" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains a storage account named account1.\nYou plan to upload the disk files of a virtual machine to account1 from your on-premises network. The on-premises\nnetwork uses a public IP address space of\n131.107.1.0/24.\nYou plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be attached to a virtual\nnetwork named VNet1. VNet1 uses an IP address space of 192.168.0.0/24.\nYou need to configure account1 to meet the following requirements:\n✑\n Ensure that you can upload the disk files to account1.\n✑\n Ensure that you can attach the disks to VM1.\n✑\n Prevent all other access to account1.\nWhich two actions should you perform? Each correct answer presents part of the solution.\nNOTE: Each correct selection is worth one point.\nA.\nFrom the Networking blade of account1, select Selected networks.\nB.\nFrom the Networking blade of account1, select Allow trusted Microsoft services to access this storage\naccount.\nC.\nFrom the Networking blade of account1, add the 131.107.1.0/24 IP address range.\nD.\nFrom the Networking blade of account1, add VNet1.\nE.\nFrom the Service endpoints blade of VNet1, add a service endpoint.", "stem": "You have an Azure subscription that contains a storage account named account1. You plan to upload the disk files of a virtual machine to account1 from your on-premises network. The on-premises network uses a public IP address space of 131.107.1.0/24. You plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be attached to a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24. You need to configure account1 to meet the following requirements: ✑ Ensure that you can upload the disk files to account1. ✑ Ensure that you can attach the disks to VM1. ✑ Prevent all other access to account1. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "From the Networking blade of account1, select Selected networks." }, { "key": "B", "text": "From the Networking blade of account1, select Allow trusted Microsoft services to access this storage account." }, { "key": "C", "text": "From the Networking blade of account1, add the 131.107.1.0/24 IP address range." }, { "key": "D", "text": "From the Networking blade of account1, add VNet1." }, { "key": "E", "text": "From the Service endpoints blade of VNet1, add a service endpoint." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Virtual machine disk traffic (including mount and unmount operations, and disk IO) is not affected by network\nrules. REST access to page blobs is protected by network rules.\nEndpoints are enabled on subnets configured in Azure virtual networks. Endpoints can't be used for traffic\nfrom your premises to Azure services. For more information, see Secure Azure service access from on-\npremises.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview\nhttps://docs.microsoft.com/en-us/azure/storage/common/storage-network-security", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview", "https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 172, "pdfId": 172, "exam": "AZ-104", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/172" }, "markersInGap": [ 171, 172 ], "questionText": "DRAG DROP -\nYou have an on-premises file server named Server1 that runs Windows Server 2016.\n You have an Azure subscription that contains an Azure file share.\nYou deploy an Azure File Sync Storage Sync Service, and you create a sync group.\nYou need to synchronize files from Server1 to Azure.\nWhich three actions should you perform in sequence? To answer, move the appropriate actions from the list of\nactions to the answer area and arrange them in the correct order.\nSelect and Place:", "stem": "You have an on-premises file server named Server1 that runs Windows Server 2016. You have an Azure subscription that contains an Azure file share. You deploy an Azure File Sync Storage Sync Service, and you create a sync group. You need to synchronize files from Server1 to Azure. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Step 1: Install the Azure File Sync agent on Server1\nThe Azure File Sync agent is a downloadable package that enables Windows Server to be synced with an\nAzure file share\nStep 2: Register Server1.\nRegister Windows Server with Storage Sync Service\nRegistering your Windows Server with a Storage Sync Service establishes a trust relationship between your\nserver (or cluster) and the Storage Sync Service.\nStep 3: Add a server endpoint -\nCreate a sync group and a cloud endpoint.\nA sync group defines the sync topology for a set of files. Endpoints within a sync group are kept in sync with", "reference": "https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide", "references": [ "https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 173, "pdfId": 173, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/173" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Zone-redundant storage (ZRS)\nZone-redundant storage (ZRS) replicates your data synchronously across three storage clusters in a single\nregion.\nLRS would not remain available if a data center in the region fails\nGRS and RA GRS use asynchronous replication.\nBox 2: StorageV2 (general purpose V2)\nZRS only support GPv2.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy https://docs.microsoft.com/en-\nus/azure/storage/common/storage-redundancy-zrs", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-redundancy", "https://docs.microsoft.com/en-" ], "note": "Each correct selection is worth one point.\nA.\nan XML manifest file\nB.\na dataset CSV file\nC.\na JSON configuration file\nD.\na PowerShell PS1 file\nE.\na driveset CSV file", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 174, "pdfId": 174, "exam": "AZ-104", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/174" }, "markersInGap": [], "questionText": "You plan to use the Azure Import/Export service to copy files to a storage account.\nWhich two files should you create before you prepare the drives for the import job? Each correct answer presents\npart of the solution.\nNOTE: Each correct selection is worth one point.\nA.\nan XML manifest file\nB.\na dataset CSV file\nC.\na JSON configuration file\nD.\na PowerShell PS1 file\nE.\na driveset CSV file", "stem": "You plan to use the Azure Import/Export service to copy files to a storage account. Which two files should you create before you prepare the drives for the import job? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "an XML manifest file" }, { "key": "B", "text": "a dataset CSV file" }, { "key": "C", "text": "a JSON configuration file" }, { "key": "D", "text": "a PowerShell PS1 file" }, { "key": "E", "text": "a driveset CSV file" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B: Modify the dataset.csv file in the root folder where the tool resides. Depending on whether you want to\nimport a file or folder or both, add entries in the dataset.csv file\nE: Modify the driveset.csv file in the root folder where the tool resides.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-data-to-files", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-data-to-files" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 175, "pdfId": 175, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/175" }, "markersInGap": [], "questionText": "You have a Recovery Service vault that you use to test backups. The test backups contain two protected virtual\nmachines.\nYou need to delete the Recovery Services vault.\nWhat should you do first?\nA.\nFrom the Recovery Service vault, delete the backup data.\nB.\nModify the disaster recovery properties of each virtual machine.\nC.\nModify the locks of each virtual machine.\nD.\nFrom the Recovery Service vault, stop the backup of each backup item.", "stem": "You have a Recovery Service vault that you use to test backups. The test backups contain two protected virtual machines. You need to delete the Recovery Services vault. What should you do first", "options": [ { "key": "A", "text": "From the Recovery Service vault, delete the backup data." }, { "key": "B", "text": "Modify the disaster recovery properties of each virtual machine." }, { "key": "C", "text": "Modify the locks of each virtual machine." }, { "key": "D", "text": "From the Recovery Service vault, stop the backup of each backup item." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "You can't delete a Recovery Services vault if it is registered to a server and holds backup data. If you try to\ndelete a vault, but can't, the vault is still configured to receive backup data.\nRemove vault dependencies and delete vault\nIn the vault dashboard menu, scroll down to the Protected Items section, and click Backup Items. In this menu,\nyou can stop and delete Azure File Servers, SQL\nServers in Azure VM, and Azure virtual machines.", "reference": "https://docs.microsoft.com/en-us/azure/backup/backup-azure-delete-vault", "references": [ "https://docs.microsoft.com/en-us/azure/backup/backup-azure-delete-vault" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 176, "pdfId": 176, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/176" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: VM1 only -\nVM1 is in the same region as Vault1.\nFile1 is not in the same region as Vautl1.\nSQL is not in the same region as Vault1.\nBlobs cannot be backup up to service vaults.", "reference": "https://docs.microsoft.com/bs-cyrl-ba/azure/backup/backup-create-rs-vault https://docs.microsoft.com/en-\nus/azure/backup/backup-afs", "references": [ "https://docs.microsoft.com/bs-cyrl-ba/azure/backup/backup-create-rs-vault", "https://docs.microsoft.com/en-" ], "note": "To create a vault to protect virtual machines, the vault must be in the same region as the virtual\nmachines.\nBox 2: Share1 only.\nStorage1 is in the same region (West USA) as Vault2. Share1 is in Storage1.\nNote: After you select Backup, the Backup pane opens and prompts you to select a storage account from a\nlist of discovered supported storage accounts. They're either associated with this vault or present in the same\nregion as the vault, but not yet associated to any Recovery Services vault.\nReference:\nhttps://docs.microsoft.com/bs-cyrl-ba/azure/backup/backup-create-rs-vault https://docs.microsoft.com/en-\nus/azure/backup/backup-afs", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 177, "pdfId": 177, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/177" }, "markersInGap": [], "questionText": "You have an Azure subscription named Subscription1.\nYou have 5 TB of data that you need to transfer to Subscription1.\nYou plan to use an Azure Import/Export job.\nWhat can you use as the destination of the imported data?\nA.\na virtual machine\nB.\nan Azure Cosmos DB database\nC.\nAzure File Storage\nD.\nthe Azure File Sync Storage Sync Service", "stem": "You have an Azure subscription named Subscription1. You have 5 TB of data that you need to transfer to Subscription1. You plan to use an Azure Import/Export job. What can you use as the destination of the imported data", "options": [ { "key": "A", "text": "a virtual machine" }, { "key": "B", "text": "an Azure Cosmos DB database" }, { "key": "C", "text": "Azure File Storage" }, { "key": "D", "text": "the Azure File Sync Storage Sync Service" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Azure Import/Export service is used to securely import large amounts of data to Azure Blob storage and Azure\nFiles by shipping disk drives to an Azure datacenter.\nThe maximum size of an Azure Files Resource of a file share is 5 TB.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-service", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-service" ], "note": "There are several versions of this question in the exam. The question has two correct answers:\n1. Azure File Storage\n2. Azure Blob Storage\nThe question can have other incorrect answer options, including the following:\n✑\n Azure Data Lake Store\n✑\n Azure SQL Database\n✑\n Azure Data Factory\nReference:\nhttps://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-service", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 178, "pdfId": 178, "exam": "AZ-104", "type": "dropdown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/178" }, "markersInGap": [ 177, 178 ], "questionText": "HOTSPOT -\nYou have an Azure subscription.\nYou create the Azure Storage account shown in the following exhibit.\n Use the drop-down menus to select the answer choice that completes each statement based on the information\npresented in the graphic.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You have an Azure subscription. You create the Azure Storage account shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: 3 -\nLocally Redundant Storage (LRS) provides highly durable and available storage within a single location (sub\nregion). We maintain an equivalent of 3 copies\n(replicas) of your data within the primary location as described in our SOSP paper; this ensures that we can\nrecover from common failures (disk, node, rack) without impacting your storage account's availability and\ndurability.\nBox 2: Access tier -\nChange the access tier from Hot to Cool.", "reference": "https://azure.microsoft.com/en-us/blog/data-series-introducing-locally-redundant-storage-for-windows-\nazure-storage/ https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers", "references": [ "https://azure.microsoft.com/en-us/blog/data-series-introducing-locally-redundant-storage-for-windows-", "https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers" ], "note": "Azure storage offers different access tiers, which allow you to store blob object data in the most cost-\neffective manner. The available access tiers include:\nHot - Optimized for storing data that is accessed frequently.\nCool - Optimized for storing data that is infrequently accessed and stored for at least 30 days.\nArchive - Optimized for storing data that is rarely accessed and stored for at least 180 days with flexible\nlatency requirements (on the order of hours).\nReference:\nhttps://azure.microsoft.com/en-us/blog/data-series-introducing-locally-redundant-storage-for-windows-\nazure-storage/ https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 179, "pdfId": 179, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/179" }, "markersInGap": [], "questionText": "You have an Azure Storage account named storage1.\nYou plan to use AzCopy to copy data to storage1.\nYou need to identify the storage services in storage1 to which you can copy the data.\nWhich storage services should you identify?\nA.\nblob, file, table, and queue\nB.\nblob and file only\nC.\nfile and table only\nD.\nfile only\nE.\nblob, table, and queue only", "stem": "You have an Azure Storage account named storage1. You plan to use AzCopy to copy data to storage1. You need to identify the storage services in storage1 to which you can copy the data. Which storage services should you identify", "options": [ { "key": "A", "text": "blob, file, table, and queue" }, { "key": "B", "text": "blob and file only" }, { "key": "C", "text": "file and table only" }, { "key": "D", "text": "file only" }, { "key": "E", "text": "blob, table, and queue only" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "AzCopy is a command-line utility that you can use to copy blobs or files to or from a storage account.\nIncorrect Answers:\nA, C, E: AzCopy does not support table and queue storage services.\nD: AzCopy supports file storage services, as well as blob storage services.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 180, "pdfId": 180, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/180" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1. Blob Storage:\nCorrect", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 181, "pdfId": 181, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/181" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. Azure Files.\nAzure Files is the recommended storage service for use with Azure Container Instances when you need to\nshare data between containers or persist data across container restarts. Since Image1 contains a Microsoft\nSQL Server instance that requires persistent storage, you should use Azure Files as the storage service for\ncontainer1.\nAzure Blob storage, Azure Queue storage, and Azure Table storage are not recommended for use with Azure\nContainer Instances when you need to persist data across container restarts. These storage services are more\nappropriate for other types of data storage and retrieval scenarios.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 182, "pdfId": 182, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/182" }, "markersInGap": [], "questionText": "You have an app named App1 that runs on two Azure virtual machines named VM1 and VM2.\nYou plan to implement an Azure Availability Set for App1. The solution must ensure that App1 is available during\nplanned maintenance of the hardware hosting\nVM1 and VM2.\nWhat should you include in the Availability Set?\nA.\none update domain\nB.\ntwo fault domains\nC.\none fault domain\nD.\ntwo update domains", "stem": "You have an app named App1 that runs on two Azure virtual machines named VM1 and VM2. You plan to implement an Azure Availability Set for App1. The solution must ensure that App1 is available during planned maintenance of the hardware hosting VM1 and VM2. What should you include in the Availability Set", "options": [ { "key": "A", "text": "one update domain" }, { "key": "B", "text": "two fault domains" }, { "key": "C", "text": "one fault domain" }, { "key": "D", "text": "two update domains" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Microsoft updates, which Microsoft refers to as planned maintenance events, sometimes require that VMs be\nrebooted to complete the update. To reduce the impact on VMs, the Azure fabric is divided into update\ndomains to ensure that not all VMs are rebooted at the same time.\nIncorrect Answers:\nA: An update domain is a group of VMs and underlying physical hardware that can be rebooted at the same\ntime.\nB, C: A fault domain shares common storage as well as a common power source and network switch. It is used\nto protect against unplanned system failure.\nReferences:\nhttps://petri.com/understanding-azure-availability-sets\nhttps://docs.microsoft.com/en-us/azure/virtual-machines/windows/tutorial-availability-sets", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 183, "pdfId": 183, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/183" }, "markersInGap": [], "questionText": "You have an Azure subscription named Subscription1.\nYou have 5 TB of data that you need to transfer to Subscription1.\nYou plan to use an Azure Import/Export job.\nWhat can you use as the destination of the imported data?\nA.\nan Azure Cosmos DB database\nB.\nAzure Blob storage\nC.\nAzure Data Lake Store\nD.\nthe Azure File Sync Storage Sync Service", "stem": "You have an Azure subscription named Subscription1. You have 5 TB of data that you need to transfer to Subscription1. You plan to use an Azure Import/Export job. What can you use as the destination of the imported data", "options": [ { "key": "A", "text": "an Azure Cosmos DB database" }, { "key": "B", "text": "Azure Blob storage" }, { "key": "C", "text": "Azure Data Lake Store" }, { "key": "D", "text": "the Azure File Sync Storage Sync Service" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure Import/Export service is used to securely import large amounts of data to Azure Blob storage and Azure\nFiles by shipping disk drives to an Azure datacenter.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-service", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-service" ], "note": "There are several versions of this question in the exam. The question has two correct answers:\n1. Azure File Storage\n2. Azure Blob Storage\nThe question can have other incorrect answer options, including the following:\n✑\n a virtual machine\n✑\n Azure SQL Database\n✑\n Azure Data Factory\nReference:\nhttps://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-service", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 184, "pdfId": 184, "exam": "AZ-104", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/184" }, "markersInGap": [ 183, 184 ], "questionText": "DRAG DROP -\nYou have an Azure subscription that contains an Azure file share.\nYou have an on-premises server named Server1 that runs Windows Server 2016.\nYou plan to set up Azure File Sync between Server1 and the Azure file share.\nYou need to prepare the subscription for the planned Azure File Sync.\nWhich two actions should you perform in the Azure subscription? To answer, drag the appropriate actions to the\n correct targets. Each action may be used once, more than once, or not at all. You may need to drag the split bar\nbetween panes or scroll to view content.\nNOTE: Each correct selection is worth one point.\nSelect and Place:", "stem": "You have an Azure subscription that contains an Azure file share. You have an on-premises server named Server1 that runs Windows Server 2016. You plan to set up Azure File Sync between Server1 and the Azure file share. You need to prepare the subscription for the planned Azure File Sync. Which two actions should you perform in the Azure subscription? To answer, drag the appropriate actions to the correct targets. Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point. Select and Place:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "First action: Create a Storage Sync Service\nThe deployment of Azure File Sync starts with placing a Storage Sync Service resource into a resource group\nof your selected subscription.\nSecond action: Install the Azure File Sync agent\nThe Azure File Sync agent is a downloadable package that enables Windows Server to be synced with an\nAzure file share.", "reference": "https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide", "references": [ "https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 185, "pdfId": 185, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/185" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: No -\nA sync group must contain one cloud endpoint, which represents an Azure file share and one or more server\nendpoints.\nBox 2: Yes -\nData2 is located on Server2 which is registered to Sync1.\nBox 3: No -\nData3 is located on Server3 which is not registered to Sync1.", "reference": "https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide?tabs=azure-\nportal%2Cproactive-portal#create-a-sync-group-and-a- cloud-endpoint", "references": [ "https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide?tabs=azure-" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 186, "pdfId": 186, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/186" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Storage accounts: Storage 3 only\nStorage Account must be in the same Region as the Recovery Services Vault.\nLog Analytics workspaces: Analytics1, Analytics2, and Analytics3\nSet up one or more Log Analytics workspaces to store your Backup reporting data. The location and\nsubscription where this Log Analytics workspace can be created is independent of the location and\nsubscription where your Vaults exist.", "reference": "https://docs.microsoft.com/en-us/azure/backup/configure-reports#1-create-a-log-analytics-workspace-or-\nuse-an-existing-one", "references": [ "https://docs.microsoft.com/en-us/azure/backup/configure-reports#1-create-a-log-analytics-workspace-or-" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 187, "pdfId": 187, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/187" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: contoso104 only.\nPremium file shares are hosted in a special purpose storage account kind, called a FileStorage account.\nBox 2: contoso101 and contos103 only.\nObject storage data tiering between hot, cool, and archive is supported in Blob Storage and General Purpose\nv2 (GPv2) accounts. General Purpose v1 (GPv1) accounts don't support tiering.\nThe archive tier supports only LRS, GRS, and RA-GRS.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview\nhttps://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-create-premium-fileshare?tabs=azure-\nportal\nhttps://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview", "https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-create-premium-fileshare?tabs=azure-", "https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 188, "pdfId": 188, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/188" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: will have no access\nThe IP 193.77.134.1 does not have access on the SAS, because it is not matching the SAS requirements. IP is\nout of range.\nBox 2: will have no access\nThe SAS token is not supported in mounting Azure File share currently, it just supports the Azure storage\naccount key.\nSince it is using \"net use\" where it uses SMB, the SMB (Server Message Broker) protocol does not support\nSAS. it still asks for username/password. Accordingly, it will give error wrong username/pass and will not\nprovide access.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1\nhttps://docs.microsoft.com/en-us/azure/vs-azure-tools-storage-manage-with-storage-explorer?\ntabs=windows\nhttps://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows\nhttps://docs.microsoft.com/en-us/answers/questions/40741/sas-key-for-unc-path.html", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-dotnet-shared-access-signature-part-1", "https://docs.microsoft.com/en-us/azure/vs-azure-tools-storage-manage-with-storage-explorer?", "https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows", "https://docs.microsoft.com/en-us/answers/questions/40741/sas-key-for-unc-path.html" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 189, "pdfId": 189, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/189" }, "markersInGap": [ 189 ], "questionText": "You have two Azure virtual machines named VM1 and VM2. You have two Recovery Services vaults named RSV1\nand RSV2.\nVM2 is backed up to RSV1.\nYou need to back up VM2 to RSV2.\nWhat should you do first?\nA.\nFrom the RSV1 blade, click Backup items and stop the VM2 backup\nB.\nFrom the RSV2 blade, click Backup. From the Backup blade, select the backup for the virtual machine, and\nthen click Backup\n C.\nFrom the VM2 blade, click Disaster recovery, click Replication settings, and then select RSV2 as the\nRecovery Services vault\nD.\nFrom the RSV1 blade, click Backup Jobs and export the VM2 job", "stem": "You have two Azure virtual machines named VM1 and VM2. You have two Recovery Services vaults named RSV1 and RSV2. VM2 is backed up to RSV1. You need to back up VM2 to RSV2. What should you do first", "options": [ { "key": "A", "text": "From the RSV1 blade, click Backup items and stop the VM2 backup" }, { "key": "B", "text": "From the RSV2 blade, click Backup. From the Backup blade, select the backup for the virtual machine, and then click Backup" }, { "key": "C", "text": "From the VM2 blade, click Disaster recovery, click Replication settings, and then select RSV2 as the Recovery Services vault" }, { "key": "D", "text": "From the RSV1 blade, click Backup Jobs and export the VM2 job" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "If you want to change the recovery service vault you need to disassociate the previous RSV and delete the\nbackup data. To delete backup data, you need to stop the backup first.\nSo:\n1. Stop the backup in RSV1 (D)\n2. Remove the backup data.\n3. Disassociate the VM in RSV1.\n4. Associate the VM in RSV2.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 190, "pdfId": 190, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/190" }, "markersInGap": [], "questionText": "You have a general-purpose v1 Azure Storage account named storage1 that uses locally-redundant storage (LRS).\nYou need to ensure that the data in the storage account is protected if a zone fails. The solution must minimize\ncosts and administrative effort.\nWhat should you do first?\nA.\nCreate a new storage account.\nB.\nConfigure object replication rules.\nC.\nUpgrade the account to general-purpose v2.\nD.\nModify the Replication setting of storage1.", "stem": "You have a general-purpose v1 Azure Storage account named storage1 that uses locally-redundant storage (LRS). You need to ensure that the data in the storage account is protected if a zone fails. The solution must minimize costs and administrative effort. What should you do first", "options": [ { "key": "A", "text": "Create a new storage account." }, { "key": "B", "text": "Configure object replication rules." }, { "key": "C", "text": "Upgrade the account to general-purpose v2." }, { "key": "D", "text": "Modify the Replication setting of storage1." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "General-purpose v2 storage accounts support the latest Azure Storage features and incorporate all of the\nfunctionality of general-purpose v1 and Blob storage accounts. General-purpose v2 accounts are\nrecommended for most storage scenarios. General-purpose v2 accounts deliver the lowest per-gigabyte\ncapacity prices for Azure Storage, as well as industry-competitive transaction prices. General-purpose v2\naccounts support default account access tiers of hot or cool and blob level tiering between hot, cool, or\narchive.\nUpgrading to a general-purpose v2 storage account from your general-purpose v1 or Blob storage accounts is\nstraightforward. You can upgrade using the Azure portal, PowerShell, or Azure CLI. There is no downtime or\nrisk of data loss associated with upgrading to a general-purpose v2 storage account. The account upgrade\nhappens via a simple Azure Resource Manager operation that changes the account type.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 191, "pdfId": 191, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/191" }, "markersInGap": [ 190, 191 ], "questionText": "You have an Azure subscription that contains the storage accounts shown in the following table.\n You plan to manage the data stored in the accounts by using lifecycle management rules.\nTo which storage accounts can you apply lifecycle management rules?\nA.\nstorage1 only\nB.\nstorage1 and storage2 only\nC.\nstorage3 and storage4 only\nD.\nstorage1, storage2, and storage3 only\nE.\nstorage1, storage2, storage3, and storage4", "stem": "You have an Azure subscription that contains the storage accounts shown in the following table. You plan to manage the data stored in the accounts by using lifecycle management rules. To which storage accounts can you apply lifecycle management rules", "options": [ { "key": "A", "text": "storage1 only" }, { "key": "B", "text": "storage1 and storage2 only" }, { "key": "C", "text": "storage3 and storage4 only" }, { "key": "D", "text": "storage1, storage2, and storage3 only" }, { "key": "E", "text": "storage1, storage2, storage3, and storage4" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Lifecycle management policies are supported for block blobs and append blobs in general-purpose v2,\npremium block blob, and Blob Storage accounts.\nThe lifecycle management feature is available in all Azure regions for general purpose v2 (GPv2) accounts,\nblob storage accounts, premium block blobs storage accounts, and Azure Data Lake Storage Gen2 accounts.", "reference": "https://docs.microsoft.com/en-us/azure/storage/blobs/storage-lifecycle-management-concepts?tabs=azure-\nportal\nYou create an Azure Storage account named contosostorage.", "references": [ "https://docs.microsoft.com/en-us/azure/storage/blobs/storage-lifecycle-management-concepts?tabs=azure-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 192, "pdfId": 192, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/192" }, "markersInGap": [], "questionText": "You plan to create a file share named data.\nUsers need to map a drive to the data file share from home computers that run Windows 10.\nWhich outbound port should you open between the home computers and the data file share?\nA.\n80\nB.\n443\nC.\n445\nD.\n3389", "stem": "You plan to create a file share named data. Users need to map a drive to the data file share from home computers that run Windows 10. Which outbound port should you open between the home computers and the data file share", "options": [ { "key": "A", "text": "80" }, { "key": "B", "text": "443" }, { "key": "C", "text": "445" }, { "key": "D", "text": "3389" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Server Message Block (SMB) is used to connect to an Azure file share over the internet. The SMB protocol\nrequires TCP port 445 to be open.\nIncorrect Answers:\nA: Port 80 is required for HTTP to a web server\nB: Port 443 is required for HTTPS to a web server\nD: Port 3389443 is required for Remote desktop protocol (RDP) connections", "reference": "https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows", "references": [ "https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 193, "pdfId": 193, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/193" }, "markersInGap": [], "questionText": "You have an Azure subscription named Subscription1.\nYou have 5 TB of data that you need to transfer to Subscription1.\nYou plan to use an Azure Import/Export job.\nWhat can you use as the destination of the imported data?\nA.\nAzure File Storage\nB.\nan Azure Cosmos DB database\nC.\nAzure Data Factory\nD.\nAzure SQL Database", "stem": "You have an Azure subscription named Subscription1. You have 5 TB of data that you need to transfer to Subscription1. You plan to use an Azure Import/Export job. What can you use as the destination of the imported data", "options": [ { "key": "A", "text": "Azure File Storage" }, { "key": "B", "text": "an Azure Cosmos DB database" }, { "key": "C", "text": "Azure Data Factory" }, { "key": "D", "text": "Azure SQL Database" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "\"Azure Import/Export service is used to securely import large amounts of data to Azure Blob storage and\nAzure Files by shipping disk drives to an Azure datacenter.\"", "reference": "https://docs.microsoft.com/en-us/azure/import-export/storage-import-export-service", "references": [ "https://docs.microsoft.com/en-us/azure/import-export/storage-import-export-service" ], "note": "Each correct selection is worth one point\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 194, "pdfId": 194, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/194" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1- Yes. VirtualNetworkRules & IpRules are blank, with the default action Allow.\nBox 2- Yes. Individual blobs can be set to the archive tier - ref.https://docs.microsoft.com/en-\nus/azure/storage/blobs/access-tiers-overview\nBob 3. No. To access blob data in the Azure portal with Azure AD credentials, a user must have the following\nrole assignments:\nA data access role, such as Storage Blob Data Contributor\nThe Azure Resource Manager Reader role", "reference": "https://docs.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access?tabs=portal", "references": [ "https://docs.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access?tabs=portal" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 195, "pdfId": 195, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/195" }, "markersInGap": [ 195 ], "questionText": "You have an Azure subscription that contains a storage account named storage1.\nYou have the devices shown in the following table.\n From which devices can you use AzCopy to copy data to storage1?\nA.\nDevice 1 only\nB.\nDevice1, Device2 and Device3\nC.\nDevice1 and Device2 only\nD.\nDevice1 and Device3 only", "stem": "You have an Azure subscription that contains a storage account named storage1. You have the devices shown in the following table. From which devices can you use AzCopy to copy data to storage1", "options": [ { "key": "A", "text": "Device 1 only" }, { "key": "B", "text": "Device1, Device2 and Device3" }, { "key": "C", "text": "Device1 and Device2 only" }, { "key": "D", "text": "Device1 and Device3 only" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B:Device1, Device2 and Device3.\nAz Copy is supported in all these three operating systems.\nhttps://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10#download-azcopy", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 196, "pdfId": 196, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/196" }, "markersInGap": [], "questionText": "You have an Azure Storage account named storage1 that contains a blob container named container1.\nYou need to prevent new content added to container1 from being modified for one year.\nWhat should you configure?\nA.\nthe access tier\nB.\nan access policy\nC.\nthe Access control (IAM) settings\nD.\nthe access level", "stem": "You have an Azure Storage account named storage1 that contains a blob container named container1. You need to prevent new content added to container1 from being modified for one year. What should you configure", "options": [ { "key": "A", "text": "the access tier" }, { "key": "B", "text": "an access policy" }, { "key": "C", "text": "the Access control (IAM) settings" }, { "key": "D", "text": "the access level" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B.an access policy.\nUsing SAS in conjunction with a stored Access Policy the desired outcome can be achieved: \"You can use a\nstored access policy to change the start time, expiry time, or permissions for a signature. You can also use a\nstored access policy to revoke a signature after it has been issued.", "reference": "https://docs.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy", "references": [ "https://docs.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 197, "pdfId": 197, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/197" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1) On October 10, you can read Dep1File1.docx: \"No\"\n2) On October 10, you can read File2.docx: \"Yes\"\n3) On October 10, you can read File3.docx: \"Yes\"\nCool Storage can be read immediately, but archived one needs to first be rehydrated.\nUsage scenarios for the cool access tier include:\nShort-term data backup and disaster recovery.\nOlder data sets that aren't used frequently, but are expected to be available for immediate access.\nLarge data sets that need to be stored in a cost-effective way while other data is being gathered for\nprocessing.\nTo learn how to move a blob to the hot or cool tier, see Set a blob's access tier.\nData in the cool tier has slightly lower availability, but offers the same high durability, retrieval latency, and\nthroughput characteristics as the hot tier. For data in the cool tier, slightly lower availability and higher access\ncosts may be acceptable trade-offs for lower overall storage costs, as compared to the hot tier. For more\ninformation, see SLA for storage.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nA.\nStorage Account Contributor\nB.\nStorage Blob Data Contributor\nC.\nReader\nD.\nContributor\nE.\nStorage Blob Data Reader", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 198, "pdfId": 198, "exam": "AZ-104", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/198" }, "markersInGap": [], "questionText": "You are configuring Azure Active Directory (Azure AD) authentication for an Azure Storage account named\nstorage1.\nYou need to ensure that the members of a group named Group1 can upload files by using the Azure portal. The\nsolution must use the principle of least privilege.\nWhich two roles should you configure for storage1? Each correct answer presents part of the solution.\nNOTE: Each correct selection is worth one point.\nA.\nStorage Account Contributor\nB.\nStorage Blob Data Contributor\nC.\nReader\nD.\nContributor\nE.\nStorage Blob Data Reader", "stem": "You are configuring Azure Active Directory (Azure AD) authentication for an Azure Storage account named storage1. You need to ensure that the members of a group named Group1 can upload files by using the Azure portal. The solution must use the principle of least privilege. Which two roles should you configure for storage1? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "Storage Account Contributor" }, { "key": "B", "text": "Storage Blob Data Contributor" }, { "key": "C", "text": "Reader" }, { "key": "D", "text": "Contributor" }, { "key": "E", "text": "Storage Blob Data Reader" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "To access blob data in the Azure portal with Azure AD credentials, a user must have the following role\nassignments:\n* A data access role, such as Storage Blob Data Reader or Storage Blob Data Contributor\n* The Azure Resource Manager Reader role, at a minimum\nThe Reader role is an Azure Resource Manager role that permits users to view storage account resources, but\nnot modify them. It does not provide read permissions to data in Azure Storage, but only to account\nmanagement resources. The Reader role is necessary so that users can navigate to blob containers in the\nAzure portal.", "reference": "https://docs.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access", "references": [ "https://docs.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access" ], "note": "in order from least to greatest permissions:\nThe Reader and Data Access role -\nThe Storage Account Contributor role", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 199, "pdfId": 199, "exam": "AZ-104", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/199" }, "markersInGap": [], "questionText": "HOTSPOT -\nYou have an Azure Storage account named storage1 that stores images.\nYou need to create a new storage account and replicate the images in storage1 to the new account by using object\nreplication.\nHow should you configure the new account? To answer, select the appropriate options in the answer area.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You have an Azure Storage account named storage1 that stores images. You need to create a new storage account and replicate the images in storage1 to the new account by using object replication. How should you configure the new account? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Account type: StorageV2 or BlobStorage only\nObject type to create in the new account: Container\nObject Replication supports General Purpose V2 and Premium Blob accounts.\nBlob versioning should be enabled on both the source and destination storage account.\nChange feed is enabled on the source storage account.", "reference": "https://docs.microsoft.com/en-us/azure/storage/blobs/object-replication-overview", "references": [ "https://docs.microsoft.com/en-us/azure/storage/blobs/object-replication-overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 200, "pdfId": 200, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/200" }, "markersInGap": [], "questionText": "You have an on-premises server that contains a folder named D:\\Folder1.\nYou need to copy the contents of D:\\Folder1 to the public container in an Azure Storage account named\ncontosodata.\nWhich command should you run?\nA.\nhttps://contosodata.blob.core.windows.net/public\nB.\nazcopy sync D:\\folder1 https://contosodata.blob.core.windows.net/public --snapshot\nC.\nazcopy copy D:\\folder1 https://contosodata.blob.core.windows.net/public --recursive\nD.\naz storage blob copy start-batch D:\\Folder1 https://contosodata.blob.core.windows.net/public", "stem": "You have an on-premises server that contains a folder named D:\\Folder1. You need to copy the contents of D:\\Folder1 to the public container in an Azure Storage account named contosodata. Which command should you run", "options": [ { "key": "A", "text": "https://contosodata.blob.core.windows.net/public" }, { "key": "B", "text": "azcopy sync D:\\folder1 https://contosodata.blob.core.windows.net/public --snapshot" }, { "key": "C", "text": "azcopy copy D:\\folder1 https://contosodata.blob.core.windows.net/public --recursive" }, { "key": "D", "text": "az storage blob copy start-batch D:\\Folder1 https://contosodata.blob.core.windows.net/public" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "The azcopy copy command copies a directory (and all of the files in that directory) to a blob container. The\nresult is a directory in the container by the same name.\nIncorrect Answers:\nB: The azcopy sync command replicates the source location to the destination location. However, the file is\nskipped if the last modified time in the destination is more recent.\nD: The az storage blob copy start-batch command copies multiple blobs to a blob container.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-blobs\nhttps://docs.microsoft.com/en-us/azure/storage/common/storage-ref-azcopy-copy", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-blobs", "https://docs.microsoft.com/en-us/azure/storage/common/storage-ref-azcopy-copy" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 201, "pdfId": 201, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/201" }, "markersInGap": [], "questionText": "You have an Azure subscription.\nIn the Azure portal, you plan to create a storage account named storage1 that will have the following settings:\n✑\n Performance: Standard\n✑\n Replication: Zone-redundant storage (ZRS)\n✑\n Access tier (default): Cool\n✑\n Hierarchical namespace: Disabled\nYou need to ensure that you can set Account kind for storage1 to BlockBlobStorage.\nWhich setting should you modify first?\nA.\nPerformance\nB.\nReplication\nC.\nAccess tier (default)\nD.\nHierarchical namespace", "stem": "You have an Azure subscription. In the Azure portal, you plan to create a storage account named storage1 that will have the following settings: ✑ Performance: Standard ✑ Replication: Zone-redundant storage (ZRS) ✑ Access tier (default): Cool ✑ Hierarchical namespace: Disabled You need to ensure that you can set Account kind for storage1 to BlockBlobStorage. Which setting should you modify first", "options": [ { "key": "A", "text": "Performance" }, { "key": "B", "text": "Replication" }, { "key": "C", "text": "Access tier (default)" }, { "key": "D", "text": "Hierarchical namespace" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Select Standard performance for general-purpose v2 storage accounts (default). This type of account is\nrecommended by Microsoft for most scenarios. For more information, see Types of storage accounts.\nSelect Premium for scenarios requiring low latency. After selecting Premium, select the type of premium\nstorage account to create. The following types of premium storage accounts are available:\nBlock blobs\nFile shares\nPage blobs", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview\nhttps://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-performance-tiers", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview", "https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-performance-tiers" ], "note": "Each correct selection is worth one point.\nSelect and Place:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 202, "pdfId": 202, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/202" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: A shared access signature (SAS) token.\nYou can provide authorization credentials by using Azure Active Directory (AD), or by using a Shared Access\nSignature (SAS) token.\nFor Blob storage you can use Azure AD & SAS.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10\nYou create an Azure Storage account.", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10" ], "note": "In the current release, if you plan to copy blobs between storage accounts, you'll have to append a SAS\ntoken to each source URL. You can omit the SAS token only from the destination URL.\nBox 2: A shared access signature (SAS) token.\nFor File storage you can only use SAS.\nReference:\nhttps://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10\nYou create an Azure Storage account.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 203, "pdfId": 203, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/203" }, "markersInGap": [], "questionText": "You plan to add 10 blob containers to the storage account.\nFor one of the containers, you need to use a different key to encrypt data at rest.\nWhat should you do before you create the container?\nA.\nGenerate a shared access signature (SAS).\nB.\nModify the minimum TLS version.\nC.\nRotate the access keys.\nD.\nCreate an encryption scope.", "stem": "You plan to add 10 blob containers to the storage account. For one of the containers, you need to use a different key to encrypt data at rest. What should you do before you create the container", "options": [ { "key": "A", "text": "Generate a shared access signature (SAS)." }, { "key": "B", "text": "Modify the minimum TLS version." }, { "key": "C", "text": "Rotate the access keys." }, { "key": "D", "text": "Create an encryption scope." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Encryption scopes enable you to manage encryption with a key that is scoped to a container or an individual\nblob. You can use encryption scopes to create secure boundaries between data that resides in the same\nstorage account but belongs to different customers.", "reference": "https://docs.microsoft.com/en-us/azure/storage/blobs/encryption-scope-overview", "references": [ "https://docs.microsoft.com/en-us/azure/storage/blobs/encryption-scope-overview" ], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 204, "pdfId": 204, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/204" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "No\nNo\nNo\nOn June 6, File1 will be in archive because File1 is in container 1, and rule 1 applies 3 days after june 1.\nOn June 1, File2 will still be in Hot tier because File2 is in container2, Rule3 and Rule4 havent hit yet.\nOn June 16, File2 will be deleted because Rule3 applies 10 days after June 1.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 205, "pdfId": 205, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/205" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "No\nNo\nYes\ndeleteRetentionPolicy is 7 days, so can not be restored after 7 days. Means, backup is deleted after 7 days.\nallowBlobPublicAccess is true, so anyone can access the blob, not just on Azure.\nkind is Standard_LRS, so 3 local copies are stored.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 206, "pdfId": 206, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/206" }, "markersInGap": [], "questionText": "You have an on-premises server that contains a folder named D:\\Folder1.\nYou need to copy the contents of D:\\Folder1 to the public container in an Azure Storage account named\ncontosodata.\nWhich command should you run?\nA.\naz storage blob copy start D:\\Folder1 https://contosodata.blob.core.windows.net/public\nB.\nazcopy sync D:\\folder1 https://contosodata.blob.core.windows.net/public --snapshot\nC.\nazcopy copy D:\\folder1 https://contosodata.blob.core.windows.net/public --recursive\nD.\naz storage blob copy start-batch D:\\Folder1 https://contosodata.blob.core.windows.net/public", "stem": "You have an on-premises server that contains a folder named D:\\Folder1. You need to copy the contents of D:\\Folder1 to the public container in an Azure Storage account named contosodata. Which command should you run", "options": [ { "key": "A", "text": "az storage blob copy start D:\\Folder1 https://contosodata.blob.core.windows.net/public" }, { "key": "B", "text": "azcopy sync D:\\folder1 https://contosodata.blob.core.windows.net/public --snapshot" }, { "key": "C", "text": "azcopy copy D:\\folder1 https://contosodata.blob.core.windows.net/public --recursive" }, { "key": "D", "text": "az storage blob copy start-batch D:\\Folder1 https://contosodata.blob.core.windows.net/public" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "A: URL of the Storage Account.\nB: The azcopy sync command replicates the source location to the destination location. However, the file is\nskipped if the last modified time in the destination is more recent.\nC: The azcopy copy command copies a directory (and all the files in that directory) to a blob container. The\nresult is a directory in the container by the same name.\nD: The az storage blob copy start-batch command copies multiple blobs to a blob container.", "reference": "https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-blobs\nhttps://docs.microsoft.com/en-us/azure/storage/common/storage-ref-azcopy-copy", "references": [ "https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-blobs", "https://docs.microsoft.com/en-us/azure/storage/common/storage-ref-azcopy-copy" ], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 207, "pdfId": 207, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/207" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "tierToArchive and prefixMatch\n- tierToArchive because it's the lowest cost tier, and doesnt say anyhting about needing to read data after 90\ndays. However, rehydration costs will occur if they did need to read it.\n- prefixMatch because we only want the blob in the container1.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 208, "pdfId": 208, "exam": "AZ-104", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/208" }, "markersInGap": [ 208 ], "questionText": "DRAG DROP\n -\nYou have an Azure subscription that contains a virtual machine named VM1.\nYou need to back up VM1. The solution must ensure that backups are stored across three availability zones in the\nprimary region.\nWhich three actions should you perform in sequence? To answer, move the appropriate actions from the list of\nactions to the answer area and arrange them in the correct order.", "stem": "You have an Azure subscription that contains a virtual machine named VM1. You need to back up VM1. The solution must ensure that backups are stored across three availability zones in the primary region. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1. Create a Recovery Services vault: This is the first step to set up a backup solution in Azure. The Recovery\nServices vault will store the backup data.\n2. Set Replication to Zone redundant storage (ZRS): This ensures that the backup data is replicated across\nthree availability zones in the primary region, providing high availability and durability.\n3. For VM1, create a backup policy and configure the backup: This step involves creating a backup policy that\ndefines the schedule and retention of the backups, and then applying this policy to VM1 to start the backup\nprocess.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 209, "pdfId": 209, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/209" }, "markersInGap": [], "questionText": "You have an Azure subscription named Subscription1.\nYou have 5 TB of data that you need to transfer to Subscription1.\nYou plan to use an Azure Import/Export job.\nWhat can you use as the destination of the imported data?\nA.\nan Azure Cosmos DB database\nB.\nAzure File Storage\nC.\nAzure SQL Database\nD.\na virtual machine", "stem": "You have an Azure subscription named Subscription1. You have 5 TB of data that you need to transfer to Subscription1. You plan to use an Azure Import/Export job. What can you use as the destination of the imported data", "options": [ { "key": "A", "text": "an Azure Cosmos DB database" }, { "key": "B", "text": "Azure File Storage" }, { "key": "C", "text": "Azure SQL Database" }, { "key": "D", "text": "a virtual machine" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "https://learn.microsoft.com/en-us/azure/import-export/storage-import-export-service\nAzure Import/Export service is used to securely import large amounts of data to Azure Blob storage and Azure\nFiles by shipping disk drives to an Azure datacenter. This service can also be used to transfer data from Azure\nBlob storage to disk drives and ship to your on-premises sites. Data from one or more disk drives can be\nimported either to Azure Blob storage or Azure Files.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 210, "pdfId": 210, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/210" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\nYou need to perform the tasks shown in the following table.\nWhich tasks can you perform by using Azure Storage Explorer?\nA.\nTask1 and Task3 only\nB.\nTask1, Task2, and Task3 only\nC.\nTask1, Task3, and Task4 only\nD.\nTask2, Task3, and Task4 only\nE.\nTask1, Task2, Task3, and Task4", "stem": "You have an Azure subscription that contains the resources shown in the following table. You need to perform the tasks shown in the following table. Which tasks can you perform by using Azure Storage Explorer", "options": [ { "key": "A", "text": "Task1 and Task3 only" }, { "key": "B", "text": "Task1, Task2, and Task3 only" }, { "key": "C", "text": "Task1, Task3, and Task4 only" }, { "key": "D", "text": "Task2, Task3, and Task4 only" }, { "key": "E", "text": "Task1, Task2, Task3, and Task4" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Azure Storage Explorer cannot be used to create a storage account. It is a tool designed to manage and\ninteract with existing Azure storage accounts and their associated resources, such as blobs, files, queues, and\ntables. However, it does not have the functionality to create storage accounts.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 211, "pdfId": 211, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/211" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1.Access Control (IAM).\nLocated under the \"Diagnose and solve problems\" section.\nIAM (Identity and Access Management) allows role-based access control (RBAC) for managing permissions to\nthe storage account.\n2.Geo-replication.\nFound under \"Data management\" settings.\nThis feature is used for replicating storage account data across different Azure regions to ensure high\navailability and disaster recovery.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 212, "pdfId": 212, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/212" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains a storage account named storage1.\nYou plan to create a blob container named container1.\nYou need to use customer-managed key encryption for container1.\nWhich key should you use?\nA.\nan EC key that uses the P-384 curve only\nB.\nan EC key that uses the P-521 curve only\nC.\nan EC key that uses the P-384 curve or P-521 curve only\nD.\nan RSA key with a key size of 4096 only\nE.\nan RSA key type with a key size of 2048, 3072, or 4096 only", "stem": "You have an Azure subscription that contains a storage account named storage1. You plan to create a blob container named container1. You need to use customer-managed key encryption for container1. Which key should you use", "options": [ { "key": "A", "text": "an EC key that uses the P-384 curve only" }, { "key": "B", "text": "an EC key that uses the P-521 curve only" }, { "key": "C", "text": "an EC key that uses the P-384 curve or P-521 curve only" }, { "key": "D", "text": "an RSA key with a key size of 4096 only" }, { "key": "E", "text": "an RSA key type with a key size of 2048, 3072, or 4096 only" } ], "answer": { "raw": "E", "keys": [ "E" ] }, "explanation": "E: an RSA key type with a key size of 2048, 3072, or 4096 only.\nFor Azure Storage accounts, customer-managed keys (CMK) can be used for encryption. When using CMKs,\nAzure supports RSA keys with key sizes of 2048, 3072, or 4096 bits. These keys can be managed in Azure Key\nVault and used to encrypt and decrypt data in your storage account.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 213, "pdfId": 213, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/213" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "key1: Table1, folder1, and container1.\nSAS1: Table 1 only.\nhttps://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage\nWhen you create a storage account, Azure generates two 512-bit storage account access keys for that\naccount. These keys can be used to authorize access to data in your storage account via Shared Key\nauthorization.\nYour storage account access keys are similar to a root password for your storage account. Always be careful\nto protect your access keys.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 214, "pdfId": 214, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/214" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Max stored access policies: 3, because max total of stored access policy is 5 and we already have 2, so\nadditional 3 available.\nMax immutable blob storage: 1, because max total of immutable blob storage policy is 2 - one Legal hold\npolicy and one Time-based retention policy. We already have one, so additional 1 available.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 215, "pdfId": 215, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/215" }, "markersInGap": [ 215 ], "questionText": "You have an Azure subscription named Subscription1.\nYou have 5 TB of data that you need to transfer to Subscription1.\nYou plan to use an Azure Import/Export job.\nWhat can you use as the destination of the imported data?\n A.\nAzure Blob Storage\nB.\nAzure Data Lake Store\nC.\nAzure SQL Database\nD.\na virtual machine", "stem": "You have an Azure subscription named Subscription1. You have 5 TB of data that you need to transfer to Subscription1. You plan to use an Azure Import/Export job. What can you use as the destination of the imported data", "options": [ { "key": "A", "text": "Azure Blob Storage" }, { "key": "B", "text": "Azure Data Lake Store" }, { "key": "C", "text": "Azure SQL Database" }, { "key": "D", "text": "a virtual machine" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Azure Import/Export service is used to securely import large amounts of data to Azure Blob storage and Azure\nFiles by shipping disk drives to an Azure datacenter. This service can also be used to transfer data from Azure\nBlob storage to disk drives and ship to your on-premises sites. Data from one or more disk drives can be\nimported either to Azure Blob storage or Azure Files. The maximum size of an Azure Files Resource of a file\nshare is 5 TB.", "reference": null, "references": [], "note": "There are several versions of this question in the exam. The question has two correct answers:\n1. Azure File Storage\nor\n2. Azure Blob Storage", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 216, "pdfId": 216, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/216" }, "markersInGap": [], "questionText": "You have an Azure subscription. The subscription contains a storage account named storage1 that has the lifecycle\nmanagement rules shown in the following table.\nOn June 1, you store a blob named File1 in the Hot access tier of storage1.\nWhat is the state of File1 on June 7?\nA.\nstored in the Cool access tier\nB.\nstored in the Archive access tier\nC.\nstored in the Hot access tier\nD.\ndeleted", "stem": "You have an Azure subscription. The subscription contains a storage account named storage1 that has the lifecycle management rules shown in the following table. On June 1, you store a blob named File1 in the Hot access tier of storage1. What is the state of File1 on June 7", "options": [ { "key": "A", "text": "stored in the Cool access tier" }, { "key": "B", "text": "stored in the Archive access tier" }, { "key": "C", "text": "stored in the Hot access tier" }, { "key": "D", "text": "deleted" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "If you define more than one action on the same blob, lifecycle management applies the least expensive action\nto the blob. For example, action delete is cheaper than action tierToArchive. Action tierToArchive is cheaper\nthan action tierToCool.\nhttps://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 217, "pdfId": 217, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/217" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1 - storage1, storage2, storage3\nLifecycle management policies are supported for block blobs and append blobs in general-purpose v2,\npremium block blob, and Blob Storage accounts.\n2 - storage2 only.\nOnly storage accounts that are configured for LRS, GRS, or RA-GRS support moving blobs to the archive tier.\nThe archive tier isn't supported for ZRS, GZRS, or RA-GZRS accounts.\nhttps://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview\nhttps://learn.microsoft.com/en-us/azure/storage/blobs/access-tiers-overview", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 218, "pdfId": 218, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/218" }, "markersInGap": [ 218 ], "questionText": "You have an Azure subscription named Subscription1.\nYou have 5 TB of data that you need to transfer to Subscription1.\nYou plan to use an Azure Import/Export job.\nWhat can you use as the destination of the imported data?\nA.\nan Azure Cosmos DB database\nB.\nAzure Data Lake Store\nC.\nAzure Blob storage\nD.\nAzure Data Factory", "stem": "You have an Azure subscription named Subscription1. You have 5 TB of data that you need to transfer to Subscription1. You plan to use an Azure Import/Export job. What can you use as the destination of the imported data", "options": [ { "key": "A", "text": "an Azure Cosmos DB database" }, { "key": "B", "text": "Azure Data Lake Store" }, { "key": "C", "text": "Azure Blob storage" }, { "key": "D", "text": "Azure Data Factory" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "https://learn.microsoft.com/en-us/azure/import-export/storage-import-export-service\nAzure Import/Export service is used to securely import large amounts of data to Azure Blob storage and Azure\nFiles by shipping disk drives to an Azure datacenter. This service can also be used to transfer data from Azure\nBlob storage to disk drives and ship to your on-premises sites. Data from one or more disk drives can be\nimported either to Azure Blob storage or Azure Files.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 219, "pdfId": 219, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/219" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1. daysAfterModificationGreaterThan\n2. Blockblob\nhttps://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-overview#rule-actions\ndaysAfterModificationGreaterThan\n- The condition for actions on a current version of a blob\nTiering is not yet supported in a premium block blob storage account. For all other accounts, tiering is allowed\nonly on block blobs and not for append and page blobs.\ntierToCool\n- Supported for blockBlob", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 220, "pdfId": 220, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/220" }, "markersInGap": [], "questionText": "You have an Azure subscription named Subscription1.\nYou have 5 TB of data that you need to transfer to Subscription1.\nYou plan to use an Azure Import/Export job.\nWhat can you use as the destination of the imported data?\nA.\nan Azure Cosmos DB database\nB.\nAzure Blob Storage\nC.\nAzure SQL Database\nD.\nthe Azure File Sync Storage Sync Service", "stem": "You have an Azure subscription named Subscription1. You have 5 TB of data that you need to transfer to Subscription1. You plan to use an Azure Import/Export job. What can you use as the destination of the imported data", "options": [ { "key": "A", "text": "an Azure Cosmos DB database" }, { "key": "B", "text": "Azure Blob Storage" }, { "key": "C", "text": "Azure SQL Database" }, { "key": "D", "text": "the Azure File Sync Storage Sync Service" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "https://learn.microsoft.com/en-us/azure/import-export/storage-import-export-serviceAzure Import/Export\nservice is used to securely import large amounts of data to Azure Blob storage and Azure Files by shipping\ndisk drives to an Azure datacenter. This service can also be used to transfer data from Azure Blob storage to\ndisk drives and ship to your on-premises sites. Data from one or more disk drives can be imported either to\nAzure Blob storage or Azure Files.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 221, "pdfId": 221, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/221" }, "markersInGap": [], "questionText": "You plan to create an Azure Storage account named storage1 that will contain a file share named share1.\nYou need to ensure that share1 can support SMB Multichannel. The solution must minimize costs.\nHow should you configure storage?\nA.\nPremium performance with locally-redundant storage (LRS)\nB.\nStandard performance with zone-redundant storage (ZRS)\nC.\nPremium performance with geo-redundant storage (GRS)\nD.\nStandard performance with locally-redundant storage (LRS)", "stem": "You plan to create an Azure Storage account named storage1 that will contain a file share named share1. You need to ensure that share1 can support SMB Multichannel. The solution must minimize costs. How should you configure storage", "options": [ { "key": "A", "text": "Premium performance with locally-redundant storage (LRS)" }, { "key": "B", "text": "Standard performance with zone-redundant storage (ZRS)" }, { "key": "C", "text": "Premium performance with geo-redundant storage (GRS)" }, { "key": "D", "text": "Standard performance with locally-redundant storage (LRS)" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A: Premium performance with locally-redundant storage (LRS).\nPremium Performance.\nPremium file shares in Azure Storage provide high-performance, low-latency storage, which is necessary to\nsupport the SMB Multichannel feature. Standard performance tiers do not support this feature.\nLocally-Redundant Storage (LRS).\nLocally-redundant storage (LRS) is the most cost-effective redundancy option for Azure Storage. It replicates\nyour data within a single datacenter in the region and is less expensive compared to geo-redundant storage\n(GRS) and zone-redundant storage (ZRS).", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 222, "pdfId": 222, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/222" }, "markersInGap": [], "questionText": "You have an Azure subscription named Subscription1.\nYou have 5 TB of data that you need to transfer to Subscription1.\nYou plan to use an Azure Import/Export job.\nWhat can you use as the destination of the imported data?\nA.\nAzure Data Lake Store\nB.\nAzure File Storage\nC.\nAzure SQL Database\nD.\nthe Azure File Sync Storage Sync Service", "stem": "You have an Azure subscription named Subscription1. You have 5 TB of data that you need to transfer to Subscription1. You plan to use an Azure Import/Export job. What can you use as the destination of the imported data", "options": [ { "key": "A", "text": "Azure Data Lake Store" }, { "key": "B", "text": "Azure File Storage" }, { "key": "C", "text": "Azure SQL Database" }, { "key": "D", "text": "the Azure File Sync Storage Sync Service" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure Import/Export service is used to securely import large amounts of data to Azure Blob storage and Azure\nFiles by shipping disk drives to an Azure datacenter. This service can also be used to transfer data from Azure\nBlob storage to disk drives and ship to your on-premises sites. Data from one or more disk drives can be\nimported either to Azure Blob storage or Azure Files.", "reference": "https://learn.microsoft.com/en-us/azure/import-export/storage-import-export-service", "references": [ "https://learn.microsoft.com/en-us/azure/import-export/storage-import-export-service" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 223, "pdfId": 223, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/223" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains a storage account named storage1.\nYou plan to use conditions when assigning role-based access control (RBAC) roles to storage1.\nWhich storage1 services support conditions when assigning roles?\nA.\ncontainers only\nB.\nfile shares only\nC.\ntables only\nD.\nqueues only\nE.\ncontainers and queues only\nF.\nfiles shares and tables only", "stem": "You have an Azure subscription that contains a storage account named storage1. You plan to use conditions when assigning role-based access control (RBAC) roles to storage1. Which storage1 services support conditions when assigning roles", "options": [ { "key": "A", "text": "containers only" }, { "key": "B", "text": "file shares only" }, { "key": "C", "text": "tables only" }, { "key": "D", "text": "queues only" }, { "key": "E", "text": "containers and queues only" }, { "key": "F", "text": "files shares and tables only" } ], "answer": { "raw": "E", "keys": [ "E" ] }, "explanation": "containers and queues only.\n\"Currently, conditions can be added to built-in or custom role assignments that have blob storage or queue\nstorage data actions. \"\nhttps://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-overview#where-can-\nconditions-be-added", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 224, "pdfId": 224, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/224" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "NYY\nVNET is created by default but we can connect to an existing VNET\"you can create an AKS cluster that uses\nkubenet and connect to an existing virtual network subnet\"\"With kubenet, a route table must exist on your\ncluster subnet(s). AKS supports bringing your own existing subnet and route table.\n\"https://learn.microsoft.com/en-us/azure/aks/configure-kubenet\nYou plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set\nby using an Azure Resource Manager template.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 225, "pdfId": 225, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/225" }, "markersInGap": [], "questionText": "You need to ensure that NGINX is available on all the virtual machines after they are deployed.\nWhat should you use?\nA.\nthe Publish-AzVMDscConfiguration cmdlet\nB.\nAzure Application Insights\nC.\na Desired State Configuration (DSC) extension\nD.\nAzure AD Application Proxy", "stem": "You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use", "options": [ { "key": "A", "text": "the Publish-AzVMDscConfiguration cmdlet" }, { "key": "B", "text": "Azure Application Insights" }, { "key": "C", "text": "a Desired State Configuration (DSC) extension" }, { "key": "D", "text": "Azure AD Application Proxy" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Answer is C) a Desired State Configuration (DSC) extension\nTo ensure that NGINX is available on all the virtual machines in a virtual machine scale set, you can use the\nDesired State Configuration (DSC) extension.\nOption A (the Publish-AzVMDscConfiguration cmdlet) is used to generate a configuration file for DSC.\nOption B (Azure Application Insights) is a monitoring service that provides application performance and\navailability telemetry.\nOption D (Azure AD Application Proxy) is a service that enables remote access to on-premises applications.\nTherefore, the correct option for this scenario is C: a Desired State Configuration (DSC) extension. The DSC\nextension can be used to configure and manage the state of the virtual machines in the virtual machine scale\nset, including the installation of NGINX.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 226, "pdfId": 226, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/226" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1.\nDefault Routing Tier\nThe default routing tier influences how network traffic is managed and priced.\nChoosing an appropriate routing tier helps reduce egress (outbound) data transfer costs.\nSome tiers optimize data delivery based on cost-efficient paths, ensuring lower expenses for accessing\nresources.\nOften used in cloud environments like Microsoft Azure or Google Cloud, where routing options affect data\ntransfer pricing.\n2.\nEnable Support for Customer-Managed Keys.\nCustomer-managed keys (CMKs) allow users to control encryption keys rather than relying on provider-\nmanaged encryption.\nOrganizations needing higher security and compliance (such as GDPR, HIPAA) can enforce their own key\nmanagement policies.\nProvides enhanced security by ensuring that only authorized users can access or decrypt stored data.\nThis setting is usually modifiable after the initial creation of a storage account or database in cloud platforms.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 227, "pdfId": 227, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/227" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Key:\nRSA.\nRSA is an asymmetric cryptographic algorithm widely used for secure data transmission.\nIt relies on the mathematical difficulty of factoring large prime numbers.\nRSA is commonly used for encryption, digital signatures, and key exchange in secure communication\nprotocols.\nBit Length :\n4096\nThe bit length determines the security strength of the RSA key.\nA 4096-bit RSA key is considered highly secure for most applications, as it provides strong resistance against\nbrute-force attacks.\nLonger key lengths increase security but also require more computational power for encryption and\ndecryption.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 228, "pdfId": 228, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/228" }, "markersInGap": [ 228 ], "questionText": "You have an Azure Storage account that contains 5,000 blobs accessed by multiple users.\nYou need to ensure that the users can view only specific blobs based on blob index tags.\nWhat should you include in the solution?\nA.\na role assignment condition\nB.\na stored access policy\nC.\njust-in-time (JIT) VM access\nD.\na shared access signature (SAS)", "stem": "You have an Azure Storage account that contains 5,000 blobs accessed by multiple users. You need to ensure that the users can view only specific blobs based on blob index tags. What should you include in the solution", "options": [ { "key": "A", "text": "a role assignment condition" }, { "key": "B", "text": "a stored access policy" }, { "key": "C", "text": "just-in-time (JIT) VM access" }, { "key": "D", "text": "a shared access signature (SAS)" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. A Role Assignment Condition.\nAzure Storage supports Azure RBAC (Role-Based Access Control) with role assignment conditions, allowing\nadministrators to grant access based on blob index tags. This means users can only view specific blobs that\nmatch the conditions defined in the role assignment.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 229, "pdfId": 229, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/229" }, "markersInGap": [], "questionText": "You have an Azure Storage account named storage1.\nFor storage1, you create an encryption scope named Scope1.\nWhich storage types can you encrypt by using Scope?\nA.\nfile shares only\nB.\ncontainers only\nC.\nfile shares and containers only\nD.\ncontainers and tables only\nE.\nfile shares, containers, and tables only\nF.\nfile shares, containers, tables, and queues", "stem": "You have an Azure Storage account named storage1. For storage1, you create an encryption scope named Scope1. Which storage types can you encrypt by using Scope", "options": [ { "key": "A", "text": "file shares only" }, { "key": "B", "text": "containers only" }, { "key": "C", "text": "file shares and containers only" }, { "key": "D", "text": "containers and tables only" }, { "key": "E", "text": "file shares, containers, and tables only" }, { "key": "F", "text": "file shares, containers, tables, and queues" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Containers only.\nEncryption scopes enable you to manage encryption at the level of an individual blob or container.\nThe encryption scope in Azure Storage is available for Azure Blob / Data Lake Gen2 storage account1. The key\nthat protects an encryption scope may be either a Microsoft-managed key or a customer-managed key in\nAzure Key Vault1. containers only as blobs are stored in containers in Azure Blob Storage.", "reference": "https://learn.microsoft.com/en-us/azure/storage/blobs/encryption-scope-manage?tabs=portal", "references": [ "https://learn.microsoft.com/en-us/azure/storage/blobs/encryption-scope-manage?tabs=portal" ], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 230, "pdfId": 230, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/230" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "​", "keys": [ "​" ] }, "explanation": "1. Perform All Actions on a Virtual Network\n\"Microsoft.Network/virtualNetworks/*\"\nThe asterisk (*) is a wildcard, which means full access to all operations on virtual networks.\nThis permission includes:\nCreating, updating, and deleting virtual networks.\nManaging subnets, peerings, and network configurations.\nThis is typically assigned to network administrators who need complete control over Azure Virtual Networks.\n2. View the Configuration Data of a Storage Account\n\"Microsoft.Storage/storageAccounts/read\"\nThis permission allows users to view (but not modify) the configuration and properties of a storage account.\nThis does not grant access to read/write data inside the storage account (such as blobs or files).\nIt is useful for auditors, monitoring teams, or read-only users who need to check storage settings without\nmaking changes.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 231, "pdfId": 231, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/231" }, "markersInGap": [], "questionText": "You have an Azure subscription named Subscription1.\nYou have 5 TB of data that you need to transfer to Subscription1.\nYou plan to use an Azure Import/Export job.\nWhat can you use as the destination of the imported data?\nA.\nAzure Data Factory\nB.\nthe Azure File Sync Storage Sync Service\nC.\nAzure File Storage\nD.\nAzure SQL Database", "stem": "You have an Azure subscription named Subscription1. You have 5 TB of data that you need to transfer to Subscription1. You plan to use an Azure Import/Export job. What can you use as the destination of the imported data", "options": [ { "key": "A", "text": "Azure Data Factory" }, { "key": "B", "text": "the Azure File Sync Storage Sync Service" }, { "key": "C", "text": "Azure File Storage" }, { "key": "D", "text": "Azure SQL Database" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Correct", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 232, "pdfId": 232, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/232" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Storage type: Premium SDD that uses zone-redundant storage (ZRS)\nHost-caching: Read-only\nRationale ZRS replicates to different locations Host caching: Write cache stores information in memory, no\nhost, no memory, no dataRedundancy options for Azure managed disks - Azure Virtual Machines | Microsoft\nLearnEnable and configure Azure VM disk cache with the Azure portal - Training | Microsoft Learn\nYou have an Azure virtual machine named VM1 and an Azure key vault named Vault1.\nOn VM1, you plan to configure Azure Disk Encryption to use a key encryption key (KEK).", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nA.\nSelect Azure Virtual machines for deployment.\nB.\nCreate a new key.\nC.\nCreate a new secret.\nD.\nConfigure a key rotation policy.\nE.\nSelect Azure Disk Encryption for volume encryption.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 233, "pdfId": 233, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/233" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. Create a new key.\nAzure Disk Encryption with KEK requires a key in the Key Vault to encrypt the disk encryption key (DEK).\nTherefore, you need to create a key in the key vault.\nE. Select Azure Disk Encryption for volume encryption.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 234, "pdfId": 234, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/234" }, "markersInGap": [], "questionText": "You need to select Azure Disk Encryption as it will integrate the key vault with the disk encryption process.\nYou have an Azure subscription that contains a virtual machine named VM1 and an Azure key vault named KV1.\nYou need to configure encryption for VM1. The solution must meet the following requirements:\n•Store and use the encryption key in KV1.\n•Maintain encryption if VM1 is downloaded from Azure.\n•Encrypt both the operating system disk and the data disks.\nWhich encryption method should you use?\nA.\ncustomer-managed keys\nB.\nConfidential disk encryption\nC.\nAzure Disk Encryption\nD.\nencryption at host", "stem": "You need to select Azure Disk Encryption as it will integrate the key vault with the disk encryption process. You have an Azure subscription that contains a virtual machine named VM1 and an Azure key vault named KV1. You need to configure encryption for VM1. The solution must meet the following requirements: •Store and use the encryption key in KV1. •Maintain encryption if VM1 is downloaded from Azure. •Encrypt both the operating system disk and the data disks. Which encryption method should you use", "options": [ { "key": "A", "text": "customer-managed keys" }, { "key": "B", "text": "Confidential disk encryption" }, { "key": "C", "text": "Azure Disk Encryption" }, { "key": "D", "text": "encryption at host" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "You can protect your managed disks by using Azure Disk Encryption for Linux VMs, which uses DM-Crypt, or\nAzure Disk Encryption for Windows VMs, which uses Windows BitLocker, to protect both operating system\ndisks and data disks with full volume encryption.\nEncryption keys and secrets are safeguarded in your Azure Key Vault subscription. By using the Azure Backup\nservice, you can back up and restore encrypted virtual machines (VMs) that use Key Encryption Key (KEK)\nconfiguration.\nReference:\nhttps://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-overview", "reference": null, "references": [], "note": "Each correct answer is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 235, "pdfId": 235, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/235" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Allowed resource types: Object (you want users to access a specific blob by name).\nAllowed permissions: Read (to allow downloading).", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 236, "pdfId": 236, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/236" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains a storage account named storage1. The storage1 account contains a\ncontainer named container1.\nYou need to configure access to container1. The solution must meet the following requirements:\n•Only allow read access.\n•Allow both HTTP and HTTPS protocols.\n•Apply access permissions to all the content in the container.\nWhat should you use?\nA.\nan access policy\nB.\na shared access signature (SAS)\nC.\nAzure Content Delivery Network (CDN)\nD.\naccess keys", "stem": "You have an Azure subscription that contains a storage account named storage1. The storage1 account contains a container named container1. You need to configure access to container1. The solution must meet the following requirements: •Only allow read access. •Allow both HTTP and HTTPS protocols. •Apply access permissions to all the content in the container. What should you use", "options": [ { "key": "A", "text": "an access policy" }, { "key": "B", "text": "a shared access signature (SAS)" }, { "key": "C", "text": "Azure Content Delivery Network (CDN)" }, { "key": "D", "text": "access keys" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. a shared access signature (SAS)\nShared Access Signatures (SAS) are used to grant limited access to specific resources in your storage\naccount while maintaining fine-grained control over the allowed operations, including read access. You can\ncreate a SAS token with the necessary permissions and then provide this token to the users or applications\nthat need access to the container.\nYou need to create an Azure Storage account named storage1. The solution must meet the following requirements:\n•Support Azure Data Lake Storage.\n•Minimize costs for infrequently accessed data.\n•Automatically replicate data to a secondary Azure region.", "reference": null, "references": [], "note": "Each correct answer is worth one point.\nA.\nzone-redundant storage (ZRS)\nB.\nthe Cool access tire\nC.\ngeo-redundant storage (GRS)\nD.\nthe Hot access tier\nE.\nhierarchical namespace", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 237, "pdfId": 237, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/237" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. The Cool access tier: The Cool access tier is suitable for infrequently accessed data and offers lower\nstorage costs compared to the Hot access tier.\nC. Geo-redundant storage (GRS): Geo-redundant storage replicates data to a secondary Azure region,\nproviding data redundancy and disaster recovery capabilities.\nE. Hierarchical namespace: The hierarchical namespace is required for Azure Data Lake Storage, as it enables\nthe storage account to support the data lake's file system structure.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 238, "pdfId": 238, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/238" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "A blob snapshot automatically moves to the Cool access tier after 15 days.\nYes .\nIncorrect Selection: Blob snapshots do not automatically move between tiers.\nIf an organization sets a Lifecycle Management policy, blobs can move to the Cool tier, but the minimum\nretention period is 30 days, not 15.\nA blob version in container2 automatically moves to the Archive access tier after 30 days.\nNo.\nCorrect Selection: Blob versions do not automatically move unless a Lifecycle Policy is configured.\nIf a Lifecycle Policy exists, blobs can be moved to Archive after a set period, but this is not the default\nbehavior.\nA rehydrated version automatically moves to the Archive access tier after 30 days.\nNo.\nCorrect Selection: Rehydrated blobs do not automatically move back to Archive.\nOnce a blob is rehydrated from Archive (moved to Hot/Cool), it stays there until a new policy moves it back to\nArchive.\nYou have an Azure subscription that contains the storage accounts shown in the following table.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 239, "pdfId": 239, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/239" }, "markersInGap": [], "questionText": "Which storage account can be converted to zone-redundant storage (ZRS) replication?\nA.\nstorage1\nB.\nstorage2\nC.\nstorage3\nD.\nstorage4", "stem": "Which storage account can be converted to zone-redundant storage (ZRS) replication", "options": [ { "key": "A", "text": "storage1" }, { "key": "B", "text": "storage2" }, { "key": "C", "text": "storage3" }, { "key": "D", "text": "storage4" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. storage2to convert to ZRS must the Kind be: Standard general-purpose v2 (StorageV2), Premium block\nblobs (BlockBlobStorage) or Premium file shares (FileStorage) and the Replication is from LRS possible (…\nfrom GRS/RA-GRS convert to LRS first)\nhttps://learn.microsoft.com/en-us/azure/storage/common/storage-redundancy#supported-storage-account-\ntypes\nhttps://learn.microsoft.com/en-us/azure/storage/common/redundancy-migration?tabs=portal#replication-\nchange-table", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 240, "pdfId": 240, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/240" }, "markersInGap": [ 240 ], "questionText": "You have an Azure subscription that contains the devices shown in the following table.\n On which devices can you install Azure Storage Explorer?\nA.\nDevice1 only\nB.\nDevice1 and Device2 only\nC.\nDevice1 and Device3 only\nD.\nDevice1, Device2, and Device3 only\nE.\nDevice1, Device3, and Device4 only", "stem": "You have an Azure subscription that contains the devices shown in the following table. On which devices can you install Azure Storage Explorer", "options": [ { "key": "A", "text": "Device1 only" }, { "key": "B", "text": "Device1 and Device2 only" }, { "key": "C", "text": "Device1 and Device3 only" }, { "key": "D", "text": "Device1, Device2, and Device3 only" }, { "key": "E", "text": "Device1, Device3, and Device4 only" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D: Device1, Device2, and Device3 only.\nAzure Storage Explorer is compatible with Windows, macOS, and Linux operating systems, which correspond\nto Device1, Device2, and Device3 in this context. Device4 does not meet the requirements for Azure Storage\nExplorer.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 241, "pdfId": 241, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/241" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1. Minimum Number of Copies of the Storage Account.\nThe selected value in the dropdown is\n3.\nThis likely refers to Locally Redundant Storage (LRS), which keeps three copies of the data within a single\nAzure region.\nOther redundancy options include:\nZRS (Zone Redundant Storage): Distributes copies across three availability zones.\nGRS (Geo-Redundant Storage): Replicates data across different regions.\nThus, selecting 3 is correct in this context as it aligns with Azure's replication methods.\n2. Reducing the Cost of Infrequently Accessed Data\nThe selected value is\n \"Access tier (default)\".\nAzure Storage offers different access tiers:\nHot Tier: Optimized for frequently accessed data.\nCool Tier: Suitable for infrequently accessed data, offering lower storage costs but higher access costs.\nArchive Tier: Used for long-term data storage at the lowest cost but with high retrieval latency.\nTo reduce costs for infrequently accessed data, moving data from Hot to Cool or Archive tiers is the correct\napproach.", "reference": null, "references": [], "note": "Each correct answer is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 242, "pdfId": 242, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/242" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1. Blob Types Selection.\nThe \"blobTypes\" field defines the type of Azure Blob Storage objects to filter.\nThe selected option\n\"blockBlob\"\n is one of the three possible blob types:\nAppend Blob: Used for logging and append-only scenarios.\nBlock Blob :The most commonly used blob type for storing general-purpose files.\nPage Blob: Used for Azure Virtual Machine disks.\nSince Block Blob is the most commonly used for general storage, selecting this makes sense.\n2. Prefix Match\n\"prefixMatch\" is used to filter blobs within a specific path or folder inside a container.\nThe selected option\n\"container1/finance\"\nmeans that only blobs inside the \"finance\" subdirectory of\n\"container1\" will be processed.\nThe other option \"container1/*\" would include all blobs within container1, but this is more restrictive.\nSince \"container1/finance\" is selected, it means the rule applies only to that specific subdirectory.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 243, "pdfId": 243, "exam": "AZ-104", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/243" }, "markersInGap": [ 243 ], "questionText": "HOTSPOT\n-\nYou have an Azure subscription that contains a storage account named storage1. The storage1 account contains\nblobs in a container named container1.\nYou plan to share access to storage1.\nYou need to generate a shared access signature (SAS). The solution must meet the following requirements:\n•Ensure that the SAS can only be used to enumerate and download blobs stored in container1.\n•Use the principle of least privilege.\nWhich three settings should you enable? To answer, select the appropriate settings in the answer area.", "stem": "You have an Azure subscription that contains a storage account named storage1. The storage1 account contains blobs in a container named container1. You plan to share access to storage1. You need to generate a shared access signature (SAS). The solution must meet the following requirements: •Ensure that the SAS can only be used to enumerate and download blobs stored in container1. •Use the principle of least privilege. Which three settings should you enable? To answer, select the appropriate settings in the answer area.", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Allowed resource types: Container\nAllowed permissions: Read and list.\nContainer: \"Grants access to the content and metadata of any blob in the container, and to the list of blobs in\nthe container.\"\nSource: https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas#specify-the-\nsigned-resource-field\nSpecifying \"Object\" additionally would be redundant because it is a subset of \"Container\".\nList: \"List blobs non-recursively.\"\nhttps://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas#specify-permissions\nSatisfies the requirement of enumeration.\nRead: \"Read the content, blocklist, properties, and metadata of any blob in the container or directory. Use a\nblob as the source of a copy operation.\"\nhttps://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas#specify-permissions\nSatisfies the requirement of download.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 244, "pdfId": 244, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/244" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "On June 6, File 1 will be stored in the Cool access tier:\nNO\nRule 1 applies and File 1 will be in archive storage.\nOn June 7, File 2 will be stored in the Cool access tier:\nYES\n - Rule 5 applies to all files due to the lack of a\nprefix, and File 2 will be in cool storage.\nOn June 16, File 2 will be stored in the Archive access tier:\nNO\n -Rule 3 applies and File 2 will be deleted.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 245, "pdfId": 245, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/245" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1-Yes: Public Access is enabled for blob\n2- No: Azure Storage Account Contributor role can't access the file share\n3- No: Access Key is disabled on the storage account", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 246, "pdfId": 246, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/246" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "No - User1 does not have access to any Azure resources since it is not synced to Entra AD, even if AD is\nconfigured as the authentication source.\nYes - User2 has access to to the storage account since it is a cloud-synced user, and AD is configured as the\nauthentication source for storage2024.\nNo - User2 can't access the content in Share3 since AD isn't configured as a source for storage2025.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 247, "pdfId": 247, "exam": "AZ-104", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/247" }, "markersInGap": [ 247 ], "questionText": "HOTSPOT\n-\nYour network contains an on-premises Active Directory Domain Services (AD DS) domain.\nThe domain contains the identities shown in the following table.\nYou have an Azure subscription that contains a storage account named storage1. The file shares in storage1 have\nan identity source of AD DS and Default share-level permissions set to Enable permissions for all authenticated\nusers and groups.\nYou create an Azure Files share named share1 that has the roles shown in the following table.\nYou have a Microsoft Entra tenant that contains a cloud-only user named User3.\nYou use Microsoft Entra Connect to sync OU1 from the AD DS domain to the Microsoft Entra tenant.\nFor each of the following statements, select Yes if the statement is true. Otherwise, select No.\n NOTE: Each correct selection is worth one point.", "stem": "Your network contains an on-premises Active Directory Domain Services (AD DS) domain. The domain contains the identities shown in the following table. You have an Azure subscription that contains a storage account named storage1. The file shares in storage1 have an identity source of AD DS and Default share-level permissions set to Enable permissions for all authenticated users and groups. You create an Azure Files share named share1 that has the roles shown in the following table. You have a Microsoft Entra tenant that contains a cloud-only user named User3. You use Microsoft Entra Connect to sync OU1 from the AD DS domain to the Microsoft Entra tenant. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "No - User 1 is in organizational unit 2, but OU2 isn't configured to sync from the AD DS domain to the Entra\nTenant.\nYes - User2 is in the OU1 domain which IS synced to the Entra tenant\nNo - User3 has not been granted access either as an authenticated user or through an authenticated group.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 248, "pdfId": 248, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/248" }, "markersInGap": [ 248 ], "questionText": "You have an Azure subscription that contains the storage accounts shown in the following table.\n Which storage account can be converted to zone-redundant storage (ZRS) replication?\nA.\nstorage1 only\nB.\nstorage2 only\nC.\nstorage3 only\nD.\nstorage2 and storage3\nE.\nstorage1, storage2, and storage3", "stem": "You have an Azure subscription that contains the storage accounts shown in the following table. Which storage account can be converted to zone-redundant storage (ZRS) replication", "options": [ { "key": "A", "text": "storage1 only" }, { "key": "B", "text": "storage2 only" }, { "key": "C", "text": "storage3 only" }, { "key": "D", "text": "storage2 and storage3" }, { "key": "E", "text": "storage1, storage2, and storage3" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Storage1 only : This storage account might be in a region that supports ZRS and is of a type that is compatible\nwith ZRS.", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 249, "pdfId": 249, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/249" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure Storage account named storage1.\nYou need to enable a user named User1 to list and regenerate storage account keys for storage1.\nSolution: You assign the Reader and Data Access role to User1.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Storage account named storage1. You need to enable a user named User1 to list and regenerate storage account keys for storage1. Solution: You assign the Reader and Data Access role to User1. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "NO To enable User1 to list and regenerate storage account keys, you should assign the Storage Account Key\nOperator Service Role1.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 250, "pdfId": 250, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/250" }, "markersInGap": [ 249, 250 ], "questionText": "You have an Azure subscription that contains a Standard SKU Azure container registry named ContReg1.\n You need to ensure that ContReg1 supports geo-replication.\nWhat should you do first for ContReg1?\nA.\nEnable Admin user.\nB.\nAdd a scope map.\nC.\nAdd an automation task.\nD.\nCreate a cache rule.\nE.\nUpgrade the SKU.", "stem": "You have an Azure subscription that contains a Standard SKU Azure container registry named ContReg1. You need to ensure that ContReg1 supports geo-replication. What should you do first for ContReg1", "options": [ { "key": "A", "text": "Enable Admin user." }, { "key": "B", "text": "Add a scope map." }, { "key": "C", "text": "Add an automation task." }, { "key": "D", "text": "Create a cache rule." }, { "key": "E", "text": "Upgrade the SKU." } ], "answer": { "raw": "E", "keys": [ "E" ] }, "explanation": "E: Upgrade the SKU. This is necessary because geo-replication is a Premium SKU feature, and your current\nregistry is on the Standard SKU. Upgrading the SKU will unlock the geo-replication capability.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 251, "pdfId": 251, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/251" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Stored Access Policies :\n2\nStored access policies provide additional control over shared access signatures (SAS) by defining a set of\nrestrictions that apply to multiple SAS tokens. Instead of defining permissions and expiration for each SAS\ntoken individually, you can link multiple SAS tokens to a single stored access policy. This allows:\nCentralized management of SAS permissions.\nThe ability to revoke access by deleting or modifying the policy instead of each individual SAS token.\nEasier enforcement of security best practices.\nIn the given image, the number of stored access policies is set to\n2\nmeaning the Azure storage account allows\nup to two stored access policies to be created.\nImmutable Blob Storage Policies\n:1.\nImmutable blob storage policies are used to protect data from being modified or deleted for a specified\nretention period. Azure provides two types of immutable policies:\nTime-based retention – Ensures data cannot be modified until a set duration expires.\nLegal hold – Prevents modification indefinitely until the hold is lifted.\nIn the image, the number of immutable blob storage policies is set to\n 1\nmeaning only one immutable storage\npolicy is allowed.\nCase study -\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like to\ncomplete each case. However, there may be additional case studies and sections on this exam. You must manage\nyour time to ensure that you are able to complete all questions included on this exam in the time provided.\nTo answer the questions included in a case study, you will need to reference information that is provided in the\ncase study. Case studies might contain exhibits and other resources that provide more information about the\nscenario that is described in the case study. Each question is independent of the other questions in this case study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and to\nmake changes before you move to the next section of the exam. After you begin a new section, you cannot return\nto this section.\nTo start the case study -\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to explore\nthe content of the case study before you answer the questions. Clicking these buttons displays information such\nas business requirements, existing environment, and problem statements. If the case study has an All Information\ntab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you\nare ready to answer a question, click the Question button to return to the question.\nOverview -\nADatum Corporation is consulting firm that has a main office in Montreal and branch offices in Seattle and New\nYork.\nExisting Environment -\nAzure Environment -\nADatum has an Azure subscription that contains three resource groups named RG1, RG2, and RG3.\nThe subscription contains the storage accounts shown in the following table.\nThe subscription contains the virtual machines shown in the following table.\nThe subscription has an Azure container registry that contains the images shown in the following table.\nThe subscription contains the resources shown in the following table.\nAzure Key Vault -\nThe subscription contains an Azure key vault named Vault1.\nVault1 contains the certificates shown in the following table.\nVault1 contains the keys shown in the following table.\nMicrosoft Entra Environment -\nADatum has a Microsoft Entra tenant named adatum.com that is linked to the Azure subscription and contains the\nusers shown in the following table.\nThe tenant contains the groups shown in the following table.\nThe adatum.com tenant has a custom security attribute named Attribute1.\nPlanned Changes -\nADatum plans to implement the following changes:\n•Configure a data collection rule (DCR) named DCR1 to collect only system events that have an event ID of 4648\nfrom VM2 and VM4.\n•In storage1, create a new container named cont2 that has the following access policies: oThree stored access\npolicies named Stored1, Stored2, and Stored3 oA legal hold for immutable blob storage\n•Whenever possible, use directories to organize storage account content.\n•Grant User1 the permissions required to link Zone1 to VNet1.\n•Assign Attribute1 to supported adatum.com resources.\n•In storage2, create an encryption scope named Scope1.\n•Deploy new containers by using Image1 or Image2.\nTechnical Requirements -\nADatum must meet the following technical requirements:\n•Use TLS for WebApp1.\n•Follow the principle of least privilege.\n•Grant permissions at the required scope only.\n•Ensure that Scope1 is used to encrypt storage services.\n•Use Azure Backup to back up cont1 and share1 as frequently as possible.\n•Whenever possible, use Azure Disk Encryption and a key encryption key (KEK) to encrypt the virtual machines.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 252, "pdfId": 252, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/252" }, "markersInGap": [], "questionText": "You need to configure encryption for the virtual machines. The solution must meet the technical requirements.\nWhich virtual machines can you encrypt?\nA.\nVM1 and VM3\nB.\nVM4 and VM5\nC.\nVM2 and VM3\nD.\nVM2 and VM4", "stem": "You need to configure encryption for the virtual machines. The solution must meet the technical requirements. Which virtual machines can you encrypt", "options": [ { "key": "A", "text": "VM1 and VM3" }, { "key": "B", "text": "VM4 and VM5" }, { "key": "C", "text": "VM2 and VM3" }, { "key": "D", "text": "VM2 and VM4" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "https://learn.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-windows\nAzure Disk Encryption does not work for the following scenarios for window, Hence we can not encrypt VM4\nand VM5.\nM-series VMs with Write Accelerator disks.\nDynamic volumes.\nhttps://learn.microsoft.com/en-us/azure/virtual-machines/linux/disk-encryption-linux?\ntabs=azcliazure%2Cenableadecli%2Cefacli%2Cadedatacli\nAzure Disk Encryption does not work for the following Linux scenarios, Hence we can not encrypt VM1\nEphemeral OS disks.\nCase study -\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like to\ncomplete each case. However, there may be additional case studies and sections on this exam. You must manage\nyour time to ensure that you are able to complete all questions included on this exam in the time provided.\nTo answer the questions included in a case study, you will need to reference information that is provided in the\ncase study. Case studies might contain exhibits and other resources that provide more information about the\nscenario that is described in the case study. Each question is independent of the other questions in this case study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and to\nmake changes before you move to the next section of the exam. After you begin a new section, you cannot return\nto this section.\nTo start the case study -\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to explore\nthe content of the case study before you answer the questions. Clicking these buttons displays information such\nas business requirements, existing environment, and problem statements. If the case study has an All Information\ntab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you\nare ready to answer a question, click the Question button to return to the question.\nOverview -\nADatum Corporation is consulting firm that has a main office in Montreal and branch offices in Seattle and New\nYork.\nExisting Environment -\nAzure Environment -\nADatum has an Azure subscription that contains three resource groups named RG1, RG2, and RG3.\nThe subscription contains the storage accounts shown in the following table.\nThe subscription contains the virtual machines shown in the following table.\nThe subscription has an Azure container registry that contains the images shown in the following table.\nThe subscription contains the resources shown in the following table.\nAzure Key Vault -\nThe subscription contains an Azure key vault named Vault1.\nVault1 contains the certificates shown in the following table.\nVault1 contains the keys shown in the following table.\nMicrosoft Entra Environment -\nADatum has a Microsoft Entra tenant named adatum.com that is linked to the Azure subscription and contains the\nusers shown in the following table.\nThe tenant contains the groups shown in the following table.\nThe adatum.com tenant has a custom security attribute named Attribute1.\nPlanned Changes -\nADatum plans to implement the following changes:\n•Configure a data collection rule (DCR) named DCR1 to collect only system events that have an event ID of 4648\nfrom VM2 and VM4.\n•In storage1, create a new container named cont2 that has the following access policies: oThree stored access\npolicies named Stored1, Stored2, and Stored3 oA legal hold for immutable blob storage\n•Whenever possible, use directories to organize storage account content.\n•Grant User1 the permissions required to link Zone1 to VNet1.\n•Assign Attribute1 to supported adatum.com resources.\n•In storage2, create an encryption scope named Scope1.\n•Deploy new containers by using Image1 or Image2.\nTechnical Requirements -\nADatum must meet the following technical requirements:\n•Use TLS for WebApp1.\n•Follow the principle of least privilege.\n•Grant permissions at the required scope only.\n•Ensure that Scope1 is used to encrypt storage services.\n•Use Azure Backup to back up cont1 and share1 as frequently as possible.\n•Whenever possible, use Azure Disk Encryption and a key encryption key (KEK) to encrypt the virtual machines.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 253, "pdfId": 253, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/253" }, "markersInGap": [], "questionText": "You need to implement the planned changes for the storage account content.\nWhich containers and file shares can you use to organize the content?\nA.\nshare1 only\nB.\ncont1 and share1 only\nC.\nshare1 and share2 only\nD.\ncont1, share1, and share2 only\nE.\ncont1, cont2, share1, and share2", "stem": "You need to implement the planned changes for the storage account content. Which containers and file shares can you use to organize the content", "options": [ { "key": "A", "text": "share1 only" }, { "key": "B", "text": "cont1 and share1 only" }, { "key": "C", "text": "share1 and share2 only" }, { "key": "D", "text": "cont1, share1, and share2 only" }, { "key": "E", "text": "cont1, cont2, share1, and share2" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "cont1: The container in storage1 with a hierarchical namespace is specifically designed to organize content\nefficiently.\nshare1 and share2: Both are file shares in storage2 and are not restricted by the hierarchical namespace\nfeature. They can still be used to organize content effectively.\nUsing all three (cont1, share1, and share2) allows for a comprehensive organization strategy across different\nstorage types, adhering to the planned changes and technical requirements.", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 254, "pdfId": 254, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/254" }, "markersInGap": [ 254 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou deploy an Azure Kubernetes Service (AKS) cluster named AKS1.\nYou need to deploy a YAML file to AKS1.\nSolution: From Azure CLI, you run az aks.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You deploy an Azure Kubernetes Service (AKS) cluster named AKS1. You need to deploy a YAML file to AKS1. Solution: From Azure CLI, you run az aks. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "To deploy the YAML file you need to runs kubectl apply -f file_name.yaml", "reference": "https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough", "references": [ "https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 255, "pdfId": 255, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/255" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou deploy an Azure Kubernetes Service (AKS) cluster named AKS1.\nYou need to deploy a YAML file to AKS1.\nSolution: From Azure CLI, you run the kubectl client.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You deploy an Azure Kubernetes Service (AKS) cluster named AKS1. You need to deploy a YAML file to AKS1. Solution: From Azure CLI, you run the kubectl client. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "To manage a Kubernetes cluster, use the Kubernetes command-line client, kubectl\nthen run \"kubectl apply -f azure-vote.yaml\"", "reference": "https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough", "references": [ "https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 256, "pdfId": 256, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/256" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou deploy an Azure Kubernetes Service (AKS) cluster named AKS1.\nYou need to deploy a YAML file to AKS1.\nSolution: From Azure CLI, you run azcopy.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You deploy an Azure Kubernetes Service (AKS) cluster named AKS1. You need to deploy a YAML file to AKS1. Solution: From Azure CLI, you run azcopy. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "To deploy a YAML file, the command is:\nkubectl apply -f example.yaml", "reference": "https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough", "references": [ "https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 257, "pdfId": 257, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/257" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure virtual machine named VM1 that runs Windows Server 2016.\nYou need to create an alert in Azure when more than two error events are logged to the System event log on VM1\nwithin an hour.\nSolution: You create an Azure storage account and configure shared access signatures (SASs). You install the\nMicrosoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the storage account as the\nsource.\nDoes that meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1 that runs Windows Server 2016. You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour. Solution: You create an Azure storage account and configure shared access signatures (SASs). You install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the storage account as the source. Does that meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Instead: You create an Azure Log Analytics workspace and configure the data settings. You install the\nMicrosoft Monitoring Agent on VM1. You create an alert in\nAzure Monitor and specify the Log Analytics workspace as the source.", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agents-overview", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agents-overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 258, "pdfId": 258, "exam": "AZ-104", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/258" }, "markersInGap": [ 257, 258 ], "questionText": "HOTSPOT -\nYou have an Azure subscription named Subscription1. Subscription1 contains the resources in the following table.\nVNet1 is in RG1. VNet2 is in RG2. There is no connectivity between VNet1 and VNet2.\nAn administrator named Admin1 creates an Azure virtual machine named VM1 in RG1. VM1 uses a disk named Disk1\nand connects to VNet1. Admin1 then installs a custom application in VM1.\nYou need to move the custom application to VNet2. The solution must minimize administrative effort.\nWhich two actions should you perform? To answer, select the appropriate options in the answer area.\n NOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You have an Azure subscription named Subscription1. Subscription1 contains the resources in the following table. VNet1 is in RG1. VNet2 is in RG2. There is no connectivity between VNet1 and VNet2. An administrator named Admin1 creates an Azure virtual machine named VM1 in RG1. VM1 uses a disk named Disk1 and connects to VNet1. Admin1 then installs a custom application in VM1. You need to move the custom application to VNet2. The solution must minimize administrative effort. Which two actions should you perform? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "We cannot just move a virtual machine between networks. What we need to do is identify the disk used by the\nVM, delete the VM itself while retaining the disk, and recreate the VM in the target virtual network and then\nattach the original disk to it.", "reference": "https://blogs.technet.microsoft.com/canitpro/2014/06/16/step-by-step-move-a-vm-to-a-different-vnet-on-\nazure/ https://4sysops.com/archives/move-an-azure-vm-to-another-virtual-network-vnet/#migrate-an-azure-\nvm-between-vnets\nYou download an Azure Resource Manager template based on an existing virtual machine. The template will be\nused to deploy 100 virtual machines.", "references": [ "https://blogs.technet.microsoft.com/canitpro/2014/06/16/step-by-step-move-a-vm-to-a-different-vnet-on-", "https://4sysops.com/archives/move-an-azure-vm-to-another-virtual-network-vnet/#migrate-an-azure-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 259, "pdfId": 259, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/259" }, "markersInGap": [ 259 ], "questionText": "You need to modify the template to reference an administrative password. You must prevent the password from\nbeing stored in plain text.\nWhat should you create to store the password?\nA.\nan Azure Key Vault and an access policy\nB.\nan Azure Storage account and an access policy\nC.\na Recovery Services vault and a backup policy\nD.\nAzure Active Directory (AD) Identity Protection and an Azure policy", "stem": "You need to modify the template to reference an administrative password. You must prevent the password from being stored in plain text. What should you create to store the password", "options": [ { "key": "A", "text": "an Azure Key Vault and an access policy" }, { "key": "B", "text": "an Azure Storage account and an access policy" }, { "key": "C", "text": "a Recovery Services vault and a backup policy" }, { "key": "D", "text": "Azure Active Directory (AD) Identity Protection and an Azure policy" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "You can use a template that allows you to deploy a simple Windows VM by retrieving the password that is\nstored in a Key Vault. Therefore, the password is never put in plain text in the template parameter file.", "reference": "https://azure.microsoft.com/en-us/resources/templates/101-vm-secure-password/", "references": [ "https://azure.microsoft.com/en-us/resources/templates/101-vm-secure-password/" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 260, "pdfId": 260, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/260" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: ASP1 ASP3 -\nAsp1, ASP3: ASP.NET Core apps can be hosted both on Windows or Linux.\nNot ASP2: The region in which your app runs is the region of the App Service plan it's in.\nBox 2: ASP1 -\nASP.NET apps can be hosted on Windows only.", "reference": "https://docs.microsoft.com/en-us/azure/app-service/quickstart-dotnetcore?pivots=platform-linux\nhttps://docs.microsoft.com/en-us/azure/app-service/app-service-plan-manage#", "references": [ "https://docs.microsoft.com/en-us/azure/app-service/quickstart-dotnetcore?pivots=platform-linux", "https://docs.microsoft.com/en-us/azure/app-service/app-service-plan-manage#" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 261, "pdfId": 261, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/261" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: 6 virtual machines -\nThe Autoscale scale out rule increases the number of VMs by 2 if the CPU threshold is 80% or higher. The\ninitial instance count is 4 and rises to 6 when the 2 extra instances of VMs are added.\nBox 2: 2 virtual machnes -\nThe Autoscale scale in rule decreases the number of VMs by 4 if the CPU threshold is 30% or lower. The initial\ninstance count is 4 and thus cannot be reduced to\n0 as the minimum instances is set to 2. Instances are only added when the CPU threshold reaches 80%.", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/platform/autoscale-overview\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/platform/autoscale-best-practices\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/platform/autoscale-common-scale-patterns", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/platform/autoscale-overview", "https://docs.microsoft.com/en-us/azure/azure-monitor/platform/autoscale-best-practices", "https://docs.microsoft.com/en-us/azure/azure-monitor/platform/autoscale-common-scale-patterns" ], "note": "Each correct selection is worth one point.\nA.\nUpload a configuration script\nB.\nCreate an automation account\nC.\nCreate an Azure policy\nD.\nModify the extensionProfile section of the Azure Resource Manager template\nE.\nCreate a new virtual machine scale set in the Azure portal", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 262, "pdfId": 262, "exam": "AZ-104", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/262" }, "markersInGap": [], "questionText": "You plan to automate the deployment of a virtual machine scale set that uses the Windows Server 2016 Datacenter\nimage.\nYou need to ensure that when the scale set virtual machines are provisioned, they have web server components\ninstalled.\nWhich two actions should you perform? Each correct answer presents part of the solution.\nNOTE: Each correct selection is worth one point.\nA.\nUpload a configuration script\nB.\nCreate an automation account\nC.\nCreate an Azure policy\nD.\nModify the extensionProfile section of the Azure Resource Manager template\nE.\nCreate a new virtual machine scale set in the Azure portal", "stem": "You plan to automate the deployment of a virtual machine scale set that uses the Windows Server 2016 Datacenter image. You need to ensure that when the scale set virtual machines are provisioned, they have web server components installed. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "Upload a configuration script" }, { "key": "B", "text": "Create an automation account" }, { "key": "C", "text": "Create an Azure policy" }, { "key": "D", "text": "Modify the extensionProfile section of the Azure Resource Manager template" }, { "key": "E", "text": "Create a new virtual machine scale set in the Azure portal" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "The Custom Script Extension downloads and executes scripts on Azure VMs. This extension is useful for post\ndeployment configuration, software installation, or any other configuration / management task. Scripts can be\ndownloaded from Azure storage or GitHub, or provided to the Azure portal at extension run-time.\nThe Custom Script extension integrates with Azure Resource Manager templates, and can also be used with\nthe Azure CLI, Azure PowerShell, Azure portal, or the REST API\nThe following Custom Script Extension definition downloads a sample script from GitHub, installs the\nrequired packages, then writes the VM instance hostname to a basic HTML page.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/tutorial-install-apps-template", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/tutorial-install-apps-template" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 263, "pdfId": 263, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/263" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "To install kubectl locally, use the az aks install-cli command: az aks install-cli", "reference": "https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough", "references": [ "https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough" ], "note": "More than one order of answer choices is correct. You will receive credit for any of the correct orders you\nselect.\nSelect and Place:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 264, "pdfId": 264, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/264" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Step 1: Upload a configuration to Azure Automation State Configuration.\nImport the configuration into the Automation account.\nStep 2: Compile a configuration into a node configuration.\nA DSC configuration defining that state must be compiled into one or more node configurations (MOF\ndocument), and placed on the Automation DSC Pull Server.\nStep 3:\nCheck the compliance status of the node.\nStep 1: Create and upload a configuration to Azure Automation\nStep 2: Compile a configuration into a node configuration\nStep 3: Register a VM to be managed by State Configuration\nStep 4: Specify configuration mode settings\nStep 5: Assign a node configuration to a managed node\nStep 6: Check the compliance status of a managed node", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 265, "pdfId": 265, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/265" }, "markersInGap": [ 265 ], "questionText": "You have an Azure Resource Manager template named Template1 that is used to deploy an Azure virtual machine.\nTemplate1 contains the following text:\n The variables section in Template1 contains the following text:\n\"location\": \"westeurope\"\nThe resources section in Template1 contains the following text:\nYou need to deploy the virtual machine to the West US location by using Template1.\nWhat should you do?\nA.\nModify the location in the resources section to westus\nB.\nSelect West US during the deployment\nC.\nModify the location in the variables section to westus", "stem": "You have an Azure Resource Manager template named Template1 that is used to deploy an Azure virtual machine. Template1 contains the following text: The variables section in Template1 contains the following text: \"location\": \"westeurope\" The resources section in Template1 contains the following text: You need to deploy the virtual machine to the West US location by using Template1. What should you do", "options": [ { "key": "A", "text": "Modify the location in the resources section to westus" }, { "key": "B", "text": "Select West US during the deployment" }, { "key": "C", "text": "Modify the location in the variables section to westus" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "You can change the location in resources. Parameters used to define the value of some variables to be able to\nuse in different places in the template resources.\nResources are used only for complicated expressions. In any case, RM will only deploy from resources. In case\nthe value is not mentioned directly, then it will check parameters if it is specified in the resources.\nBased on this question, the value of location is defined directly in resources. so you change the resources\nlocation value\nYou create an App Service plan named Plan1 and an Azure web app named webapp1.\nYou discover that the option to create a staging slot is unavailable.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 266, "pdfId": 266, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/266" }, "markersInGap": [ 266 ], "questionText": "You need to create a staging slot for Plan1.\nWhat should you do first?\nA.\nFrom Plan1, scale up the App Service plan\nB.\nFrom webapp1, modify the Application settings\nC.\nFrom webapp1, add a custom domain\nD.\nFrom Plan1, scale out the App Service plan", "stem": "You need to create a staging slot for Plan1. What should you do first", "options": [ { "key": "A", "text": "From Plan1, scale up the App Service plan" }, { "key": "B", "text": "From webapp1, modify the Application settings" }, { "key": "C", "text": "From webapp1, add a custom domain" }, { "key": "D", "text": "From Plan1, scale out the App Service plan" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "The app must be running in the Standard, Premium, or Isolated tier in order for you to enable multiple\ndeployment slots.\nIf the app isn't already in the Standard, Premium, or Isolated tier, you receive a message that indicates the\nsupported tiers for enabling staged publishing. At this point, you have the option to select Upgrade and go to\nthe Scale tab of your app before continuing.\nScale up: Get more CPU, memory, disk space, and extra features like dedicated virtual machines (VMs),\ncustom domains and certificates, staging slots, autoscaling, and more.\nIncorrect:\nScale out: Increase the number of VM instances that run your app. You can scale out to as many as 30\ninstances", "reference": "https://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots https://docs.microsoft.com/en-\nus/azure/app-service/manage-scale-up", "references": [ "https://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots", "https://docs.microsoft.com/en-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 267, "pdfId": 271, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/271" }, "markersInGap": [], "questionText": "You plan to move a distributed on-premises app named App1 to an Azure subscription.\nAfter the planned move, App1 will be hosted on several Azure virtual machines.\nYou need to ensure that App1 always runs on at least eight virtual machines during planned Azure maintenance.\nWhat should you create?\nA.\none virtual machine scale set that has 10 virtual machines instances\nB.\none Availability Set that has three fault domains and one update domain\nC.\none Availability Set that has 10 update domains and one fault domain\nD.\none virtual machine scale set that has 12 virtual machines instances", "stem": "You plan to move a distributed on-premises app named App1 to an Azure subscription. After the planned move, App1 will be hosted on several Azure virtual machines. You need to ensure that App1 always runs on at least eight virtual machines during planned Azure maintenance. What should you create", "options": [ { "key": "A", "text": "one virtual machine scale set that has 10 virtual machines instances" }, { "key": "B", "text": "one Availability Set that has three fault domains and one update domain" }, { "key": "C", "text": "one Availability Set that has 10 update domains and one fault domain" }, { "key": "D", "text": "one virtual machine scale set that has 12 virtual machines instances" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "First: in case you created on fault domain, you are limited with one update domain. You can test this.\nSecond: By default, Azure uses 5 update domains and up to 3 fault domains. So, In case you created 10 vm in\nscale set. then you will have 2 vm in each update domain. So once one update domain is not available, then you\nget 4 domains with 8 vms as required.", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 268, "pdfId": 267, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/267" }, "markersInGap": [ 267, 268 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure virtual machine named VM1 that runs Windows Server 2016.\nYou need to create an alert in Azure when more than two error events are logged to the System event log on VM1\n within an hour.\nSolution: You create an event subscription on VM1. You create an alert in Azure Monitor and specify VM1 as the\nsource\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1 that runs Windows Server 2016. You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour. Solution: You create an event subscription on VM1. You create an alert in Azure Monitor and specify VM1 as the source Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Instead: You create an Azure Log Analytics workspace and configure the data settings. You install the\nMicrosoft Monitoring Agent on VM1. You create an alert in\nAzure Monitor and specify the Log Analytics workspace as the source.", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agents-overview", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agents-overview" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 269, "pdfId": 268, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/268" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager\ntemplate named ARM1.json.\nYou receive a notification that VM1 will be affected by maintenance.\nYou need to move VM1 to a different host immediately.\nSolution: From the Overview blade, you move the virtual machine to a different subscription.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json. You receive a notification that VM1 will be affected by maintenance. You need to move VM1 to a different host immediately. Solution: From the Overview blade, you move the virtual machine to a different subscription. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Changing Subscription won't affect the downtime, it will just you change the billing. You would need to\nredeploy the VM. After you redeploy a VM, the temporary disk is lost, and dynamic IP addresses associated\nwith virtual network interface are updated.\nFrom Overview there is no option to move the VM to another hardware to skip the maintenance.\nIdeally you need an Availability Set and defining the Update Domains.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/redeploy-to-new-node\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/redeploy-to-new-node" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 270, "pdfId": 269, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/269" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager\ntemplate named ARM1.json.\nYou receive a notification that VM1 will be affected by maintenance.\nYou need to move VM1 to a different host immediately.\nSolution: From the Redeploy blade, you click Redeploy.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json. You receive a notification that VM1 will be affected by maintenance. You need to move VM1 to a different host immediately. Solution: From the Redeploy blade, you click Redeploy. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "When you redeploy a VM, it moves the VM to a new node within the Azure infrastructure and then powers it\nback on, retaining all your configuration options and associated resources.\nReferences:\nhttps://docs.microsoft.com/en-us/azure/virtual-machines/windows/redeploy-to-new-node", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 271, "pdfId": 270, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/270" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager\ntemplate named ARM1.json.\nYou receive a notification that VM1 will be affected by maintenance.\nYou need to move VM1 to a different host immediately.\nSolution: From the Update management blade, you click Enable.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json. You receive a notification that VM1 will be affected by maintenance. You need to move VM1 to a different host immediately. Solution: From the Update management blade, you click Enable. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "You would need to redeploy the VM.\nThis action would not make the Vm be re-deployed in a new host.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/redeploy-to-new-node\nYou have an Azure subscription that contains a web app named webapp1.", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/redeploy-to-new-node" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 272, "pdfId": 272, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/272" }, "markersInGap": [], "questionText": "You need to add a custom domain named www.contoso.com to webapp1.\nWhat should you do first?\nA.\nCreate a DNS record\nB.\nAdd a connection string\nC.\nUpload a certificate.\nD.\nStop webapp1.", "stem": "You need to add a custom domain named www.contoso.com to webapp1. What should you do first", "options": [ { "key": "A", "text": "Create a DNS record" }, { "key": "B", "text": "Add a connection string" }, { "key": "C", "text": "Upload a certificate." }, { "key": "D", "text": "Stop webapp1." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "You can use either a CNAME record or an A record to map a custom DNS name to App Service.", "reference": "https://docs.microsoft.com/en-us/Azure/app-service/app-service-web-tutorial-custom-domain", "references": [ "https://docs.microsoft.com/en-us/Azure/app-service/app-service-web-tutorial-custom-domain" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 273, "pdfId": 273, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/273" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription that contains the resources shown in the following table.\nVM1 connects to VNET1.\nYou need to connect VM1 to VNET2.\nSolution: You move VM1 to RG2, and then you add a new network interface to VM1.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the resources shown in the following table. VM1 connects to VNET1. You need to connect VM1 to VNET2. Solution: You move VM1 to RG2, and then you add a new network interface to VM1. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Instead you should delete VM1. You recreate VM1, and then you add the network interface for VM1.", "reference": null, "references": [], "note": "When you create an Azure virtual machine (VM), you must create a virtual network (VNet) or use an\nexisting VNet. You can change the subnet a VM is connected to after it's created, but you cannot change the\nVNet.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 274, "pdfId": 274, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/274" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription that contains the resources shown in the following table.\nVM1 connects to VNET1.\nYou need to connect VM1 to VNET2.\nSolution: You delete VM1. You recreate VM1, and then you create a new network interface for VM1 and connect it to\nVNET2.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the resources shown in the following table. VM1 connects to VNET1. You need to connect VM1 to VNET2. Solution: You delete VM1. You recreate VM1, and then you create a new network interface for VM1 and connect it to VNET2. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "You should delete VM1. You recreate VM1, and then you add the network interface for VM1.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/network-overview\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/network-overview" ], "note": "When you create an Azure virtual machine (VM), you must create a virtual network (VNet) or use an\nexisting VNet. You can change the subnet a VM is connected to after it's created, but you cannot change the\nVNet.\nReference:\nhttps://docs.microsoft.com/en-us/azure/virtual-machines/windows/network-overview\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 275, "pdfId": 275, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/275" }, "markersInGap": [ 274, 275 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\n appear in the review screen.\nYou have an Azure subscription that contains the resources shown in the following table.\nVM1 connects to VNET1.\nYou need to connect VM1 to VNET2.\nSolution: You turn off VM1, and then you add a new network interface to VM1.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the resources shown in the following table. VM1 connects to VNET1. You need to connect VM1 to VNET2. Solution: You turn off VM1, and then you add a new network interface to VM1. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Instead you should delete VM1. You recreate VM1, and then you add the network interface for VM1.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/network-overview", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/network-overview" ], "note": "When you create an Azure virtual machine (VM), you must create a virtual network (VNet) or use an\nexisting VNet. You can change the subnet a VM is connected to after it's created, but you cannot change the\nVNet.\nReference:\nhttps://docs.microsoft.com/en-us/azure/virtual-machines/windows/network-overview", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 276, "pdfId": 276, "exam": "AZ-104", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/276" }, "markersInGap": [ 276 ], "questionText": "HOTSPOT -\nYou have an Azure subscription named Subscription1 that contains the quotas shown in the following table.\nYou deploy virtual machines to Subscription1 as shown in the following table.\nYou plan to deploy the virtual machines shown in the following table.\n For each of the following statements, select Yes if the statement is true. Otherwise, select No.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You have an Azure subscription named Subscription1 that contains the quotas shown in the following table. You deploy virtual machines to Subscription1 as shown in the following table. You plan to deploy the virtual machines shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Total regional vCPUs = 20\n2 vCPUs (VM1) + 16 vCPUs (VM20) = 18 vCPUs, which means that only 2 vCPUs left to exceed usage limit.\nBox 1: Yes\nWe can add 1 vCPU. 2 vCPUs (VM1) + 16 vCPUs (VM20) + 1 vCPU (VM3) = 19 vCPUs\nBox 2: No\nWe cannot add 4 vCPUs. 2 vCPUs (VM1) + 16 vCPUs (VM20) + 4 vCPU (VM4) = 22 vCPUs\nBox 3: No\nWe cannot add 16 vCPU. 2 vCPUs (VM1) + 16 vCPUs (VM20) + 16 vCPU (VM5) = 34 vCPUs", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/quota", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/quota" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 277, "pdfId": 277, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/277" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: 2 -\nThere are 10 update domains. The 14 VMs are shared across the 10 update domains so four update domains\nwill have two VMs and six update domains will have one VM. Only one update domain is rebooted at a time.\nTherefore, a maximum of two VMs will be offline.\nBox 2: 7 -\nThere are 2 fault domains. The 14 VMs are shared across the 2 fault domains, so 7 VMs in each fault domain. A\nrack failure will affect one fault domain so 7 VMs will be offline.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/manage-availability\nYou deploy an Azure Kubernetes Service (AKS) cluster named Cluster1 that uses the IP addresses shown in the\nfollowing table.", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/manage-availability" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 278, "pdfId": 278, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/278" }, "markersInGap": [], "questionText": "You need to provide internet users with access to the applications that run in Cluster1.\nWhich IP address should you include in the DNS record for Cluster1?\nA.\n131.107.2.1\nB.\n10.0.10.11\nC.\n172.17.7.1\nD.\n192.168.10.2", "stem": "You need to provide internet users with access to the applications that run in Cluster1. Which IP address should you include in the DNS record for Cluster1", "options": [ { "key": "A", "text": "131.107.2.1" }, { "key": "B", "text": "10.0.10.11" }, { "key": "C", "text": "172.17.7.1" }, { "key": "D", "text": "192.168.10.2" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A.131.107.2.1.\nIn Kubernetes when we expose apps we either expose them though Ingress using a single front-end\nloadbalancer IP, or we expose them using Services like NodePort or LoadBalancer.\nBased on the provided scenario we should map the DNS entry to the Load Balancer Front End Ip and expose\napplications using Ingress.\nTo be able to access applications on kubernetes , you need a application Load Balancer created by Azure", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 279, "pdfId": 279, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/279" }, "markersInGap": [], "questionText": "which have public ip.\nYou have a deployment template named Template1 that is used to deploy 10 Azure web apps.\nYou need to identify what to deploy before you deploy Template1. The solution must minimize Azure costs.\nWhat should you identify?\nA.\nfive Azure Application Gateways\nB.\none App Service plan\nC.\n10 App Service plans\nD.\none Azure Traffic Manager\nE.\none Azure Application Gateway", "stem": "which have public ip. You have a deployment template named Template1 that is used to deploy 10 Azure web apps. You need to identify what to deploy before you deploy Template1. The solution must minimize Azure costs. What should you identify", "options": [ { "key": "A", "text": "five Azure Application Gateways" }, { "key": "B", "text": "one App Service plan" }, { "key": "C", "text": "10 App Service plans" }, { "key": "D", "text": "one Azure Traffic Manager" }, { "key": "E", "text": "one Azure Application Gateway" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Creating one App Service Plan should be your first priority and what type of Plan i.e. Basic, STD, premium,\nIsolated will depends on needs and once done then you can support up to 10 Web Apps.\nYou create Azure web apps in an App Service plan.\nReference:\nhttps://docs.microsoft.com/en-us/azure/app-service/overview-hosting-plans", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 280, "pdfId": 280, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/280" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Internet Users Connectivity to the Contain\nCan connect to the container from any device.\nIn Azure Container Instances (ACI) or Docker containers running in the cloud, containers are typically exposed\nusing public IP addresses or DNS names.\nIf networking and firewall rules allow, internet users can connect from any device (Windows, Linux, macOS,\nmobile, etc.).\nThe other options (\"cannot connect\" or \"only from Windows devices\") are incorrect because:\nContainers are platform-independent and do not require a specific OS to access them.\nIf proper network and firewall configurations are applied, users can connect.\nIIS Failure Recovery in the Container\nThe container will restart automatically.\nIn Azure Container Instances (ACI), Kubernetes, or Docker, a container restart policy can be set to\nautomatically restart a container if it fails.\nBy default, Azure Container Instances use a restart policy such as:\nAlways (default)\n→\n Ensures the container restarts if it crashes.\nOnFailure\n→\n Restarts only if the container exits with a failure code.\nNever\n→\n The container does not restart.\nSince IIS runs inside the container, if it crashes, the container itself is restarted automatically, provided the\ncorrect restart policy is configured.\nThe other options (\"only restart manually\" or \"must be redeployed\") are incorrect because:\nContainers typically do not require manual intervention for restarts.\nRedeployment is not needed unless the container image itself is faulty.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 281, "pdfId": 281, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/281" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains a virtual machine named VM1. VM1 hosts a line-of-business\napplication that is available 24 hours a day. VM1 has one network interface and one managed disk. VM1 uses the\nD4s v3 size.\nYou plan to make the following changes to VM1:\n✑\n Change the size to D8s v3.\n✑\n Add a 500-GB managed disk.\n✑\n Add the Puppet Agent extension.\n✑\n Enable Desired State Configuration Management.\nWhich change will cause downtime for VM1?\nA.\nEnable Desired State Configuration Management\nB.\nAdd a 500-GB managed disk\nC.\nChange the size to D8s v3\nD.\nAdd the Puppet Agent extension", "stem": "You have an Azure subscription that contains a virtual machine named VM1. VM1 hosts a line-of-business application that is available 24 hours a day. VM1 has one network interface and one managed disk. VM1 uses the D4s v3 size. You plan to make the following changes to VM1: ✑ Change the size to D8s v3. ✑ Add a 500-GB managed disk. ✑ Add the Puppet Agent extension. ✑ Enable Desired State Configuration Management. Which change will cause downtime for VM1", "options": [ { "key": "A", "text": "Enable Desired State Configuration Management" }, { "key": "B", "text": "Add a 500-GB managed disk" }, { "key": "C", "text": "Change the size to D8s v3" }, { "key": "D", "text": "Add the Puppet Agent extension" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C. Change the size to D8s v3.\nChanging the size of an Azure virtual machine involves a stop and restart of the virtual machine, which will\ncause downtime for the line-of-business application hosted on VM1. This downtime can be minimized by using\nAzure Availability Sets or by taking appropriate steps to prepare for the change, such as backing up data or\nmoving the application to another virtual machine.\nAdding a managed disk, installing the Puppet Agent extension, or enabling Desired State Configuration\nManagement should not cause downtime for VM1.\nWhile resizing the VM it must be in a stopped state.", "reference": "https://azure.microsoft.com/en-us/blog/resize-virtual-machines/", "references": [ "https://azure.microsoft.com/en-us/blog/resize-virtual-machines/" ], "note": "Each correct selection is worth one point.\nA.\nSwap the slots\nB.\nDeploy the App1 update to webapp1-prod, and then test the update\nC.\nStop webapp1-prod\nD.\nDeploy the App1 update to webapp1-test, and then test the update\nE.\nStop webapp1-test", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 282, "pdfId": 282, "exam": "AZ-104", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/282" }, "markersInGap": [ 281, 282 ], "questionText": "You have an app named App1 that runs on an Azure web app named webapp1.\nThe developers at your company upload an update of App1 to a Git repository named Git1.\nWebapp1 has the deployment slots shown in the following table.\n You need to ensure that the App1 update is tested before the update is made available to users.\nWhich two actions should you perform? Each correct answer presents part of the solution.\nNOTE: Each correct selection is worth one point.\nA.\nSwap the slots\nB.\nDeploy the App1 update to webapp1-prod, and then test the update\nC.\nStop webapp1-prod\nD.\nDeploy the App1 update to webapp1-test, and then test the update\nE.\nStop webapp1-test", "stem": "You have an app named App1 that runs on an Azure web app named webapp1. The developers at your company upload an update of App1 to a Git repository named Git1. Webapp1 has the deployment slots shown in the following table. You need to ensure that the App1 update is tested before the update is made available to users. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "Swap the slots" }, { "key": "B", "text": "Deploy the App1 update to webapp1-prod, and then test the update" }, { "key": "C", "text": "Stop webapp1-prod" }, { "key": "D", "text": "Deploy the App1 update to webapp1-test, and then test the update" }, { "key": "E", "text": "Stop webapp1-test" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. Swap the slots.\nOnce the update is successfully tested in the test slot, you swap the slots.\nSwapping the slots promotes the tested version from webapp1-test to webapp1-prod without downtime.\nThis ensures a smooth transition and minimizes the risk of deploying untested changes.\nD. Deploy the update to webapp1-test, and then test the update.\nIn Azure App Service, deployment slots allow you to deploy an update to a staging/test slot without affecting\nthe live production environment.\nThe update should first be deployed to webapp1-test to verify that it works correctly.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 283, "pdfId": 283, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/283" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "When you create or update a virtual network in your subscription, Network Watcher will be enabled\nautomatically in your Virtual Network's region. There is no impact to your resources or associated charge for\nautomatically enabling Network Watcher. For more information, see Network Watcher create.\nCreate a VM with a network security group\nEnable Network Watcher (done by default with the vnet/subnet creation)\n-- and register the Microsoft.Insights provider ---------todo\nEnable a traffic flow log for an NSG, using Network Watcher's NSG flow log capability --todo BUT !\nNSG flow log data is written to an Azure Storage account. Complete the following steps to create a storage\naccount for the log data.\nSo you need to create a storage account before enable the NSG flow\nDownload logged data\nView logged data\nhttps://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview\nhttps://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-portal", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 284, "pdfId": 284, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/284" }, "markersInGap": [], "questionText": "You need to deploy an Azure virtual machine scale set that contains five instances as quickly as possible.\nWhat should you do?\nA.\nDeploy five virtual machines. Modify the Availability Zones settings for each virtual machine.\nB.\nDeploy five virtual machines. Modify the Size setting for each virtual machine.\nC.\nDeploy one virtual machine scale set that is set to VM (virtual machines) orchestration mode.\nD.\nDeploy one virtual machine scale set that is set to ScaleSetVM orchestration mode.", "stem": "You need to deploy an Azure virtual machine scale set that contains five instances as quickly as possible. What should you do", "options": [ { "key": "A", "text": "Deploy five virtual machines. Modify the Availability Zones settings for each virtual machine." }, { "key": "B", "text": "Deploy five virtual machines. Modify the Size setting for each virtual machine." }, { "key": "C", "text": "Deploy one virtual machine scale set that is set to VM (virtual machines) orchestration mode." }, { "key": "D", "text": "Deploy one virtual machine scale set that is set to ScaleSetVM orchestration mode." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. Deploy one virtual machine scale set that is set to ScaleSetVM orchestration mode.\nTo deploy an Azure Virtual Machine Scale Set (VMSS) with five instances as quickly as possible, the best\noption is to use ScaleSetVM orchestration mode. This mode is specifically designed for scalable and\nautomatically managed virtual machines.\nYou plan to create the Azure web apps shown in the following table.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 285, "pdfId": 285, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/285" }, "markersInGap": [], "questionText": "What is the minimum number of App Service plans you should create for the web apps?\nA.\n1\nB.\n2\nC.\n3\nD.\n4", "stem": "What is the minimum number of App Service plans you should create for the web apps", "options": [], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "NET Core 3.0: Windows and Linux ASP\n.NET V4.7: Windows only\nPHP 7.3: Windows and Linux\nRuby 2.6: Linux only\nAlso, you can’t use Windows and Linux Apps in the same App Service Plan, because when you create a new\nApp Service plan you have to choose the OS type. You can't mix Windows and Linux apps in the same App\nService plan. So, you need 2 ASPs.", "reference": "https://docs.microsoft.com/en-us/azure/app-service/overview", "references": [ "https://docs.microsoft.com/en-us/azure/app-service/overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": true } }, { "seq": 286, "pdfId": 286, "exam": "AZ-104", "type": "dropdown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/286" }, "markersInGap": [ 285, 286 ], "questionText": "HOTSPOT -\nYou have a pay-as-you-go Azure subscription that contains the virtual machines shown in the following table.\nYou create the budget shown in the following exhibit.\n The AG1 action group contains a user named\n[email protected]\n only.\nUse the drop-down menus to select the answer choice that completes each statement based on the information\npresented in the graphic.\nHot Area:", "stem": "You have a pay-as-you-go Azure subscription that contains the virtual machines shown in the following table. You create the budget shown in the following exhibit. The AG1 action group contains a user named [email protected] only. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: VM1 and VM2 continue to run\nThe budget alerts are for Resource Group RG1, which include VM1, but not VM2. However, when the budget\nthresholds you've created are exceeded, only notifications are triggered. None of your resources are affected\nand your consumption isn't stopped.\nBox 2: one email notification will be sent each month.\nBudget alerts for Resource Group RG1, which include VM1, but not VM2.VM1 consumes 20 Euro/day. The 50%,\n500 Euro limit, will be reached in 25 days, and an email will be sent.\nThe 70% and 100% alert conditions will not be reached within a month, and they don't trigger email actions\nanyway.\nCredit alerts: Credit alerts are generated automatically at 90% and at 100% of your Azure credit balance.\nWhenever an alert is generated, it's reflected in cost alerts and in the email sent to the account owners. 90%\nand 100% will not be reached though.", "reference": "https://docs.microsoft.com/en-us/azure/cost-management-billing/costs/cost-mgt-alerts-monitor-usage-\nspending https://docs.microsoft.com/en-gb/azure/cost-management-billing/costs/tutorial-acm-create-\nbudgets\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "references": [ "https://docs.microsoft.com/en-us/azure/cost-management-billing/costs/cost-mgt-alerts-monitor-usage-", "https://docs.microsoft.com/en-gb/azure/cost-management-billing/costs/tutorial-acm-create-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 287, "pdfId": 287, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/287" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1\ncontains resources that were deployed by using templates.\nYou need to view the date and time when the resources were created in RG1.\nSolution: From the Subscriptions blade, you select the subscription, and then click Programmatic deployment.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates. You need to view the date and time when the resources were created in RG1. Solution: From the Subscriptions blade, you select the subscription, and then click Programmatic deployment. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "From the RG1 blade, click Deployments. You see a history of deployment for the resource group.", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorial-create-first-\ntemplate?tabs=azure-powershell", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorial-create-first-" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 288, "pdfId": 288, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/288" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription that contains the resources shown in the following table.\nVM1 connects to VNET1.\nYou need to connect VM1 to VNET2.\nSolution: You create a new network interface, and then you add the network interface to VM1.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the resources shown in the following table. VM1 connects to VNET1. You need to connect VM1 to VNET2. Solution: You create a new network interface, and then you add the network interface to VM1. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "You should delete VM1. You recreate VM1, and then you add the network interface for VM1.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/network-overview", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/network-overview" ], "note": "When you create an Azure virtual machine (VM), you must create a virtual network (VNet) or use an\nexisting VNet. You can change the subnet a VM is connected to after it's created, but you cannot change the\nVNet.\nReference:\nhttps://docs.microsoft.com/en-us/azure/virtual-machines/windows/network-overview", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 289, "pdfId": 289, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/289" }, "markersInGap": [], "questionText": "You have an Azure Active Directory (Azure AD) tenant named adatum.com that contains the users shown in the\nfollowing table.\nAdatum.com has the following configurations:\n✑\n Users may join devices to Azure AD is set to User1.\n✑\n Additional local administrators on Azure AD joined devices is set to None.\nYou deploy Windows 10 to a computer named Computer1. User1 joins Computer1 to adatum.com.\nYou need to identify the local Administrator group membership on Computer1.\nWhich users are members of the local Administrators group?\nA.\nUser1 only\nB.\nUser2 only\nC.\nUser1 and User2 only\nD.\nUser1, User2, and User3 only\nE.\nUser1, User2, User3, and User4", "stem": "You have an Azure Active Directory (Azure AD) tenant named adatum.com that contains the users shown in the following table. Adatum.com has the following configurations: ✑ Users may join devices to Azure AD is set to User1. ✑ Additional local administrators on Azure AD joined devices is set to None. You deploy Windows 10 to a computer named Computer1. User1 joins Computer1 to adatum.com. You need to identify the local Administrator group membership on Computer1. Which users are members of the local Administrators group", "options": [ { "key": "A", "text": "User1 only" }, { "key": "B", "text": "User2 only" }, { "key": "C", "text": "User1 and User2 only" }, { "key": "D", "text": "User1, User2, and User3 only" }, { "key": "E", "text": "User1, User2, User3, and User4" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Users may join devices to Azure AD - This setting enables you to select the users who can register their\ndevices as Azure AD joined devices. The default is All.\nAdditional local administrators on Azure AD joined devices - You can select the users that are granted local\nadministrator rights on a device. Users added here are added to the Device Administrators role in Azure AD.\nGlobal administrators, here User2, in Azure AD and device owners are granted local administrator rights by\ndefault.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 290, "pdfId": 290, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/290" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: No -\nRG2 is read only. ReadOnly means authorized users can read a resource, but they cannot delete or update the\nresource.\nBox 2: Yes -\nBox 3: Yes -", "reference": "https://docs.microsoft.com/en-us/azure/app-service/manage-move-across-regions\nhttps://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-limitations/app-service-\nmove-limitations", "references": [ "https://docs.microsoft.com/en-us/azure/app-service/manage-move-across-regions", "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-limitations/app-service-" ], "note": "App Service resources are region-specific and cannot be moved directly across regions. You can move the\nApp Service resource by creating a copy of your existing App Service resource in the target region, then move\nyour content over to the new app. You can then delete the source app and App Service plan.\nTo make copying your app easier, you can clone an individual App Service app into an App Service plan in\nanother region.\nReference:\nhttps://docs.microsoft.com/en-us/azure/app-service/manage-move-across-regions\nhttps://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-limitations/app-service-\nmove-limitations", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 291, "pdfId": 291, "exam": "AZ-104", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/291" }, "markersInGap": [ 291 ], "questionText": "HOTSPOT -\nYou have an Azure subscription named Subscription1 that contains the following resource group:\n✑\n Name: RG1\n✑\n Region: West US\n✑\n Tag: `tag1`: `value1`\nYou assign an Azure policy named Policy1 to Subscription1 by using the following configurations:\n✑\n Exclusions: None\n✑\n Policy definition: Append a tag and its value to resources\n✑\n Assignment name: Policy1\n✑\n Parameters:\n✑\n Tag name: tag2\nTag value: value2 -\nAfter Policy1 is assigned, you create a storage account that has the following configuration:\n✑\n Name: storage1\n✑\n Location: West US\n✑\n Resource group: RG1\n✑\n Tags: `tag3`: `value3`\nYou need to identify which tags are assigned to each resource.\nWhat should you identify? To answer, select the appropriate options in the answer area.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You have an Azure subscription named Subscription1 that contains the following resource group: ✑ Name: RG1 ✑ Region: West US ✑ Tag: `tag1`: `value1` You assign an Azure policy named Policy1 to Subscription1 by using the following configurations: ✑ Exclusions: None ✑ Policy definition: Append a tag and its value to resources ✑ Assignment name: Policy1 ✑ Parameters: ✑ Tag name: tag2 Tag value: value2 - After Policy1 is assigned, you create a storage account that has the following configuration: ✑ Name: storage1 ✑ Location: West US ✑ Resource group: RG1 ✑ Tags: `tag3`: `value3` You need to identify which tags are assigned to each resource. What should you identify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1 ) Tags assigned to RG1: \"'tag1': 'value1' only\"\n2) Tags assigned to storage1: \"'tag2': 'value2' and 'tag3': 'value3' only\"\nThe Resource Group already existed before the Policy was created. And the policy is for resources only not\nresource groups.\nThe storage account was created with tag3 and then gets appended the tag2 because the policy.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 292, "pdfId": 292, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/292" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: 60 -\nOne alert per minute will trigger one email per minute.\nBox 2: 12 -\nNo more than 1 SMS every 5 minutes can be send, which equals 12 per hour.", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-rate-limiting", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-rate-limiting" ], "note": "Rate limiting is a suspension of notifications that occurs when too many are sent to a particular phone\nnumber, email address or device. Rate limiting ensures that alerts are manageable and actionable.\nThe rate limit thresholds are:\n✑\n SMS: No more than 1 SMS every 5 minutes.\n✑\n Voice: No more than 1 Voice call every 5 minutes.\n✑\n Email: No more than 100 emails in an hour.\n✑\n Other actions are not rate limited.\nReference:\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-rate-limiting", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 293, "pdfId": 293, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/293" }, "markersInGap": [], "questionText": "You have an Azure subscription named Subscription1 that contains the resources shown in the following table.\nYou create virtual machines in Subscription1 as shown in the following table.\nYou plan to use Vault1 for the backup of as many virtual machines as possible.\nWhich virtual machines can be backed up to Vault1?\nA.\nVM1 only\nB.\nVM3 and VMC only\nC.\nVM1, VM2, VM3, VMA, VMB, and VMC\nD.\nVM1, VM3, VMA, and VMC only\nE.\nVM1 and VM3 only", "stem": "You have an Azure subscription named Subscription1 that contains the resources shown in the following table. You create virtual machines in Subscription1 as shown in the following table. You plan to use Vault1 for the backup of as many virtual machines as possible. Which virtual machines can be backed up to Vault1", "options": [ { "key": "A", "text": "VM1 only" }, { "key": "B", "text": "VM3 and VMC only" }, { "key": "C", "text": "VM1, VM2, VM3, VMA, VMB, and VMC" }, { "key": "D", "text": "VM1, VM3, VMA, and VMC only" }, { "key": "E", "text": "VM1 and VM3 only" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "To create a vault to protect virtual machines, the vault must be in the same region as the virtual machines. If", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nA.\nthe kubectl command\nB.\nthe az aks command\nC.\nthe Set-AzVm cmdlet\nD.\nthe Azure portal\nE.\nthe Set-AzAks cmdlet", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 294, "pdfId": 294, "exam": "AZ-104", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/294" }, "markersInGap": [ 293 ], "questionText": "you have virtual machines in several regions, create a\nRecovery Services vault in each region.\n Reference:\nhttps://docs.microsoft.com/bs-cyrl-ba/azure/backup/backup-create-rs-vault\nYou have an Azure Kubernetes Service (AKS) cluster named AKS1.\nYou need to configure cluster autoscaler for AKS1.\nWhich two tools should you use? Each correct answer presents a complete solution.\nNOTE: Each correct selection is worth one point.\nA.\nthe kubectl command\nB.\nthe az aks command\nC.\nthe Set-AzVm cmdlet\nD.\nthe Azure portal\nE.\nthe Set-AzAks cmdlet", "stem": "you have virtual machines in several regions, create a Recovery Services vault in each region. Reference: https://docs.microsoft.com/bs-cyrl-ba/azure/backup/backup-create-rs-vault You have an Azure Kubernetes Service (AKS) cluster named AKS1. You need to configure cluster autoscaler for AKS1. Which two tools should you use? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "the kubectl command" }, { "key": "B", "text": "the az aks command" }, { "key": "C", "text": "the Set-AzVm cmdlet" }, { "key": "D", "text": "the Azure portal" }, { "key": "E", "text": "the Set-AzAks cmdlet" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. the az aks command: You can use the Azure Command-Line Interface (CLI) command az aks update to\nconfigure the cluster autoscaler for an AKS cluster. This command allows you to enable or disable the cluster\nautoscaler and set parameters like minimum and maximum node counts.\nD. the Azure portal: You can also configure the cluster autoscaler for AKS using the Azure portal. Navigate to\nyour AKS cluster in the Azure portal, go to the \"Node pools\" section, and then configure the autoscaler\nsettings for the specific node pool.\nYou create the following resources in an Azure subscription:\n✑\n An Azure Container Registry instance named Registry1\n✑\n An Azure Kubernetes Service (AKS) cluster named Cluster1\nYou create a container image named App1 on your administrative workstation.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 295, "pdfId": 295, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/295" }, "markersInGap": [], "questionText": "You need to deploy App1 to Cluster1.\nWhat should you do first?\nA.\nRun the docker push command.\nB.\nCreate an App Service plan.\nC.\nRun the az acr build command.\nD.\nRun the az aks create command.", "stem": "You need to deploy App1 to Cluster1. What should you do first", "options": [ { "key": "A", "text": "Run the docker push command." }, { "key": "B", "text": "Create an App Service plan." }, { "key": "C", "text": "Run the az acr build command." }, { "key": "D", "text": "Run the az aks create command." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. Run the docker push command.\nTo deploy your container image named App1 to your AKS cluster, you need to push the image to a container\nregistry where it can be accessed by the cluster. Since you've created the image on your administrative\nworkstation, the next logical step is to push this image to your Azure Container Registry (Registry1).\nYou have an Azure subscription that contains the resources shown in the following table.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 296, "pdfId": 296, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/296" }, "markersInGap": [], "questionText": "You need to configure a proximity placement group for VMSS1.\nWhich proximity placement groups should you use?\nA.\nProximity2 only\nB.\nProximity1, Proximity2, and Proximity3\nC.\nProximity1 only\nD.\nProximity1 and Proximity3 only", "stem": "You need to configure a proximity placement group for VMSS1. Which proximity placement groups should you use", "options": [ { "key": "A", "text": "Proximity2 only" }, { "key": "B", "text": "Proximity1, Proximity2, and Proximity3" }, { "key": "C", "text": "Proximity1 only" }, { "key": "D", "text": "Proximity1 and Proximity3 only" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Resource Group location of VMSS1 is the RG2 location, which is West US.\nOnly Proximity2, which also in RG2, is location in West US", "reference": "https://azure.microsoft.com/en-us/blog/introducing-proximity-placement-groups/", "references": [ "https://azure.microsoft.com/en-us/blog/introducing-proximity-placement-groups/" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 297, "pdfId": 297, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/297" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1\ncontains resources that were deployed by using templates.\nYou need to view the date and time when the resources were created in RG1.\nSolution: From the Subscriptions blade, you select the subscription, and then click Resource providers.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates. You need to view the date and time when the resources were created in RG1. Solution: From the Subscriptions blade, you select the subscription, and then click Resource providers. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "From the RG1 blade, click Deployments. You see a history of deployment for the resource group.", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorial-create-first-\ntemplate?tabs=azure-powershell", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorial-create-first-" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 298, "pdfId": 298, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/298" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1\ncontains resources that were deployed by using templates.\nYou need to view the date and time when the resources were created in RG1.\nSolution: From the RG1 blade, you click Automation script.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates. You need to view the date and time when the resources were created in RG1. Solution: From the RG1 blade, you click Automation script. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "From the RG1 blade, click Deployments. You see a history of deployment for the resource group.", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorial-create-first-\ntemplate?tabs=azure-powershell", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorial-create-first-" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 299, "pdfId": 299, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/299" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1\ncontains resources that were deployed by using templates.\nYou need to view the date and time when the resources were created in RG1.\nSolution: From the RG1 blade, you click Deployments.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates. You need to view the date and time when the resources were created in RG1. Solution: From the RG1 blade, you click Deployments. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "From the RG1 blade, click Deployments. You see a history of deployment for the resource group.", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorial-create-first-\ntemplate?tabs=azure-powershell\nYou have an Azure subscription named Subscription1.\nYou deploy a Linux virtual machine named VM1 to Subscription1.", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorial-create-first-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 300, "pdfId": 300, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/300" }, "markersInGap": [], "questionText": "You need to monitor the metrics and the logs of VM1.\nWhat should you use?\nA.\nAzure HDInsight\nB.\nLinux Diagnostic Extension (LAD) 3.0\nC.\nthe AzurePerformanceDiagnostics extension\nD.\nAzure Analysis Services", "stem": "You need to monitor the metrics and the logs of VM1. What should you use", "options": [ { "key": "A", "text": "Azure HDInsight" }, { "key": "B", "text": "Linux Diagnostic Extension (LAD) 3.0" }, { "key": "C", "text": "the AzurePerformanceDiagnostics extension" }, { "key": "D", "text": "Azure Analysis Services" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "The Linux Diagnostic Extension should be used which downloads the Diagnostic Extension (LAD) agent on\nLinux server.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/diagnostics-linux", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/diagnostics-linux" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 301, "pdfId": 301, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/301" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1:Can connect to only the web server on VM 1.\nRule2 blocks ports 50-60, which includes port 53, the DNS port. Internet users can reach to the Web server,\nsince it uses port 80.\nBox 2:Can connect to the web server and the DNS Server on VM 1.\nIf Rule2 is removed internet users can reach the DNS server as well.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/security-overview", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/security-overview" ], "note": "Rules are processed in priority order, with lower numbers processed before higher numbers, because\nlower numbers have higher priority. Once traffic matches a rule, processing stops. As a result, any rules that\nexist with lower priorities (higher numbers) that have the same attributes as rules with higher priorities are not\nprocessed.\nReference:\nhttps://docs.microsoft.com/en-us/azure/virtual-network/security-overview", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 302, "pdfId": 302, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/302" }, "markersInGap": [ 302 ], "questionText": "You plan to deploy three Azure virtual machines named VM1, VM2, and VM3. The virtual machines will host a web\napp named App1.\n You need to ensure that at least two virtual machines are available if a single Azure datacenter becomes\nunavailable.\nWhat should you deploy?\nA.\nall three virtual machines in a single Availability Zone\nB.\nall virtual machines in a single Availability Set\nC.\neach virtual machine in a separate Availability Zone\nD.\neach virtual machine in a separate Availability Set", "stem": "You plan to deploy three Azure virtual machines named VM1, VM2, and VM3. The virtual machines will host a web app named App1. You need to ensure that at least two virtual machines are available if a single Azure datacenter becomes unavailable. What should you deploy", "options": [ { "key": "A", "text": "all three virtual machines in a single Availability Zone" }, { "key": "B", "text": "all virtual machines in a single Availability Set" }, { "key": "C", "text": "each virtual machine in a separate Availability Zone" }, { "key": "D", "text": "each virtual machine in a separate Availability Set" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Use availability zones to protect from datacenter level failures.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/manage-availability\nhttps://docs.microsoft.com/en-us/azure/virtual-machines/windows/tutorial-availability-sets", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/manage-availability", "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/tutorial-availability-sets" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 303, "pdfId": 303, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/303" }, "markersInGap": [], "questionText": "You have an Azure virtual machine named VM1 that runs Windows Server 2019.\nYou save VM1 as a template named Template1 to the Azure Resource Manager library.\nYou plan to deploy a virtual machine named VM2 from Template1.\nWhat can you configure during the deployment of VM2?\nA.\noperating system\nB.\nadministrator username\nC.\nvirtual machine size\nD.\nresource group", "stem": "You have an Azure virtual machine named VM1 that runs Windows Server 2019. You save VM1 as a template named Template1 to the Azure Resource Manager library. You plan to deploy a virtual machine named VM2 from Template1. What can you configure during the deployment of VM2", "options": [ { "key": "A", "text": "operating system" }, { "key": "B", "text": "administrator username" }, { "key": "C", "text": "virtual machine size" }, { "key": "D", "text": "resource group" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "When you deploy a template, you specify a resource group that will contain the resources. Before running the\ndeployment command, create the resource group or during deployment also we can create the resource\ngroup. If you try to deploy your own template in the portal, there are 3 available options - \"Subscription\",\n\"Resource Group\", \"Location\". Resource group is the only one of the three options available in this list of\nanswers.\nResource group: During deployment, you can choose the resource group where the new VM (VM2) will be\ncreated. This allows you to organize resources logically.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 304, "pdfId": 304, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/304" }, "markersInGap": [ 303, 304 ], "questionText": "You have an Azure subscription that contains an Azure virtual machine named VM1. VM1 runs a financial reporting\napp named App1 that does not support multiple active instances.\nAt the end of each month, CPU usage for VM1 peaks when App1 runs.\nYou need to create a scheduled runbook to increase the processor performance of VM1 at the end of each month.\nWhat task should you include in the runbook?\nA.\nAdd the Azure Performance Diagnostics agent to VM1.\n B.\nModify the VM size property of VM1.\nC.\nAdd VM1 to a scale set.\nD.\nIncrease the vCPU quota for the subscription.\nE.\nAdd a Desired State Configuration (DSC) extension to VM1.", "stem": "You have an Azure subscription that contains an Azure virtual machine named VM1. VM1 runs a financial reporting app named App1 that does not support multiple active instances. At the end of each month, CPU usage for VM1 peaks when App1 runs. You need to create a scheduled runbook to increase the processor performance of VM1 at the end of each month. What task should you include in the runbook", "options": [ { "key": "A", "text": "Add the Azure Performance Diagnostics agent to VM1." }, { "key": "B", "text": "Modify the VM size property of VM1." }, { "key": "C", "text": "Add VM1 to a scale set." }, { "key": "D", "text": "Increase the vCPU quota for the subscription." }, { "key": "E", "text": "Add a Desired State Configuration (DSC) extension to VM1." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Modify the VM size property of VM1: This option allows you to resize the virtual machine to a larger size with\nmore vCPUs and potentially more memory, which directly increases the processing power available to VM1.\nThis can help accommodate the increased CPU usage at the end of each month.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 305, "pdfId": 305, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/305" }, "markersInGap": [], "questionText": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set\nby using an Azure Resource Manager template.\nYou need to ensure that NGINX is available on all the virtual machines after they are deployed.\nWhat should you use?\nA.\nDeployment Center in Azure App Service\nB.\nA Desired State Configuration (DSC) extension\nC.\nthe New-AzConfigurationAssignment cmdlet\nD.\na Microsoft Intune device configuration profile", "stem": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource Manager template. You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use", "options": [ { "key": "A", "text": "Deployment Center in Azure App Service" }, { "key": "B", "text": "A Desired State Configuration (DSC) extension" }, { "key": "C", "text": "the New-AzConfigurationAssignment cmdlet" }, { "key": "D", "text": "a Microsoft Intune device configuration profile" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure virtual machine extensions are small packages that run post-deployment configuration and automation\non Azure virtual machines.\nIn the following example, the Azure CLI is used to deploy a custom script extension to an existing virtual\nmachine, which installs a Nginx webserver. az vm extension set \\\n--resource-group myResourceGroup \\\n--vm-name myVM --name customScript \\\n--publisher Microsoft.Azure.Extensions \\\n--settings ' \"commandToExecute\": \"apt-get install -y nginx\"", "reference": null, "references": [], "note": "There are several versions of this question in the exam. The question has two correct answers:\n1. a Desired State Configuration (DSC) extension\n2. Azure Custom Script Extension\nThe question can have other incorrect answer options, including the following:\n✑\n the Publish-AzVMDscConfiguration cmdlet\n✑\n Azure Application Insights", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 306, "pdfId": 306, "exam": "AZ-104", "type": "dropdown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/306" }, "markersInGap": [ 306 ], "questionText": "HOTSPOT -\nYou deploy an Azure Kubernetes Service (AKS) cluster that has the network profile shown in the following exhibit.\nUse the drop-down menus to select the answer choice that completes each statement based on the information\npresented in the graphic.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You deploy an Azure Kubernetes Service (AKS) cluster that has the network profile shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: 10.244.0.0/16 -\nThe Pod CIDR.", "reference": "https://docs.microsoft.com/en-us/azure/aks/configure-kubenet", "references": [ "https://docs.microsoft.com/en-us/azure/aks/configure-kubenet" ], "note": "The --pod-cidr should be a large address space that isn't in use elsewhere in your network environment.\nThis range includes any on-premises network ranges if you connect, or plan to connect, your Azure virtual\nnetworks using Express Route or a Site-to-Site VPN connection.\nThis address range must be large enough to accommodate the number of nodes that you expect to scale up\nto. You can't change this address range once the cluster is deployed if you need more addresses for additional\nnodes.\nBox 2: 10.0.0.0/16 -\nThe --service-cidr is used to assign internal services in the AKS cluster an IP address.\nReference:\nhttps://docs.microsoft.com/en-us/azure/aks/configure-kubenet", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 307, "pdfId": 307, "exam": "AZ-104", "type": "dropdown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/307" }, "markersInGap": [ 307 ], "questionText": "HOTSPOT -\nYou have the App Service plan shown in the following exhibit.\n The scale-in settings for the App Service plan are configured as shown in the following exhibit.\nThe scale out rule is configured with the same duration and cool down tile as the scale in rule.\nUse the drop-down menus to select the answer choice that completes each statement based on the information\npresented in the graphic.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You have the App Service plan shown in the following exhibit. The scale-in settings for the App Service plan are configured as shown in the following exhibit. The scale out rule is configured with the same duration and cool down tile as the scale in rule. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: 2\n70% for 1h, and then 90% for 5 minutes. So, from the default of 1 it will scale out out 1 more. So, 2 in total.\nBox 2: 4\n90% for 1h and then 25% for 9minutes. So, from the default of 1 it will it scale in to the max 5 (60/5 = 12, which\nmeans 6 times scale out, because we have 5 minutes period of cool down). Then when it drops to 25% for 9\nminutes and it will scale in once after 5 mins (since the average of the last 5 minutes is under 30% ), so it will\ndecrease by 1, so 4 in total. Then it will have a cooldown of 5 minutes before scaling in again, but since only 4\nminutes left from 9 minutes (9-5 = 4), it won't scale in again. So, 4 in total.", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/learn/tutorial-autoscale-performance-schedule\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/autoscale/autoscale-understanding-settings", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/learn/tutorial-autoscale-performance-schedule", "https://docs.microsoft.com/en-us/azure/azure-monitor/autoscale/autoscale-understanding-settings" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 308, "pdfId": 308, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/308" }, "markersInGap": [], "questionText": "You have an Azure virtual machine named VM1 that runs Windows Server 2019. The VM was deployed using default\ndrive settings.\nYou sign in to VM1 as a user named User1 and perform the following actions:\n✑\n Create files on drive C.\n✑\n Create files on drive D.\n✑\n Modify the screen saver timeout.\n✑\n Change the desktop background.\nYou plan to redeploy VM1.\nWhich changes will be lost after you redeploy VM1?\nA.\nthe modified screen saver timeout\nB.\nthe new desktop background\nC.\nthe new files on drive D\nD.\nthe new files on drive C", "stem": "You have an Azure virtual machine named VM1 that runs Windows Server 2019. The VM was deployed using default drive settings. You sign in to VM1 as a user named User1 and perform the following actions: ✑ Create files on drive C. ✑ Create files on drive D. ✑ Modify the screen saver timeout. ✑ Change the desktop background. You plan to redeploy VM1. Which changes will be lost after you redeploy VM1", "options": [ { "key": "A", "text": "the modified screen saver timeout" }, { "key": "B", "text": "the new desktop background" }, { "key": "C", "text": "the new files on drive D" }, { "key": "D", "text": "the new files on drive C" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "For Windows Server, the temporary disk is mounted as “D:\\”.\nFor Linux based VM’s the temporary disk is mounted as “/dev/sdb1”.", "reference": "https://www.cloudelicious.net/azure-vms-and-their-temporary-storage", "references": [ "https://www.cloudelicious.net/azure-vms-and-their-temporary-storage" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 309, "pdfId": 309, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/309" }, "markersInGap": [ 308, 309 ], "questionText": "You have an Azure subscription.\nYou have an on-premises virtual machine named VM1. The settings for VM1 are shown in the exhibit. (Click the\nExhibit tab.)\n You need to ensure that you can use the disks attached to VM1 as a template for Azure virtual machines.\nWhat should you modify on VM1?\nA.\nthe memory\nB.\nthe network adapters\nC.\nthe hard drive\nD.\nthe processor\nE.\nIntegration Services", "stem": "You have an Azure subscription. You have an on-premises virtual machine named VM1. The settings for VM1 are shown in the exhibit. (Click the Exhibit tab.) You need to ensure that you can use the disks attached to VM1 as a template for Azure virtual machines. What should you modify on VM1", "options": [ { "key": "A", "text": "the memory" }, { "key": "B", "text": "the network adapters" }, { "key": "C", "text": "the hard drive" }, { "key": "D", "text": "the processor" }, { "key": "E", "text": "Integration Services" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "From the exhibit we see that the disk is in the VHDX format.\nBefore you upload a Windows virtual machine (VM) from on-premises to Microsoft Azure, you must prepare\nthe virtual hard disk (VHD or VHDX). Azure supports only generation 1 VMs that are in the VHD file format and\nhave a fixed sized disk. The maximum size allowed for the VHD is 1,023 GB. You can convert a generation 1 VM\nfrom the VHDX file system to VHD and from a dynamically expanding disk to fixed-sized.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/prepare-for-upload-vhd-image", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/prepare-for-upload-vhd-image" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 310, "pdfId": 310, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/310" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: 4", "reference": "https://docs.microsoft.com/en-us/learn/modules/build-app-with-scale-sets/2-features-benefits-virtual-\nmachine-scale-sets\nhttps://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-\nupgrade\nhttps://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-upgrade-\nscale-set", "references": [ "https://docs.microsoft.com/en-us/learn/modules/build-app-with-scale-sets/2-features-benefits-virtual-", "https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-", "https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-upgrade-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 311, "pdfId": 311, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/311" }, "markersInGap": [ 311 ], "questionText": "You have an Azure subscription named Subscription1 that is used by several departments at your company.\nSubscription1 contains the resources in the following table:\n Another administrator deploys a virtual machine named VM1 and an Azure Storage account named storage2 by\nusing a single Azure Resource Manager template.\nYou need to view the template used for the deployment.\nFrom which blade can you view the template that was used for the deployment?\nA.\nVM1\nB.\nRG1\nC.\nstorage2\nD.\ncontainer1", "stem": "You have an Azure subscription named Subscription1 that is used by several departments at your company. Subscription1 contains the resources in the following table: Another administrator deploys a virtual machine named VM1 and an Azure Storage account named storage2 by using a single Azure Resource Manager template. You need to view the template used for the deployment. From which blade can you view the template that was used for the deployment", "options": [ { "key": "A", "text": "VM1" }, { "key": "B", "text": "RG1" }, { "key": "C", "text": "storage2" }, { "key": "D", "text": "container1" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "View template from deployment history\n1. Go to the resource group for your new resource group. Notice that the portal shows the result of the last\ndeployment. Select this link.\n2. You see a history of deployments for the group. In your case, the portal probably lists only one deployment.\nSelect this deployment.\n3. The portal displays a summary of the deployment. The summary includes the status of the deployment and\nits operations and the values that you provided for parameters. To see the template that you used for the\ndeployment, select View template.", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-export-template", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-export-template" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 312, "pdfId": 312, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/312" }, "markersInGap": [], "questionText": "You have an Azure web app named App1. App1 has the deployment slots shown in the following table:\nIn webapp1-test, you test several changes to App1.\nYou back up App1.\nYou swap webapp1-test for webapp1-prod and discover that App1 is experiencing performance issues.\nYou need to revert to the previous version of App1 as quickly as possible.\nWhat should you do?\nA.\nRedeploy App1\nB.\nSwap the slots\nC.\nClone App1\nD.\nRestore the backup of App1", "stem": "You have an Azure web app named App1. App1 has the deployment slots shown in the following table: In webapp1-test, you test several changes to App1. You back up App1. You swap webapp1-test for webapp1-prod and discover that App1 is experiencing performance issues. You need to revert to the previous version of App1 as quickly as possible. What should you do", "options": [ { "key": "A", "text": "Redeploy App1" }, { "key": "B", "text": "Swap the slots" }, { "key": "C", "text": "Clone App1" }, { "key": "D", "text": "Restore the backup of App1" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "When you swap deployment slots, Azure swaps the Virtual IP addresses of the source and destination slots,\nthereby swapping the URLs of the slots. We can easily revert the deployment by swapping back.", "reference": "https://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots", "references": [ "https://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 313, "pdfId": 313, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/313" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Any Windows computer that has Internet connectivity\nFor files recovery, you download and run a windows executable to map a network drive. It can only run when\nthe OS meets the requirements. Any computer running Windows Server 2016 or Windows 10 is suitable. File\nrecovery can be done from any machine on the Internet.", "reference": "https://docs.microsoft.com/en-us/azure/backup/backup-azure-restore-files-from-vm\nhttps://github.com/MicrosoftDocs/azure-docs/blob/master/articles/backup/backup-azure-restore-files-from-\nvm.md#for-windows-os", "references": [ "https://docs.microsoft.com/en-us/azure/backup/backup-azure-restore-files-from-vm", "https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/backup/backup-azure-restore-files-from-" ], "note": "There might be compatibility issues with any Windows computer, so consider VM1 and VM2 only as an\nanswer.\nBox 2: VM1 or a new Azure virtual machine only\nFor restoring a VM, you can choose 'Create new' or 'Replace existing'.\nReference:\nhttps://docs.microsoft.com/en-us/azure/backup/backup-azure-restore-files-from-vm\nhttps://github.com/MicrosoftDocs/azure-docs/blob/master/articles/backup/backup-azure-restore-files-from-\nvm.md#for-windows-os", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 314, "pdfId": 314, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/314" }, "markersInGap": [ 314 ], "questionText": "You plan to back up an Azure virtual machine named VM1.\nYou discover that the Backup Pre-Check status displays a status of Warning.\nWhat is a possible cause of the Warning status?\nA.\nVM1 is stopped.\nB.\nVM1 does not have the latest version of the Azure VM Agent (WaAppAgent.exe) installed.\nC.\nVM1 has an unmanaged disk.\nD.\nA Recovery Services vault is unavailable.", "stem": "You plan to back up an Azure virtual machine named VM1. You discover that the Backup Pre-Check status displays a status of Warning. What is a possible cause of the Warning status", "options": [ { "key": "A", "text": "VM1 is stopped." }, { "key": "B", "text": "VM1 does not have the latest version of the Azure VM Agent (WaAppAgent.exe) installed." }, { "key": "C", "text": "VM1 has an unmanaged disk." }, { "key": "D", "text": "A Recovery Services vault is unavailable." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "The Warning state indicates one or more issues in VM's configuration that might lead to backup failures and\nprovides recommended steps to ensure successful backups. Not having the latest VM Agent installed, for\nexample, can cause backups to fail intermittently and falls in this class of issues.", "reference": "https://azure.microsoft.com/en-us/blog/azure-vm-backup-pre-checks/", "references": [ "https://azure.microsoft.com/en-us/blog/azure-vm-backup-pre-checks/" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 315, "pdfId": 315, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/315" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager\ntemplate named ARM1.json.\nYou receive a notification that VM1 will be affected by maintenance.\nYou need to move VM1 to a different host immediately.\nSolution: From the Overview blade, you move the virtual machine to a different resource group.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json. You receive a notification that VM1 will be affected by maintenance. You need to move VM1 to a different host immediately. Solution: From the Overview blade, you move the virtual machine to a different resource group. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "You would need to redeploy the VM.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/redeploy-to-new-node", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/redeploy-to-new-node" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 316, "pdfId": 316, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/316" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: 3 -\nyou can create 3 fault domains (max) in eastus, so the answer is 3and 20, because the update domain max is\n20.\nBox 2: 20 -\nUse 20 for platformUpdateDomainCount\nIncreasing the update domain (platformUpdateDomainCount) helps with capacity and availability planning\nwhen the platform reboots nodes. A higher number for the pool (20 is max) means that fewer of their nodes in\nany given availability set would be rebooted at once.", "reference": "https://www.itprotoday.com/microsoft-azure/check-if-azure-region-supports-2-or-3-fault-domains-managed-\ndisks https://github.com/Azure/acs-engine/issues/1030", "references": [ "https://www.itprotoday.com/microsoft-azure/check-if-azure-region-supports-2-or-3-fault-domains-managed-", "https://github.com/Azure/acs-engine/issues/1030" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 317, "pdfId": 317, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/317" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure virtual machine named VM1 that runs Windows Server 2016.\nYou need to create an alert in Azure when more than two error events are logged to the System event log on VM1\nwithin an hour.\nSolution: You create an Azure Log Analytics workspace and configure the Agent configuration settings. You install\nthe Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the Log Analytics\nworkspace as the source.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1 that runs Windows Server 2016. You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour. Solution: You create an Azure Log Analytics workspace and configure the Agent configuration settings. You install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Alerts in Azure Monitor can identify important information in your Log Analytics repository. They are created\nby alert rules that automatically run log searches at regular intervals, and if results of the log search match\nparticular criteria, then an alert record is created and it can be configured to perform an automated response.\nThe Log Analytics agent collects monitoring data from the guest operating system and workloads of virtual\nmachines in Azure, other cloud providers, and on- premises. It collects data into a Log Analytics workspace.\nReferences:\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/learn/tutorial-response https://docs.microsoft.com/en-\nus/azure/azure-monitor/platform/agents-overview", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 318, "pdfId": 318, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/318" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box-1 : 3\nInitial starts 2 VM's 15 minutes have passed. at 10 minutes 1 VM was added we now have 3 VM's. Cool down is\n5 Minutes before another 10 minute wait cycle starts so the answer is 3.\nBox-2: 1\nInitial 5 VM's 60 minutes Pass. 1 VM removed every 15 minute cycle. 10 minutes wait timer plus 5 minute cool\ndown equals 15 minutes cycle. Four 15 minute cycles pass equaling 60 minutes removing 4 VM's. We have 1\nVM left.\nDefault Scale in and Out Default Durations are 10 minutes with 5 minute cool down.\nThe default scale set settings in Azure are:\n-Minimum number of instances 1\n-Maximum number of instances 10\n-Scale out CPU threshold (%) 75\n-Duration in minutes10\n-Number of instances to increase by 1\n-Scale in CPU threshold (%) 25\n-Number of instances to decrease by -1", "reference": "https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-autoscale-\nportal#create-a-rule-to-automatically-scale-in", "references": [ "https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-autoscale-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 319, "pdfId": 319, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/319" }, "markersInGap": [], "questionText": "You have web apps in the West US, Central US and East US Azure regions.\nYou have the App Service plans shown in the following table.\nYou plan to create an additional App Service plan named ASP5 that will use the Linux operating system.\nYou need to identify in which of the currently used locations you can deploy ASP5.\nWhat should you recommend?\nA.\nWest US, Central US, or East US\nB.\nCentral US only\nC.\nEast US only\nD.\nWest US only", "stem": "You have web apps in the West US, Central US and East US Azure regions. You have the App Service plans shown in the following table. You plan to create an additional App Service plan named ASP5 that will use the Linux operating system. You need to identify in which of the currently used locations you can deploy ASP5. What should you recommend", "options": [ { "key": "A", "text": "West US, Central US, or East US" }, { "key": "B", "text": "Central US only" }, { "key": "C", "text": "East US only" }, { "key": "D", "text": "West US only" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. West US, Central US, or East US\nAzure supports Linux App Service plans in a variety of regions, and West US, Central US, and East US are\namong those regions that commonly support Linux-based App Service plans.\nyou can deploy ASP5 in any of\nthese three locations.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 320, "pdfId": 320, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/320" }, "markersInGap": [], "questionText": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set\nby using an Azure Resource Manager template.\nYou need to ensure that NGINX is available on all the virtual machines after they are deployed.\nWhat should you use?\nA.\nthe New-AzConfigurationAssignment cmdlet\nB.\na Desired State Configuration (DSC) extension\nC.\nAzure Active Directory (Azure AD) Application Proxy\nD.\nAzure Application Insights", "stem": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource Manager template. You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use", "options": [ { "key": "A", "text": "the New-AzConfigurationAssignment cmdlet" }, { "key": "B", "text": "a Desired State Configuration (DSC) extension" }, { "key": "C", "text": "Azure Active Directory (Azure AD) Application Proxy" }, { "key": "D", "text": "Azure Application Insights" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "There are several versions of this question in the exam. The question has two correct answers:\n1. a Desired State Configuration (DSC) extension\n2. Azure Custom Script Extension\nThe question can have other incorrect answer options, including the following:\n✑\n the Publish-AzVMDscConfiguration cmdlet\n✑\n Azure Application Insights", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/dsc-overview", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/dsc-overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 321, "pdfId": 321, "exam": "AZ-104", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/321" }, "markersInGap": [ 320, 321 ], "questionText": "HOTSPOT -\nYou have an Azure subscription that contains the resources shown in the following table.\nIn Azure Cloud Shell, you need to create a virtual machine by using an Azure Resource Manager (ARM) template.\nHow should you complete the command? To answer, select the appropriate options in the answer area.\n NOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You have an Azure subscription that contains the resources shown in the following table. In Azure Cloud Shell, you need to create a virtual machine by using an Azure Resource Manager (ARM) template. How should you complete the command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: New-AzResourceGroupDeployment.\nThis cmdlet allows you to use a custom ARM template file to deploy resources to a resource group. For\nexample:\nNew-AzResourceGroup -Name $resourceGroupName -Location \"$location\"\nNew-AzResourceGroupDeployment `\n-ResourceGroupName $resourceGroupName `\n-TemplateUri \"https://raw.githubusercontent.com/Azure/azure-quickstart-\ntemplates/master/quickstarts/microsoft.compute/vm-simple-windows/azuredeploy.json\" `\n-adminUsername $adminUsername `\n-adminPassword $adminPassword `\n-dnsLabelPrefix $dnsLabelPrefix\nBox 2: -ResourceGroupName RG1.\nIt’s one of parameters of New-AzResourceGroupDeployment to specify to which resource group you want to\ndeploy resources.\nYou could use New-AzVm to create a VM, but it doesn’t use a template. You would need to provide all\nparameters in the command line.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/ps-template\nhttps://docs.microsoft.com/en-us/powershell/module/az.compute/new-azvm?view=azps-7.0.0\nhttps://docs.microsoft.com/en-us/powershell/module/az.resources/new-azresourcegroupdeployment?\nview=azps-6.6.0", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/ps-template", "https://docs.microsoft.com/en-us/powershell/module/az.compute/new-azvm?view=azps-7.0.0", "https://docs.microsoft.com/en-us/powershell/module/az.resources/new-azresourcegroupdeployment?" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some questions sets might have more than one\ncorrect solution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 322, "pdfId": 322, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/322" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou deploy an Azure Kubernetes Service (AKS) cluster named AKS1.\nYou need to deploy a YAML file to AKS1.\nSolution: From Azure Cloud Shell, you run az aks.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You deploy an Azure Kubernetes Service (AKS) cluster named AKS1. You need to deploy a YAML file to AKS1. Solution: From Azure Cloud Shell, you run az aks. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "To deploy a YAML file, the command is:\nkubectl apply -f .yaml", "reference": "https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough", "references": [ "https://docs.microsoft.com/en-us/azure/aks/kubernetes-walkthrough" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 323, "pdfId": 323, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/323" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure virtual machine named VM1 that runs Windows Server 2016.\nYou need to create an alert in Azure when more than two error events are logged to the System event log on VM1\nwithin an hour.\nSolution: You create an Azure Log Analytics workspace and configure the data settings. You add the Microsoft\nMonitoring Agent VM extension to VM1. You create an alert in Azure Monitor and specify the Log Analytics\nworkspace as the source.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1 that runs Windows Server 2016. You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour. Solution: You create an Azure Log Analytics workspace and configure the data settings. You add the Microsoft Monitoring Agent VM extension to VM1. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "You add the Microsoft Monitoring Agent VM extension to VM1 > This is WRONG\nYou Install the Microsoft Monitoring Agent VM agent to VM1 > This is Correct\n1. Log analytics agent - Install in VM. 2. Log analytics workspace - collect the log files from Log Analytics\nAgent. 3. Azure Monitor - Create alert based on logs read from Log Analytics Workspace. Reference:\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/platform/agents-overview\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 324, "pdfId": 324, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/324" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure virtual machine named VM1 that runs Windows Server 2016.\nYou need to create an alert in Azure when more than two error events are logged to the System event log on VM1\nwithin an hour.\nSolution: You create an Azure Log Analytics workspace and configure the data settings. You install the Microsoft\nMonitoring Agent on VM1. You create an alert in\nAzure Monitor and specify the Log Analytics workspace as the source.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1 that runs Windows Server 2016. You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour. Solution: You create an Azure Log Analytics workspace and configure the data settings. You install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Alerts in Azure Monitor can identify important information in your Log Analytics repository. They are created\nby alert rules that automatically run log searches at regular intervals, and if results of the log search match\nparticular criteria, then an alert record is created and it can be configured to perform an automated response.\nThe Log Analytics agent collects monitoring data from the guest operating system and workloads of virtual\nmachines in Azure, other cloud providers, and on- premises. It collects data into a Log Analytics workspace.", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/learn/tutorial-response https://docs.microsoft.com/en-\nus/azure/azure-monitor/platform/agents-overview", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/learn/tutorial-response", "https://docs.microsoft.com/en-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 325, "pdfId": 325, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/325" }, "markersInGap": [ 324, 325 ], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\nAll virtual machines run Windows Server 2016.\nOn VM1, you back up a folder named Folder1 as shown in the following exhibit.\n You plan to restore the backup to a different virtual machine.\nYou need to restore the backup to VM2.\nWhat should you do first?\nA.\nFrom VM1, install the Windows Server Backup feature.\nB.\nFrom VM2, install the Microsoft Azure Recovery Services Agent.\nC.\nFrom VM1, install the Microsoft Azure Recovery Services Agent.\nD.\nFrom VM2, install the Windows Server Backup feature.", "stem": "You have an Azure subscription that contains the resources shown in the following table. All virtual machines run Windows Server 2016. On VM1, you back up a folder named Folder1 as shown in the following exhibit. You plan to restore the backup to a different virtual machine. You need to restore the backup to VM2. What should you do first", "options": [ { "key": "A", "text": "From VM1, install the Windows Server Backup feature." }, { "key": "B", "text": "From VM2, install the Microsoft Azure Recovery Services Agent." }, { "key": "C", "text": "From VM1, install the Microsoft Azure Recovery Services Agent." }, { "key": "D", "text": "From VM2, install the Windows Server Backup feature." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "From VM2, install the Microsoft Azure Recovery Services Agent: This is the correct step to take first because\nthe Recovery Services Agent allows VM2 to interact with Azure Backup and restore the backup from Azure.", "reference": "https://docs.microsoft.com/en-us/azure/backup/backup-azure-restore-windows-server", "references": [ "https://docs.microsoft.com/en-us/azure/backup/backup-azure-restore-windows-server" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 326, "pdfId": 326, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/326" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1. copy\n2. copyIndex\nhttps://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/copy-properties#syntax\nAdd the copy element to the resources section of your template to set the number of items for a property. The\ncopy element has the following general format:\n- The count property specifies the number of iterations you want for the property\nhttps://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/copy-properties#property-\niteration\nUse the length function on the array to specify the count for iterations, and copyIndex to retrieve the current\nindex in the array.", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 327, "pdfId": 327, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/327" }, "markersInGap": [ 327 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription named Subscription1 that contains the resources shown in the following table.\n Subscription1 also includes a virtual network named VNET2. VM1 connects to a virtual network named VNET2 by\nusing a network interface named NIC1.\nYou need to create a new network interface named NIC2 for VM1.\nSolution: You create NIC2 in RG1 and West US.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Subscription1 that contains the resources shown in the following table. Subscription1 also includes a virtual network named VNET2. VM1 connects to a virtual network named VNET2 by using a network interface named NIC1. You need to create a new network interface named NIC2 for VM1. Solution: You create NIC2 in RG1 and West US. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "The virtual machine you attach a network interface to and the virtual network you connect it to must exist in\nthe same location, here West US, also referred to as a region.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 328, "pdfId": 328, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/328" }, "markersInGap": [ 328 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription named Subscription1 that contains the resources shown in the following table.\nSubscription1 also includes a virtual network named VNET2. VM1 connects to a virtual network named VNET2 by\nusing a network interface named NIC1.\nYou need to create a new network interface named NIC2 for VM1.\nSolution: You create NIC2 in RG2 and Central US.\nDoes this meet the goal?\nA.\nYes\n B.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Subscription1 that contains the resources shown in the following table. Subscription1 also includes a virtual network named VNET2. VM1 connects to a virtual network named VNET2 by using a network interface named NIC1. You need to create a new network interface named NIC2 for VM1. Solution: You create NIC2 in RG2 and Central US. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "The virtual machine you attach a network interface to and the virtual network you connect it to must exist in\nthe same location, here West US, also referred to as a region.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 329, "pdfId": 329, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/329" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription named Subscription1 that contains the resources shown in the following table.\nSubscription1 also includes a virtual network named VNET2. VM1 connects to a virtual network named VNET2 by\nusing a network interface named NIC1.\nYou need to create a new network interface named NIC2 for VM1.\nSolution: You create NIC2 in RG2 and West US.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription named Subscription1 that contains the resources shown in the following table. Subscription1 also includes a virtual network named VNET2. VM1 connects to a virtual network named VNET2 by using a network interface named NIC1. You need to create a new network interface named NIC2 for VM1. Solution: You create NIC2 in RG2 and West US. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "The virtual machine you attach a network interface to and the virtual network you connect it to must exist in\nthe same location, here West US, also referred to as a region.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface\nYou develop the following Azure Resource Manager (ARM) template to create a resource group and deploy an\nAzure Storage account to the resource group.\nWhich cmdlet should you run to deploy the template?\nA.\nNew-AzResource\nB.\nNew-AzResourceGroupDeployment\nC.\nNew-AzTenantDeployment\nD.\nNew-AzDeployment", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 330, "pdfId": 330, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/330" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Answer D: New-AzDeployment.\nTo add resources to a resource group, use the New-AzResourceGroupDeployment which creates a\ndeployment at a resource group. The New-AzDeployment cmdlet creates a deployment at the current\nsubscription scope, which deploys subscription level resources.", "reference": "https://learn.microsoft.com/en-us/powershell/module/az.resources/new-azdeployment?view=azps-9.7.0", "references": [ "https://learn.microsoft.com/en-us/powershell/module/az.resources/new-azdeployment?view=azps-9.7.0" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 331, "pdfId": 331, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/331" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: An Azure Storage account -\nApp Service can back up the following information to an Azure storage account and container that you have\nconfigured your app to use.\nApp configuration -\nFile content -\nDatabase connected to your app -", "reference": "https://docs.microsoft.com/en-us/azure/app-service/manage-backup", "references": [ "https://docs.microsoft.com/en-us/azure/app-service/manage-backup" ], "note": "Choose your backup destination by selecting a Storage Account and Container. The storage account\nmust belong to the same subscription as the app you want to back up. If you wish, you can create a new\nstorage account or a new container in the respective pages.\nBox 2: A _backup.filter file -\nExclude files from your backup.\nSuppose you have an app that contains log files and static images that have been backup once and are not\ngoing to change. In such cases, you can exclude those folders and files from being stored in your future\nbackups. To exclude files and folders from your backups, create a _backup.filter file in the D:\\home\\site\n\\wwwroot folder of your app. Specify the list of files and folders you want to exclude in this file.\nReference:\nhttps://docs.microsoft.com/en-us/azure/app-service/manage-backup", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 332, "pdfId": 332, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/332" }, "markersInGap": [], "questionText": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set\nby using an Azure Resource Manager template.\nYou need to ensure that NGINX is available on all the virtual machines after they are deployed.\nWhat should you use?\nA.\nthe Publish-AzVMDscConfiguration cmdlet\nB.\nAzure Application Insights\nC.\nAzure Custom Script Extension\nD.\na Microsoft Endpoint Manager device configuration profile", "stem": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource Manager template. You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use", "options": [ { "key": "A", "text": "the Publish-AzVMDscConfiguration cmdlet" }, { "key": "B", "text": "Azure Application Insights" }, { "key": "C", "text": "Azure Custom Script Extension" }, { "key": "D", "text": "a Microsoft Endpoint Manager device configuration profile" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Use Azure Resource Manager templates to install applications into virtual machine scale sets with the Custom\nScript Extension.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/tutorial-install-apps-template", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/tutorial-install-apps-template" ], "note": "The Custom Script Extension downloads and executes scripts on Azure VMs. This extension is useful for\npost deployment configuration, software installation, or any other configuration / management task.\nTo see the Custom Script Extension in action, create a scale set that installs the NGINX web server and\noutputs the hostname of the scale set VM instance.\nReference:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 333, "pdfId": 333, "exam": "AZ-104", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/333" }, "markersInGap": [], "questionText": "HOTSPOT -\nYou have an Azure subscription. The subscription contains a virtual machine that runs Windows 10.\nYou need to join the virtual machine to an Active Directory domain.\nHow should you complete the Azure Resource Manager (ARM) template? To answer, select the appropriate\noptions in the answer area.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You have an Azure subscription. The subscription contains a virtual machine that runs Windows 10. You need to join the virtual machine to an Active Directory domain. How should you complete the Azure Resource Manager (ARM) template? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: \"Microsoft.Compute/VirtualMachines/extensions\",\nThe following JSON example uses the Microsoft.Compute/virtualMachines/extensions resource type to install\nthe Active Directory domain join extension.\nParameters are used that you specify at deployment time. When the extension is deployed, the VM is joined to\nthe specified managed domain.\nBox 2: \"ProtectedSettings\":\nExample:\n\"apiVersion\": \"2015-06-15\",\n\"type\": \"Microsoft.Compute/virtualMachines/extensions\",\n\"name\": \"[concat(parameters('dnsLabelPrefix'),'/joindomain')]\",\n\"location\": \"[parameters('location')]\",\n\"dependsOn\": [\n\"[concat('Microsoft.Compute/virtualMachines/', parameters('dnsLabelPrefix'))]\"\n],\n\"properties\":\n\"publisher\": \"Microsoft.Compute\",\n\"type\": \"JsonADDomainExtension\",\n\"typeHandlerVersion\": \"1.3\",\n\"autoUpgradeMinorVersion\": true,\n\"settings\":\n\"Name\": \"[parameters('domainToJoin')]\",\n\"OUPath\": \"[parameters('ouPath')]\",\n\"User\": \"[concat(parameters('domainToJoin'), '\\\\', parameters('domainUsername'))]\",\n\"Restart\": \"true\",\n\"Options\": \"[parameters('domainJoinOptions')]\"\n,\n\"protectedSettings\":\n\"Password\": \"[parameters('domainPassword')]\"", "reference": "https://docs.microsoft.com/en-us/azure/active-directory-domain-services/join-windows-vm-template", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory-domain-services/join-windows-vm-template" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 334, "pdfId": 334, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/334" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\nYou need to configure a proximity placement group for VMSS1.\nWhich proximity placement groups should you use?\nA.\nProximity2 only\nB.\nProximity1, Proximity2, and Proximity3\nC.\nProximity1 only\nD.\nProximity1 and Proximity3 only", "stem": "You have an Azure subscription that contains the resources shown in the following table. You need to configure a proximity placement group for VMSS1. Which proximity placement groups should you use", "options": [ { "key": "A", "text": "Proximity2 only" }, { "key": "B", "text": "Proximity1, Proximity2, and Proximity3" }, { "key": "C", "text": "Proximity1 only" }, { "key": "D", "text": "Proximity1 and Proximity3 only" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Resource Group location of VMSS1 is the RG2 location, which is West US.\nOnly Proximity1, which also in RG2, is located in West US", "reference": "https://azure.microsoft.com/en-us/blog/introducing-proximity-placement-groups/", "references": [ "https://azure.microsoft.com/en-us/blog/introducing-proximity-placement-groups/" ], "note": "When you assign your virtual machines to a proximity placement group, the virtual machines are placed\nin the same data center, resulting in lower and deterministic latency for your applications.\nReference:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 335, "pdfId": 335, "exam": "AZ-104", "type": "dropdown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/335" }, "markersInGap": [ 335 ], "questionText": "HOTSPOT\n-\nYou are creating an Azure Kubernetes Services (AKS) cluster as shown in the following exhibit.\n Use the drop-down menus to select the answer choice that completes each statement based on the information\npresented in the graphic.\nNOTE: Each correct selection is worth one point.", "stem": "You are creating an Azure Kubernetes Services (AKS) cluster as shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1) Modify the Network configuration setting\n\"To run an AKS cluster that supports node pools for Windows Server containers, your cluster needs to use a\nnetwork policy that uses Azure CNI (advanced) network plugin.\"\n2) AKS-Managed Azure Active Directory", "reference": "https://learn.microsoft.com/en-us/azure/aks/cluster-container-registry-integration?tabs=azure-cli\n https://learn.microsoft.com/en-us/azure/aks/learn/quick-windows-container-deploy-cli", "references": [ "https://learn.microsoft.com/en-us/azure/aks/cluster-container-registry-integration?tabs=azure-cli", "https://learn.microsoft.com/en-us/azure/aks/learn/quick-windows-container-deploy-cli" ], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 336, "pdfId": 336, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/336" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1. updates\n2. --max-surge 2\nhttps://learn.microsoft.com/en-us/cli/azure/aks/nodepool?view=azure-cli-latest#az-aks-nodepool-update\nUpdate a node pool properties.\nhttps://learn.microsoft.com/en-us/cli/azure/aks/nodepool?view=azure-cli-latest#az-aks-nodepool-update-\noptional-parameters\nmax-surge\n- Extra nodes used to speed upgrade. When specified, it represents the number or percent used, eg. 5 or 33%.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 337, "pdfId": 337, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/337" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Yes : The 4 resources created are the RG1 resource group + the 3 storage accounts\nNo: the location of the storage accounts is defined by the parameter \"location\" in the \"resources\" item that\nhas the value of the Resource Group (stated by the \"resourceGroup().location\" function that returns the\nlocation of the resource group RG1 which is in Central US)\nYes: the names of the storages account have the prefix given by the copyIndex() function in \"name\": \"\n[concat(copyIndex(),'storage',uniqueString(resourceGroup().id))]\", which starts at the position 0", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 338, "pdfId": 338, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/338" }, "markersInGap": [], "questionText": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set\nby using an Azure Resource Manager template.\nYou need to ensure that NGINX is available on all the virtual machines after they are deployed.\nWhat should you use?\nA.\nAzure Custom Script Extension\nB.\nDeployment Center in Azure App Service\nC.\nthe Publish-AzVMDscConfiguration cmdlet\nD.\nthe New-AzConfigurationAssignment cmdlet", "stem": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource Manager template. You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use", "options": [ { "key": "A", "text": "Azure Custom Script Extension" }, { "key": "B", "text": "Deployment Center in Azure App Service" }, { "key": "C", "text": "the Publish-AzVMDscConfiguration cmdlet" }, { "key": "D", "text": "the New-AzConfigurationAssignment cmdlet" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. Azure Custom Script Extension.\nAzure Custom Script Extension: This extension can be used to download and execute scripts on Azure VMs\nduring their provisioning. You can provide a script to install NGINX on the virtual machines as part of the\ndeployment process.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 339, "pdfId": 339, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/339" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1. -ResourceGroupName\n2. Complete\nhttps://learn.microsoft.com/en-us/powershell/module/az.resources/new-azresourcegroupdeployment?\nview=azps-9.3.0#-resourcegroupname\nSpecifies the name of the resource group to deploy.\nhttps://learn.microsoft.com/en-us/powershell/module/az.resources/new-azresourcegroupdeployment?\nview=azps-9.3.0#-mode\nSpecifies the deployment mode. The acceptable values for this parameter are:\n-Complete: In complete mode, Resource Manager deletes resources that exist in the resource group but are\nnot specified in the template.\n- Incremental: In incremental mode, Resource Manager leaves unchanged resources that exist in the resource\ngroup but are not specified in the template.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 340, "pdfId": 340, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/340" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "After CPU usage has reached 80 percent for 15 minutes, [answer choice] will be running.\n2 instances.\nThis indicates that autoscaling is enabled, and when CPU utilization exceeds 80% for 15 minutes, the system\nscales out by adding an additional instance.\nIf initially only one instance was running, then scaling up will increase the total count to 2 instances.\nThis is a common threshold-based scaling policy used in cloud environments to optimize performance and\navailability.\nOnce the first scale-out instance is created, the minimum time before an additional instance is created will be\n[answer choice].\n15 minutes.\nThe scale-out cooldown period determines how long the system waits before adding another instance after\nthe first scale-out.\nA 15-minute delay ensures the system does not aggressively add new instances too quickly, preventing\nunnecessary costs and system instability.\nThis setting is useful in preventing rapid oscillations in scaling activity.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 341, "pdfId": 341, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/341" }, "markersInGap": [], "questionText": "You have an Azure subscription.\nYou plan to deploy the Azure container instances shown in the following table.\nWhich instances can you deploy to a container group?\nA.\nInstance1 only\nB.\nInstance2 only\nC.\nInstance1 and Instance2 only\nD.\nInstance3 and Instance4 only", "stem": "You have an Azure subscription. You plan to deploy the Azure container instances shown in the following table. Which instances can you deploy to a container group", "options": [ { "key": "A", "text": "Instance1 only" }, { "key": "B", "text": "Instance2 only" }, { "key": "C", "text": "Instance1 and Instance2 only" }, { "key": "D", "text": "Instance3 and Instance4 only" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Multi-container groups currently support only Linux containers. For Windows containers, Azure Container\nInstances only supports deployment of a single container instance. While we are working to bring all features\nto Windows containers, you can find current platform differences in the service", "reference": "https://learn.microsoft.com/en-us/azure/container-instances/container-instances-container-groups", "references": [ "https://learn.microsoft.com/en-us/azure/container-instances/container-instances-container-groups" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 342, "pdfId": 342, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/342" }, "markersInGap": [], "questionText": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set\nby using an Azure Resource Manager template.\nYou need to ensure that NGINX is available on all the virtual machines after they are deployed.\nWhat should you use?\nA.\nAzure Custom Script Extension\nB.\nDeployment Center in Azure App Service\nC.\nthe New-AzConfigurationAssignment cmdlet\nD.\nAzure AD Application Proxy", "stem": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource Manager template. You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use", "options": [ { "key": "A", "text": "Azure Custom Script Extension" }, { "key": "B", "text": "Deployment Center in Azure App Service" }, { "key": "C", "text": "the New-AzConfigurationAssignment cmdlet" }, { "key": "D", "text": "Azure AD Application Proxy" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/custom-script-windows\nThe Custom Script Extension downloads and runs scripts on Azure virtual machines (VMs). This extension is\nuseful for post-deployment configuration, software installation, or any other configuration or management\ntask. You can download scripts from Azure Storage or GitHub, or provide them to the Azure portal at\nextension runtime.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 343, "pdfId": 343, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/343" }, "markersInGap": [], "questionText": "You have an Azure subscription that has the public IP addresses shown in the following table.\nYou plan to deploy an Instance of Azure Firewall Premium named FW1.\nWhich IP addresses can you use?\nA.\nIP2 only\nB.\nIP1 and IP2 only\nC.\nIP1, IP2, and IP5 only\nD.\nIP1, IP2, IP4, and IP5 only", "stem": "You have an Azure subscription that has the public IP addresses shown in the following table. You plan to deploy an Instance of Azure Firewall Premium named FW1. Which IP addresses can you use", "options": [ { "key": "A", "text": "IP2 only" }, { "key": "B", "text": "IP1 and IP2 only" }, { "key": "C", "text": "IP1, IP2, and IP5 only" }, { "key": "D", "text": "IP1, IP2, IP4, and IP5 only" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure Firewall\n- Dynamic IPv4: No\n- Static IPv4: Yes\n- Dynamic IPv6: No\n- Static IPv6: No\nAzure Firewall is a cloud-based network security service that protects your Azure Virtual Network resources.\nAzure Firewall requires at least one public static IP address to be configured. This IP or set of IPs are used as\nthe external connection point to the firewall. Azure Firewall supports standard SKU public IP addresses. Basic\nSKU public IP address and public IP prefixes aren't supported.", "reference": "https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses#at-a-glance\nAzure Firewall\n- Dynamic IPv4: No\n- Static IPv4: Yes\n- Dynamic IPv6: No\n- Static IPv6: No\nhttps://learn.microsoft.com/en-us/azure/virtual-network/ip-services/configure-public-ip-firewall\nAzure Firewall is a cloud-based network security service that protects your Azure Virtual Network resources.\nAzure Firewall requires at least one public static IP address to be configured. This IP or set of IPs are used as\nthe external connection point to the firewall. Azure Firewall supports standard SKU public IP addresses. Basic\nSKU public IP address and public IP prefixes aren't supported.\nReference:\nhttps://learn.microsoft.com/en-us/azure/virtual-network/ip-services/configure-public-ip-firewall\nhttps://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses#at-a-\nglanchttps://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses#at-a-glance\nAzure Firewall", "references": [ "https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses#at-a-glance", "https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/configure-public-ip-firewall", "https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/configure-public-ip-firewall", "https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses#at-a-", "https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses#at-a-glance" ], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 344, "pdfId": 344, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/344" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "resourceId.\nresourceId is used to dynamically retrieve the ID of an existing resource.\nEnsures the VM references the correct network interface (NIC).\nresourceId dynamically retrieves the ID of an existing network interface (NIC).\nimageReference.\nimageReference defines the OS image for the VM.\nimageReference ensures the VM uses the correct Windows Server 2019 OS image.", "reference": null, "references": [], "note": "Each correct answer is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 345, "pdfId": 345, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/345" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Pricing Plan: Standard.\nRecord Type: TXT.\nWebApp1 must be able to verify a custom domain name of app.contoso.com. All paid tiers (Basic, Standard,\nPremium, Isolated) allow for custom domains.\nWebApp1 must be able to automatically scale up to eight instances. Auto-scaling is a feature that is available\nin the Standard, Premium, and Isolated tiers. It is not available in the Basic tier, which allows you to manually\nscale up to 3 instances.\nCosts and administrative effort must be minimized.\nPricing Plan: Given these requirements, the best option is the \"Standard\" tier. It offers both auto-scaling and\ncustom domains, while being less expensive than the Premium or Isolated tiers. The Basic tier does not\nsupport auto-scaling, and the Free and Shared tiers do not support custom domains or auto-scaling.\nFor verifying a custom domain, Azure uses a CNAME or TXT record. The A record cannot be used for domain\nverification", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 346, "pdfId": 346, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/346" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1- NO\nVM gen 2 is not directly supported for image definition with v1. Image & VM source regions doesn't match.\nBox 2 - YES\nVM generations matches, along with image & VM source region.\nBox 3 - NO\nVM generations matches, but image & VM source region doesn't.", "reference": "https://learn.microsoft.com/en-us/azure/virtual-machines/shared-image-galleries?tabs=azure-cli#how-do-i-\nspecify-the-source-region-while-creating-the-image-version", "references": [ "https://learn.microsoft.com/en-us/azure/virtual-machines/shared-image-galleries?tabs=azure-cli#how-do-i-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 347, "pdfId": 347, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/347" }, "markersInGap": [ 347 ], "questionText": "You plan to create the Azure web apps shown in the following table.\n What is the minimum number of App Service plans you should create for the web apps?\nA.\n1\nB.\n2\nC.\n3\nD.\n4", "stem": "You plan to create the Azure web apps shown in the following table. What is the minimum number of App Service plans you should create for the web apps", "options": [], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Correct", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": true } }, { "seq": 348, "pdfId": 348, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/348" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "1. Yes. RG0 will be created with location from template file. For subscription level deployments, you must\nprovide a location for the deployment. The location of the deployment is separate from the location of the\nresources you deploy. The deployment location specifies where to store deployment data.\n2. No. Only RG0 and RG3 will be created, RG1 and RG2 already exist and can't be created.\n3. No. RG3 will be created in east region.\nhttps://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-to-subscription?\ntabs=azure-cli#deployment-location-and-name", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 349, "pdfId": 349, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/349" }, "markersInGap": [ 349 ], "questionText": "You have an Azure App Service app named App1 that contains two running instances.\nYou have an autoscale rule configured as shown in the following exhibit.\n For the Instance limits scale condition setting, you set Maximum to 5.\nDuring a 30-minute period, App1 uses 80 percent of the available memory.\nWhat is the maximum number of instances for App1 during the 30-minute period?\nA.\n2\nB.\n3\nC.\n4\nD.\n5", "stem": "You have an Azure App Service app named App1 that contains two running instances. You have an autoscale rule configured as shown in the following exhibit. For the Instance limits scale condition setting, you set Maximum to 5. During a 30-minute period, App1 uses 80 percent of the available memory. What is the maximum number of instances for App1 during the 30-minute period", "options": [], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Start at 2 instances, after 15 min, > 70%, then +1 instance\nCooling 5 mins, still >70%, then +1 instance\nCooling 5 mins, still > 70%, then +1 instance\nCooling 5 mins, still >70%, since max 5 instances, keep 5 instances only.", "reference": null, "references": [], "note": "Each correct answer is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": true } }, { "seq": 350, "pdfId": 350, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/350" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Azure Container Instances only.\nACI is a serverless container service that allows you to run containers without managing the underlying\ninfrastructure.\nIt is ideal for short-lived tasks or scenarios where you need to quickly deploy containers.\nAzure Container Apps only.\nACA is a fully managed serverless platform for running containerized applications.\nIt is designed for microservices and modern applications, offering features like auto-scaling and integration\nwith Dapr (Distributed Application Runtime).", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 351, "pdfId": 351, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/351" }, "markersInGap": [], "questionText": "You have an Azure AD tenant named contoso.com.\nYou have an Azure subscription that contains an Azure App Service web app named App1 and an Azure key vault\nnamed KV1. KV1 contains a wildcard certificate for contoso.com.\nYou have a user named use\n[email protected]\n that is assigned the Owner role for App1 and KV1.\nYou need to configure App1 to use the wildcard certificate of KV1.\nWhat should you do first?\nA.\nCreate an access policy for KV1 and assign the Microsoft Azure App Service principal to the policy.\nB.\nAssign a managed user identity to App1.\nC.\nConfigure KV1 to use the role-based access control (RBAC) authorization system.\nD.\nCreate an access policy for KV1 and assign the policy to User1.", "stem": "You have an Azure AD tenant named contoso.com. You have an Azure subscription that contains an Azure App Service web app named App1 and an Azure key vault named KV1. KV1 contains a wildcard certificate for contoso.com. You have a user named use [email protected] that is assigned the Owner role for App1 and KV1. You need to configure App1 to use the wildcard certificate of KV1. What should you do first", "options": [ { "key": "A", "text": "Create an access policy for KV1 and assign the Microsoft Azure App Service principal to the policy." }, { "key": "B", "text": "Assign a managed user identity to App1." }, { "key": "C", "text": "Configure KV1 to use the role-based access control (RBAC) authorization system." }, { "key": "D", "text": "Create an access policy for KV1 and assign the policy to User1." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "[email protected] =\nuser1@contoso.com\nIn order to read secrets from a key vault, you need to have a vault created and give your app permission to\naccess it. Create a key vault by following the Key Vault quick start. Create a managed identity for your\napplication. Key vault references use the app's system-assigned identity by default, but you can specify a\nuser-assigned identity. Authorize read access to secrets your key vault for the managed identity you created\nearlier. How you do it depends on the permissions model of your key vault: Azure role-based access control:\nAssign the Key Vault Secrets User role to the managed identity. For instructions, see Provide access to Key\nVault keys, certificates, and secrets with an Azure role-based access control. Vault access policy: Assign the\nGet secrets permission to the managed identity. For instructions, see Assign a Key Vault access policy.\nhttps://learn.microsoft.com/en-us/azure/app-service/app-service-key-vault-references?tabs=azure-cli", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 352, "pdfId": 352, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/352" }, "markersInGap": [], "questionText": "You have an Azure subscription.\nYou plan to deploy the resources shown in the following table.\nYou need to create a single Azure Resource Manager (ARM) template that will be used to deploy the resources.\nWhich resource should be added to the dependsOn section for VM1?\nA.\nVNET1\nB.\nNIC1\nC.\nIP1\nD.\nNSG1", "stem": "You have an Azure subscription. You plan to deploy the resources shown in the following table. You need to create a single Azure Resource Manager (ARM) template that will be used to deploy the resources. Which resource should be added to the dependsOn section for VM1", "options": [ { "key": "A", "text": "VNET1" }, { "key": "B", "text": "NIC1" }, { "key": "C", "text": "IP1" }, { "key": "D", "text": "NSG1" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. The NIC acts as the bridge between the VM and the other network resources like the virtual network, public\nIP, and network security group. Hence, it's essential to ensure that NIC1 is deployed before VM1.\nhttps://learn.microsoft.com/en-us/azure/templates/microsoft.compute/virtualmachines?pivots=deployment-\nlanguage-arm-template\nhttps://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/resource-dependency\nhttps://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorial-create-\ntemplates-with-dependent-resources?tabs=CLI\nYou have an Azure subscription.\nYou create the following Azure Resource Manager (ARM) template named Template.json.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 353, "pdfId": 353, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/353" }, "markersInGap": [], "questionText": "You need to deploy Template.json.\nWhich PowerShell cmdlet should you run from Azure Cloud Shell?\nA.\nNew-AzSubscriptionDeployment\nB.\nNew-AzManagementGroupDeployment\nC.\nNew-AzResourceGroupDeployment\nD.\nNew-AzTenantDeployment", "stem": "You need to deploy Template.json. Which PowerShell cmdlet should you run from Azure Cloud Shell", "options": [ { "key": "A", "text": "New-AzSubscriptionDeployment" }, { "key": "B", "text": "New-AzManagementGroupDeployment" }, { "key": "C", "text": "New-AzResourceGroupDeployment" }, { "key": "D", "text": "New-AzTenantDeployment" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "New-Az Subscription Deployment is the correct answer, as the New-Az Resource Deployment is used to\ndeploy in an existing resource group. You can use New-Az Subscription Deployment(which is an alias for New-\nAz Deployment) to deploy resources at subscription level. \"The New-Az Resource Group Deployment cmdlet\nadds a deployment to an existing resource group\n\"https://learn.microsoft.com/en-us/powershell/module/az.resources/new-azresourcegroupdeployment?\nview=azps-10.4.1\nhttps://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-to-subscription?\ntabs=azure-powershell", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 354, "pdfId": 354, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/354" }, "markersInGap": [ 353, 354 ], "questionText": "You have an Azure subscription that contains a resource group named RG1.\nYou plan to create a storage account named storage1.\nYou have a Bicep file named File1.\nYou need to modify File1 so that it can be used to automate the deployment of storage1 to RG1.\n Which property should you modify?\nA.\nkind\nB.\nscope\nC.\nsku\nD.\nlocation", "stem": "You have an Azure subscription that contains a resource group named RG1. You plan to create a storage account named storage1. You have a Bicep file named File1. You need to modify File1 so that it can be used to automate the deployment of storage1 to RG1. Which property should you modify", "options": [ { "key": "A", "text": "kind" }, { "key": "B", "text": "scope" }, { "key": "C", "text": "sku" }, { "key": "D", "text": "location" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D (location) is the only logical answer. Here’s the rationale. Kind, sku and location are three required\nproperties. Scope (function) is not. Since we already 'have a Bicep file named File1' and need 'to automate the\ndeployment of storage1 to RG1' the only variable required updating is the location, as we can leave other two\n(kind & sku) as-is. Location is required property which must be modified.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 355, "pdfId": 355, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/355" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Yes\nNo\nYes\nThe deployment creates 3 RGs called RG0, RG1, RG2 as the index is 0-based.\nYou can deploy to RG1 as the lock is delete.\nYou can't deploy to RG2 as the lock is read-only, hence it can't be modified.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 356, "pdfId": 356, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/356" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\nYou need to configure a proximity placement group for VMSS1.\nWhich proximity placement groups should you use?\nA.\nProximity2 only\nB.\nProximity1, Proximity2, and Proximity3\nC.\nProximity1 only\nD.\nProximity1 and Proximity3 only", "stem": "You have an Azure subscription that contains the resources shown in the following table. You need to configure a proximity placement group for VMSS1. Which proximity placement groups should you use", "options": [ { "key": "A", "text": "Proximity2 only" }, { "key": "B", "text": "Proximity1, Proximity2, and Proximity3" }, { "key": "C", "text": "Proximity1 only" }, { "key": "D", "text": "Proximity1 and Proximity3 only" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C. Proximity1 only.\nProximity1 is chosen because it ensures that the VMs in VMSS1 are co-located physically, maximizing\nperformance and minimizing latency. Using multiple PPGs (options B and D) would spread the VMs across\ndifferent physical locations, increasing latency and reducing the benefits of proximity placement.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 357, "pdfId": 357, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/357" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "webapp1 can communicate with vm2: Yes\nwebapp1 is integrated with vnet1 and vnet1 is peered with vnet2, which vm2 is connected to. So, webapp1 can\ncommunicate with vm2.\nnsg1 controls inbound traffic to webapp1: No\nnsg1 is associated with subnet1, not directly with webapp1. It controls the inbound traffic to the subnet1, not to\nthe webapp1.\nwebapp2 can communicate with vm1: Yes\nwebapp2 is deployed to subnet2 and subnet2 is in vnet2. vnet2 is peered with vnet1, which vm1 is connected\nto. So, webapp2 can communicate with vm1.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 358, "pdfId": 358, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/358" }, "markersInGap": [ 358 ], "questionText": "You have an Azure subscription named Subscription1 that contains the resources shown in the following table.\nYou create virtual machines in Subscription1 as shown in the following table.\n You plan to use Vault1 for the backup of as many virtual machines as possible.\nWhich virtual machines can be backed up to Vault1?\nA.\nVM1 only\nB.\nVM3 and VMC only\nC.\nVM1, VM2, VM3, VMA, VMB, and VMC\nD.\nVM1, VM3, VMA, and VMC only\nE.\nVM1 and VM3 only", "stem": "You have an Azure subscription named Subscription1 that contains the resources shown in the following table. You create virtual machines in Subscription1 as shown in the following table. You plan to use Vault1 for the backup of as many virtual machines as possible. Which virtual machines can be backed up to Vault1", "options": [ { "key": "A", "text": "VM1 only" }, { "key": "B", "text": "VM3 and VMC only" }, { "key": "C", "text": "VM1, VM2, VM3, VMA, VMB, and VMC" }, { "key": "D", "text": "VM1, VM3, VMA, and VMC only" }, { "key": "E", "text": "VM1 and VM3 only" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D: VM1, VM3, VMA, and VMC only the West Europe VMs:You need a vault in every Azure region that contains\nVMs you want to back up. You can't back up to a different region.Azure Backup supports application-\nconsistent backups for both Windows and Linux VMsThere is no restriction that prevents backups from being\nperformed on a Recovery Services Vault located in another resource Group", "reference": "https://learn.microsoft.com/en-us/azure/virtual-machines/backup-recovery", "references": [ "https://learn.microsoft.com/en-us/azure/virtual-machines/backup-recovery" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 359, "pdfId": 359, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/359" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains an Azure container registry named ContReg1.\nYou enable the Admin user for ContReg1.\nWhich username can you use to sign in to ContReg1?\nA.\nroot\nB.\nadmin\nC.\nadministrator\nD.\nContReg1", "stem": "You have an Azure subscription that contains an Azure container registry named ContReg1. You enable the Admin user for ContReg1. Which username can you use to sign in to ContReg1", "options": [ { "key": "A", "text": "root" }, { "key": "B", "text": "admin" }, { "key": "C", "text": "administrator" }, { "key": "D", "text": "ContReg1" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "A. root\n\n❌\n Incorrect.\n“root” is not used as a username for Azure Container Registry authentication.\nB. admin\n❌\n Incorrect.\nEven though the admin user is enabled, the username is not simply “admin”.\nC. administrator\n\n❌\n Incorrect.\nThis is not a valid username for Azure Container Registry.\nD. ContReg1\n\n✅\n Correct.\nWhen the Admin user is enabled for an Azure Container Registry, the\nregistry name (ContReg1)\n is used as the\nusername for authentication.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 360, "pdfId": 360, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/360" }, "markersInGap": [], "questionText": "You have an Azure subscription.\nYou plan to create an Azure container registry named ContReg1.\nYou need to ensure that you can push and pull signed images for ContReg1.\nWhat should you do for ContReg1?\nA.\nEnable encryption by using a customer-managed key.\nB.\nCreate a connected registry.\nC.\nAdd a token.\nD.\nEnable content trust.", "stem": "You have an Azure subscription. You plan to create an Azure container registry named ContReg1. You need to ensure that you can push and pull signed images for ContReg1. What should you do for ContReg1", "options": [ { "key": "A", "text": "Enable encryption by using a customer-managed key." }, { "key": "B", "text": "Create a connected registry." }, { "key": "C", "text": "Add a token." }, { "key": "D", "text": "Enable content trust." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. Enable content trust.\nEnabling content trust in Azure Container Registry ensures that all images are signed before they are pushed\nto the registry and verifies the signatures when images are pulled. This helps maintain the integrity and\nauthenticity of the container images, ensuring that only signed and trusted images are used.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 361, "pdfId": 361, "exam": "AZ-104", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/361" }, "markersInGap": [ 360, 361 ], "questionText": "HOTSPOT\n-\nYou have an Azure subscription that has the Azure container registries shown in the following table.\nYou plan to use ACR Tasks and configure private endpoint connections.\nWhich container registries support ACR Tasks and private endpoints? To answer, select the appropriate options in\nthe answer area.\n NOTE: Each correct selection is worth one point.", "stem": "You have an Azure subscription that has the Azure container registries shown in the following table. You plan to use ACR Tasks and configure private endpoint connections. Which container registries support ACR Tasks and private endpoints? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "ContReg1, ContReg2, and ContReg3.\nThis option indicates that ACR Tasks are applicable to all three container registries.\nContReg1 only.\nThis option suggests that private endpoints are configured only for ContReg1.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 362, "pdfId": 362, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/362" }, "markersInGap": [ 362 ], "questionText": "You plan to deploy several Azure virtual machines that will run Windows Server 2022 in a virtual machine scale set\nby using an Azure Resource Manager template.\nYou need to ensure that NGINX is available on all the virtual machines after they are deployed.\n What should you use?\nA.\nAzure Custom Script Extension\nB.\nDeployment Center in Azure App Service\nC.\nMicrosoft Entra Application Proxy\nD.\nthe Publish-AzVMDscConfiguration cmdlet", "stem": "You plan to deploy several Azure virtual machines that will run Windows Server 2022 in a virtual machine scale set by using an Azure Resource Manager template. You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use", "options": [ { "key": "A", "text": "Azure Custom Script Extension" }, { "key": "B", "text": "Deployment Center in Azure App Service" }, { "key": "C", "text": "Microsoft Entra Application Proxy" }, { "key": "D", "text": "the Publish-AzVMDscConfiguration cmdlet" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. Azure Custom Script Extension.\nThe Azure Custom Script Extension allows you to run scripts (PowerShell, Bash, etc.) on Azure VMs after\ndeployment.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 363, "pdfId": 363, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/363" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains a container group named Group1. Group1 contains two Azure\ncontainer instances as shown in the following table.\nYou need to ensure that container2 can use CPU resources without negatively affecting container1.\nWhat should you do?\nA.\nIncrease the resource limit of container1 to three CPUs.\nB.\nIncrease the resource limit of container2 to six CPUs.\nC.\nRemove the resource limit for both containers.\nD.\nDecrease the resource limit of container2 to two CPUs.", "stem": "You have an Azure subscription that contains a container group named Group1. Group1 contains two Azure container instances as shown in the following table. You need to ensure that container2 can use CPU resources without negatively affecting container1. What should you do", "options": [ { "key": "A", "text": "Increase the resource limit of container1 to three CPUs." }, { "key": "B", "text": "Increase the resource limit of container2 to six CPUs." }, { "key": "C", "text": "Remove the resource limit for both containers." }, { "key": "D", "text": "Decrease the resource limit of container2 to two CPUs." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Answer is C.\nThe resources allocated to Group1 is 5 CPUs\nOption D must be wrong. It is because the resource limit of a container instance must be greater than or equal\nto the mandatory resource request property. The resource limit of container 2 must be 3 or greater.\nOption B is wrong as well. The maximum resource limit you can set for a container instance is the total\nresources allocated to the group. Thus, maximum request limit of container2 is 5. Also, Resource limit of\ncontainer2 is 4. Container2 could use up to 4 CPUs that will negatively impact container1. Increase it 6 CPUs\nwill make the situation even worse.\nOption A can not stop container2 use up to 4 CPUs.\nYou have an Azure subscription.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 364, "pdfId": 364, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/364" }, "markersInGap": [], "questionText": "You plan to deploy a container.\nYou need to recommend which Azure services can scale the container automatically.\nWhat should you recommend?\nA.\nAzure Container Apps only\nB.\nAzure Container Instances only\nC.\nAzure Container Apps or Azure App Service only\nD.\nAzure Container Instances or Azure App Service only\nE.\nAzure Container Apps, Azure Container Instances, or Azure App Service", "stem": "You plan to deploy a container. You need to recommend which Azure services can scale the container automatically. What should you recommend", "options": [ { "key": "A", "text": "Azure Container Apps only" }, { "key": "B", "text": "Azure Container Instances only" }, { "key": "C", "text": "Azure Container Apps or Azure App Service only" }, { "key": "D", "text": "Azure Container Instances or Azure App Service only" }, { "key": "E", "text": "Azure Container Apps, Azure Container Instances, or Azure App Service" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "To scale containers automatically, the following Azure services support this feature:\nAzure Container Apps: Supports automatic horizontal scaling through declarative scaling rules1.\nAzure App Service: Supports automatic scaling for web apps, including those deployed as containers", "reference": null, "references": [], "note": "Each correct answer is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 365, "pdfId": 365, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/365" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Provision a new container registry:\naz.acr create.\nThis is the correct command to create a new Azure Container Registry.\nAdd image1 to the registry:\ndocker push.\n​\nThis is the correct command to push a Docker image to a registry.", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 366, "pdfId": 366, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/366" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure container registry named Registry1 that contains an image named image1.\nYou receive an error message when you attempt to deploy a container instance by using image1.\nYou need to be able to deploy a container instance by using image1.\nSolution: You assign the AcrPull role to ACR-Tasks-Network for Registry1.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure container registry named Registry1 that contains an image named image1. You receive an error message when you attempt to deploy a container instance by using image1. You need to be able to deploy a container instance by using image1. Solution: You assign the AcrPull role to ACR-Tasks-Network for Registry1. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "No Acr Pull role assigned to ACR-Tasks-Network does not meet the goal. This role should be assigned to the\nidentity that is performing the container deployment.", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 367, "pdfId": 367, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/367" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure container registry named Registry1 that contains an image named image1.\nYou receive an error message when you attempt to deploy a container instance by using image1.\nYou need to be able to deploy a container instance by using image1.\nSolution: You select Use dedicated data endpoint for Registry1.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure container registry named Registry1 that contains an image named image1. You receive an error message when you attempt to deploy a container instance by using image1. You need to be able to deploy a container instance by using image1. Solution: You select Use dedicated data endpoint for Registry1. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "No, selecting “Use dedicated data endpoint” for Registry1 does not directly address the issue of deploying a\ncontainer instance using image1.The error message you received likely indicates that the image is\ninaccessible. This can happen due to several reasons, such as incorrect credentials or firewall rules blocking\naccess12.To resolve this issue, you should ensure that:The credentials used to access the Azure Container\nRegistry are correct.The Azure Container Registry allows access from the Azure Container Instances service.\nYou can achieve this by enabling the “Allow trusted services” option or using a managed identity12.", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 368, "pdfId": 368, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/368" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure container registry named Registry1 that contains an image named image1.\nYou receive an error message when you attempt to deploy a container instance by using image1.\nYou need to be able to deploy a container instance by using image1.\nSolution: You create a private endpoint connection for Registry1.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure container registry named Registry1 that contains an image named image1. You receive an error message when you attempt to deploy a container instance by using image1. You need to be able to deploy a container instance by using image1. Solution: You create a private endpoint connection for Registry1. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. No\nCreating a private endpoint connection for Registry1 alone will not resolve the issue of deploying a container\ninstance using image1. The error could be due to various reasons such as authentication issues, image not\nbeing found, or network restrictions.\nTo troubleshoot, you might need to:\n- Ensure the container instance has the necessary permissions to access the registry.\n- Verify the image name and tag are correct.\n- Check network settings and firewall rules.\n- Confirm that the container instance can resolve the registry's DNS name.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 369, "pdfId": 369, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/369" }, "markersInGap": [ 368, 369 ], "questionText": "You have a Standard Azure App Service plan named Plan1.\nYou need to ensure that Plan1 will scale automatically when the CPU usage of the web app exceeds 80 percent.\nWhat should you select for Plan1?\nA.\nAutomatic in the Scale out method settings\nB.\nRules Based in the Scale out method settings\n C.\nPremium P1 in the Scale up (App Service plan) settings\nD.\nStandard S1 in the Scale up (App Service plan) settings\nE.\nManual in the Scale out method settings", "stem": "You have a Standard Azure App Service plan named Plan1. You need to ensure that Plan1 will scale automatically when the CPU usage of the web app exceeds 80 percent. What should you select for Plan1", "options": [ { "key": "A", "text": "Automatic in the Scale out method settings" }, { "key": "B", "text": "Rules Based in the Scale out method settings" }, { "key": "C", "text": "Premium P1 in the Scale up (App Service plan) settings" }, { "key": "D", "text": "Standard S1 in the Scale up (App Service plan) settings" }, { "key": "E", "text": "Manual in the Scale out method settings" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "In Azure Monitor, rules-based scaling in the scale-out method settings use metrics and schedules to\ndetermine when to add or remove resources to run an application. These rules include minimum and maximum\nresource levels, and when the conditions are met, one or more autoscale actions are triggered. For example,\nyou can scale out an application by adding VMs when the average CPU usage per VM is above a certain\npercentage, or scale it back by removing VMs when CPU usage drops below a certain percentage.\nCase study -\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like to\ncomplete each case. However, there may be additional case studies and sections on this exam. You must manage\nyour time to ensure that you are able to complete all questions included on this exam in the time provided.\nTo answer the questions included in a case study, you will need to reference information that is provided in the\ncase study. Case studies might contain exhibits and other resources that provide more information about the\nscenario that is described in the case study. Each question is independent of the other questions in this case study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and to\nmake changes before you move to the next section of the exam. After you begin a new section, you cannot return\nto this section.\nTo start the case study -\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to explore\nthe content of the case study before you answer the questions. Clicking these buttons displays information such\nas business requirements, existing environment, and problem statements. If the case study has an All Information\ntab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you\nare ready to answer a question, click the Question button to return to the question.\nOverview -\nADatum Corporation is consulting firm that has a main office in Montreal and branch offices in Seattle and New\nYork.\nExisting Environment -\nAzure Environment -\nADatum has an Azure subscription that contains three resource groups named RG1, RG2, and RG3.\nThe subscription contains the storage accounts shown in the following table.\nThe subscription contains the virtual machines shown in the following table.\nThe subscription has an Azure container registry that contains the images shown in the following table.\nThe subscription contains the resources shown in the following table.\nAzure Key Vault -\nThe subscription contains an Azure key vault named Vault1.\nVault1 contains the certificates shown in the following table.\nVault1 contains the keys shown in the following table.\nMicrosoft Entra Environment -\nADatum has a Microsoft Entra tenant named adatum.com that is linked to the Azure subscription and contains the\nusers shown in the following table.\nThe tenant contains the groups shown in the following table.\nThe adatum.com tenant has a custom security attribute named Attribute1.\nPlanned Changes -\nADatum plans to implement the following changes:\n•Configure a data collection rule (DCR) named DCR1 to collect only system events that have an event ID of 4648\nfrom VM2 and VM4.\n•In storage1, create a new container named cont2 that has the following access policies: oThree stored access\npolicies named Stored1, Stored2, and Stored3 oA legal hold for immutable blob storage\n•Whenever possible, use directories to organize storage account content.\n•Grant User1 the permissions required to link Zone1 to VNet1.\n•Assign Attribute1 to supported adatum.com resources.\n•In storage2, create an encryption scope named Scope1.\n•Deploy new containers by using Image1 or Image2.\nTechnical Requirements -\nADatum must meet the following technical requirements:\n•Use TLS for WebApp1.\n•Follow the principle of least privilege.\n•Grant permissions at the required scope only.\n•Ensure that Scope1 is used to encrypt storage services.\n•Use Azure Backup to back up cont1 and share1 as frequently as possible.\n•Whenever possible, use Azure Disk Encryption and a key encryption key (KEK) to encrypt the virtual machines.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 370, "pdfId": 370, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/370" }, "markersInGap": [], "questionText": "You need to configure WebApp1 to meet the technical requirements.\nWhich certificate can you use from Vault1?\nA.\nCert1 only\nB.\nCert1 or Cert2 only\nC.\nCert1 or Cert3 only\nD.\nCert3 or Cert4 only\nE.\nCert1, Cert2 Cert3, or Cert4", "stem": "You need to configure WebApp1 to meet the technical requirements. Which certificate can you use from Vault1", "options": [ { "key": "A", "text": "Cert1 only" }, { "key": "B", "text": "Cert1 or Cert2 only" }, { "key": "C", "text": "Cert1 or Cert3 only" }, { "key": "D", "text": "Cert3 or Cert4 only" }, { "key": "E", "text": "Cert1, Cert2 Cert3, or Cert4" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D.Cert3 or Cert4 only.\nCert3 and Cert4 likely meet the specific technical requirements for WebApp1, such as being issued by a\ntrusted CA, having valid expiration dates, and being configured for the appropriate domain.", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 371, "pdfId": 371, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/371" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager\ntemplate named ARM1.json.\nYou receive a notification that VM1 will be affected by maintenance.\nYou need to move VM1 to a different host immediately.\nSolution: From the resource group blade, move VM1 to another subscription.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json. You receive a notification that VM1 will be affected by maintenance. You need to move VM1 to a different host immediately. Solution: From the resource group blade, move VM1 to another subscription. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. No\nMoving a VM to another subscription does not immediately move it to a different host. Instead, it involves a\ncomplex process that may require recreating the VM in the target subscription.", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 372, "pdfId": 372, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/372" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager\ntemplate named ARM1.json.\nYou receive a notification that VM1 will be affected by maintenance.\nYou need to move VM1 to a different host immediately.\nSolution: From the VM1 Redeploy + reapply blade, you select Redeploy.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json. You receive a notification that VM1 will be affected by maintenance. You need to move VM1 to a different host immediately. Solution: From the VM1 Redeploy + reapply blade, you select Redeploy. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. Yes\nSelecting Redeploy from the Redeploy + reapply blade will move VM1 to a new Azure host immediately. This\naction shuts down the VM, moves it to a different physical server, and then powers it back on, which meets the\ngoal of moving the VM to a different host.\nRedeploy forces the VM to be placed on a new host in Azure while retaining all configurations.\nThis is useful for resolving host-related issues or maintenance scenarios.", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 373, "pdfId": 373, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/373" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager\ntemplate named ARM1.json.\nYou receive a notification that VM1 will be affected by maintenance.\nYou need to move VM1 to a different host immediately.\nSolution: From the VM1 Updates blade, select One-time update.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json. You receive a notification that VM1 will be affected by maintenance. You need to move VM1 to a different host immediately. Solution: From the VM1 Updates blade, select One-time update. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. No\nSelecting One-time update from the Updates blade is related to applying updates to the VM (such as\nWindows or Linux updates) but does not move the VM to a different host.\nTo move VM1 to a different host immediately, you should use the Redeploy option under Redeploy + reapply,", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 374, "pdfId": 374, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/374" }, "markersInGap": [ 373, 374 ], "questionText": "which forces the VM to migrate to a new Azure host.\nCase study -\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like to\ncomplete each case. However, there may be additional case studies and sections on this exam. You must manage\nyour time to ensure that you are able to complete all questions included on this exam in the time provided.\nTo answer the questions included in a case study, you will need to reference information that is provided in the\ncase study. Case studies might contain exhibits and other resources that provide more information about the\n scenario that is described in the case study. Each question is independent of the other questions in this case study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and to\nmake changes before you move to the next section of the exam. After you begin a new section, you cannot return\nto this section.\nTo start the case study -\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to explore\nthe content of the case study before you answer the questions. Clicking these buttons displays information such\nas business requirements, existing environment, and problem statements. If the case study has an All Information\ntab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you\nare ready to answer a question, click the Question button to return to the question.\nOverview -\nADatum Corporation is consulting firm that has a main office in Montreal and branch offices in Seattle and New\nYork.\nExisting Environment -\nAzure Environment -\nADatum has an Azure subscription that contains three resource groups named RG1, RG2, and RG3.\nThe subscription contains the storage accounts shown in the following table.\nThe subscription contains the virtual machines shown in the following table.\nThe subscription has an Azure container registry that contains the images shown in the following table.\nThe subscription contains the resources shown in the following table.\n\nAzure Key Vault -\nThe subscription contains an Azure key vault named Vault1.\nVault1 contains the certificates shown in the following table.\nVault1 contains the keys shown in the following table.\nMicrosoft Entra Environment -\nADatum has a Microsoft Entra tenant named adatum.com that is linked to the Azure subscription and contains the\nusers shown in the following table.\nThe tenant contains the groups shown in the following table.\nThe adatum.com tenant has a custom security attribute named Attribute1.\nPlanned Changes -\nADatum plans to implement the following changes:\n•Configure a data collection rule (DCR) named DCR1 to collect only system events that have an event ID of 4648\nfrom VM2 and VM4.\n•In storage1, create a new container named cont2 that has the following access policies: oThree stored access\npolicies named Stored1, Stored2, and Stored3 oA legal hold for immutable blob storage\n•Whenever possible, use directories to organize storage account content.\n•Grant User1 the permissions required to link Zone1 to VNet1.\n•Assign Attribute1 to supported adatum.com resources.\n•In storage2, create an encryption scope named Scope1.\n•Deploy new containers by using Image1 or Image2.\nTechnical Requirements -\nADatum must meet the following technical requirements:\n•Use TLS for WebApp1.\n•Follow the principle of least privilege.\n•Grant permissions at the required scope only.\n•Ensure that Scope1 is used to encrypt storage services.\n•Use Azure Backup to back up cont1 and share1 as frequently as possible.\n•Whenever possible, use Azure Disk Encryption and a key encryption key (KEK) to encrypt the virtual machines.\nYou need to meet the technical requirements for the KEK.\nWhich PowerShell cmdlet and key should you use?\nA.\nSet-AzVMDiskEncryptionExtension and Key2.\nB.\nSet-AzDiskEncryptionKey and Key2.\nC.\nSet-AzDiskDiskEncryptionKey and Key1.\nD.\nSet-AzVMDiskEncryptionExtension and Key1.", "stem": "which forces the VM to migrate to a new Azure host. Case study - This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study - To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question. Overview - ADatum Corporation is consulting firm that has a main office in Montreal and branch offices in Seattle and New York. Existing Environment - Azure Environment - ADatum has an Azure subscription that contains three resource groups named RG1, RG2, and RG3. The subscription contains the storage accounts shown in the following table. The subscription contains the virtual machines shown in the following table. The subscription has an Azure container registry that contains the images shown in the following table. The subscription contains the resources shown in the following table. Azure Key Vault - The subscription contains an Azure key vault named Vault1. Vault1 contains the certificates shown in the following table. Vault1 contains the keys shown in the following table. Microsoft Entra Environment - ADatum has a Microsoft Entra tenant named adatum.com that is linked to the Azure subscription and contains the users shown in the following table. The tenant contains the groups shown in the following table. The adatum.com tenant has a custom security attribute named Attribute1. Planned Changes - ADatum plans to implement the following changes: •Configure a data collection rule (DCR) named DCR1 to collect only system events that have an event ID of 4648 from VM2 and VM4. •In storage1, create a new container named cont2 that has the following access policies: oThree stored access policies named Stored1, Stored2, and Stored3 oA legal hold for immutable blob storage •Whenever possible, use directories to organize storage account content. •Grant User1 the permissions required to link Zone1 to VNet1. •Assign Attribute1 to supported adatum.com resources. •In storage2, create an encryption scope named Scope1. •Deploy new containers by using Image1 or Image2. Technical Requirements - ADatum must meet the following technical requirements: •Use TLS for WebApp1. •Follow the principle of least privilege. •Grant permissions at the required scope only. •Ensure that Scope1 is used to encrypt storage services. •Use Azure Backup to back up cont1 and share1 as frequently as possible. •Whenever possible, use Azure Disk Encryption and a key encryption key (KEK) to encrypt the virtual machines. You need to meet the technical requirements for the KEK. Which PowerShell cmdlet and key should you use", "options": [ { "key": "A", "text": "Set-AzVMDiskEncryptionExtension and Key2." }, { "key": "B", "text": "Set-AzDiskEncryptionKey and Key2." }, { "key": "C", "text": "Set-AzDiskDiskEncryptionKey and Key1." }, { "key": "D", "text": "Set-AzVMDiskEncryptionExtension and Key1." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. Set-AzVMDiskEncryptionExtension and Key1.\nTo meet the technical requirements for the KEK (Key Encryption Key) in Azure VM Disk Encryption, you need\nto use the Set-AzVMDiskEncryptionExtension cmdlet. This cmdlet enables Azure Disk Encryption (ADE), which\nsupports encrypting both OS and data disks using Azure Key Vault keys.\nSet-AzVMDiskEncryptionExtension: This is the correct cmdlet for enabling encryption on a VM using Azure\nDisk Encryption.\nKey1: This likely refers to the Key Encryption Key (KEK), which is used to further protect the encryption keys\nstored in Azure Key Vault.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 375, "pdfId": 375, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/375" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: an internal load balancer\nAzure Internal Load Balancer (ILB) provides network load balancing between virtual machines that reside\ninside a cloud service or a virtual network with a regional scope.\nBox 2: an application gateway that uses the WAF tier\nAzure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your\nweb applications from common exploits and vulnerabilities. Web applications are increasingly targeted by\nmalicious attacks that exploit commonly known vulnerabilities.", "reference": "https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview\nYour company has three offices. The offices are located in Miami, Los Angeles, and New York. Each office contains\ndatacenter.", "references": [ "https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 376, "pdfId": 376, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/376" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains resources in the East US and West US Azure regions. Each region\ncontains a virtual network. The virtual networks are peered.\nYou need to connect the datacenters to the subscription. The solution must minimize network latency between the\ndatacenters.\nWhat should you create?\nA.\nthree Azure Application Gateways and one On-premises data gateway\nB.\nthree virtual hubs and one virtual WAN\nC.\nthree virtual WANs and one virtual hub\nD.\nthree On-premises data gateways and one Azure Application Gateway", "stem": "You have an Azure subscription that contains resources in the East US and West US Azure regions. Each region contains a virtual network. The virtual networks are peered. You need to connect the datacenters to the subscription. The solution must minimize network latency between the datacenters. What should you create", "options": [ { "key": "A", "text": "three Azure Application Gateways and one On-premises data gateway" }, { "key": "B", "text": "three virtual hubs and one virtual WAN" }, { "key": "C", "text": "three virtual WANs and one virtual hub" }, { "key": "D", "text": "three On-premises data gateways and one Azure Application Gateway" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "A. three Azure Application Gateways and one On-premises data gateway\n\n❌\n Incorrect.\nApplication Gateway is used for web traffic load balancing, not for connecting on-premises datacenters to\nAzure networks.\nB. three virtual hubs and one virtual WAN\n\n✅\n Correct.\nAzure Virtual WAN with multiple virtual hubs allows each office (Miami, Los Angeles, New York) to connect to\nthe nearest Azure hub, minimizing latency and enabling optimized global connectivity.\nC. three virtual WANs and one virtual hub\n\n❌\n Incorrect.\nA single Virtual WAN is designed to manage multiple hubs, not the other way around.\nD. three On-premises data gateways and one Azure Application Gateway\n\n❌\n Incorrect.\nOn-premises data gateways are used for connecting services like Power BI, not for full network connectivity\nbetween datacenters and Azure.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 377, "pdfId": 377, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/377" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: 5 -\nA public and a private IP address can be assigned to a single network interface.\nBox 2: 1 -\nYou can associate zero, or one, network security group to each virtual network subnet and network interface\nin a virtual machine. The same network security group can be associated to as many subnets and network\ninterfaces as you choose.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface-addresses", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface-addresses" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 378, "pdfId": 378, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/378" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\nLB1 is configured as shown in the following table.\nYou plan to create new inbound NAT rules that meet the following requirements:\n✑\n Provide Remote Desktop access to VM1 from the internet by using port 3389.\n✑\n Provide Remote Desktop access to VM2 from the internet by using port 3389.\nWhat should you create on LB1 before you can create the new inbound NAT rules?\nA.\na frontend IP address\nB.\na load balancing rule\nC.\na health probe\nD.\na backend pool", "stem": "You have an Azure subscription that contains the resources shown in the following table. LB1 is configured as shown in the following table. You plan to create new inbound NAT rules that meet the following requirements: ✑ Provide Remote Desktop access to VM1 from the internet by using port 3389. ✑ Provide Remote Desktop access to VM2 from the internet by using port 3389. What should you create on LB1 before you can create the new inbound NAT rules", "options": [ { "key": "A", "text": "a frontend IP address" }, { "key": "B", "text": "a load balancing rule" }, { "key": "C", "text": "a health probe" }, { "key": "D", "text": "a backend pool" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. a frontend IP address.\nBefore you can create inbound NAT rules on Azure Load Balancer (LB1), you need to have a frontend IP\naddress. The frontend IP is the public or private IP address that receives incoming traffic before forwarding it\nbased on NAT rules.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 379, "pdfId": 379, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/379" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "The virtual machines are registered (added) to the private zone as A records pointing to their private IP\naddresses.", "reference": "https://docs.microsoft.com/en-us/azure/dns/private-dns-overview https://docs.microsoft.com/en-\nus/azure/dns/private-dns-scenarios", "references": [ "https://docs.microsoft.com/en-us/azure/dns/private-dns-overview", "https://docs.microsoft.com/en-" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 380, "pdfId": 380, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/380" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: An Azure Log Analytics workspace\nIn the Azure portal you can set up a Log Analytics workspace, which is a unique Log Analytics environment\nwith its own data repository, data sources, and solutions.\nBox 2: NSG1\nNSG flow logs allow viewing information about ingress and egress IP traffic through a Network security\ngroup. Through this, the IP addresses that connect to the ILB can be monitored when the diagnostics are\nenabled on a Network Security Group.\nWe cannot enable diagnostics on an internal load balancer to check for the IP addresses.\nAs for Internal LB, it is basic one. Basic can only connect to storage account. Also, Basic LB has only activity\nlogs, which doesn't include the connectivity workflow. So, we need to use NSG to meet the mentioned\nrequirements.", "reference": "https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-quick-create-workspace\nhttps://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-diagnostics", "references": [ "https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-quick-create-workspace", "https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-diagnostics" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 381, "pdfId": 381, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/381" }, "markersInGap": [], "questionText": "You have the Azure virtual networks shown in the following table.\nTo which virtual networks can you establish a peering connection from VNet1?\nA.\nVNet2 andVNet3 only\nB.\nVNet2 only\nC.\nVNet3 and VNet4 only\nD.\nVNet2, VNet3, and VNet4", "stem": "You have the Azure virtual networks shown in the following table. To which virtual networks can you establish a peering connection from VNet1", "options": [ { "key": "A", "text": "VNet2 andVNet3 only" }, { "key": "B", "text": "VNet2 only" }, { "key": "C", "text": "VNet3 and VNet4 only" }, { "key": "D", "text": "VNet2, VNet3, and VNet4" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Address spaces must not overlap to enable VNet Peering.\nIncorrect Answers:\nA, B, D: The address space for VNet2 overlaps with VNet1. We therefore cannot establish a peering between\nVNet2 and VNet1.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-connect-virtual-networks-portal\nhttps://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq#vnet-peering\nYou have an Azure subscription that contains a virtual network named VNet1. VNet1 contains four subnets named\nGateway, Perimeter, NVA, and Production.\nThe NVA subnet contains two network virtual appliances (NVAs) that will perform network traffic inspection\nbetween the Perimeter subnet and the Production subnet.", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-connect-virtual-networks-portal", "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq#vnet-peering" ], "note": "Each correct selection is worth one point.\nA.\nDeploy a basic load balancer\nB.\nDeploy a standard load balancer\nC.\nAdd two load balancing rules that have HA Ports and Floating IP enabled\nD.\nAdd two load balancing rules that have HA Ports enabled and Floating IP disabled\nE.\nAdd a frontend IP configuration, a backend pool, and a health probe\nF.\nAdd a frontend IP configuration, two backend pools, and a health probe", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 382, "pdfId": 382, "exam": "AZ-104", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/382" }, "markersInGap": [], "questionText": "You need to implement an Azure load balancer for the NVAs. The solution must meet the following requirements:\n✑\n The NVAs must run in an active-active configuration that uses automatic failover.\n✑\n The load balancer must load balance traffic to two services on the Production subnet. The services have different\nIP addresses.\nWhich three actions should you perform? Each correct answer presents part of the solution.\nNOTE: Each correct selection is worth one point.\nA.\nDeploy a basic load balancer\nB.\nDeploy a standard load balancer\nC.\nAdd two load balancing rules that have HA Ports and Floating IP enabled\nD.\nAdd two load balancing rules that have HA Ports enabled and Floating IP disabled\nE.\nAdd a frontend IP configuration, a backend pool, and a health probe\nF.\nAdd a frontend IP configuration, two backend pools, and a health probe", "stem": "You need to implement an Azure load balancer for the NVAs. The solution must meet the following requirements: ✑ The NVAs must run in an active-active configuration that uses automatic failover. ✑ The load balancer must load balance traffic to two services on the Production subnet. The services have different IP addresses. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "Deploy a basic load balancer" }, { "key": "B", "text": "Deploy a standard load balancer" }, { "key": "C", "text": "Add two load balancing rules that have HA Ports and Floating IP enabled" }, { "key": "D", "text": "Add two load balancing rules that have HA Ports enabled and Floating IP disabled" }, { "key": "E", "text": "Add a frontend IP configuration, a backend pool, and a health probe" }, { "key": "F", "text": "Add a frontend IP configuration, two backend pools, and a health probe" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "A. Deploy a basic load balancer\n\n❌\n Incorrect.\nBasic Load Balancer does not support advanced scenarios like HA Ports and is not suitable for NVA active-\nactive designs.\nB. Deploy a standard load balancer\n\n✅\n Correct.\nStandard Load Balancer supports HA Ports and is required for high availability, scalability, and NVA scenarios\nwith active-active configurations.\nC. Add two load balancing rules that have HA Ports and Floating IP enabled\n\n❌\n Incorrect.\nHA Ports should be enabled, but Floating IP (direct server return) is typically not required for this NVA\nscenario.\nD. Add two load balancing rules that have HA Ports enabled and Floating IP disabled\n\n✅\n Correct.\nHA Ports allows all traffic to be load balanced across NVAs, which is required for inspection. Floating IP is not\nneeded here.\nE. Add a frontend IP configuration, a backend pool, and a health probe\n\n✅\n Correct.\nThese are essential components:\nFrontend IP to receive traffic\nBackend pool for NVAs\nHealth probe for automatic failover between NVAs\nF. Add a frontend IP configuration, two backend pools, and a health probe\n\n❌\n Incorrect.\nOnly one backend pool is needed for the NVAs in this architecture.\nYou have an Azure subscription named Subscription1 that contains two Azure virtual networks named VNet1 and\nVNet2. VNet1 contains a VPN gateway named\nVPNGW1 that uses static routing. There is a site-to-site VPN connection between your on-premises network and\nVNet1.\nOn a computer named Client1 that runs Windows 10, you configure a point-to-site VPN connection to VNet1.\nYou configure virtual network peering between VNet1 and VNet2. You verify that you can connect to VNet2 from\nthe on-premises network. Client1 is unable to connect to VNet2.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 383, "pdfId": 383, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/383" }, "markersInGap": [], "questionText": "You need to ensure that you can connect Client1 to VNet2.\nWhat should you do?\nA.\nDownload and re-install the VPN client configuration package on Client1.\nB.\nSelect Allow gateway transit on VNet1.\nC.\nSelect Allow gateway transit on VNet2.\nD.\nEnable BGP on VPNGW1", "stem": "You need to ensure that you can connect Client1 to VNet2. What should you do", "options": [ { "key": "A", "text": "Download and re-install the VPN client configuration package on Client1." }, { "key": "B", "text": "Select Allow gateway transit on VNet1." }, { "key": "C", "text": "Select Allow gateway transit on VNet2." }, { "key": "D", "text": "Enable BGP on VPNGW1" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. Download and re-install the VPN client configuration package on Client1.\nClient1 is using a Point-to-Site (P2S) VPN connection to connect to VNet1. However, by default, Point-to-Site\nVPN clients do not automatically inherit peered network routes (like VNet2).\nTo fix this issue, you need to download and re-install the VPN client configuration package on Client1 after\nconfiguring virtual network peering. This ensures that Client1 gets the updated route table, including routes to\nVNet2.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 384, "pdfId": 384, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/384" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "All three VMs are in VNET2. Auto registration is enabled for private Azure DNS zone named contoso.com,", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-\ninstances\nhttps://docs.microsoft.com/en-us/azure/dns/private-dns-autoregistration\nhttps://docs.microsoft.com/en-us/azure/dns/private-dns-virtual-network-links\nReference:\nhttps://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-\ninstances https://docs.microsoft.com/en-us/azure/dns/private-dns-autoregistration", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-", "https://docs.microsoft.com/en-us/azure/dns/private-dns-autoregistration", "https://docs.microsoft.com/en-us/azure/dns/private-dns-virtual-network-links", "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-", "https://docs.microsoft.com/en-us/azure/dns/private-dns-autoregistration" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 385, "pdfId": 385, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/385" }, "markersInGap": [ 385 ], "questionText": "You have an Azure subscription that contains the resources in the following table.\nTo which subnets can you apply NSG1?\n A.\nthe subnets on VNet1 only\nB.\nthe subnets on VNet2 and VNet3 only\nC.\nthe subnets on VNet2 only\nD.\nthe subnets on VNet3 only\nE.\nthe subnets on VNet1, VNet2, and VNet3", "stem": "You have an Azure subscription that contains the resources in the following table. To which subnets can you apply NSG1", "options": [ { "key": "A", "text": "the subnets on VNet1 only" }, { "key": "B", "text": "the subnets on VNet2 and VNet3 only" }, { "key": "C", "text": "the subnets on VNet2 only" }, { "key": "D", "text": "the subnets on VNet3 only" }, { "key": "E", "text": "the subnets on VNet1, VNet2, and VNet3" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "All Azure resources are created in an Azure region and subscription. A resource can only be created in a\nvirtual network that exists in the same region and subscription as the resource.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-vnet-plan-design-arm", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-vnet-plan-design-arm" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 386, "pdfId": 386, "exam": "AZ-104", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/386" }, "markersInGap": [ 386 ], "questionText": "DRAG DROP -\nYou have an Azure subscription that contains two virtual networks named VNet1 and VNet2. Virtual machines\nconnect to the virtual networks.\nThe virtual networks have the address spaces and the subnets configured as shown in the following table.\nYou need to add the address space of 10.33.0.0/16 to VNet1. The solution must ensure that the hosts on VNet1 and\nVNet2 can communicate.\nWhich three actions should you perform in sequence? To answer, move the appropriate actions from the list of\nactions to the answer area and arrange them in the correct order.\nSelect and Place:", "stem": "You have an Azure subscription that contains two virtual networks named VNet1 and VNet2. Virtual machines connect to the virtual networks. The virtual networks have the address spaces and the subnets configured as shown in the following table. You need to add the address space of 10.33.0.0/16 to VNet1. The solution must ensure that the hosts on VNet1 and VNet2 can communicate. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Step 1: Remove peering between Vnet1 and VNet2.\nYou can't add address ranges to, or delete address ranges from a virtual network's address space once a\nvirtual network is peered with another virtual network.\nTo add or remove address ranges, delete the peering, add or remove the address ranges, then re-create the\npeering.\nStep 2:\nAdd the 10.33.0.0/16 address space to VNet1.\nStep 3: Recreate peering between VNet1 and VNet2", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 387, "pdfId": 387, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/387" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Yes\nYou can move the Storage Account to RG2, however it stayed in the West US region. You cannot change the\nRegion, you need to recreate the Storage Account.\nBox 2: Yes\nYou can move move NIC1 to RG2 which was associated with VM1 and VNET1 subnet1, however it stayed in the\nWest US region. You can move a NIC to a different RG or Subscription by selecting (change) next to the RG or\nSubscription name. If you move the NIC to a new Subscription, you must move all resources related to the NIC\nwith it. If the network interface is attached to a virtual machine, for example, you must also move the virtual\nmachine, and other virtual machine-related resources.\nBox 3: No\nYou can move IP2 to RG1, as it isn't associated with any other resource, however it stayed in the East US\nregion. The location will not change.", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources\nhttps://docs.microsoft.com/en-us/azure/virtual-network/move-across-regions-publicip-powershell", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources", "https://docs.microsoft.com/en-us/azure/virtual-network/move-across-regions-publicip-powershell" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 388, "pdfId": 388, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/388" }, "markersInGap": [], "questionText": "You have an Azure web app named webapp1.\nYou have a virtual network named VNET1 and an Azure virtual machine named VM1 that hosts a MySQL database.\nVM1 connects to VNET1.\nYou need to ensure that webapp1 can access the data hosted on VM1.\nWhat should you do?\nA.\nDeploy an internal load balancer\nB.\nPeer VNET1 to another virtual network\nC.\nConnect webapp1 to VNET1\nD.\nDeploy an Azure Application Gateway", "stem": "You have an Azure web app named webapp1. You have a virtual network named VNET1 and an Azure virtual machine named VM1 that hosts a MySQL database. VM1 connects to VNET1. You need to ensure that webapp1 can access the data hosted on VM1. What should you do", "options": [ { "key": "A", "text": "Deploy an internal load balancer" }, { "key": "B", "text": "Peer VNET1 to another virtual network" }, { "key": "C", "text": "Connect webapp1 to VNET1" }, { "key": "D", "text": "Deploy an Azure Application Gateway" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C. Connect webapp1 to VNET1.\nBy connecting the web app to the virtual network, you can enable access from the web app to resources on\nthe virtual network, including the MySQL database hosted on VM1. This can be done by enabling VNet\nIntegration for the web app and then selecting VNET1 as the virtual network to integrate with. Once the\nintegration is set up, the web app will be able to communicate with VM1 on VNET1 as if it were on the same\nnetwork.\nOption A, deploying an internal load balancer, is not necessary in this scenario, as load balancing is not\nrequired.\nOption B, peering VNET1 to another virtual network, is also not necessary for this scenario, as it does not\naddress the requirement to enable communication between the web app and the MySQL database hosted on\nVM1.\nOption D, deploying an Azure Application Gateway, is not necessary for this scenario, as it is primarily used for\nload balancing and routing of HTTP/HTTPS traffic. It does not address the requirement to enable\ncommunication between the web app and the MySQL database hosted on VM1.\nYou create an Azure VM named VM1 that runs Windows Server 2019.\nVM1 is configured as shown in the exhibit. (Click the Exhibit tab.)", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 389, "pdfId": 389, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/389" }, "markersInGap": [], "questionText": "You need to enable Desired State Configuration for VM1.\nWhat should you do first?\nA.\nConnect to VM1.\nB.\nStart VM1.\nC.\nCapture a snapshot of VM1.\nD.\nConfigure a DNS name for VM1.", "stem": "You need to enable Desired State Configuration for VM1. What should you do first", "options": [ { "key": "A", "text": "Connect to VM1." }, { "key": "B", "text": "Start VM1." }, { "key": "C", "text": "Capture a snapshot of VM1." }, { "key": "D", "text": "Configure a DNS name for VM1." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Status is Stopped (Deallocated).\nThe DSC extension for Windows requires that the target virtual machine is able to communicate with Azure.\nThe VM needs to be started.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/dsc-windows", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/dsc-windows" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 390, "pdfId": 393, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/393" }, "markersInGap": [], "questionText": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web\nservers.\nYou have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.\nYou need to ensure that visitors are serviced by the same web server for each request.\nWhat should you configure?\nA.\nFloating IP (direct server return) to Disabled\nB.\nSession persistence to None\nC.\nFloating IP (direct server return) to Enabled\nD.\nSession persistence to Client IP", "stem": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure", "options": [ { "key": "A", "text": "Floating IP (direct server return) to Disabled" }, { "key": "B", "text": "Session persistence to None" }, { "key": "C", "text": "Floating IP (direct server return) to Enabled" }, { "key": "D", "text": "Session persistence to Client IP" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "With Sticky Sessions when a client starts a session on one of your web servers, session stays on that specific\nserver. To configure An Azure Load-Balancer For\nSticky Sessions set Session persistence to Client IP or to Client IP and protocol.\nOn the following image you can see sticky session configuration:", "reference": "https://cloudopszone.com/configure-azure-load-balancer-for-sticky-sessions/\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "references": [ "https://cloudopszone.com/configure-azure-load-balancer-for-sticky-sessions/" ], "note": "✑\n Client IP and protocol specifies that successive requests from the same client IP address and protocol\ncombination will be handled by the same virtual machine.\n✑\n Client IP specifies that successive requests from the same client IP address will be handled by the same\nvirtual machine.\nReference:\nhttps://cloudopszone.com/configure-azure-load-balancer-for-sticky-sessions/\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 391, "pdfId": 390, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/390" }, "markersInGap": [ 390, 391 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription that contains the following resources:\n✑\n A virtual network that has a subnet named Subnet1\n✑\n Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1\n✑\n A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop\nconnections\nNSG-Subnet1 has the default inbound security rules only.\nNSG-VM1 has the default inbound security rules and the following custom inbound security rule:\n✑\n Priority: 100\n✑\n Source: Any\n✑\n Source port range: *\n✑\n Destination: *\n ✑\n Destination port range: 3389\n✑\n Protocol: UDP\n✑\n Action: Allow\nVM1 has a public IP address and is connected to Subnet1. NSG-VM1 is associated to the network interface of VM1.\nNSG-Subnet1 is associated to Subnet1.\nYou need to be able to establish Remote Desktop connections from the internet to VM1.\nSolution: You add an inbound security rule to NSG-Subnet1 that allows connections from the Any source to the\n*destination for port range 3389 and uses the TCP protocol. You remove NSG-VM1 from the network interface of\nVM1.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the following resources: ✑ A virtual network that has a subnet named Subnet1 ✑ Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1 ✑ A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop connections NSG-Subnet1 has the default inbound security rules only. NSG-VM1 has the default inbound security rules and the following custom inbound security rule: ✑ Priority: 100 ✑ Source: Any ✑ Source port range: * ✑ Destination: * ✑ Destination port range: 3389 ✑ Protocol: UDP ✑ Action: Allow VM1 has a public IP address and is connected to Subnet1. NSG-VM1 is associated to the network interface of VM1. NSG-Subnet1 is associated to Subnet1. You need to be able to establish Remote Desktop connections from the internet to VM1. Solution: You add an inbound security rule to NSG-Subnet1 that allows connections from the Any source to the *destination for port range 3389 and uses the TCP protocol. You remove NSG-VM1 from the network interface of VM1. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "The answer is Yes. The main point i miss was that NSG-Subnet 1 is correctly modified with TCP 3389 and NSG-\nVM1 is removed. In this case you should be able to connect. - \"Solution: You add an inbound security rule to\nNSG-Subnet1 that allows connections from the Any source to the *destination for port range 3389 and uses\nthe TCP protocol. You remove NSG-VM1 from the network interface of VM1.\"", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 392, "pdfId": 391, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/391" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription that contains the following resources:\n✑\n A virtual network that has a subnet named Subnet1\n✑\n Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1\n✑\n A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop\nconnections\nNSG-Subnet1 has the default inbound security rules only.\nNSG-VM1 has the default inbound security rules and the following custom inbound security rule:\n✑\n Priority: 100\n✑\n Source: Any\n✑\n Source port range: *\n✑\n Destination: *\n✑\n Destination port range: 3389\nProtocol: UDP -\n✑\n Action: Allow\nVM1 has a public IP address and is connected to Subnet1. NSG-VM1 is associated to the network interface of VM1.\nNSG-Subnet1 is associated to Subnet1.\nYou need to be able to establish Remote Desktop connections from the internet to VM1.\nSolution: You add an inbound security rule to NSG-Subnet1 that allows connections from the internet source to the\nVirtualNetwork destination for port range 3389 and uses the UDP protocol.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the following resources: ✑ A virtual network that has a subnet named Subnet1 ✑ Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1 ✑ A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop connections NSG-Subnet1 has the default inbound security rules only. NSG-VM1 has the default inbound security rules and the following custom inbound security rule: ✑ Priority: 100 ✑ Source: Any ✑ Source port range: * ✑ Destination: * ✑ Destination port range: 3389 Protocol: UDP - ✑ Action: Allow VM1 has a public IP address and is connected to Subnet1. NSG-VM1 is associated to the network interface of VM1. NSG-Subnet1 is associated to Subnet1. You need to be able to establish Remote Desktop connections from the internet to VM1. Solution: You add an inbound security rule to NSG-Subnet1 that allows connections from the internet source to the VirtualNetwork destination for port range 3389 and uses the UDP protocol. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "The default port for RDP is TCP port 3389. A rule to permit RDP traffic must be created automatically when\nyou create your VM.\nNote on NSG-Subnet1: Azure routes network traffic between all subnets in a virtual network, by default.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-machines/troubleshooting/troubleshoot-rdp-connection", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-machines/troubleshooting/troubleshoot-rdp-connection" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 393, "pdfId": 392, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/392" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription that contains the following resources:\n✑\n A virtual network that has a subnet named Subnet1\n✑\n Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1\n✑\n A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop\nconnections\nNSG-Subnet1 has the default inbound security rules only.\nNSG-VM1 has the default inbound security rules and the following custom inbound security rule:\n✑\n Priority: 100\n✑\n Source: Any\n✑\n Source port range: *\n✑\n Destination: *\n✑\n Destination port range: 3389\n✑\n Protocol: UDP\n✑\n Action: Allow\nVM1 has a public IP address and is connected to Subnet1. NSG-VM1 is associated to the network interface of VM1.\nNSG-Subnet1 is associated to Subnet1.\nYou need to be able to establish Remote Desktop connections from the internet to VM1.\nSolution: You add an inbound security rule to NSG-Subnet1 and NSG-VM1 that allows connections from the\ninternet source to the VirtualNetwork destination for port range 3389 and uses the TCP protocol.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the following resources: ✑ A virtual network that has a subnet named Subnet1 ✑ Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1 ✑ A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop connections NSG-Subnet1 has the default inbound security rules only. NSG-VM1 has the default inbound security rules and the following custom inbound security rule: ✑ Priority: 100 ✑ Source: Any ✑ Source port range: * ✑ Destination: * ✑ Destination port range: 3389 ✑ Protocol: UDP ✑ Action: Allow VM1 has a public IP address and is connected to Subnet1. NSG-VM1 is associated to the network interface of VM1. NSG-Subnet1 is associated to Subnet1. You need to be able to establish Remote Desktop connections from the internet to VM1. Solution: You add an inbound security rule to NSG-Subnet1 and NSG-VM1 that allows connections from the internet source to the VirtualNetwork destination for port range 3389 and uses the TCP protocol. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "To enable RDP, you need to add \"Allow\" rule for 3389 port on TCP protocol. this is matches the given\nsuggested solution.\nFor the existing custom rule, priority doesn't matter if it is 100 or not. As \"Network security group security\nrules are evaluated by priority using the 5-tuple information (source, source port, destination, destination port,\nand protocol) to allow or deny the traffic.\" So Azure checks the first rule, it finds that it has UDP. then It will\ncheck the second rule, it will find allow TCP on port 3389. So it will allow. Since the protocols are different, so\nthose are totally different rules.\nhttps://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 394, "pdfId": 394, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/394" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: add an address space –\nYour IaaS virtual machines (VMs) and PaaS role instances in a virtual network automatically receive a private\nIP address from a range that you specify, based on the address space of the subnet they are connected to. We\nneed to add the 192.168.1.0/24 address space.\nBox 2: add a subnet –\nThe 10.2.1.0/24 network exists. We need to add a network interface.", "reference": "https://docs.microsoft.com/en-us/office365/enterprise/designing-networking-for-microsoft-azure-iaas", "references": [ "https://docs.microsoft.com/en-us/office365/enterprise/designing-networking-for-microsoft-azure-iaas" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 395, "pdfId": 395, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/395" }, "markersInGap": [ 395 ], "questionText": "You have an Azure subscription that contains a virtual network named VNET1. VNET1 contains the subnets shown\nin the following table.\nEach virtual machine uses a static IP address.\nYou need to create network security groups (NSGs) to meet following requirements:\n✑\n Allow web requests from the internet to VM3, VM4, VM5, and VM6.\n✑\n Allow all connections between VM1 and VM2.\n✑\n Allow Remote Desktop connections to VM1.\n✑\n Prevent all other network traffic to VNET1.\nWhat is the minimum number of NSGs you should create?\n A.\n1\nB.\n3\nC.\n4\nD.\n12", "stem": "You have an Azure subscription that contains a virtual network named VNET1. VNET1 contains the subnets shown in the following table. Each virtual machine uses a static IP address. You need to create network security groups (NSGs) to meet following requirements: ✑ Allow web requests from the internet to VM3, VM4, VM5, and VM6. ✑ Allow all connections between VM1 and VM2. ✑ Allow Remote Desktop connections to VM1. ✑ Prevent all other network traffic to VNET1. What is the minimum number of NSGs you should create", "options": [ { "key": "D", "text": "12" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "NSGs can be associated to subnets, individual VMs (classic), or individual network interfaces (NIC) attached to\nVMs (Resource Manager). You can associate zero, or one, NSG(s) to each VNet subnet and NIC in a virtual\nmachine. The same NSG can be associated to as many subnets and NICs as you choose. So, you can create 1\nNSG and associate it with all 3 Subnets. - Allow web requests from internet to VM3, VM4, VM5 and VM 6: You\nneed to add an inbound rule to allow Internet TCP 80 to VM3, VM4, VM5 and VM6 static IP addresses. - Allow\nall connections between VM1 & VM2: You do not need an NSG as communication in the same VNet is allowed\nby default, without even configuring NSG. - Allow remote desktop to VM1: You need to add an inbound rule to\nallow RDP 3389 in VM1’s static IP address . - Prevent all other network traffic to VNET1: You do not need to\nconfigure any NSG as the there is explicit deny rule (DenyAllInbound) in every NSG.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 396, "pdfId": 396, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/396" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\nThe Not allowed resource types Azure policy that has policy enforcement enabled is assigned to RG1 and uses the\nfollowing parameters:\nMicrosoft.Network/virtualNetworks\nMicrosoft.Compute/virtualMachines\nIn RG1, you need to create a new virtual machine named VM2, and then connect VM2 to VNET1.\nWhat should you do first?\nA.\nRemove Microsoft.Compute/virtualMachines from the policy.\nB.\nCreate an Azure Resource Manager template\nC.\nAdd a subnet to VNET1.\nD.\nRemove Microsoft.Network/virtualNetworks from the policy.", "stem": "You have an Azure subscription that contains the resources shown in the following table. The Not allowed resource types Azure policy that has policy enforcement enabled is assigned to RG1 and uses the following parameters: Microsoft.Network/virtualNetworks Microsoft.Compute/virtualMachines In RG1, you need to create a new virtual machine named VM2, and then connect VM2 to VNET1. What should you do first", "options": [ { "key": "A", "text": "Remove Microsoft.Compute/virtualMachines from the policy." }, { "key": "B", "text": "Create an Azure Resource Manager template" }, { "key": "C", "text": "Add a subnet to VNET1." }, { "key": "D", "text": "Remove Microsoft.Network/virtualNetworks from the policy." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "The Not allowed resource types Azure policy prohibits the deployment of specified resource types. You\nspecify an array of the resource types to block.\nVirtual Networks and Virtual Machines are prohibited.", "reference": "https://docs.microsoft.com/en-us/azure/governance/policy/samples/not-allowed-resource-types\nYour company has an Azure subscription named Subscription1.\nThe company also has two on-premises servers named Server1 and Server2 that run Windows Server 2016. Server1\nis configured as a DNS server that has a primary DNS zone named adatum.com. Adatum.com contains 1,000 DNS\nrecords.\nYou manage Server1 and Subscription1 from Server2. Server2 has the following tools installed:\n✑\n The DNS Manager console\n✑\n Azure PowerShell\n✑\n Azure CLI 2.0", "references": [ "https://docs.microsoft.com/en-us/azure/governance/policy/samples/not-allowed-resource-types" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 397, "pdfId": 397, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/397" }, "markersInGap": [], "questionText": "You need to move the adatum.com zone to an Azure DNS zone in Subscription1. The solution must minimize\nadministrative effort.\nWhat should you use?\nA.\nAzure CLI\nB.\nAzure PowerShell\nC.\nthe Azure portal\nD.\nthe DNS Manager console", "stem": "You need to move the adatum.com zone to an Azure DNS zone in Subscription1. The solution must minimize administrative effort. What should you use", "options": [ { "key": "A", "text": "Azure CLI" }, { "key": "B", "text": "Azure PowerShell" }, { "key": "C", "text": "the Azure portal" }, { "key": "D", "text": "the DNS Manager console" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Azure CLI.\nAzure DNS supports importing and exporting zone files by using the Azure command-line interface (CLI). Zone\nfile import is not currently supported via Azure PowerShell or the Azure portal.\nPrivateDNSMigrationScript is for migrating legacy Azure DNS private zones to the new Azure DNS private\nzone resource.\nhttps://docs.microsoft.com/en-us/azure/dns/dns-import-export", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 398, "pdfId": 398, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/398" }, "markersInGap": [], "questionText": "You have a public load balancer that balances ports 80 and 443 across three virtual machines named VM1, VM2,\nand VM3.\nYou need to direct all the Remote Desktop Protocol (RDP) connections to VM3 only.\nWhat should you configure?\nA.\nan inbound NAT rule\nB.\na new public load balancer for VM3\nC.\na frontend IP configuration\nD.\na load balancing rule", "stem": "You have a public load balancer that balances ports 80 and 443 across three virtual machines named VM1, VM2, and VM3. You need to direct all the Remote Desktop Protocol (RDP) connections to VM3 only. What should you configure", "options": [ { "key": "A", "text": "an inbound NAT rule" }, { "key": "B", "text": "a new public load balancer for VM3" }, { "key": "C", "text": "a frontend IP configuration" }, { "key": "D", "text": "a load balancing rule" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "An inbound NAT rule forwards incoming traffic to a specific virtual machine\nService: RDP\nProtocol: TCP\nPort: 3389\nTarget VM =VM3", "reference": "https://docs.microsoft.com/en-us/azure/load-balancer/tutorial-load-balancer-port-forwarding-portal\nhttps://pixelrobots.co.uk/2017/08/azure-load-balancer-for-rds/", "references": [ "https://docs.microsoft.com/en-us/azure/load-balancer/tutorial-load-balancer-port-forwarding-portal", "https://pixelrobots.co.uk/2017/08/azure-load-balancer-for-rds/" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 399, "pdfId": 399, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/399" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Basic Load Balancer: Backend pool endpoints for Virtual machines in a single availability set or virtual\nmachine scale set.\nSubnet12 association will be used to assign an IP for the internal load balancer, not to load balance the VMs in\nthe Subnet.\nBox 1: Yes\nVM1 and VM are in the Availability Set.\nBox 2: No\nBoth VMs are not part of any Availability Set or Scale Set.\nBox 3: No\nBoth VMs are not part of any Availability Set or Scale Set.", "reference": "https://docs.microsoft.com/en-us/azure/load-balancer/skus\nhttps://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-overview", "references": [ "https://docs.microsoft.com/en-us/azure/load-balancer/skus", "https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-overview" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 400, "pdfId": 400, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/400" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: The Private Zones only.\nBox 2: The Private Zones only.\nYou can only link VNETs to private DNS zones only and accordingly auto register a VNET only to a private DNS\nzones. Private DNS zones can be linked with VNETs (not public ones). And VM can auto-register to any private\nDNS zone linked with the Vnet and with auto-registration option set.\nTo resolve the records of a private DNS zone from your virtual network, you must link the virtual network with\nthe zone. Linked virtual networks have full access and can resolve all DNS records published in the private\nzone.", "reference": "https://docs.microsoft.com/en-us/azure/dns/private-dns-overview", "references": [ "https://docs.microsoft.com/en-us/azure/dns/private-dns-overview" ], "note": "More than one order of answer choice is correct. You will receive credit for any of the correct orders you\nselect.\nSelect and Place:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 401, "pdfId": 401, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/401" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1 - Create a Gateway subnet. You need the subnet in place first before you can associate a VPN gateway with\nit, which is what is created next.\n2 - Create a VPN gateway. Associate the VPN gateway with the gateway subnet you created (there are other\nsteps but for the sake of what is available for answers, the prem side is now configured)\nNow for the premice side.\n3. Create a local gateway. You need the local gateway in order to complete the tunnel,\n4.then you can create a VPN connection", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 402, "pdfId": 402, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/402" }, "markersInGap": [ 402 ], "questionText": "You have an Azure subscription that contains the resources in the following table.\nVM1 and VM2 are deployed from the same template and host line-of-business applications.\nYou configure the network security group (NSG) shown in the exhibit. (Click the Exhibit tab.)\n You need to prevent users of VM1 and VM2 from accessing websites on the Internet over TCP port 80.\nWhat should you do?\nA.\nDisassociate the NSG from a network interface\nB.\nChange the Port_80 inbound security rule.\nC.\nAssociate the NSG to Subnet1.\nD.\nChange the DenyWebSites outbound security rule.", "stem": "You have an Azure subscription that contains the resources in the following table. VM1 and VM2 are deployed from the same template and host line-of-business applications. You configure the network security group (NSG) shown in the exhibit. (Click the Exhibit tab.) You need to prevent users of VM1 and VM2 from accessing websites on the Internet over TCP port 80. What should you do", "options": [ { "key": "A", "text": "Disassociate the NSG from a network interface" }, { "key": "B", "text": "Change the Port_80 inbound security rule." }, { "key": "C", "text": "Associate the NSG to Subnet1." }, { "key": "D", "text": "Change the DenyWebSites outbound security rule." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "You can associate or dissociate a network security group from a network interface or subnet.\nThe NSG has the appropriate rule to block users from accessing the Internet. We just need to associate it with\nSubnet1.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-group", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-group" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 403, "pdfId": 403, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/403" }, "markersInGap": [ 403 ], "questionText": "You have two subscriptions named Subscription1 and Subscription2. Each subscription is associated to a different\nAzure AD tenant.\nSubscription1 contains a virtual network named VNet1. VNet1 contains an Azure virtual machine named VM1 and\nhas an IP address space of 10.0.0.0/16.\nSubscription2 contains a virtual network named VNet2. VNet2 contains an Azure virtual machine named VM2 and\nhas an IP address space of 10.10.0.0/24.\nYou need to connect VNet1 to VNet2.\nWhat should you do first?\nA.\nMove VM1 to Subscription2.\nB.\nMove VNet1 to Subscription2.\n C.\nModify the IP address space of VNet2.\nD.\nProvision virtual network gateways.", "stem": "You have two subscriptions named Subscription1 and Subscription2. Each subscription is associated to a different Azure AD tenant. Subscription1 contains a virtual network named VNet1. VNet1 contains an Azure virtual machine named VM1 and has an IP address space of 10.0.0.0/16. Subscription2 contains a virtual network named VNet2. VNet2 contains an Azure virtual machine named VM2 and has an IP address space of 10.10.0.0/24. You need to connect VNet1 to VNet2. What should you do first", "options": [ { "key": "A", "text": "Move VM1 to Subscription2." }, { "key": "B", "text": "Move VNet1 to Subscription2." }, { "key": "C", "text": "Modify the IP address space of VNet2." }, { "key": "D", "text": "Provision virtual network gateways." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "The virtual networks can be in the same or different regions, and from the same or different subscriptions.\nWhen connecting VNets from different subscriptions, the subscriptions do not need to be associated with the\nsame Active Directory tenant.\nConfiguring a VNet-to-VNet connection is a good way to easily connect VNets. Connecting a virtual network\nto another virtual network using the VNet-to-VNet connection type (VNet2VNet) is similar to creating a Site-\nto-Site IPsec connection to an on-premises location. Both connectivity types use a VPN gateway to provide a\nsecure tunnel using IPsec/IKE, and both function the same way when communicating.\nThe local network gateway for each VNet treats the other VNet as a local site. This lets you specify additional\naddress space for the local network gateway in order to route traffic.", "reference": "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-\nportal", "references": [ "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-" ], "note": "Each correct selection is worth one point.\nA.\nUse managed disks\nB.\nOS disk type\nC.\nAvailability options\nD.\nSize\nE.\nImage", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 404, "pdfId": 404, "exam": "AZ-104", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/404" }, "markersInGap": [ 404 ], "questionText": "You plan to create an Azure virtual machine named VM1 that will be configured as shown in the following exhibit.\n The planned disk configurations for VM1 are shown in the following exhibit.\nYou need to ensure that VM1 can be created in an Availability Zone.\nWhich two settings should you modify? Each correct answer presents part of the solution.\nNOTE: Each correct selection is worth one point.\nA.\nUse managed disks\nB.\nOS disk type\nC.\nAvailability options\nD.\nSize\nE.\nImage", "stem": "You plan to create an Azure virtual machine named VM1 that will be configured as shown in the following exhibit. The planned disk configurations for VM1 are shown in the following exhibit. You need to ensure that VM1 can be created in an Availability Zone. Which two settings should you modify? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "Use managed disks" }, { "key": "B", "text": "OS disk type" }, { "key": "C", "text": "Availability options" }, { "key": "D", "text": "Size" }, { "key": "E", "text": "Image" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A: Your VMs should use managed disks if you want to move them to an Availability Zone by using Site\nRecovery.\nC: When you create a VM for an Availability Zone, Under Settings > High availability, select one of the\nnumbered zones from the Availability zone dropdown.", "reference": "https://docs.microsoft.com/en-us/azure/site-recovery/move-azure-vms-avset-azone\nhttps://docs.microsoft.com/en-us/azure/virtual-machines/windows/create-portal-availability-zone", "references": [ "https://docs.microsoft.com/en-us/azure/site-recovery/move-azure-vms-avset-azone", "https://docs.microsoft.com/en-us/azure/virtual-machines/windows/create-portal-availability-zone" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 405, "pdfId": 405, "exam": "AZ-104", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/405" }, "markersInGap": [ 405 ], "questionText": "HOTSPOT -\nYou have an Azure subscription that contains the resources shown in the following table.\nVMSS1 is set to VM (virtual machines) orchestration mode.\nYou need to deploy a new Azure virtual machine named VM1, and then add VM1 to VMSS1.\nWhich resource group and location should you use to deploy VM1? To answer, select the appropriate options in the\nanswer area.\n NOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You have an Azure subscription that contains the resources shown in the following table. VMSS1 is set to VM (virtual machines) orchestration mode. You need to deploy a new Azure virtual machine named VM1, and then add VM1 to VMSS1. Which resource group and location should you use to deploy VM1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: RG1, RG2, or RG3 -\nThe resource group stores metadata about the resources. When you specify a location for the resource group,\nyou're specifying where that metadata is stored.\nBox 2: West US only -", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview" ], "note": "Virtual machine scale sets will support 2 distinct orchestration modes:\nScaleSetVM \" Virtual machine instances added to the scale set are based on the scale set configuration\nmodel. The virtual machine instance lifecycle - creation, update, deletion - is managed by the scale set.\nVM (virtual machines) \" Virtual machines created outside of the scale set can be explicitly added to the\nscaleset.\nReference:\nhttps://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 406, "pdfId": 406, "exam": "AZ-104", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/406" }, "markersInGap": [ 406 ], "questionText": "HOTSPOT -\nYou have an Azure subscription that contains three virtual networks named VNET1, VNET2, and VNET3.\nPeering for VNET1 is configured as shown in the following exhibit.\nPeering for VNET2 is configured as shown in the following exhibit.\nPeering for VNET3 is configured as shown in the following exhibit.\n How can packets be routed between the virtual networks? To answer, select the appropriate options in the answer\narea.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You have an Azure subscription that contains three virtual networks named VNET1, VNET2, and VNET3. Peering for VNET1 is configured as shown in the following exhibit. Peering for VNET2 is configured as shown in the following exhibit. Peering for VNET3 is configured as shown in the following exhibit. How can packets be routed between the virtual networks? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1. VNET2 and VNET3\nVNet1 is peered with VNet2 and VNet3. Also Gateway transit is disabled.\nBox 2: VNET1 only\nGateway transit is disabled, so it can only communicate with the connected VNET1.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview\nhttps://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview", "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 407, "pdfId": 407, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/407" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named\nVNet1. The point-to-site connection uses a self-signed certificate.\nFrom Azure, you download and install the VPN client configuration package on a computer named Computer2.\nYou need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2.\nSolution: You modify the Azure Active Directory (Azure AD) authentication policies.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site connection uses a self-signed certificate. From Azure, you download and install the VPN client configuration package on a computer named Computer2. You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2. Solution: You modify the Azure Active Directory (Azure AD) authentication policies. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Instead export the client certificate from Computer1 and install the certificate on Computer2.\nNote:", "reference": "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site", "references": [ "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 408, "pdfId": 408, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/408" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named\nVNet1. The point-to-site connection uses a self-signed certificate.\nFrom Azure, you download and install the VPN client configuration package on a computer named Computer2.\nYou need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2.\nSolution: You join Computer2 to Azure Active Directory (Azure AD).\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site connection uses a self-signed certificate. From Azure, you download and install the VPN client configuration package on a computer named Computer2. You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2. Solution: You join Computer2 to Azure Active Directory (Azure AD). Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "A client computer that connects to a VNet using Point-to-Site must have a client certificate installed. Instead\nexport the client certificate from Computer1 and install the certificate on Computer2.\nA Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network\nfrom an individual client computer. A P2S connection is established by starting it from the client computer.\nThis solution is useful for telecommuters who want to connect to Azure VNets from a remote location, such as\nfrom home or a conference. P2S VPN is also a useful solution to use instead of S2S VPN when you have only a\nfew clients that need to connect to a VNet. This article applies to the Resource Manager deployment model.", "reference": "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site", "references": [ "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 409, "pdfId": 409, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/409" }, "markersInGap": [ 408, 409 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate\nresource groups.\nAnother administrator plans to create several network security groups (NSGs) in the subscription.\nYou need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual\n networks.\nSolution: You create a resource lock, and then you assign the lock to the subscription.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups. Another administrator plans to create several network security groups (NSGs) in the subscription. You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks. Solution: You create a resource lock, and then you assign the lock to the subscription. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "No", "reference": "https://docs.microsoft.com/en-us/azure/azure-policy/policy-definition\nhttps://docs.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies\nhttps://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json", "references": [ "https://docs.microsoft.com/en-us/azure/azure-policy/policy-definition", "https://docs.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies", "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 410, "pdfId": 410, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/410" }, "markersInGap": [ 410 ], "questionText": "You have an Azure subscription named Subscription1. Subscription1 contains a virtual machine named VM1.\nYou have a computer named Computer1 that runs Windows 10. Computer1 is connected to the Internet.\nYou add a network interface named vm1173 to VM1 as shown in the exhibit. (Click the Exhibit tab.)\nFrom Computer1, you attempt to connect to VM1 by using Remote Desktop, but the connection fails.\nYou need to establish a Remote Desktop connection to VM1.\nWhat should you do first?\nA.\nChange the priority of the RDP rule\nB.\nAttach a network interface\n C.\nDelete the DenyAllInBound rule\nD.\nStart VM1", "stem": "You have an Azure subscription named Subscription1. Subscription1 contains a virtual machine named VM1. You have a computer named Computer1 that runs Windows 10. Computer1 is connected to the Internet. You add a network interface named vm1173 to VM1 as shown in the exhibit. (Click the Exhibit tab.) From Computer1, you attempt to connect to VM1 by using Remote Desktop, but the connection fails. You need to establish a Remote Desktop connection to VM1. What should you do first", "options": [ { "key": "A", "text": "Change the priority of the RDP rule" }, { "key": "B", "text": "Attach a network interface" }, { "key": "C", "text": "Delete the DenyAllInBound rule" }, { "key": "D", "text": "Start VM1" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. Start VM1", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/security-overview", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/security-overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 411, "pdfId": 411, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/411" }, "markersInGap": [ 411 ], "questionText": "You have the Azure virtual machines shown in the following table.\nA DNS service is installed on VM1.\nYou configure the DNS servers settings for each virtual network as shown in the following exhibit.\n You need to ensure that all the virtual machines can resolve DNS names by using the DNS service on VM1.\nWhat should you do?\nA.\nConfigure a conditional forwarder on VM1\nB.\nAdd service endpoints on VNET1\nC.\nAdd service endpoints on VNET2 and VNET3\nD.\nConfigure peering between VNET1, VNET2, and VNET3", "stem": "You have the Azure virtual machines shown in the following table. A DNS service is installed on VM1. You configure the DNS servers settings for each virtual network as shown in the following exhibit. You need to ensure that all the virtual machines can resolve DNS names by using the DNS service on VM1. What should you do", "options": [ { "key": "A", "text": "Configure a conditional forwarder on VM1" }, { "key": "B", "text": "Add service endpoints on VNET1" }, { "key": "C", "text": "Add service endpoints on VNET2 and VNET3" }, { "key": "D", "text": "Configure peering between VNET1, VNET2, and VNET3" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Virtual network peering enables you to seamlessly connect networks in Azure Virtual Network. The virtual\nnetworks appear as one for connectivity purposes. The traffic between virtual machines uses the Microsoft\nbackbone infrastructure.\nIncorrect Answers:\nB, C: Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over\nan optimized route over the Azure backbone network.\nEndpoints allow you to secure your critical Azure service resources to only your virtual networks. Service\nEndpoints enables private IP addresses in the VNet to reach the endpoint of an Azure service without needing\na public IP address on the VNet.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview\nhttps://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview", "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 412, "pdfId": 412, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/412" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: No\nNSG1 limits the traffic that is flowing into 172.16.2.0/24 (Subnet2), which host VM2.\nBox 2: Yes\nSince Network Watcher is showing that traffic from VM1 to VM2 is not reaching on the TCP port, that means\nthat NSG1 is applied to VM2. We can understand for sure, that it is not applied to VM1.\nBox 3: Yes\nIn Network Watcher, you can see that the next hop is the destination VM2. This means that they are part of\nthe same virtual network.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 413, "pdfId": 413, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/413" }, "markersInGap": [ 413 ], "questionText": "You have the Azure virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 contains three\nAzure virtual machines. Each virtual machine has a public IP address.\nThe virtual machines host several applications that are accessible over port 443 to users on the Internet.\n Your on-premises network has a site-to-site VPN connection to VNet1.\nYou discover that the virtual machines can be accessed by using the Remote Desktop Protocol (RDP) from the\nInternet and from the on-premises network.\nYou need to prevent RDP access to the virtual machines from the Internet, unless the RDP connection is\nestablished from the on-premises network. The solution must ensure that all the applications can still be accessed\nby the Internet users.\nWhat should you do?\nA.\nModify the address space of the local network gateway\nB.\nCreate a deny rule in a network security group (NSG) that is linked to Subnet1\nC.\nRemove the public IP addresses from the virtual machines\nD.\nModify the address space of Subnet1", "stem": "You have the Azure virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 contains three Azure virtual machines. Each virtual machine has a public IP address. The virtual machines host several applications that are accessible over port 443 to users on the Internet. Your on-premises network has a site-to-site VPN connection to VNet1. You discover that the virtual machines can be accessed by using the Remote Desktop Protocol (RDP) from the Internet and from the on-premises network. You need to prevent RDP access to the virtual machines from the Internet, unless the RDP connection is established from the on-premises network. The solution must ensure that all the applications can still be accessed by the Internet users. What should you do", "options": [ { "key": "A", "text": "Modify the address space of the local network gateway" }, { "key": "B", "text": "Create a deny rule in a network security group (NSG) that is linked to Subnet1" }, { "key": "C", "text": "Remove the public IP addresses from the virtual machines" }, { "key": "D", "text": "Modify the address space of Subnet1" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "You can use a site-to-site VPN to connect your on-premises network to an Azure virtual network. Users on\nyour on-premises network connect by using the RDP or\nSSH protocol over the site-to-site VPN connection. You don't have to allow direct RDP or SSH access over the\ninternet.", "reference": "https://docs.microsoft.com/en-us/azure/security/fundamentals/network-best-practices", "references": [ "https://docs.microsoft.com/en-us/azure/security/fundamentals/network-best-practices" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 414, "pdfId": 414, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/414" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the resources in the following table.\nSubnet1 is associated to VNet1. NIC1 attaches VM1 to Subnet1.\nYou need to apply ASG1 to VM1.\nWhat should you do?\nA.\nAssociate NIC1 to ASG1\nB.\nModify the properties of ASG1\nC.\nModify the properties of NSG1", "stem": "You have an Azure subscription that contains the resources in the following table. Subnet1 is associated to VNet1. NIC1 attaches VM1 to Subnet1. You need to apply ASG1 to VM1. What should you do", "options": [ { "key": "A", "text": "Associate NIC1 to ASG1" }, { "key": "B", "text": "Modify the properties of ASG1" }, { "key": "C", "text": "Modify the properties of NSG1" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Application Security Group can be associated with NICs.\nApplication security groups enable you to configure network security as a natural extension of an\napplication's structure, allowing you to group virtual machines and define network security policies based on\nthose groups. You can reuse your security policy at scale without manual maintenance of explicit IP\naddresses. The platform handles the complexity of explicit IP addresses and multiple rule sets, allowing you\nto focus on your business logic.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/application-security-groups\nhttps://tutorialsdojo.com/network-security-group-nsg-vs-application-security-group\nReferences:\nhttps://docs.microsoft.com/en-us/azure/virtual-network/security-overview#application-security-groups", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/application-security-groups", "https://tutorialsdojo.com/network-security-group-nsg-vs-application-security-group", "https://docs.microsoft.com/en-us/azure/virtual-network/security-overview#application-security-groups" ], "note": "Each correct selection is worth one point.\nA.\nCreate a connection\nB.\nCreate a local site VPN gateway\nC.\nCreate a VPN gateway that uses the VpnGw1 SKU\nD.\nCreate a gateway subnet\nE.\nCreate a VPN gateway that uses the Basic SKU", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 415, "pdfId": 415, "exam": "AZ-104", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/415" }, "markersInGap": [], "questionText": "You have an Azure subscription named Subscription1 that contains an Azure virtual network named VNet1. VNet1\nconnects to your on-premises network by using\nAzure ExpressRoute.\nYou plan to prepare the environment for automatic failover in case of ExpressRoute failure.\nYou need to connect VNet1 to the on-premises network by using a site-to-site VPN. The solution must minimize\ncost.\nWhich three actions should you perform? Each correct answer presents part of the solution.\nNOTE: Each correct selection is worth one point.\nA.\nCreate a connection\nB.\nCreate a local site VPN gateway\nC.\nCreate a VPN gateway that uses the VpnGw1 SKU\nD.\nCreate a gateway subnet\nE.\nCreate a VPN gateway that uses the Basic SKU", "stem": "You have an Azure subscription named Subscription1 that contains an Azure virtual network named VNet1. VNet1 connects to your on-premises network by using Azure ExpressRoute. You plan to prepare the environment for automatic failover in case of ExpressRoute failure. You need to connect VNet1 to the on-premises network by using a site-to-site VPN. The solution must minimize cost. Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "Create a connection" }, { "key": "B", "text": "Create a local site VPN gateway" }, { "key": "C", "text": "Create a VPN gateway that uses the VpnGw1 SKU" }, { "key": "D", "text": "Create a gateway subnet" }, { "key": "E", "text": "Create a VPN gateway that uses the Basic SKU" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "For a site to site VPN, you need:\n- a local gateway\n- a gateway subnet\n- a VPN gateway\n- a connection to connect the local gateway and the VPN gateway\nHowever, the question states that VNet1 connects to your on-premises network by using Azure ExpressRoute.\nFor an ExpressRoute connection, VNET1 must already be configured with a gateway subnet so we don't need\nanother one.", "reference": null, "references": [], "note": "BasicSKU cannot coexist with ExpressRoute. You must use a non-Basic SKU gateway for both the\nExpressRoute gateway and the VPN gateway.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 416, "pdfId": 416, "exam": "AZ-104", "type": "dropdown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/416" }, "markersInGap": [], "questionText": "You have peering configured as shown in the following exhibit.\nUse the drop-down menus to select the answer choice that completes each statement based on the information\npresented in the graphic.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You have peering configured as shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: vNET6 only -\nPeering status to both VNet1 and Vnet2 are disconnected.\nBox 2: delete peering1 -\nPeering to Vnet1 is Enabled but disconnected. We need to update or re-create the remote peering to get it\nback to Initiated state.", "reference": "https://blog.kloud.com.au/2018/10/19/address-space-maintenance-with-vnet-peering/", "references": [ "https://blog.kloud.com.au/2018/10/19/address-space-maintenance-with-vnet-peering/" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 417, "pdfId": 417, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/417" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Yes -\nA Basic Load Balancer supports virtual machines in a single availability set or virtual machine scale set.\nBox 2: Yes -\nWhen using load-balancing rules with Azure Load Balancer, you need to specify health probes to allow Load\nBalancer to detect the backend endpoint status. The configuration of the health probe and probe responses\ndetermine which backend pool instances will receive new flows. You can use health probes to detect the\nfailure of an application on a backend endpoint. You can also generate a custom response to a health probe\nand use the health probe for flow control to manage load or planned downtime. When a health probe fails,\nLoad Balancer will stop sending new flows to the respective unhealthy instance. Outbound connectivity is not\nimpacted, only inbound connectivity is impacted.\nBox 3: No -\nThere will be no loadbalancing between the VMs.\nBasic Load Balancer: Virtual machines in a single availability set or virtual machine scale set.\nStandard Load Balancer: Any virtual machines or virtual machine scale sets in a single virtual network.", "reference": "https://docs.microsoft.com/en-us/azure/load-balancer/skus\nhttps://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview", "references": [ "https://docs.microsoft.com/en-us/azure/load-balancer/skus", "https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 418, "pdfId": 418, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/418" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Change the private IP address of VM1 to static\nBox 1: Remove the public IP address from VM1", "reference": "https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview", "references": [ "https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview" ], "note": "A public load balancer can provide outbound connections for virtual machines (VMs) inside your virtual\nnetwork. These connections are accomplished by translating their private IP addresses to public IP addresses.\nPublic Load Balancers are used to load balance internet traffic to your VMs.\nBox 2: Create and configure an NSG\nNSGs are used to explicitly permit allowed traffic. If you do not have an NSG on a subnet or NIC of your virtual\nmachine resource, traffic is not allowed to reach this resource.\nReference:\nhttps://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 419, "pdfId": 419, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/419" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\nYou need to create a network interface named NIC1.\nIn which location can you create NIC1?\nA.\nEast US and North Europe only\nB.\nEast US only\nC.\nEast US, West Europe, and North Europe\nD.\nEast US and West Europe only", "stem": "You have an Azure subscription that contains the resources shown in the following table. You need to create a network interface named NIC1. In which location can you create NIC1", "options": [ { "key": "A", "text": "East US and North Europe only" }, { "key": "B", "text": "East US only" }, { "key": "C", "text": "East US, West Europe, and North Europe" }, { "key": "D", "text": "East US and West Europe only" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Before creating a network interface, you must have an existing virtual network in the same location and\nsubscription you create a network interface in.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 420, "pdfId": 420, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/420" }, "markersInGap": [ 419, 420 ], "questionText": "You have Azure virtual machines that run Windows Server 2019 and are configured as shown in the following table.\n You create a public Azure DNS zone named adatum.com and a private Azure DNS zone named contoso.com.\nFor controso.com, you create a virtual network link named link1 as shown in the exhibit. (Click the Exhibit tab.)\nYou discover that VM1 can resolve names in contoso.com but cannot resolve names in adatum.com. VM1 can\nresolve other hosts on the Internet.\nYou need to ensure that VM1 can resolve host names in adatum.com.\nWhat should you do?\nA.\nUpdate the DNS suffix on VM1 to be adatum.com\nB.\nConfigure the name servers for adatum.com at the domain registrar\nC.\nCreate an SRV record in the contoso.com zone\nD.\nModify the Access control (IAM) settings for link1", "stem": "You have Azure virtual machines that run Windows Server 2019 and are configured as shown in the following table. You create a public Azure DNS zone named adatum.com and a private Azure DNS zone named contoso.com. For controso.com, you create a virtual network link named link1 as shown in the exhibit. (Click the Exhibit tab.) You discover that VM1 can resolve names in contoso.com but cannot resolve names in adatum.com. VM1 can resolve other hosts on the Internet. You need to ensure that VM1 can resolve host names in adatum.com. What should you do", "options": [ { "key": "A", "text": "Update the DNS suffix on VM1 to be adatum.com" }, { "key": "B", "text": "Configure the name servers for adatum.com at the domain registrar" }, { "key": "C", "text": "Create an SRV record in the contoso.com zone" }, { "key": "D", "text": "Modify the Access control (IAM) settings for link1" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Adatum.com is a public DNS zone. The Internet top level domain DNS servers need to know which DNS\nservers to direct DNS queries for adatum.com to. You configure this by configuring the name servers for\nadatum.com at the domain registrar.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 421, "pdfId": 421, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/421" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: IP flow verify -\nAt some point, a VM may become unable to communicate with other resources, because of a security rule. The\nIP flow verify capability enables you to specify a source and destination IPv4 address, port, protocol (TCP or\nUDP), and traffic direction (inbound or outbound). IP flow verify then tests the communication and informs you\nif the connection succeeds or fails. If the connection fails, IP flow verify tells you which.\nBox 2: Connection troubleshoot -\nDiagnose outbound connections from a VM: The connection troubleshoot capability enables you to test a\nconnection between a VM and another VM, an FQDN, a\nURI, or an IPv4 address. The test returns similar information returned when using the connection monitor\ncapability, but tests the connection at a point in time, rather than monitoring it over time, as connection\nmonitor does. Learn more about how to troubleshoot connections using connection-troubleshoot.", "reference": "https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview", "references": [ "https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 422, "pdfId": 422, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/422" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Yes -\nYou can specify DNS server IP addresses in the VNet settings. The setting is applied as the default DNS\nserver(s) for all VMs in the VNet.\nBox 2: No -\nYou can set DNS servers per VM or cloud service to override the default network settings.\nBox 3: Yes -\nYou can set DNS servers per VM or cloud service to override the default network settings.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq#name-resolution-dns", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq#name-resolution-dns" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 423, "pdfId": 423, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/423" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: IP1, VNET2, and storage1\nBox 2: IP2, VNET2, and storage2\nLocks are designed for any update or removal. In this case we want to move only, we are not deleting, and we\nare not changing anything in the resource.", "reference": "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources\nhttps://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources", "references": [ "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources", "https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 424, "pdfId": 424, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/424" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription that contains the virtual machines shown in the following table.\nYou deploy a load balancer that has the following configurations:\n✑\n Name: LB1\n✑\n Type: Internal\n✑\n SKU: Standard\n✑\n Virtual network: VNET1\nYou need to ensure that you can add VM1 and VM2 to the backend pool of LB1.\nSolution: You create a Basic SKU public IP address, associate the address to the network interface of VM1, and\nthen start VM1.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the virtual machines shown in the following table. You deploy a load balancer that has the following configurations: ✑ Name: LB1 ✑ Type: Internal ✑ SKU: Standard ✑ Virtual network: VNET1 You need to ensure that you can add VM1 and VM2 to the backend pool of LB1. Solution: You create a Basic SKU public IP address, associate the address to the network interface of VM1, and then start VM1. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "A Backend Pool configured by IP address has the following limitations:\n✑\n Standard load balancer only", "reference": "https://docs.microsoft.com/en-us/azure/load-balancer/backend-pool-management", "references": [ "https://docs.microsoft.com/en-us/azure/load-balancer/backend-pool-management" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 425, "pdfId": 425, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/425" }, "markersInGap": [ 424, 425 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription that contains the virtual machines shown in the following table.\n You deploy a load balancer that has the following configurations:\n✑\n Name: LB1\n✑\n Type: Internal\n✑\n SKU: Standard\n✑\n Virtual network: VNET1\nYou need to ensure that you can add VM1 and VM2 to the backend pool of LB1.\nSolution: You create a Standard SKU public IP address, associate the address to the network interface of VM1, and\nthen stop VM2.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the virtual machines shown in the following table. You deploy a load balancer that has the following configurations: ✑ Name: LB1 ✑ Type: Internal ✑ SKU: Standard ✑ Virtual network: VNET1 You need to ensure that you can add VM1 and VM2 to the backend pool of LB1. Solution: You create a Standard SKU public IP address, associate the address to the network interface of VM1, and then stop VM2. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "A Backend Pool configured by IP address has the following limitations:\n✑\n Standard load balancer only", "reference": "https://docs.microsoft.com/en-us/azure/load-balancer/backend-pool-management", "references": [ "https://docs.microsoft.com/en-us/azure/load-balancer/backend-pool-management" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 426, "pdfId": 426, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/426" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription that contains the virtual machines shown in the following table.\nYou deploy a load balancer that has the following configurations:\n✑\n Name: LB1\n✑\n Type: Internal\n✑\n SKU: Standard\n✑\n Virtual network: VNET1\nYou need to ensure that you can add VM1 and VM2 to the backend pool of LB1.\nSolution: You create two Standard SKU public IP addresses and associate a Standard SKU public IP address to the\nnetwork interface of each virtual machine.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the virtual machines shown in the following table. You deploy a load balancer that has the following configurations: ✑ Name: LB1 ✑ Type: Internal ✑ SKU: Standard ✑ Virtual network: VNET1 You need to ensure that you can add VM1 and VM2 to the backend pool of LB1. Solution: You create two Standard SKU public IP addresses and associate a Standard SKU public IP address to the network interface of each virtual machine. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A - Yes\nYou can only attach virtual machines that are in the same location and on the same virtual network as the LB.\nVirtual machines must have a standard SKU public IP or no public IP.\nThe LB needs to be a standard SKU to accept individual VMs outside an availability set or vmss. VMs do not\nneed to have public IPs but if they do have them they have to be standard SKU. Vms can only be from a single\nnetwork. When they don’t have a public IP they are assigned an ephemeral IP.\nAlso, when adding them to a backend pool, it doesn’t matter in which status are the VMs.", "reference": "https://docs.microsoft.com/en-us/azure/load-balancer/backend-pool-management\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "references": [ "https://docs.microsoft.com/en-us/azure/load-balancer/backend-pool-management" ], "note": "Load balancer and the public IP address SKU must match when you use them with public IP addresses.\nA Backend Pool configured by IP address has the following limitations:\n✑\n Standard load balancer only\nReference:\nhttps://docs.microsoft.com/en-us/azure/load-balancer/backend-pool-management\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 427, "pdfId": 427, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/427" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named\nVNet1. The point-to-site connection uses a self-signed certificate.\nFrom Azure, you download and install the VPN client configuration package on a computer named Computer2.\nYou need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2.\nSolution: You export the client certificate from Computer1 and install the certificate on Computer2.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site connection uses a self-signed certificate. From Azure, you download and install the VPN client configuration package on a computer named Computer2. You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2. Solution: You export the client certificate from Computer1 and install the certificate on Computer2. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You\ngenerate a client certificate from the self-signed root certificate, and then export and install the client\ncertificate. If the client certificate is not installed, authentication fails.", "reference": "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site", "references": [ "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 428, "pdfId": 428, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/428" }, "markersInGap": [ 427, 428 ], "questionText": "You have an Azure virtual machine named VM1.\nThe network interface for VM1 is configured as shown in the exhibit. (Click the Exhibit tab.)\n You deploy a web server on VM1, and then create a secure website that is accessible by using the HTTPS protocol.\nVM1 is used as a web server only.\nYou need to ensure that users can connect to the website from the Internet.\nWhat should you do?\nA.\nModify the protocol of Rule4\nB.\nDelete Rule1\nC.\nFor Rule5, change the Action to Allow and change the priority to 401\nD.\nCreate a new inbound rule that allows TCP protocol 443 and configure the rule to have a priority of 501.", "stem": "You have an Azure virtual machine named VM1. The network interface for VM1 is configured as shown in the exhibit. (Click the Exhibit tab.) You deploy a web server on VM1, and then create a secure website that is accessible by using the HTTPS protocol. VM1 is used as a web server only. You need to ensure that users can connect to the website from the Internet. What should you do", "options": [ { "key": "A", "text": "Modify the protocol of Rule4" }, { "key": "B", "text": "Delete Rule1" }, { "key": "C", "text": "For Rule5, change the Action to Allow and change the priority to 401" }, { "key": "D", "text": "Create a new inbound rule that allows TCP protocol 443 and configure the rule to have a priority of 501." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "HTTPS uses port 443.\nRule2, with priority 500, denies HTTPS traffic.\nRule5, with priority changed from 2000 to 401, would allow HTTPS traffic.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview" ], "note": "Priority is a number between 100 and 4096. Rules are processed in priority order, with lower numbers\nprocessed before higher numbers, because lower numbers have higher priority. Once traffic matches a rule,\nprocessing stops. As a result, any rules that exist with lower priorities (higher numbers) that have the same\nattributes as rules with higher priorities are not processed.\nNote:\nThere are several versions of this question in the exam. The question has two possible correct answers:\n1. Change the priority of Rule3 to 450.\n2. For Rule5, change the Action to Allow and change the priority to 401.\nOther incorrect answer options you may see on the exam include the following:\n✑\n Modify the action of Rule1.\n✑\n Change the priority of Rule6 to 100.\n✑\n For Rule4, change the protocol from UDP to Any.\nReference:\nhttps://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview\nNote: This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 429, "pdfId": 429, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/429" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate\nresource groups.\nAnother administrator plans to create several network security groups (NSGs) in the subscription.\nYou need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual\nnetworks.\nSolution: From the Resource providers blade, you unregister the Microsoft.ClassicNetwork provider.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups. Another administrator plans to create several network security groups (NSGs) in the subscription. You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks. Solution: From the Resource providers blade, you unregister the Microsoft.ClassicNetwork provider. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "You should use a policy definition.\nResource policy definition used by Azure Policy enables you to establish conventions for resources in your\norganization by describing when the policy is enforced and what effect to take. By defining conventions, you\ncan control costs and more easily manage your resources.", "reference": "https://docs.microsoft.com/en-us/azure/azure-policy/policy-definition", "references": [ "https://docs.microsoft.com/en-us/azure/azure-policy/policy-definition" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 430, "pdfId": 430, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/430" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "VNET1: 10.10.10.0 - 10.10.10.255\nVNET2: 172.16.0.0 - 172.16.255.255\nVNETA: 10.10.128.0 - 10.10.255.255\nBox 1: No\nTo create a VNet to VNet VPN you need to have a special Gateway Subnet. Here, the VNet has no sufficient\naddress space to create a Gateway Subnet and thus to establish a VNet to VNet VPN connection.\nBox 2: Yes\nFor VNet peering the only consideration is that the VNets do not overlap. VNET1 and VNET2 do not overlap.\nBox 3: Yes\nFor VNet peering the only consideration is that the VNets do not overlap. VNET1 and VNETA do not overlap.", "reference": "https://azure.microsoft.com/en-us/blog/vnet-to-vnet-connecting-virtual-networks-in-azure-across-different-\nregions/ https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-\npeering#requirements-and-constraints", "references": [ "https://azure.microsoft.com/en-us/blog/vnet-to-vnet-connecting-virtual-networks-in-azure-across-different-", "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 431, "pdfId": 431, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/431" }, "markersInGap": [ 431 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to\nApp1 are managed by using an Azure Load\nBalancer.\nThe effective network security configurations for VM2 are shown in the following exhibit.\n You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail.\nYou verify that the Load Balancer rules are configured correctly.\nYou need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port\n443.\nSolution: You create an inbound security rule that denies all traffic from the 131.107.100.50 source and has a cost\nof 64999.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer. The effective network security configurations for VM2 are shown in the following exhibit. You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail. You verify that the Load Balancer rules are configured correctly. You need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port 443. Solution: You create an inbound security rule that denies all traffic from the 131.107.100.50 source and has a cost of 64999. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B - No", "reference": "https://fastreroute.com/azure-network-security-groups-explained/", "references": [ "https://fastreroute.com/azure-network-security-groups-explained/" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 432, "pdfId": 432, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/432" }, "markersInGap": [ 432 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to\nApp1 are managed by using an Azure Load\nBalancer.\n The effective network security configurations for VM2 are shown in the following exhibit.\nYou discover that connections to App1 from 131.107.100.50 over TCP port 443 fail.\nYou verify that the Load Balancer rules are configured correctly.\nYou need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port\n443.\nSolution: You delete the BlockAllOther443 inbound security rule.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer. The effective network security configurations for VM2 are shown in the following exhibit. You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail. You verify that the Load Balancer rules are configured correctly. You need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port 443. Solution: You delete the BlockAllOther443 inbound security rule. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Allow_131.107.100.50 rule has a higher priority (100) than BlockAllOther441 (200) and it allows inbound traffic\nover TCP 443 from source 131.107.100.50. App1 (VM1 and VM2) is in a VNet, so this rule applies. Unfortunately,\nwe still cannot access App1, so the issue is somewhere else, maybe the VMs are off, or the firewall is blocking\nit.", "reference": "https://fastreroute.com/azure-network-security-groups-explained/", "references": [ "https://fastreroute.com/azure-network-security-groups-explained/" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 433, "pdfId": 433, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/433" }, "markersInGap": [ 433 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to\nApp1 are managed by using an Azure Load\nBalancer.\nThe effective network security configurations for VM2 are shown in the following exhibit.\n You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail.\nYou verify that the Load Balancer rules are configured correctly.\nYou need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port\n443.\nSolution: You modify the priority of the Allow_131.107.100.50 inbound security rule.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer. The effective network security configurations for VM2 are shown in the following exhibit. You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail. You verify that the Load Balancer rules are configured correctly. You need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port 443. Solution: You modify the priority of the Allow_131.107.100.50 inbound security rule. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "The rule currently has the highest priority.", "reference": "https://fastreroute.com/azure-network-security-groups-explained/", "references": [ "https://fastreroute.com/azure-network-security-groups-explained/" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 434, "pdfId": 434, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/434" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate\nresource groups.\nAnother administrator plans to create several network security groups (NSGs) in the subscription.\nYou need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual\nnetworks.\nSolution: You assign a built-in policy definition to the subscription.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups. Another administrator plans to create several network security groups (NSGs) in the subscription. You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks. Solution: You assign a built-in policy definition to the subscription. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Resource policy definition used by Azure Policy enables you to establish conventions for resources in your\norganization by describing when the policy is enforced and what effect to take. By defining conventions, you\ncan control costs and more easily manage your resources.", "reference": "https://docs.microsoft.com/en-us/azure/azure-policy/policy-definition", "references": [ "https://docs.microsoft.com/en-us/azure/azure-policy/policy-definition" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 435, "pdfId": 437, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/437" }, "markersInGap": [], "questionText": "You have an Azure subscription.\nYou plan to deploy an Azure Kubernetes Service (AKS) cluster to support an app named App1. On-premises clients\nconnect to App1 by using the IP address of the pod.\nFor the AKS cluster, you need to choose a network type that will support App1.\nWhat should you choose?\nA.\nkubenet\nB.\nAzure Container Networking Interface (CNI)\nC.\nHybrid Connection endpoints\nD.\nAzure Private Link", "stem": "You have an Azure subscription. You plan to deploy an Azure Kubernetes Service (AKS) cluster to support an app named App1. On-premises clients connect to App1 by using the IP address of the pod. For the AKS cluster, you need to choose a network type that will support App1. What should you choose", "options": [ { "key": "A", "text": "kubenet" }, { "key": "B", "text": "Azure Container Networking Interface (CNI)" }, { "key": "C", "text": "Hybrid Connection endpoints" }, { "key": "D", "text": "Azure Private Link" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "With Azure CNI, every pod gets an IP address from the subnet and can be accessed directly. These IP\naddresses must be unique across your network space.\nIncorrect Answers:\nA: The kubenet networking option is the default configuration for AKS cluster creation. With kubenet, nodes\nget an IP address from the Azure virtual network subnet. Pods receive an IP address from a logically different\naddress space to the Azure virtual network subnet of the nodes. Network address translation (NAT) is then\nconfigured so that the pods can reach resources on the Azure virtual network.\nC, D: AKS only supports Kubenet networking and Azure Container Networking Interface (CNI) networking", "reference": "https://docs.microsoft.com/en-us/azure/aks/concepts-network", "references": [ "https://docs.microsoft.com/en-us/azure/aks/concepts-network" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 436, "pdfId": 435, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/435" }, "markersInGap": [ 435, 436 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription that contains the virtual machines shown in the following table.\n You deploy a load balancer that has the following configurations:\n✑\n Name: LB1\n✑\n Type: Internal\n✑\n SKU: Standard\n✑\n Virtual network: VNET1\nYou need to ensure that you can add VM1 and VM2 to the backend pool of LB1.\nSolution: You disassociate the public IP address from the network interface of VM2.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the virtual machines shown in the following table. You deploy a load balancer that has the following configurations: ✑ Name: LB1 ✑ Type: Internal ✑ SKU: Standard ✑ Virtual network: VNET1 You need to ensure that you can add VM1 and VM2 to the backend pool of LB1. Solution: You disassociate the public IP address from the network interface of VM2. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "You can only attach virtual machines that have a standard SKU public IP configuration or no public IP\nconfiguration. All IP configurations must be on the same virtual network.\nALso, VMs do not have to be powered on when adding them to a backend pool.", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 437, "pdfId": 436, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/436" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate\nresource groups.\nAnother administrator plans to create several network security groups (NSGs) in the subscription.\nYou need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual\nnetworks.\nSolution: You configure a custom policy definition, and then you assign the policy to the subscription.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups. Another administrator plans to create several network security groups (NSGs) in the subscription. You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks. Solution: You configure a custom policy definition, and then you assign the policy to the subscription. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Resource policy definition used by Azure Policy enables you to establish conventions for resources in your\norganization by describing when the policy is enforced and what effect to take. By defining conventions, you\ncan control costs and more easily manage your resources.", "reference": "https://docs.microsoft.com/en-us/azure/azure-policy/policy-definition", "references": [ "https://docs.microsoft.com/en-us/azure/azure-policy/policy-definition" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 438, "pdfId": 438, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/438" }, "markersInGap": [ 437, 438 ], "questionText": "You have two Azure virtual networks named VNet1 and VNet2. VNet1 contains an Azure virtual machine named\nVM1. VNet2 contains an Azure virtual machine named VM2.\nVM1 hosts a frontend application that connects to VM2 to retrieve data.\n Users report that the frontend application is slower than usual.\nYou need to view the average round-trip time (RTT) of the packets from VM1 to VM2.\nWhich Azure Network Watcher feature should you use?\nA.\nIP flow verify\nB.\nConnection troubleshoot\nC.\nConnection monitor\nD.\nNSG flow logs", "stem": "You have two Azure virtual networks named VNet1 and VNet2. VNet1 contains an Azure virtual machine named VM1. VNet2 contains an Azure virtual machine named VM2. VM1 hosts a frontend application that connects to VM2 to retrieve data. Users report that the frontend application is slower than usual. You need to view the average round-trip time (RTT) of the packets from VM1 to VM2. Which Azure Network Watcher feature should you use", "options": [ { "key": "A", "text": "IP flow verify" }, { "key": "B", "text": "Connection troubleshoot" }, { "key": "C", "text": "Connection monitor" }, { "key": "D", "text": "NSG flow logs" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "The connection monitor capability monitors communication at a regular interval and informs you of\nreachability, latency, and network topology changes between the VM and the endpoint\nIncorrect Answers:\nA: The IP flow verify capability enables you to specify a source and destination IPv4 address, port, protocol\n(TCP or UDP), and traffic direction (inbound or outbound). IP flow verify then tests the communication and\ninforms you if the connection succeeds or fails. If the connection fails, IP flow verify tells you which security\nrule allowed or denied the communication, so that you can resolve the problem.\nB: The connection troubleshoot capability enables you to test a connection between a VM and another VM, an\nFQDN, a URI, or an IPv4 address. The test returns similar information returned when using the connection\nmonitor capability, but tests the connection at a point in time, rather than monitoring it over time, as\nconnection monitor does.\nD: The NSG flow log capability allows you to log the source and destination IP address, port, protocol, and\nwhether traffic was allowed or denied by an NSG.", "reference": "https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview", "references": [ "https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 439, "pdfId": 439, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/439" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: be created in the same availability set or virtual machine scale set.\nThe Basic tier is quite restrictive. A load balancer is restricted to a single availability set, virtual machine scale\nset, or a single machine.\nBox 2: be connected to the same virtual network\nThe Standard tier can span any virtual machine in a single virtual network, including blends of scale sets,\navailability sets, and machines.", "reference": "https://www.petri.com/comparing-basic-standard-azure-load-balancers", "references": [ "https://www.petri.com/comparing-basic-standard-azure-load-balancers" ], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 440, "pdfId": 440, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/440" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: 2 -\n2 public IP addresses in the on-premises data center, and 2 public IP addresses in the VNET for the active-\nactive. The most reliable option is to combine the active-active gateways on both your network and Azure, as\nshown in the diagram below.\nBox 2: 2 -\nEvery Azure VPN gateway consists of two instances in an active-standby configuration. For any planned\nmaintenance or unplanned disruption that happens to the active instance, the standby instance would take\nover (failover) automatically, and resume the S2S VPN or VNet-to-VNet connections.\nBox 3: 2 -\nDual-redundancy: active-active VPN gateways for both Azure and on-premises networks", "reference": "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable\nYou have an Azure subscription that contains two virtual machines as shown in the following table.\nYou perform a reverse DNS lookup for 10.0.0.4 from VM2.", "references": [ "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-highlyavailable" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 441, "pdfId": 441, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/441" }, "markersInGap": [], "questionText": "Which FQDN will be returned?\nA.\nvm1.core.windows.net\nB.\nvm1.azure.com\nC.\nvm1.westeurope.cloudapp.azure.com\nD.\nvm1.internal.cloudapp.net", "stem": "Which FQDN will be returned", "options": [ { "key": "A", "text": "vm1.core.windows.net" }, { "key": "B", "text": "vm1.azure.com" }, { "key": "C", "text": "vm1.westeurope.cloudapp.azure.com" }, { "key": "D", "text": "vm1.internal.cloudapp.net" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. vm1.internal.cloudapp.net\nIn Azure, when performing a reverse DNS lookup for a private IP address within a virtual network (VNet), Azure\nassigns an internal Fully Qualified Domain Name (FQDN) in the format:\n.internal.cloudapp.net\nSince VM1 has the private IP 10.0.0.4, when VM2 performs a reverse DNS lookup, it will return:\nvm1.internal.cloudapp.net", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 442, "pdfId": 442, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/442" }, "markersInGap": [ 442 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to\nApp1 are managed by using an Azure Load\nBalancer.\nThe effective network security configurations for VM2 are shown in the following exhibit.\nYou discover that connections to App1 from 131.107.100.50 over TCP port 443 fail.\nYou verify that the Load Balancer rules are configured correctly.\n You need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port\n443.\nSolution: You create an inbound security rule that allows any traffic from the AzureLoadBalancer source and has a\ncost of 150.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer. The effective network security configurations for VM2 are shown in the following exhibit. You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail. You verify that the Load Balancer rules are configured correctly. You need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port 443. Solution: You create an inbound security rule that allows any traffic from the AzureLoadBalancer source and has a cost of 150. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. No\nTo allow connections to App1 from 131.107.100.50 over TCP port 443, you need to create an inbound security\nrule that specifically allows traffic from the IP address 131.107.100.50 to port 443.\nThe given solution allows traffic from \"AzureLoadBalancer\" as the source. However, this only permits traffic\noriginating from Azure's internal load balancer health probes, not from external public IP addresses like\n131.107.100.50.\nYou create an inbound security rule that allows any traffic from the AzureLoadBalancer source and has a\nPRIORITY of 150.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nA.\nAdd a service endpoint to VNet1\nB.\nReset GW1\nC.\nCreate a route-based virtual network gateway\nD.\nAdd a connection to GW1\nE.\nDelete GW1\nF.\nAdd a public IP address space to VNet1", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 443, "pdfId": 443, "exam": "AZ-104", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/443" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains a policy-based virtual network gateway named GW1 and a virtual\nnetwork named VNet1.\nYou need to ensure that you can configure a point-to-site connection from an on-premises computer to VNet1.\nWhich two actions should you perform? Each correct answer presents part of the solution.\nNOTE: Each correct selection is worth one point.\nA.\nAdd a service endpoint to VNet1\nB.\nReset GW1\nC.\nCreate a route-based virtual network gateway\nD.\nAdd a connection to GW1\nE.\nDelete GW1\nF.\nAdd a public IP address space to VNet1", "stem": "You have an Azure subscription that contains a policy-based virtual network gateway named GW1 and a virtual network named VNet1. You need to ensure that you can configure a point-to-site connection from an on-premises computer to VNet1. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "Add a service endpoint to VNet1" }, { "key": "B", "text": "Reset GW1" }, { "key": "C", "text": "Create a route-based virtual network gateway" }, { "key": "D", "text": "Add a connection to GW1" }, { "key": "E", "text": "Delete GW1" }, { "key": "F", "text": "Add a public IP address space to VNet1" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C: A VPN gateway is used when creating a VPN connection to your on-premises network.\nRoute-based VPN devices use any-to-any (wildcard) traffic selectors, and let routing/forwarding tables direct\ntraffic to different IPsec tunnels. It is typically built on router platforms where each IPsec tunnel is modeled\nas a network interface or VTI (virtual tunnel interface).\nE: Policy-based VPN devices use the combinations of prefixes from both networks to define how traffic is\nencrypted/decrypted through IPsec tunnels. It is typically built on firewall devices that perform packet\nfiltering. IPsec tunnel encryption and decryption are added to the packet filtering and processing engine.\nIncorrect Answers:\nF: Point-to-Site connections do not require a VPN device or a public-facing IP address.", "reference": "https://docs.microsoft.com/en-us/azure/vpn-gateway/create-routebased-vpn-gateway-portal\nhttps://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps", "references": [ "https://docs.microsoft.com/en-us/azure/vpn-gateway/create-routebased-vpn-gateway-portal", "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 444, "pdfId": 444, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/444" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: No -\nAzure DNS provides automatic registration of virtual machines from a single virtual network that's linked to a\nprivate zone as a registration virtual network. VM5 does not belong to the registration virtual network though.\nBox 2: No -\nForward DNS resolution is supported across virtual networks that are linked to the private zone as resolution\nvirtual networks. VM5 does belong to a resolution virtual network.\nBox 3: Yes -\nVM6 belongs to registration virtual network, and an A (Host) record exists for VM9 in the DNS zone.\nBy default, registration virtual networks also act as resolution virtual networks, in the sense that DNS\nresolution against the zone works from any of the virtual machines within the registration virtual network.", "reference": "https://docs.microsoft.com/en-us/azure/dns/private-dns-overview", "references": [ "https://docs.microsoft.com/en-us/azure/dns/private-dns-overview" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 445, "pdfId": 445, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/445" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "https://docs.microsoft.com/en-us/azure/dns/private-dns-virtual-network-links\nA virtual network can be linked to private DNS zone as a registration or as a resolution virtual network.\nRegistration virtual network:\nA private DNS zone can have multiple registration virtual networks. However, every virtual network can only\nhave one registration zone associated with it.\nResolution virtual network:\nOne private DNS zone can have multiple resolution virtual networks and a virtual network can have multiple\nresolution zones associated to it.\n1. Yes\nNo registration zone for VNET2.\n2. Yes\nA virtual network can have multiple resolution zones associated to it.\n3.Yes\nNo registration zone for VNET2.", "reference": "https://docs.microsoft.com/en-us/azure/dns/private-dns-virtual-network-links https://docs.microsoft.com/en-\nus/azure/dns/private-dns-autoregistration", "references": [ "https://docs.microsoft.com/en-us/azure/dns/private-dns-virtual-network-links", "https://docs.microsoft.com/en-" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 446, "pdfId": 446, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/446" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1. AzureBastionSubnet\n2. 10.10.10.0/27\nhttps://learn.microsoft.com/en-us/azure/bastion/configuration-settings#subnet\nAzure Bastion requires a dedicated subnet: AzureBastionSubnet. You must create this subnet in the same\nvirtual network that you want to deploy Azure Bastion to.\nFor Azure Bastion resources deployed on or after November 2, 2021, the minimum AzureBastionSubnet size is\n/26 or larger (/25, /24, etc.). All Azure Bastion resources deployed in subnets of size /27 prior to this date are\nunaffected by this change and will continue to work, but we highly recommend increasing the size of any\nexisting AzureBastionSubnet to /26 in case you choose to take advantage of host scaling in the future.", "reference": "https://medium.com/charot/deploy-azure-bastion-preview-using-an-arm-template-15e3010767d6", "references": [ "https://medium.com/charot/deploy-azure-bastion-preview-using-an-arm-template-15e3010767d6" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 447, "pdfId": 447, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/447" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou manage a virtual network named VNet1 that is hosted in the West US Azure region.\nVNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.\nYou need to inspect all the network traffic from VM1 to VM2 for a period of three hours.\nSolution: From Azure Network Watcher, you create a packet capture.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You manage a virtual network named VNet1 that is hosted in the West US Azure region. VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server. You need to inspect all the network traffic from VM1 to VM2 for a period of three hours. Solution: From Azure Network Watcher, you create a packet capture. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Network Watcher variable packet capture allows you to create packet capture sessions to track traffic to and\nfrom a virtual machine. Packet capture helps to diagnose network anomalies both reactively and proactively.\nOther uses include gathering network statistics, gaining information on network intrusions, to debug client-\nserver communications and much more.", "reference": "https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-packet-capture-overview", "references": [ "https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-packet-capture-overview" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 448, "pdfId": 448, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/448" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou manage a virtual network named VNet1 that is hosted in the West US Azure region.\nVNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.\nYou need to inspect all the network traffic from VM1 to VM2 for a period of three hours.\nSolution: From Azure Network Watcher, you create a connection monitor.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You manage a virtual network named VNet1 that is hosted in the West US Azure region. VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server. You need to inspect all the network traffic from VM1 to VM2 for a period of three hours. Solution: From Azure Network Watcher, you create a connection monitor. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "No.\nWe need to inspect all the network traffic \"from\" VM1 \"to\" VM2 and not between the 2 VMs.\nEven if we were using Connection monitor, this one would inspect only network traffic over a specific port.\nAnd for a period of 3 hours, packet capture session time limit default value is 18000 seconds or 5 hours.", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 449, "pdfId": 449, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/449" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou manage a virtual network named VNet1 that is hosted in the West US Azure region.\nVNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.\nYou need to inspect all the network traffic from VM1 to VM2 for a period of three hours.\nSolution: From Performance Monitor, you create a Data Collector Set (DCS).\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You manage a virtual network named VNet1 that is hosted in the West US Azure region. VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server. You need to inspect all the network traffic from VM1 to VM2 for a period of three hours. Solution: From Performance Monitor, you create a Data Collector Set (DCS). Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Use the Connection Monitor feature of Azure Network Watcher.", "reference": "https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview", "references": [ "https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 450, "pdfId": 450, "exam": "AZ-104", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/450" }, "markersInGap": [ 449, 450 ], "questionText": "DRAG DROP -\nYou have an Azure subscription that contains the resources shown in the following table.\nYou need to load balance HTTPS connections to vm1 and vm2 by using lb1.\nWhich three actions should you perform in sequence? To answer, move the appropriate actions from the list of\nactions to the answer area and arrange them in the correct order.\nSelect and Place:", "stem": "You have an Azure subscription that contains the resources shown in the following table. You need to load balance HTTPS connections to vm1 and vm2 by using lb1. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1.\nRemove the public IP addresses from VM1 and VM2\nWhen using an internal load balancer, backend VMs should not have public IPs. Removing public IPs ensures\nthat all inbound traffic is routed through the load balancer.\n2\n.Create a health probe and backend pool on lb1\nA health probe is required to monitor the availability of backend VMs.\nA backend pool groups the VMs that will receive traffic from the load balancer.\n3.\nCreate a load balancing rule on lb1\nA load balancing rule defines how traffic is distributed across the backend VMs (e.g., specifying ports and\nprotocols).", "reference": "https://docs.microsoft.com/en-us/azure/load-balancer/tutorial-load-balancer-standard-public-zone-\nredundant-portal", "references": [ "https://docs.microsoft.com/en-us/azure/load-balancer/tutorial-load-balancer-standard-public-zone-" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 451, "pdfId": 451, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/451" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou manage a virtual network named VNet1 that is hosted in the West US Azure region.\nVNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.\nYou need to inspect all the network traffic from VM1 to VM2 for a period of three hours.\nSolution: From Azure Monitor, you create a metric on Network In and Network Out.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You manage a virtual network named VNet1 that is hosted in the West US Azure region. VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server. You need to inspect all the network traffic from VM1 to VM2 for a period of three hours. Solution: From Azure Monitor, you create a metric on Network In and Network Out. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "You use the Packet Capture, not Connection Monitor nor Network watcher.", "reference": "https://azure.microsoft.com/en-us/updates/general-availability-azure-network-watcher-connection-monitor-\nin-all-public-regions/", "references": [ "https://azure.microsoft.com/en-us/updates/general-availability-azure-network-watcher-connection-monitor-" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 452, "pdfId": 452, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/452" }, "markersInGap": [ 451, 452 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to\nApp1 are managed by using an Azure Load\nBalancer.\nThe effective network security configurations for VM2 are shown in the following exhibit.\n You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail.\nYou verify that the Load Balancer rules are configured correctly.\nYou need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port\n443.\nSolution: You create an inbound security rule that denies all traffic from the 131.107.100.50 source and has a\npriority of 64999.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer. The effective network security configurations for VM2 are shown in the following exhibit. You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail. You verify that the Load Balancer rules are configured correctly. You need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port 443. Solution: You create an inbound security rule that denies all traffic from the 131.107.100.50 source and has a priority of 64999. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B (No)\nWhen an Azure Load Balancer get created, it will probe backend to detect if the backend service is healthy or\nnot, the probe packet is sent from source address \"AzureLoadBalancer\", the IP address of\n\"AzureLoadBalancer\" is always 168.63.129.16.\nhttps://msazure.club/addendum-of-azure-load-balancer-and-nsg-rules/", "reference": "https://fastreroute.com/azure-network-security-groups-explained/", "references": [ "https://fastreroute.com/azure-network-security-groups-explained/" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 453, "pdfId": 453, "exam": "AZ-104", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/453" }, "markersInGap": [ 453 ], "questionText": "DRAG DROP -\nYou have an Azure subscription that contains two on-premises locations named site1 and site2.\nYou need to connect site1 and site2 by using an Azure Virtual WAN.\nWhich four actions should you perform in sequence? To answer, move the appropriate actions from the list of\nactions to the answer area and arrange them in the correct order.\n Select and Place:", "stem": "You have an Azure subscription that contains two on-premises locations named site1 and site2. You need to connect site1 and site2 by using an Azure Virtual WAN. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Create a Virtual WAN resource.\nThis is the first step in setting up Azure Virtual WAN, which acts as a centralized networking service for\nconnectivity.\nCreate a virtual hub.\nA Virtual Hub is required within Virtual WAN to facilitate connections between VPNs, ExpressRoute, and\nVirtual Networks.\nCreate VPN sites.\nIn Azure Virtual WAN, VPN sites represent on-premises locations that connect to Azure via Site-to-Site VPN.\nConnect the VPN sites to the hub.\nOnce VPN sites are created, they need to be connected to the Virtual Hub to enable communication between\non-premises networks and Azure.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 454, "pdfId": 454, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/454" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "No: Server2 uses Server1 for DNS. Server1 has no host2.contoso.com record for 131.107.50.50. It would work if\nVNET1 hat a virtual network link to the private zone contoso.com.\nYes: Server2 uses Server1 for DNS. Server1 has a host1.contoso.com record for 131.107.10.15\nNo: Server3 uses 10.10.0.4 as DNS (inherited from VNET2). 10.10.0.4 (Server1) has no record for\nhost2.contoso.com. The virtual network link for the private zone contoso.com on VNET2 won't be used since\nthe DNS from VNET1 is set on VNET2. VNET1 DNS is not aware of the private zone contoso.com. It would work\nif VNET1 had a virtual network link to the private zone contoso.com.\nKey: Server1 considers itself authoritive for contoso.com (its a Primary DNS zone)\nIf it doesn't have a record, that's game over man\nServer2 gets a DNS server of Server 1 (NIC2 is hard set to Server1's IP)\nServer2 can not resolve host2.contoso.com as Server1 has no record for it\nServer2 resolve host1.contoso.com as 131.107.10.15 as that's Server1's record for it\nServer3 (NIC3) inherits from it VNET (VNET2) which is also Server1\nServer3 resolves host2.contoso.com the same as Server2 with NO resolution", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 455, "pdfId": 455, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/455" }, "markersInGap": [ 455 ], "questionText": "You have a virtual network named VNet1 as shown in the exhibit. (Click the Exhibit tab.)\nNo devices are connected to VNet1.\nYou plan to peer VNet1 to another virtual network named VNet2. VNet2 has an address space of 10.2.0.0/16.\nYou need to create the peering.\nWhat should you do first?\n A.\nModify the address space of VNet1.\nB.\nAdd a gateway subnet to VNet1.\nC.\nCreate a subnet on VNet1 and VNet2.\nD.\nConfigure a service endpoint on VNet2.", "stem": "You have a virtual network named VNet1 as shown in the exhibit. (Click the Exhibit tab.) No devices are connected to VNet1. You plan to peer VNet1 to another virtual network named VNet2. VNet2 has an address space of 10.2.0.0/16. You need to create the peering. What should you do first", "options": [ { "key": "A", "text": "Modify the address space of VNet1." }, { "key": "B", "text": "Add a gateway subnet to VNet1." }, { "key": "C", "text": "Create a subnet on VNet1 and VNet2." }, { "key": "D", "text": "Configure a service endpoint on VNet2." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "The virtual networks you peer must have non-overlapping IP address spaces. The exhibit indicates that VNet1\nhas an address space of 10.2.0.0/16, which is the same as VNet2, and thus overlaps. We need to change the\naddress space for VNet1.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering#requirements-and-\nconstraints https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering#requirements-and-", "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 456, "pdfId": 456, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/456" }, "markersInGap": [], "questionText": "You have the Azure virtual machines shown in the following table.\nVNET1 is linked to a private DNS zone named contoso.com that contains the records shown in the following table.\nYou need to ping VM2 from VM1.\nWhich DNS names can you use to ping VM2?\nA.\ncomp2.contoso.com and comp4.contoso.com only\nB.\ncomp1.contoso.com, comp2.contoso.com, comp3.contoso.com, and comp4.contoso.com\nC.\ncomp2.contoso.com only\nD.\ncomp1.contoso.com and comp2.contoso.com only\nE.\ncomp1.contoso.com, comp2.contoso.com, and comp4.contoso.com only", "stem": "You have the Azure virtual machines shown in the following table. VNET1 is linked to a private DNS zone named contoso.com that contains the records shown in the following table. You need to ping VM2 from VM1. Which DNS names can you use to ping VM2", "options": [ { "key": "A", "text": "comp2.contoso.com and comp4.contoso.com only" }, { "key": "B", "text": "comp1.contoso.com, comp2.contoso.com, comp3.contoso.com, and comp4.contoso.com" }, { "key": "C", "text": "comp2.contoso.com only" }, { "key": "D", "text": "comp1.contoso.com and comp2.contoso.com only" }, { "key": "E", "text": "comp1.contoso.com, comp2.contoso.com, and comp4.contoso.com only" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "comp2.contoso.com only\nA record: Is used to map a DNS/domain name to an IP\nTXT records in a lot of cases get used to prove ownership of a domain, it has other purposes too.\nPTR: A Reverse DNS lookup is used by remote hosts to determine who 'owns' an IP address.\nCNAME records get used to redirect a DNS name or subdomain name to another DNS name or domain name\nor subdomain name.\nIt would do good to read up on DNS record types and what they are used for, you will be lost if you don't have\na basic understanding of it.\nDNS is a key component In the IT field.", "reference": "https://support.dnsimple.com/articles/cname-record/\nhttps://ns1.com/resources/dns-types-records-servers-and-queries\nhttps://www.mailenable.com/kb/content/article.asp?ID=ME020206\nhttps://support.google.com/a/answer/2716800?\nhl=en#:~:text=TXT%20records%20are%20a%20type,and%20to%20ensure%20email%20security.\nhttps://www.cloudflare.com/learning/dns/dns-records/dns-a-record/", "references": [ "https://support.dnsimple.com/articles/cname-record/", "https://ns1.com/resources/dns-types-records-servers-and-queries", "https://www.mailenable.com/kb/content/article.asp?ID=ME020206", "https://support.google.com/a/answer/2716800?", "https://www.cloudflare.com/learning/dns/dns-records/dns-a-record/" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 457, "pdfId": 457, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/457" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Direction: Outbound\nSource 10.1.0.10 (VM1)\nDestination: 10.1.0.11 (VM2)\nPriority: 110\nPlease note that the rule won't block outbound response from VM2.\nNSGs allow or deny the establishment of a TCP connection. Once a connection is established, traffic can flow\nboth ways as needed without obstruction. NSGs will not end active TCP connections either.", "reference": "https://www.thomasmaurer.ch/2019/09/how-to-enable-ping-icmp-echo-on-an-azure-vm/", "references": [ "https://www.thomasmaurer.ch/2019/09/how-to-enable-ping-icmp-echo-on-an-azure-vm/" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 458, "pdfId": 458, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/458" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named\nVNet1. The point-to-site connection uses a self-signed certificate.\nFrom Azure, you download and install the VPN client configuration package on a computer named Computer2.\nYou need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2.\nSolution: On Computer2, you set the Startup type for the IPSec Policy Agent service to Automatic.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site connection uses a self-signed certificate. From Azure, you download and install the VPN client configuration package on a computer named Computer2. You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2. Solution: On Computer2, you set the Startup type for the IPSec Policy Agent service to Automatic. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You\ngenerate a client certificate from the self-signed root certificate, and then export and install the client\ncertificate. If the client certificate is not installed, authentication fails.", "reference": "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site", "references": [ "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 459, "pdfId": 459, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/459" }, "markersInGap": [], "questionText": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web\nservers.\nYou have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.\nYou need to ensure that visitors are serviced by the same web server for each request.\nWhat should you configure?\nA.\nSession persistence to Client IP and protocol\nB.\nProtocol to UDP\nC.\nSession persistence to None\nD.\nFloating IP (direct server return) to Enabled", "stem": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure", "options": [ { "key": "A", "text": "Session persistence to Client IP and protocol" }, { "key": "B", "text": "Protocol to UDP" }, { "key": "C", "text": "Session persistence to None" }, { "key": "D", "text": "Floating IP (direct server return) to Enabled" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "None (hash-based) - Specifies that successive requests from the same client may be handled by any virtual\nmachine.\nClient IP (source IP affinity two-tuple) - Specifies that successive requests from the same client IP address\nwill be handled by the same virtual machine.\nClient IP and protocol (source IP affinity three-tuple) - Specifies that successive requests from the same\nclient IP address and protocol combination will be handled by the same virtual machine.", "reference": "https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-distribution-mode?tabs=azure-portal\nhttps://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-distribution-mode?tabs=azure-portal", "references": [ "https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-distribution-mode?tabs=azure-portal", "https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-distribution-mode?tabs=azure-portal" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 460, "pdfId": 460, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/460" }, "markersInGap": [], "questionText": "You have an Azure subscription that uses the public IP addresses shown in the following table.\nYou need to create a public Azure Standard Load Balancer.\nWhich public IP addresses can you use?\nA.\nIP1, IP2, and IP3\nB.\nIP2 only\nC.\nIP3 only\nD.\nIP1 and IP3 only", "stem": "You have an Azure subscription that uses the public IP addresses shown in the following table. You need to create a public Azure Standard Load Balancer. Which public IP addresses can you use", "options": [ { "key": "A", "text": "IP1, IP2, and IP3" }, { "key": "B", "text": "IP2 only" }, { "key": "C", "text": "IP3 only" }, { "key": "D", "text": "IP1 and IP3 only" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Matching SKUs are required for load balancer and public IP resources. You can't have a mixture of Basic SKU\nresources and standard SKU resources.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 461, "pdfId": 461, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/461" }, "markersInGap": [], "questionText": "You have an Azure subscription.\nYou are deploying an Azure Kubernetes Service (AKS) cluster that will contain multiple pods. The pods will use\nkubernet networking.\nYou need to restrict network traffic between the pods.\nWhat should you configure on the AKS cluster?\nA.\nthe Azure network policy\nB.\nthe Calico network policy\nC.\npod security policies\nD.\nan application security group", "stem": "You have an Azure subscription. You are deploying an Azure Kubernetes Service (AKS) cluster that will contain multiple pods. The pods will use kubernet networking. You need to restrict network traffic between the pods. What should you configure on the AKS cluster", "options": [ { "key": "A", "text": "the Azure network policy" }, { "key": "B", "text": "the Calico network policy" }, { "key": "C", "text": "pod security policies" }, { "key": "D", "text": "an application security group" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "The question describes “the pods will use kubernet networking.”\nTo provide network connectivity, AKS clusters can use kubenet (basic networking) or Azure CNI (advanced\nnetworking).\nAzure Network Policies supports Azure CNI only. Calico Network Policies supports both Azure CNI (Windows\nServer 2019 and Linux) and kubenet (Linux).\nReference\nhttps://docs.microsoft.com/en-us/azure/aks/use-network-policies\nhttps://docs.microsoft.com/en-us/azure/aks/configure-kubenet", "reference": "https://docs.microsoft.com/en-us/azure/aks/use-network-policies", "references": [ "https://docs.microsoft.com/en-us/azure/aks/use-network-policies" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 462, "pdfId": 462, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/462" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: 10.0.0.0/16\nAddress prefix\ndestination-> Vnet 1 (Address space of Vnet1)\nBox 2: Virtual appliance\nNext hop type\nVM1 ->Virtual Appliance. You can specify IP address of VM 1 when configuring next hop as Virtual appliance.\nBox 3: Gateway Subnet\nAssigned to\nThis route is to be followed by Gateway Subnet for the incoming traffic. You can associate routing table to the\nSubnet from Rout Table -> subnet ->Associate.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 463, "pdfId": 463, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/463" }, "markersInGap": [ 463 ], "questionText": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web\nservers.\nYou have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.\nYou need to ensure that visitors are serviced by the same web server for each request.\nWhat should you configure?\n A.\nFloating IP (direct server return) to Enabled\nB.\nFloating IP (direct server return) to Disabled\nC.\na health probe\nD.\nSession persistence to Client IP and Protocol", "stem": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure", "options": [ { "key": "A", "text": "Floating IP (direct server return) to Enabled" }, { "key": "B", "text": "Floating IP (direct server return) to Disabled" }, { "key": "C", "text": "a health probe" }, { "key": "D", "text": "Session persistence to Client IP and Protocol" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "With Sticky Sessions when a client starts a session on one of your web servers, session stays on that specific\nserver. To configure An Azure Load-Balancer For\nSticky Sessions set Session persistence to Client IP.\nOn the following image you can see sticky session configuration:", "reference": "https://cloudopszone.com/configure-azure-load-balancer-for-sticky-sessions/", "references": [ "https://cloudopszone.com/configure-azure-load-balancer-for-sticky-sessions/" ], "note": "There are several versions of this question in the exam. The question can have other incorrect answer options,\nincluding the following:\n1. Idle Time-out (minutes) to 20\n2. Protocol to UDP\nReference:\nhttps://cloudopszone.com/configure-azure-load-balancer-for-sticky-sessions/", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 464, "pdfId": 464, "exam": "AZ-104", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/464" }, "markersInGap": [ 464 ], "questionText": "HOTSPOT -\nYou have an Azure subscription that contains the virtual machines shown in the following table:\n VM1 and VM2 use public IP addresses. From Windows Server 2019 on VM1 and VM2, you allow inbound Remote\nDesktop connections.\nSubnet1 and Subnet2 are in a virtual network named VNET1.\nThe subscription contains two network security groups (NSGs) named NSG1 and NSG2. NSG1 uses only the default\nrules.\nNSG2 uses the default rules and the following custom incoming rule:\n✑\n Priority: 100\n✑\n Name: Rule1\n✑\n Port: 3389\n✑\n Protocol: TCP\n✑\n Source: Any\n✑\n Destination: Any\n✑\n Action: Allow\nNSG1 is associated to Subnet1. NSG2 is associated to the network interface of VM2.\nFor each of the following statements, select Yes if the statement is true. Otherwise, select No.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You have an Azure subscription that contains the virtual machines shown in the following table: VM1 and VM2 use public IP addresses. From Windows Server 2019 on VM1 and VM2, you allow inbound Remote Desktop connections. Subnet1 and Subnet2 are in a virtual network named VNET1. The subscription contains two network security groups (NSGs) named NSG1 and NSG2. NSG1 uses only the default rules. NSG2 uses the default rules and the following custom incoming rule: ✑ Priority: 100 ✑ Name: Rule1 ✑ Port: 3389 ✑ Protocol: TCP ✑ Source: Any ✑ Destination: Any ✑ Action: Allow NSG1 is associated to Subnet1. NSG2 is associated to the network interface of VM2. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "No: VM1 has default rules which denies any port open for inbound rules\nYes: VM2 has custom rule allowing RDP port\nYes: VM1 and VM2 are in the same Vnet. by default, communication are allowed", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nA.\na frontend IP address\nB.\nan inbound NAT rule\nC.\na virtual network\nD.\na backend pool\nE.\na health probe", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 465, "pdfId": 465, "exam": "AZ-104", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/465" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains two virtual machines named VM1 and VM2.\nYou create an Azure load balancer.\nYou plan to create a load balancing rule that will load balance HTTPS traffic between VM1 and VM2.\nWhich two additional load balancer resources should you create before you can create the load balancing rule?\nEach correct answer presents part of the solution.\nNOTE: Each correct selection is worth one point.\nA.\na frontend IP address\nB.\nan inbound NAT rule\nC.\na virtual network\nD.\na backend pool\nE.\na health probe", "stem": "You have an Azure subscription that contains two virtual machines named VM1 and VM2. You create an Azure load balancer. You plan to create a load balancing rule that will load balance HTTPS traffic between VM1 and VM2. Which two additional load balancer resources should you create before you can create the load balancing rule? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "a frontend IP address" }, { "key": "B", "text": "an inbound NAT rule" }, { "key": "C", "text": "a virtual network" }, { "key": "D", "text": "a backend pool" }, { "key": "E", "text": "a health probe" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "You can't create a LB without FrontEnd IP, so if we have a LB we also have a FrontEnd IP already. You can\nhowever create a LB without a backend pool and without any rules. If you want to add a rule to your LB later", "reference": "https://docs.microsoft.com/en-us/azure/load-balancer/components", "references": [ "https://docs.microsoft.com/en-us/azure/load-balancer/components" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 466, "pdfId": 466, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/466" }, "markersInGap": [], "questionText": "You have an on-premises network that contains a database server named dbserver1.\nYou have an Azure subscription.\nYou plan to deploy three Azure virtual machines. Each virtual machine will be deployed to a separate availability\nzone.\nYou need to configure an Azure VPN gateway for a site-to-site VPN. The solution must ensure that the virtual\nmachines can connect to dbserver1.\nWhich type of public IP address SKU and assignment should you use for the gateway?\nA.\na basic SKU and a static IP address assignment\nB.\na standard SKU and a static IP address assignment\nC.\na basic SKU and a dynamic IP address assignment", "stem": "You have an on-premises network that contains a database server named dbserver1. You have an Azure subscription. You plan to deploy three Azure virtual machines. Each virtual machine will be deployed to a separate availability zone. You need to configure an Azure VPN gateway for a site-to-site VPN. The solution must ensure that the virtual machines can connect to dbserver1. Which type of public IP address SKU and assignment should you use for the gateway", "options": [ { "key": "A", "text": "a basic SKU and a static IP address assignment" }, { "key": "B", "text": "a standard SKU and a static IP address assignment" }, { "key": "C", "text": "a basic SKU and a dynamic IP address assignment" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "since the VMs are in AZ then VPN gateway will have to on AZ which will rely on Azure public IP resource\nStandard SKU. And must be Static as Dynamic is only for non-AZ. See links below.\nhttps://learn.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses#at-a-glance\nhttps://learn.microsoft.com/en-us/azure/vpn-gateway/about-zone-redundant-vnet-gateways", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 467, "pdfId": 467, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/467" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Yes -\nVM1 is in VNET1. In VNET1 Server1 resolves to 131.107.3.3\nBox 2: No -\nVM2 is in VNET2. VNET2 uses custom DNS server 192.168.05\nBox 3: Yes.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 468, "pdfId": 468, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/468" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: No\nNone of the actions in question added the VM1 record to contoso.com dns\nBox 2: Yes -\nFabrikam.com is a Private DNS zone. The private IP address is used.", "reference": "https://docs.microsoft.com/en-us/azure/dns/dns-zones-records\nhttps://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-\ninstances", "references": [ "https://docs.microsoft.com/en-us/azure/dns/dns-zones-records", "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-" ], "note": "The Azure DNS private zones auto registration feature manages DNS records for virtual machines\ndeployed in a virtual network. When you link a virtual network with a private DNS zone with this setting\nenabled, a DNS record gets created for each virtual machine deployed in the virtual network.\nFor each virtual machine, an A record and a PTR record are created. DNS records for newly deployed virtual\nmachines are also automatically created in the linked private DNS zone.\nNote: If you use Azure Provided DNS then appropriate DNS suffix will be automatically applied to your virtual\nmachines. For all other options you must either use\nFully Qualified Domain Names (FQDN) or manually apply appropriate DNS suffix to your virtual machines.\nBox 3: Yes -\nN - Public Ips wont auto register DNS\nY - Auto registration is enabled\nN - Linux won't do auto registration\nReference:\nhttps://docs.microsoft.com/en-us/azure/dns/dns-zones-records\nhttps://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-\ninstances", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 469, "pdfId": 469, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/469" }, "markersInGap": [], "questionText": "You have an on-premises datacenter and an Azure subscription.\nYou plan to connect the datacenter to Azure by using ExpressRoute.\nYou need to deploy an ExpressRoute gateway. The solution must meet the following requirements:\n✑\n Support up to 10 Gbps of traffic.\n✑\n Support availability zones.\n✑\n Support FastPath.\n✑\n Minimize costs.\nWhich SKU should you deploy?\nA.\nERGw1AZ\nB.\nERGw2\nC.\nErGw3\nD.\nErGw3AZ", "stem": "You have an on-premises datacenter and an Azure subscription. You plan to connect the datacenter to Azure by using ExpressRoute. You need to deploy an ExpressRoute gateway. The solution must meet the following requirements: ✑ Support up to 10 Gbps of traffic. ✑ Support availability zones. ✑ Support FastPath. ✑ Minimize costs. Which SKU should you deploy", "options": [ { "key": "A", "text": "ERGw1AZ" }, { "key": "B", "text": "ERGw2" }, { "key": "C", "text": "ErGw3" }, { "key": "D", "text": "ErGw3AZ" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "ErGw3Az supports FastPath.\nThe following table shows the features supported across each gateway type.", "reference": null, "references": [], "note": "ExpressRoute virtual network gateways can use the following SKUs:\nStandard -\nHighPerformance -\nUltraPerformance -\nErGw1Az -\nErGw2Az -\nErGw3Az -", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 470, "pdfId": 470, "exam": "AZ-104", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/470" }, "markersInGap": [], "questionText": "HOTSPOT -\nYou have a virtual network named VNET1 that contains the subnets shown in the following table:\nYou have Azure virtual machines that have the network configurations shown in the following table:\nFor NSG1, you create the inbound security rule shown in the following table:\nFor NSG2, you create the inbound security rule shown in the following table:\nFor each of the following statements, select Yes if the statement is true. Otherwise, select No.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You have a virtual network named VNET1 that contains the subnets shown in the following table: You have Azure virtual machines that have the network configurations shown in the following table: For NSG1, you create the inbound security rule shown in the following table: For NSG2, you create the inbound security rule shown in the following table: For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: NO - here is why \"Remember this- The rule closest to destination take precedence over other rules\" i.e.\nif subnet allows for TCP traffic to flow on port 1433 but the\nNSG denies access/blocks access and is applied to Network interface of VM1 and lets say VM2 tries to access\nVM1 @ port 1433 then NSG1 applied at subnet level will allow traffic to flow but access will Definitely be\ndenied at NIC level and hence VM2 gets blocked. Remember what i said earlier the NSG rule nearest to\ndestination take precedence and Deny takes precedence over allow assuming the NSG rule has Higher\npriority (meaning will be applied first). Important Note if you have NSG1 rule with priority 100 (allows RDP\ntraffic 3389) and NSG2 rule with priority 110 (Deny RDP traffic 3389) and both are applied at same level i.e.\nSUBNET or NIC (If applied at NIC level assume subnet level is allow for example sake) then the NSG1 rule will\ntake precedence and traffic is allowed and Rule NSG2 is NEVER checked - basically has no value\nBox 2: Yes -\nNo rule explicitly blocks communication from VM1. The default rules, which allow communication, are thus\napplied.\nBox 3: Yes -\nNo rule explicitly blocks communication between VM2 and VM3 which are both on Subnet2. The default rules,", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/security-overview", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/security-overview" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 471, "pdfId": 471, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/471" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "IP forwarding enables the virtual machine a network interface is attached to:\n✑\n Receive network traffic not destined for one of the IP addresses assigned to any of the IP configurations\nassigned to the network interface.\nSend network traffic with a different source IP address than the one assigned to one of a network interface's\nIP configurations.\nThe setting must be enabled for every network interface that is attached to the virtual machine that receives\ntraffic that the virtual machine needs to forward. A virtual machine can forward traffic whether it has multiple\nnetwork interfaces or a single network interface attached to it.\nBox 1: Yes -\nThe routing table allows connections from VM3 to VM1 and VM2. And as IP forwarding is enabled on VM3,\nVM3 can connect to VM1.\nBox 2: No -\nVM3, which has IP forwarding, must be turned on, in order for VM2 to connect to VM1.\nBox 3: Yes -\nThe routing table allows connections from VM1 and VM2 to VM3. IP forwarding on VM3 allows VM1 to connect\nto VM2 via VM3.", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview\nhttps://www.quora.com/What-is-IP-forwarding\nYour on-premises network contains an SMB share named Share1.", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview", "https://www.quora.com/What-is-IP-forwarding" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 472, "pdfId": 472, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/472" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the following resources:\n✑\n A web app named webapp1\n✑\n A virtual network named VNET1\nYou need to ensure that webapp1 can connect to Share1.\nWhat should you deploy?\nA.\nan Azure Application Gateway\nB.\nan Azure Active Directory (Azure AD) Application Proxy\nC.\nan Azure Virtual Network Gateway", "stem": "You have an Azure subscription that contains the following resources: ✑ A web app named webapp1 ✑ A virtual network named VNET1 You need to ensure that webapp1 can connect to Share1. What should you deploy", "options": [ { "key": "A", "text": "an Azure Application Gateway" }, { "key": "B", "text": "an Azure Active Directory (Azure AD) Application Proxy" }, { "key": "C", "text": "an Azure Virtual Network Gateway" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "A Site-to-Site VPN gateway connection can be used to connect your on-premises network to an Azure virtual\nnetwork over an IPsec/IKE (IKEv1 or IKEv2) VPN tunnel.\nThis type of connection requires a VPN device, a VPN gateway, located on-premises that has an externally\nfacing public IP address assigned to it.\nIncorrect Answers:\nB: Application Proxy is a feature of Azure AD that enables users to access on-premises web applications from\na remote client.", "reference": "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-\nportal\nYou plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set\nby using an Azure Resource Manager template.", "references": [ "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 473, "pdfId": 473, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/473" }, "markersInGap": [], "questionText": "You need to ensure that NGINX is available on all the virtual machines after they are deployed.\nWhat should you use?\nA.\nthe Publish-AzVMDscConfiguration cmdlet\nB.\nAzure Application Insights\nC.\nAzure Custom Script Extension\nD.\nthe New-AzConfigurationAssignement cmdlet", "stem": "You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use", "options": [ { "key": "A", "text": "the Publish-AzVMDscConfiguration cmdlet" }, { "key": "B", "text": "Azure Application Insights" }, { "key": "C", "text": "Azure Custom Script Extension" }, { "key": "D", "text": "the New-AzConfigurationAssignement cmdlet" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Note:\nThere are several versions of this question in the exam. The question has two correct answers:\n1. a Desired State Configuration (DSC) extension\n2. Azure Custom Script Extension\nThe question can have other incorrect answer options, including the following:\n✑\n Deployment Center in Azure App Service\n✑\n a Microsoft Intune device configuration profile", "reference": "https://docs.microsoft.com/en-us/azure/architecture/framework/devops/automation-configuration\nYour on-premises network contains a VPN gateway.", "references": [ "https://docs.microsoft.com/en-us/azure/architecture/framework/devops/automation-configuration" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 474, "pdfId": 474, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/474" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\nYou need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network.\nWhat should you configure?\nA.\na network security group (NSG)\nB.\nservice endpoints\nC.\nAzure Peering Service\nD.\nAzure Firewall", "stem": "You have an Azure subscription that contains the resources shown in the following table. You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network. What should you configure", "options": [ { "key": "A", "text": "a network security group (NSG)" }, { "key": "B", "text": "service endpoints" }, { "key": "C", "text": "Azure Peering Service" }, { "key": "D", "text": "Azure Firewall" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "\"Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over an\noptimized route over the Azure backbone network. \"", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 475, "pdfId": 475, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/475" }, "markersInGap": [], "questionText": "You plan to deploy route-based Site-to-Site VPN connections between several on-premises locations and an Azure\nvirtual network.\nWhich tunneling protocol should you use?\nA.\nIKEv1\nB.\nPPTP\nC.\nIKEv2\nD.\nL2TP", "stem": "You plan to deploy route-based Site-to-Site VPN connections between several on-premises locations and an Azure virtual network. Which tunneling protocol should you use", "options": [ { "key": "A", "text": "IKEv1" }, { "key": "B", "text": "PPTP" }, { "key": "C", "text": "IKEv2" }, { "key": "D", "text": "L2TP" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "A Site-to-Site (S2S) VPN gateway connection is used to connect your on-premises network to an Azure virtual\nnetwork over an IPsec/IKE (IKEv1 or IKEv2) VPN tunnel.\nIKEv2 supports 10 S2S connections, while IKEv1 only supports 1.", "reference": "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-classic-portal\nhttps://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps", "references": [ "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-classic-portal", "https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-connect-multiple-policybased-rm-ps" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 476, "pdfId": 476, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/476" }, "markersInGap": [ 475, 476 ], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\n You configure Azure Site Recovery to replicate VM1 between the US East and West US regions.\nYou perform a test failover of VM1 and specify VNET2 as the target virtual network.\nWhen the test version of VM1 is created, to which subnet will the virtual machine be connected?\nA.\nTestSubnet1\nB.\nDemoSubnet1\nC.\nRecoverySubnetA\nD.\nRecoverySubnetB", "stem": "You have an Azure subscription that contains the resources shown in the following table. You configure Azure Site Recovery to replicate VM1 between the US East and West US regions. You perform a test failover of VM1 and specify VNET2 as the target virtual network. When the test version of VM1 is created, to which subnet will the virtual machine be connected", "options": [ { "key": "A", "text": "TestSubnet1" }, { "key": "B", "text": "DemoSubnet1" }, { "key": "C", "text": "RecoverySubnetA" }, { "key": "D", "text": "RecoverySubnetB" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "https://learn.microsoft.com/en-us/azure/site-recovery/azure-to-azure-network-mapping\nThe subnet of the target VM is selected based on the name of the subnet of the source VM.\n- If a subnet with the same name as the source VM subnet is available in the target network, that subnet is set\nfor the target VM.\n- If a subnet with the same name doesn't exist in the target network, the first subnet in the alphabetical order\nis set as the target subnet.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 477, "pdfId": 477, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/477" }, "markersInGap": [ 477 ], "questionText": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web\nservers.\nYou have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.\nYou need to ensure that visitors are serviced by the same web server for each request.\nWhat should you configure?\n A.\nProtocol to UDP\nB.\nSession persistence to None\nC.\nFloating IP (direct server return) to Disabled\nD.\nSession persistence to Client IP", "stem": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure", "options": [ { "key": "A", "text": "Protocol to UDP" }, { "key": "B", "text": "Session persistence to None" }, { "key": "C", "text": "Floating IP (direct server return) to Disabled" }, { "key": "D", "text": "Session persistence to Client IP" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. Session persistence to Client IP.\nWhen configuring an Azure Load Balancer (LB1) for web servers, you can define session persistence to ensure\nthat a user is always connected to the same virtual machine (VM) for the duration of their session.\nSession persistence (also known as \"sticky sessions\") ensures that requests from the same client IP are\ndirected to the same backend server.\nThis is especially useful for stateful applications, where session data is stored locally on a specific server.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 478, "pdfId": 478, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/478" }, "markersInGap": [], "questionText": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set\nby using an Azure Resource Manager template.\nYou need to ensure that NGINX is available on all the virtual machines after they are deployed.\nWhat should you use?\nA.\nthe Publish-AzVMDscConfiguration cmdlet\nB.\na Microsoft Endpoint Manager device configuration profile\nC.\nDeployment Center in Azure App Service\nD.\na Desired State Configuration (DSC) extension", "stem": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource Manager template. You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use", "options": [ { "key": "A", "text": "the Publish-AzVMDscConfiguration cmdlet" }, { "key": "B", "text": "a Microsoft Endpoint Manager device configuration profile" }, { "key": "C", "text": "Deployment Center in Azure App Service" }, { "key": "D", "text": "a Desired State Configuration (DSC) extension" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. a Desired State Configuration (DSC) extension.\nWhen deploying Azure Virtual Machine Scale Sets (VMSS) using an Azure Resource Manager (ARM) template,", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 479, "pdfId": 479, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/479" }, "markersInGap": [ 478, 479 ], "questionText": "you need to ensure that NGINX is installed on all instances after deployment. The best way to automate\nsoftware installation and configuration in an ARM template is by using the Desired State Configuration (DSC)\nextension.\nYou have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web\nservers.\nYou have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.\nYou need to ensure that visitors are serviced by the same web server for each request.\nWhat should you configure?\n A.\nFloating IP (direct server return) to Disabled\nB.\nSession persistence to Client IP\nC.\nProtocol to UDP\nD.\nIdle Time-out (minutes) to 20", "stem": "you need to ensure that NGINX is installed on all instances after deployment. The best way to automate software installation and configuration in an ARM template is by using the Desired State Configuration (DSC) extension. You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure", "options": [ { "key": "A", "text": "Floating IP (direct server return) to Disabled" }, { "key": "B", "text": "Session persistence to Client IP" }, { "key": "C", "text": "Protocol to UDP" }, { "key": "D", "text": "Idle Time-out (minutes) to 20" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. Session persistence to Client IP.\nIn an Azure Load Balancer (LB1) scenario where multiple virtual machines (web servers) are serving traffic, we\nneed to ensure that a visitor is always connected to the same web server during their session.\nThis is achieved by Session Persistence, which ensures that traffic from the same client is routed to the same\nbackend VM.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 480, "pdfId": 480, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/480" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains 20 virtual machines, a network security group (NSG) named NSG1,\nand two virtual networks named VNET1 and VNET2 that are peered.\nYou plan to deploy an Azure Bastion Basic SKU host named Bastion1 to VNET1.\nYou need to configure NSG1 to allow inbound access to the virtual machines via Bastion1.\nWhich port should you configure for the inbound security rule?\nA.\n22\nB.\n443\nC.\n389\nD.\n8080", "stem": "You have an Azure subscription that contains 20 virtual machines, a network security group (NSG) named NSG1, and two virtual networks named VNET1 and VNET2 that are peered. You plan to deploy an Azure Bastion Basic SKU host named Bastion1 to VNET1. You need to configure NSG1 to allow inbound access to the virtual machines via Bastion1. Which port should you configure for the inbound security rule", "options": [ { "key": "A", "text": "22" }, { "key": "B", "text": "443" }, { "key": "C", "text": "389" }, { "key": "D", "text": "8080" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "443\nUsing Bastion your RDP/SSH session is over TLS on port 443.\nhttps://learn.microsoft.com/en-us/azure/bastion/bastion-overview", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 481, "pdfId": 481, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/481" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1) Obtain an IP address automatically\nThe first 4 IP addresses within a subnet space are getting reserved for Azure automatically. Thus, 10.0.1.3\ncan't be the right answer. 10.0.2.1 is in the VNET space but falls out of the subnet space. 192.168.2.1 is just out\nof the VNET.\n2) Configure VNET1 to use a custom DNS server\nThis VNET1 should use our pre-created DNS server as its DNS server so that the member servers in", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 482, "pdfId": 482, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/482" }, "markersInGap": [], "questionText": "contoso.com can resolve AD DS DNS names.\nhttps://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-\ninstances\nYou have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web\nservers.\nYou have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.\nYou need to ensure that visitors are serviced by the same web server for each request.\nWhat should you configure?\nA.\nSession persistence to None\nB.\na health probe\nC.\nSession persistence to Client IP\nD.\nIdle Time-out (minutes) to 20", "stem": "contoso.com can resolve AD DS DNS names. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role- instances You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure", "options": [ { "key": "A", "text": "Session persistence to None" }, { "key": "B", "text": "a health probe" }, { "key": "C", "text": "Session persistence to Client IP" }, { "key": "D", "text": "Idle Time-out (minutes) to 20" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Session persistence to Client IP.\nTraffic from the same client IP is routed to the same backend instance", "reference": "https://learn.microsoft.com/en-us/azure/load-balancer/distribution-mode-concepts", "references": [ "https://learn.microsoft.com/en-us/azure/load-balancer/distribution-mode-concepts" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 483, "pdfId": 483, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/483" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the virtual networks shown in the following table.\nYou need to deploy an Azure firewall named AF1 to RG1 in the West US Azure region.\nTo which virtual networks can you deploy AF1?\nA.\nVNET1, VNET2, VNET3, and VNET4\nB.\nVNET1 and VNET2 only\nC.\nVNET1 only\nD.\nVNET1, VNET2, and VNET4 only\nE.\nVNET1 and VNET4 only", "stem": "You have an Azure subscription that contains the virtual networks shown in the following table. You need to deploy an Azure firewall named AF1 to RG1 in the West US Azure region. To which virtual networks can you deploy AF1", "options": [ { "key": "A", "text": "VNET1, VNET2, VNET3, and VNET4" }, { "key": "B", "text": "VNET1 and VNET2 only" }, { "key": "C", "text": "VNET1 only" }, { "key": "D", "text": "VNET1, VNET2, and VNET4 only" }, { "key": "E", "text": "VNET1 and VNET4 only" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "VNET1 only.\nNo idea why people are saying option E as the question clearly states that \"You need to deploy an Azure\nfirewall named AF1 to RG1 in the West US\", so RG1 in the West US region means the correct answer is\nC(VNET1).\nAn Azure Firewall can protect a VNet in the same resource group, but it cannot directly protect a VNet in a\ndifferent resource group. This is because an Azure Firewall is deployed in a VNet and filters traffic entering\nand exiting that VNet. It cannot interact with resources in other resource groups.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 484, "pdfId": 484, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/484" }, "markersInGap": [ 483, 484 ], "questionText": "If you need to protect a VNet in a different resource group, you can use one of the following workarounds:\nVNet peering\nAzure Virtual WAN\nVPN\n You have an on-premises network.\nYou have an Azure subscription that contains three virtual networks named VNET1. VNET2. and VNET3. The virtual\nnetworks are peered and connected to the on-premises network. The subscription contains the virtual machines\nshown in the following table.\nYou need to monitor connectivity between the virtual machines and the on-premises network by using Connection\nMonitor.\nWhat is the minimum number of connection monitors you should deploy?\nA.\n1\nB.\n2\nC.\n3\nD.\n4", "stem": "If you need to protect a VNet in a different resource group, you can use one of the following workarounds: VNet peering Azure Virtual WAN VPN You have an on-premises network. You have an Azure subscription that contains three virtual networks named VNET1. VNET2. and VNET3. The virtual networks are peered and connected to the on-premises network. The subscription contains the virtual machines shown in the following table. You need to monitor connectivity between the virtual machines and the on-premises network by using Connection Monitor. What is the minimum number of connection monitors you should deploy", "options": [], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "The answer is B. 2 minimum connection monitors. The reason is you have on-premises network and\nAzure(Cloud) network. So, you need 2. This is nothing to do with the location: West US and Central US. This is a\ntrap! Someone people said it's to do with these 2 locations. f you only have 1 kind of network(Azure Cloud/on-\npremises, then you need minimum 1 connection monitor.\nConnection monitor resource: A region-specific Azure resource.\nhttps://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-create-using-portal#before-\nyou-begin", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": true } }, { "seq": 485, "pdfId": 485, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/485" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "NO, NO, NO.\nBox 1: instead of \"netname\" there should be the value of netname variable\nBox 2: I don't see Resource Group mentioned anywhere in the template\nBox 3: I don't see parameters being referred anywhere in the template, only variables are referred, e.g. \"sku\"\nvariable.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 486, "pdfId": 486, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/486" }, "markersInGap": [ 486 ], "questionText": "You have an Azure subscription that contains a storage account. The account stores website data.\nYou need to ensure that inbound user traffic uses the Microsoft point-of-presence (POP) closest to the user's\nlocation.\nWhat should you configure?\nA.\nprivate endpoints\n B.\nAzure Firewall rules\nC.\nRouting preference\nD.\nload balancing", "stem": "You have an Azure subscription that contains a storage account. The account stores website data. You need to ensure that inbound user traffic uses the Microsoft point-of-presence (POP) closest to the user's location. What should you configure", "options": [ { "key": "A", "text": "private endpoints" }, { "key": "B", "text": "Azure Firewall rules" }, { "key": "C", "text": "Routing preference" }, { "key": "D", "text": "load balancing" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C:Routing preference.\nRouting preference in Azure Traffic Manager allows you to specify how to route traffic to your Azure service\nendpoints based on various criteria, such as the geographic location of the client or the endpoint, the\nperformance of the endpoint, or the priority of the endpoint.\nBy configuring routing preference, you can direct incoming user traffic to the Microsoft point-of-presence\n(POP) closest to the user's location, ensuring the best possible user experience. This can be achieved by\nselecting the \"Performance\" routing method in Azure Traffic Manager, which uses DNS-based traffic routing\nto direct users to the endpoint that offers the best performance from the user's location.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 487, "pdfId": 487, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/487" }, "markersInGap": [], "questionText": "You have two Azure virtual machines named VM1 and VM2 that run Windows Server. The virtual machines are in a\nsubnet named Subnet1. Subnet1 is in a virtual network named VNet1.\nYou need to prevent VM1 from accessing VM2 on port 3389.\nWhat should you do?\nA.\nCreate a network security group (NSG) that has an outbound security rule to deny destination port 3389 and\napply the NSG to the network interface of VM1.\nB.\nConfigure Azure Bastion in VNet1.\nC.\nCreate a network security group (NSG) that has an outbound security rule to deny source port 3389 and\napply the NSG to Subnet1.\nD.\nCreate a network security group (NSG) that has an inbound security rule to deny source port 3389 and apply\nthe NSG to Subnet1.", "stem": "You have two Azure virtual machines named VM1 and VM2 that run Windows Server. The virtual machines are in a subnet named Subnet1. Subnet1 is in a virtual network named VNet1. You need to prevent VM1 from accessing VM2 on port 3389. What should you do", "options": [ { "key": "A", "text": "Create a network security group (NSG) that has an outbound security rule to deny destination port 3389 and apply the NSG to the network interface of VM1." }, { "key": "B", "text": "Configure Azure Bastion in VNet1." }, { "key": "C", "text": "Create a network security group (NSG) that has an outbound security rule to deny source port 3389 and apply the NSG to Subnet1." }, { "key": "D", "text": "Create a network security group (NSG) that has an inbound security rule to deny source port 3389 and apply the NSG to Subnet1." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. Create a network security group (NSG) that has an outbound security rule to deny destination port 3389\nand apply the NSG to the network interface of VM1.\nBy creating an outbound security rule in a network security group (NSG) to deny destination port 3389, you\ncan prevent VM1 from accessing port 3389 on VM2. By applying the NSG to the network interface of VM1, you\ncan enforce the security rule specifically for VM1.\nThis solution provides a centralized way to manage and enforce network security for VM1, and it helps to\nprevent unwanted access to port 3389 on VM2 from VM1.\nIf it was D. \"Create a network security group (NSG) that has an inbound security rule to deny source port 3389\nand apply the NSG to Subnet1\" you could prevent access to port 3389 on VM2 from ANY SOURCE (including\nVM1). By applying the NSG to Subnet1, you can apply the security rule to both VM1 and VM2.\nThe question asked \"to prevent VM1 from accessing VM2 on port 3389\", not from any source.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 488, "pdfId": 488, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/488" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\nYou need to manage outbound traffic from VNET1 by using Firewall1.\nWhat should you do first?\nA.\nConfigure the Hybrid Connection Manager.\nB.\nUpgrade ASP1 to the Premium SKU.\nC.\nCreate a route table.\nD.\nCreate an Azure Network Watcher.", "stem": "You have an Azure subscription that contains the resources shown in the following table. You need to manage outbound traffic from VNET1 by using Firewall1. What should you do first", "options": [ { "key": "A", "text": "Configure the Hybrid Connection Manager." }, { "key": "B", "text": "Upgrade ASP1 to the Premium SKU." }, { "key": "C", "text": "Create a route table." }, { "key": "D", "text": "Create an Azure Network Watcher." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Route all traffic to the firewall\nWhen you create a virtual network, Azure automatically creates a default route table for each of its subnets\nand adds system default routes to the table. In this step, you create a user-defined route table that routes all\ntraffic to the firewall, and then associate it with the App Service subnet in the integrated virtual network.\nSection3 in document.\nhttps://learn.microsoft.com/en-us/azure/app-service/network-secure-outbound-traffic-azure-firewall", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 489, "pdfId": 489, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/489" }, "markersInGap": [ 488, 489 ], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\nAll the resources connect to a virtual network named VNet1.\nYou plan to deploy an Azure Bastion host named Bastion1 to VNet1.\nWhich resources can be protected by using Bastion1?\n A.\nVM1 only\nB.\ncontoso.com only\nC.\nApp1 and contoso.com only\nD.\nVM1 and contoso.com only\nE.\nVM1, App1, and contoso.com", "stem": "You have an Azure subscription that contains the resources shown in the following table. All the resources connect to a virtual network named VNet1. You plan to deploy an Azure Bastion host named Bastion1 to VNet1. Which resources can be protected by using Bastion1", "options": [ { "key": "A", "text": "VM1 only" }, { "key": "B", "text": "contoso.com only" }, { "key": "C", "text": "App1 and contoso.com only" }, { "key": "D", "text": "VM1 and contoso.com only" }, { "key": "E", "text": "VM1, App1, and contoso.com" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Bastion provides secure RDP and SSH connectivity to all of the VMs in the virtual network in which it is\nprovisioned. Using Azure Bastion protects your virtual machines from exposing RDP/SSH ports to the outside\nworld, while still providing secure access using RDP/SSH.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 490, "pdfId": 490, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/490" }, "markersInGap": [], "questionText": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web\nservers.\nYou have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.\nYou need to ensure that visitors are serviced by the same web server for each request.\nWhat should you configure?\nA.\nSession persistence to None\nB.\na health probe\nC.\nSession persistence to Client IP and protocol\nD.\nIdle Time-out (minutes) to 20", "stem": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure", "options": [ { "key": "A", "text": "Session persistence to None" }, { "key": "B", "text": "a health probe" }, { "key": "C", "text": "Session persistence to Client IP and protocol" }, { "key": "D", "text": "Idle Time-out (minutes) to 20" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "https://learn.microsoft.com/en-us/azure/load-balancer/distribution-mode-concepts\nSession persistence: Client IP and protocol\nTraffic from the same client IP and protocol is routed to the same backend instance", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 491, "pdfId": 491, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/491" }, "markersInGap": [ 490, 491 ], "questionText": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web\nservers.\nYou have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.\nYou need to ensure that visitors are serviced by the same web server for each request.\nWhat should you configure?\nA.\na health probe\nB.\nFloating IP (direct server return) to Enabled\nC.\nSession persistence to Client IP and protocol\n D.\nProtocol to UDP", "stem": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure", "options": [ { "key": "A", "text": "a health probe" }, { "key": "B", "text": "Floating IP (direct server return) to Enabled" }, { "key": "C", "text": "Session persistence to Client IP and protocol" }, { "key": "D", "text": "Protocol to UDP" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C. Session persistence to Client IP and protocol.\nAzure Load Balancer distributes incoming traffic across multiple virtual machines. To ensure that visitors are\nconsistently directed to the same web server for each request, you need to configure session persistence\n(also known as \"sticky sessions\").\nSession persistence ensures that a client's requests are always sent to the same backend server for the\nduration of the session.\nThe \"Client IP and protocol\" option ensures that the same server handles requests from a client based on both\ntheir IP address and protocol.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 492, "pdfId": 492, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/492" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains 10 virtual machines and the resources shown in the following table.\nYou need to ensure that Bastion1 can support 100 concurrent SSH users. The solution must minimize administrative\neffort.\nWhat should you do first?\nA.\nResize the subnet of Bastion1\nB.\nConfigure host scaling.\nC.\nCreate a network security group (NSG)\nD.\nUpgrade Bastion1 to the Standard SKU", "stem": "You have an Azure subscription that contains 10 virtual machines and the resources shown in the following table. You need to ensure that Bastion1 can support 100 concurrent SSH users. The solution must minimize administrative effort. What should you do first", "options": [ { "key": "A", "text": "Resize the subnet of Bastion1" }, { "key": "B", "text": "Configure host scaling." }, { "key": "C", "text": "Create a network security group (NSG)" }, { "key": "D", "text": "Upgrade Bastion1 to the Standard SKU" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "https://learn.microsoft.com/en-us/azure/bastion/configuration-settings#instanceWhen you configure Azure\nBastion using the Basic SKU, two instances are created. If you use the Standard SKU, you can specify the\nnumber of instances. This is called host scaling.Each instance can support 20 concurrent RDP connections\nand 40 concurrent SSH connections for medium workloads. Once the concurrent sessions are exceeded, an\nadditional scale unit (instance) is required.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 493, "pdfId": 493, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/493" }, "markersInGap": [ 492, 493 ], "questionText": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web\nservers.\n You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.\nYou need to ensure that visitors are serviced by the same web server for each request.\nWhat should you configure?\nA.\nSession persistence to Client IP and protocol\nB.\nProtocol to UDP\nC.\nSession persistence to None\nD.\nFloating IP (direct server return) to Disabled", "stem": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure", "options": [ { "key": "A", "text": "Session persistence to Client IP and protocol" }, { "key": "B", "text": "Protocol to UDP" }, { "key": "C", "text": "Session persistence to None" }, { "key": "D", "text": "Floating IP (direct server return) to Disabled" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. Session persistence to Client IP and protocol.\nAzure Load Balancer distributes traffic among backend virtual machines (VMs). To ensure that each visitor's\nrequests go to the same web server, you need to enable session persistence (also known as \"sticky sessions\").\n\"Client IP and protocol\" session persistence ensures that requests from a specific client IP always go to the\nsame backend VM, as long as the session is active.\nThis helps maintain user sessions, especially for applications that rely on stateful data, such as shopping carts\nor login sessions.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 494, "pdfId": 494, "exam": "AZ-104", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/494" }, "markersInGap": [ 494 ], "questionText": "DRAG DROP\n-\nYou have a Windows 11 device named Device and an Azure subscription that contains the resources shown in the\nfollowing table.\nDevice1 has Azure PowerShell and Azure Command-Line Interface (CLI) installed.\nFrom Device1, you need to establish a Remote Desktop connection to VM1.\nWhich three actions should you perform in sequence? To answer, move the appropriate actions from the list of\nactions to the answer area and arrange them in the correct order.", "stem": "You have a Windows 11 device named Device and an Azure subscription that contains the resources shown in the following table. Device1 has Azure PowerShell and Azure Command-Line Interface (CLI) installed. From Device1, you need to establish a Remote Desktop connection to VM1. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1.\nUpgrade Bastion1 to the Standard SKU.\nAzure Bastion offers two SKUs: Basic and Standard.\nNative Client Support is available only in the Standard SKU, so you must upgrade Bastion1 if it's running on\nthe Basic SKU.\nThis is a mandatory prerequisite before enabling Native Client Support.\n2.\nFrom Bastion 1,Select Native Client Support.\nAfter upgrading, you must enable Native Client Support in the Azure Bastion settings.\nThis allows users to connect using tools like mstsc.exe (Microsoft's RDP client) instead of the browser-based\nAzure portal.\n3.\nFrom Azure CLI on Device1,run az network bastion rdp.\nOnce Native Client Support is enabled, you can connect using Azure CLI with the following command:\nsh\nCopy\nEdit\naz network bastion rdp --name Bastion1 --resource-group MyResourceGroup --target-ip VM-IP-Address\nThis command starts an RDP connection to the target VM using Azure Bastion and the native RDP client\n(mstsc.exe).", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 495, "pdfId": 495, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/495" }, "markersInGap": [], "questionText": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web\nservers.\nYou have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.\nYou need to ensure that visitors are serviced by the same web server for each request.\nWhat should you configure?\nA.\nFloating IP (direct server return) to Enabled\nB.\nSession persistence to Client IP\nC.\nProtocol to UDP\nD.\nIdle Time-out (minutes) to 20", "stem": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure", "options": [ { "key": "A", "text": "Floating IP (direct server return) to Enabled" }, { "key": "B", "text": "Session persistence to Client IP" }, { "key": "C", "text": "Protocol to UDP" }, { "key": "D", "text": "Idle Time-out (minutes) to 20" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. Session persistence to Client IP.To ensure that visitors are serviced by the same web server for each\nrequest, we need to configure session persistence on the Azure load balancer. Session persistence is also\nknown as affinity, and it ensures that all requests from a client are sent to the same backend server. This is\nimportant for applications that maintain session state, such as web applications that require authentication or\nshopping carts.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 496, "pdfId": 496, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/496" }, "markersInGap": [], "questionText": "You have an Azure subscription that has the public IP addresses shown in the following table.\nYou plan to deploy an Azure Bastion Basic SKU host named Bastion1.\nWhich IP addresses can you use?\nA.\nIP1 only\nB.\nIP1 and IP2 only\nC.\nIP3, IP4, and IP5 only\nD.\nIP1, IP2, IP4, and IP5 only\nE.\nIP1, IP2, IP3, IP4, and IP5", "stem": "You have an Azure subscription that has the public IP addresses shown in the following table. You plan to deploy an Azure Bastion Basic SKU host named Bastion1. Which IP addresses can you use", "options": [ { "key": "A", "text": "IP1 only" }, { "key": "B", "text": "IP1 and IP2 only" }, { "key": "C", "text": "IP3, IP4, and IP5 only" }, { "key": "D", "text": "IP1, IP2, IP4, and IP5 only" }, { "key": "E", "text": "IP1, IP2, IP3, IP4, and IP5" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. IP1 only.\nAzure Bastion requires a Standard SKU public IP address, and the public IP address must be static and\nregional.\nLooking at the provided table:\nIP1: Standard SKU, regional, static (meets all the requirements for Azure Bastion Basic SKU).\nIP2: Standard SKU, global, static (global tier is not supported for Bastion, only regional tier is allowed).", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 497, "pdfId": 497, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/497" }, "markersInGap": [], "questionText": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web\nservers.\nYou have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.\nYou need to ensure that visitors are serviced by the same web server for each request.\nWhat should you configure?\nA.\nFloating IP (direct server return) to Disabled\nB.\nFloating IP (direct server return) to Enabled\nC.\na health probe\nD.\nSession persistence to Client IP", "stem": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure", "options": [ { "key": "A", "text": "Floating IP (direct server return) to Disabled" }, { "key": "B", "text": "Floating IP (direct server return) to Enabled" }, { "key": "C", "text": "a health probe" }, { "key": "D", "text": "Session persistence to Client IP" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. Session persistence to Client IP.\nAzure Load Balancer distributes traffic among backend virtual machines (VMs) to ensure availability and\nscalability. However, to ensure that each visitor is always serviced by the same web server for each request,", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 498, "pdfId": 498, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/498" }, "markersInGap": [ 497, 498 ], "questionText": "you need to configure session persistence (also known as \"sticky sessions\").\nSession Persistence (Client IP):\nThis setting ensures that all requests from the same client IP address are routed to the same backend VM.\nThis is useful for stateful applications, such as web applications that store session data on the server.\nYou have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web\nservers.\nYou have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.\nYou need to ensure that visitors are serviced by the same web server for each request.\nWhat should you configure?\nA.\nFloating IP (direct server return) to Enabled\nB.\nIdle Time-out (minutes) to 20\n C.\na health probe\nD.\nSession persistence to Client IP", "stem": "you need to configure session persistence (also known as \"sticky sessions\"). Session Persistence (Client IP): This setting ensures that all requests from the same client IP address are routed to the same backend VM. This is useful for stateful applications, such as web applications that store session data on the server. You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure", "options": [ { "key": "A", "text": "Floating IP (direct server return) to Enabled" }, { "key": "B", "text": "Idle Time-out (minutes) to 20" }, { "key": "C", "text": "a health probe" }, { "key": "D", "text": "Session persistence to Client IP" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. Session persistence to Client IP.\nAzure Load Balancer distributes incoming traffic among multiple virtual machines (VMs). If you need to ensure\nthat each visitor is serviced by the same web server for each request, you must enable session persistence\n(also called sticky sessions).\nSession Persistence (Client IP):\nEnsures that requests from the same client IP address are routed to the same backend VM.\nThis is especially useful for stateful applications that store session data on a specific server.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 499, "pdfId": 499, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/499" }, "markersInGap": [], "questionText": "You have two Azure subscriptions named Sub1 and Sub2.\nSub1 contains a virtual machine named VM1 and a storage account named storage1.\nVM1 is associated to the resources shown in the following table.\nYou need to move VM1 to Sub2.\nWhich resources should you move to Sub2?\nA.\nVM1, Disk1, and NetInt1 only\nB.\nVM1, Disk1, and VNet1 only\nC.\nVM1, Disk1, and storage1 only\nD.\nVM1, Disk1, NetInt1, and VNet1", "stem": "You have two Azure subscriptions named Sub1 and Sub2. Sub1 contains a virtual machine named VM1 and a storage account named storage1. VM1 is associated to the resources shown in the following table. You need to move VM1 to Sub2. Which resources should you move to Sub2", "options": [ { "key": "A", "text": "VM1, Disk1, and NetInt1 only" }, { "key": "B", "text": "VM1, Disk1, and VNet1 only" }, { "key": "C", "text": "VM1, Disk1, and storage1 only" }, { "key": "D", "text": "VM1, Disk1, NetInt1, and VNet1" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "When you move a virtual machine from one subscription to another, you need to ensure that all the dependent\nresources are also moved along with it.In the given scenario, VM1 is associated with the resources Disk1 (OS\nDisk), NetInt1 (Network Interface), and VNet1 (Virtual Network), and the storage account named storage1 is\nnot associated with VM1.Therefore, to move VM1 to Sub2, you need to move the following resources:VM1: This\nis the virtual machine that you want to move to Sub2.Disk1: This is the OS disk for VM1, and it contains the\noperating system and boot files.NetInt1: This is the network interface that is attached to VM1 and provides\nconnectivity to the virtual network.VNet1: This is the virtual network that is associated with VM1, and it\nprovides the network connectivity to the virtual machine.\nYou have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web\nservers.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 500, "pdfId": 500, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/500" }, "markersInGap": [], "questionText": "You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.\nYou need to ensure that visitors are serviced by the same web server for each request.\nWhat should you configure?\nA.\nSession persistence to Client IP and protocol\nB.\nIdle Time-out (minutes) to 20\nC.\nSession persistence to None\nD.\nFloating IP (direct server return) to Enabled", "stem": "You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure", "options": [ { "key": "A", "text": "Session persistence to Client IP and protocol" }, { "key": "B", "text": "Idle Time-out (minutes) to 20" }, { "key": "C", "text": "Session persistence to None" }, { "key": "D", "text": "Floating IP (direct server return) to Enabled" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. Session persistence to Client IP and protocol.\nAzure Load Balancer distributes incoming traffic among multiple virtual machines (VMs). If you want each\nvisitor to be serviced by the same web server for each request, you must enable session persistence (also\nknown as sticky sessions).\nSession Persistence (Client IP and protocol)\nEnsures that all requests from the same client IP address and protocol (TCP/UDP) are routed to the same\nbackend VM.\nThis is useful for stateful applications that store session data on a specific server.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 501, "pdfId": 501, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/501" }, "markersInGap": [], "questionText": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web\nservers.\nYou have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.\nYou need to ensure that visitors are serviced by the same web server for each request.\nWhat should you configure?\nA.\nFloating IP (direct server return) to Disabled\nB.\nIdle Time-out (minutes) to 20\nC.\na health probe\nD.\nSession persistence to Client IP", "stem": "You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure", "options": [ { "key": "A", "text": "Floating IP (direct server return) to Disabled" }, { "key": "B", "text": "Idle Time-out (minutes) to 20" }, { "key": "C", "text": "a health probe" }, { "key": "D", "text": "Session persistence to Client IP" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. Session persistence to Client IP.\nAzure Load Balancer distributes incoming traffic among multiple backend virtual machines (VMs). If you want", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 502, "pdfId": 502, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/502" }, "markersInGap": [], "questionText": "each visitor to be serviced by the same web server for each request, you must enable session persistence\n(also known as sticky sessions).\nSession Persistence (Client IP)\nEnsures that requests from the same client IP are always routed to the same backend VM.\nThis is useful for applications that rely on maintaining user sessions, such as web applications with shopping\ncarts, user authentication, or other stateful interactions.\nYou have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web\nservers.\nYou have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.\nYou need to ensure that visitors are serviced by the same web server for each request.\nWhat should you configure?\nA.\nSession persistence to Client IP\nB.\nIdle Time-out (minutes) to 20\nC.\nSession persistence to None\nD.\nProtocol to UDP", "stem": "each visitor to be serviced by the same web server for each request, you must enable session persistence (also known as sticky sessions). Session Persistence (Client IP) Ensures that requests from the same client IP are always routed to the same backend VM. This is useful for applications that rely on maintaining user sessions, such as web applications with shopping carts, user authentication, or other stateful interactions. You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure", "options": [ { "key": "A", "text": "Session persistence to Client IP" }, { "key": "B", "text": "Idle Time-out (minutes) to 20" }, { "key": "C", "text": "Session persistence to None" }, { "key": "D", "text": "Protocol to UDP" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. Session persistence to Client IP.\nAzure Load Balancer distributes incoming traffic among multiple backend virtual machines (VMs). If you need\nto ensure that each visitor is always serviced by the same web server for each request, you must enable\nsession persistence (also known as sticky sessions).\nSession Persistence (Client IP)\nEnsures that requests from the same client IP are always routed to the same backend VM.\nThis is essential for applications that rely on maintaining user sessions, such as shopping carts, user\nauthentication, or other stateful interactions.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 503, "pdfId": 503, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/503" }, "markersInGap": [ 502, 503 ], "questionText": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set\nby using an Azure Resource Manager template.\nYou need to ensure that NGINX is available on all the virtual machines after they are deployed.\nWhat should you use?\nA.\nthe Publish-AzVMDscConfiguration cmdlet\nB.\na Microsoft Endpoint Manager device configuration profile\n C.\nAzure Application Insights\nD.\na Desired State Configuration (DSC) extension", "stem": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource Manager template. You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use", "options": [ { "key": "A", "text": "the Publish-AzVMDscConfiguration cmdlet" }, { "key": "B", "text": "a Microsoft Endpoint Manager device configuration profile" }, { "key": "C", "text": "Azure Application Insights" }, { "key": "D", "text": "a Desired State Configuration (DSC) extension" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "A. the Publish-AzVMDscConfiguration cmdlet\n\n❌\n Incorrect.\nThis cmdlet is used to upload DSC configurations to Azure, but it does not by itself ensure the configuration is\napplied to virtual machines.\nB. a Microsoft Endpoint Manager device configuration profile\n\n❌\n Incorrect.\nEndpoint Manager is used for managing devices, not for configuring software like NGINX on Azure VMs\nduring deployment.\nC. Azure Application Insights\n\n❌\n Incorrect.\nApplication Insights is used for monitoring and telemetry, not for installing or configuring software.\nD. a Desired State Configuration (DSC) extension\n\n✅\n Correct.\nThe DSC extension can be applied to virtual machines in a scale set to ensure that required software (like\nNGINX) is installed and configured automatically after deployment, maintaining the desired state across all\ninstances.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 504, "pdfId": 504, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/504" }, "markersInGap": [], "questionText": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set\nby using an Azure Resource Manager template.\nYou need to ensure that NGINX is available on all the virtual machines after they are deployed.\nWhat should you use?\nA.\nAzure Custom Script Extension\nB.\nDeployment Center in Azure App Service\nC.\nthe New-AzConfigurationAssignment cmdlet\nD.\na Microsoft Endpoint Manager device configuration profile", "stem": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource Manager template. You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use", "options": [ { "key": "A", "text": "Azure Custom Script Extension" }, { "key": "B", "text": "Deployment Center in Azure App Service" }, { "key": "C", "text": "the New-AzConfigurationAssignment cmdlet" }, { "key": "D", "text": "a Microsoft Endpoint Manager device configuration profile" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. Azure Custom Script Extension.\nThe Azure Custom Script Extension allows you to run scripts on Azure virtual machines after they are\ndeployed. You can use this to install and configure software like NGINX on all virtual machines in a virtual\nmachine scale set. By specifying a script that installs NGINX in the template, it ensures that the software is\navailable on all the virtual machines after deployment.\nYou have an Azure subscription that contains a Recovery Services vault named Vault1.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 505, "pdfId": 505, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/505" }, "markersInGap": [], "questionText": "You need to enable multi-user authorization (MAU) for Vault1.\nWhich resource should you create first?\nA.\nan administrative unit\nB.\na managed identity\nC.\na resource guard\nD.\na custom Azure role", "stem": "You need to enable multi-user authorization (MAU) for Vault1. Which resource should you create first", "options": [ { "key": "A", "text": "an administrative unit" }, { "key": "B", "text": "a managed identity" }, { "key": "C", "text": "a resource guard" }, { "key": "D", "text": "a custom Azure role" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "https://learn.microsoft.com/en-us/azure/backup/multi-user-authorization?tabs=azure-portal&pivots=vaults-\nrecovery-services-vaultBefore you startTesting scenariosCreate a Resource GuardEnable MUA on a Recovery\nServices vaultProtected operations on a vault using MUAAuthorize critical operations on a vaultDisable MUA\non a Recovery Services vault", "reference": null, "references": [], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 506, "pdfId": 506, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/506" }, "markersInGap": [ 506 ], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to\nApp1 are managed by using an Azure Load Balancer.\nThe effective network security configurations for VM2 are shown in the following exhibit.\nYou discover that connections to App1 from 131.107.100.50 over TCP port 443 fail.\nYou verify that the Load Balancer rules are configured correctly.\nYou need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port\n443.\n Solution: You create an inbound security rule that allows any traffic from the AzureLoadBalancer source and has a\npriority of 150.\nDoes this meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer. The effective network security configurations for VM2 are shown in the following exhibit. You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail. You verify that the Load Balancer rules are configured correctly. You need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port 443. Solution: You create an inbound security rule that allows any traffic from the AzureLoadBalancer source and has a priority of 150. Does this meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. Yes\nCreating an inbound security rule that allows any traffic from the Azure Load Balancer source with a priority\nof 150 will enable the connections to App1 from the Load Balancer, which is necessary for routing traffic to\nVM2. Since the Load Balancer forwards traffic to the VMs, this rule will help ensure that connections over TCP\nport 443 from the specified IP address can be established successfully.\nYour on-premises network contains a VPN gateway.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 507, "pdfId": 507, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/507" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the resources shown in the following table.\nYou need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network.\nWhat should you configure?\nA.\nAzure Application Gateway\nB.\nservice endpoints\nC.\nAzure AD Application Proxy\nD.\nAzure Virtual WAN", "stem": "You have an Azure subscription that contains the resources shown in the following table. You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network. What should you configure", "options": [ { "key": "A", "text": "Azure Application Gateway" }, { "key": "B", "text": "service endpoints" }, { "key": "C", "text": "Azure AD Application Proxy" }, { "key": "D", "text": "Azure Virtual WAN" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview\"Virtual\nNetwork (VNet) service endpoint provides secure and direct connectivity to Azure services over an optimized\nroute over the Azure backbone network. Endpoints allow you to secure your critical Azure service resources to\nonly your virtual networks. Service Endpoints enables private IP addresses in the VNet to reach the endpoint\nof an Azure service without needing a public IP address on the VNet.\"\nYou create an Azure VM named VM1 that runs Windows Server 2019.\nVM1 is configured as shown in the exhibit. (Click the Exhibit tab.)", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 508, "pdfId": 508, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/508" }, "markersInGap": [], "questionText": "You need to enable Desired State Configuration for VM1.\nWhat should you do first?\nA.\nConnect to VM1.\nB.\nStart VM1.\nC.\nCapture a snapshot of VM1.\nD.\nConfigure a DNS name for VM1.", "stem": "You need to enable Desired State Configuration for VM1. What should you do first", "options": [ { "key": "A", "text": "Connect to VM1." }, { "key": "B", "text": "Start VM1." }, { "key": "C", "text": "Capture a snapshot of VM1." }, { "key": "D", "text": "Configure a DNS name for VM1." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. Start VM1.\nDesired State Configuration (DSC) is a feature of Windows PowerShell that enables you to manage and\nconfigure systems in a consistent way. To use DSC, the virtual machine (VM1 in this case) needs to be running.\nIf the VM is not started, you cannot apply any DSC configurations to it.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 509, "pdfId": 509, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/509" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "VNet3 only: Indicates that only VNet3 should be used for the configuration.\n/23: This subnet mask allows for 512 IP addresses. It is suitable for medium-sized networks.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 510, "pdfId": 510, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/510" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the virtual networks shown in the following table.\nAll the virtual networks are peered. Each virtual network contains nine virtual machines.\nYou need to configure secure RDP connections to the virtual machines by using Azure Bastion.\nWhat is the minimum number of Bastion hosts required?\nA.\n1\nB.\n3\nC.\n9\nD.\n10", "stem": "You have an Azure subscription that contains the virtual networks shown in the following table. All the virtual networks are peered. Each virtual network contains nine virtual machines. You need to configure secure RDP connections to the virtual machines by using Azure Bastion. What is the minimum number of Bastion hosts required", "options": [ { "key": "D", "text": "10" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Answer : 1.\nAzure Bastion and VNet peering can be used together.\nWhen VNet peering is configured, you don’t have to deploy Azure Bastion in each peered VNet. This means if\nyou have an Azure Bastion host configured in one virtual network (VNet), it can be used to connect to VMs\ndeployed in a peered VNet without deploying an additional bastion host.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 511, "pdfId": 511, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/511" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "The Remote Desktop Connection client (mstsc.exe) can be used to connect to VM1 through Bastion1.\nNo\nAzure Bastion provides secure and seamless RDP (Remote Desktop Protocol) connectivity to your VMs\ndirectly from the Azure portal. If VM1 is configured to allow RDP connections and Bastion1 is properly set up,\nyou can use the Remote Desktop Connection client (mstsc.exe) to connect to VM1 through Bastion1. This\nmethod leverages Bastion's secure tunnel to establish the connection without exposing the VM to the public\ninternet.\nThe Azure portal can use SSH to connect to VM2 through Bastion1.\nYes\nAzure Bastion also supports SSH (Secure Shell) connections. If VM2 is configured to allow SSH connections\nand Bastion1 is set up correctly, you can use the Azure portal to initiate an SSH session to VM2 through\nBastion1. This provides a secure way to manage your VM using command-line tools without needing a public IP\naddress on the VM.\nThe Azure portal can be used to connect to VM3 through Bastion1.\nNo\nAzure Bastion allows you to connect to VMs directly from the Azure portal using either RDP or SSH,\ndepending on the VM's configuration. If VM3 is set up to allow connections through Bastion1, you can use the\nAzure portal to connect to VM3 using the appropriate protocol (RDP or SSH). This simplifies the process of\naccessing your VMs securely without the need for additional client software.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 512, "pdfId": 512, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/512" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Yes\nVirtual networks must be in the same region as the service endpoint policyhttps://learn.microsoft.com/en-\nus/azure/virtual-network/virtual-network-service-endpoint-policies-overview#limitations\nBox 2: No\nVNet2 is in SEA Region, so it can only connect to the stoa cc in SEA Region through Service Endpoint, which is\nstorage3\nBox 3: Yes\nVNet3 is in the South Central US region, and so is the storage2", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 513, "pdfId": 513, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/513" }, "markersInGap": [ 513 ], "questionText": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set\nby using an Azure Resource Manager template.\nYou need to ensure that NGINX is available on all the virtual machines after they are deployed.\nWhat should you use?\n A.\nthe New-AzConfigurationAssignment cmdlet\nB.\nAzure Application Insights\nC.\nthe Publish-AzVMDscConfiguration cmdlet\nD.\na Desired State Configuration (DSC) extension", "stem": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource Manager template. You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use", "options": [ { "key": "A", "text": "the New-AzConfigurationAssignment cmdlet" }, { "key": "B", "text": "Azure Application Insights" }, { "key": "C", "text": "the Publish-AzVMDscConfiguration cmdlet" }, { "key": "D", "text": "a Desired State Configuration (DSC) extension" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. a Desired State Configuration (DSC) extension.\nDesired State Configuration (DSC) is a configuration management platform in PowerShell that ensures that\nthe configuration of a system (in this case, an Azure virtual machine) remains consistent. Using the DSC\nextension for Azure VMs allows you to apply DSC configurations to all the virtual machines in your virtual\nmachine scale set, ensuring that NGINX is installed and configured after deployment.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 514, "pdfId": 514, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/514" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains a resource group named RG1 and a virtual network named VNet1.\nYou plan to create an Azure container instance named container1.\nYou need to be able to configure DNS name label scope reuse for container1.\nWhat should you configure for container1?\nA.\nthe private networking type\nB.\nthe public networking type\nC.\na new subnet on VNet1\nD.\na confidential SKU", "stem": "You have an Azure subscription that contains a resource group named RG1 and a virtual network named VNet1. You plan to create an Azure container instance named container1. You need to be able to configure DNS name label scope reuse for container1. What should you configure for container1", "options": [ { "key": "A", "text": "the private networking type" }, { "key": "B", "text": "the public networking type" }, { "key": "C", "text": "a new subnet on VNet1" }, { "key": "D", "text": "a confidential SKU" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "For Azure portal users, you can set the DNS name reuse policy on the Networking tab during the container\ninstance creation process using the DNS name label scope reuse field.Available after choosing public network\ntype\nhttps://learn.microsoft.com/en-us/azure/container-instances/how-to-reuse-dns-names#create-a-container-\ninstance", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 515, "pdfId": 515, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/515" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "NYN is a correct answer.\nStatement 1: From VM1, server1.contoso.com resolves to 131.107.3.3.\nVM1 in VNET1 uses the Azure-provided DNS, which does not reference the DNS records on VM4.\nResult: No.\nStatement 2: From VM2, server1.contoso.com resolves to 131.107.3.3.\nVM2 in VNET2 uses a custom DNS (192.168.0.5), which points to VM4's DNS server.\nVM4's DNS contains a record for server1.contoso.com resolving to 131.107.3.3.\nResult: Yes.\nStatement 3: From VM3, server2.contoso.com resolves to 131.107.2.4.\nVM3 in VNET3 uses a custom DNS (192.168.0.5), which points to VM4's DNS server.\nVM4's DNS contains a record for server2.contoso.com, but it resolves to 131.107.3.4, not 131.107.2.4.\nResult: No.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 516, "pdfId": 516, "exam": "AZ-104", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/516" }, "markersInGap": [ 516 ], "questionText": "DRAG DROP\n-\nYou have an Azure subscription that contains a resource group named RG1.\nYou plan to create an Azure Resource Manager (ARM) template to deploy a new virtual machine named VM1. VM1\nmust support the capture of performance data.\nYou need to specify resource dependencies for the ARM template.\nIn which order should you deploy the resources? To answer, move all resources from the list of resources to the\nanswer area and arrange them in the correct order.", "stem": "You have an Azure subscription that contains a resource group named RG1. You plan to create an Azure Resource Manager (ARM) template to deploy a new virtual machine named VM1. VM1 must support the capture of performance data. You need to specify resource dependencies for the ARM template. In which order should you deploy the resources? To answer, move all resources from the list of resources to the answer area and arrange them in the correct order.", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Virtual Network (VNet).\nA virtual network in Azure is a logically isolated section of the Azure cloud where you can launch and manage\nAzure resources. It allows you to securely connect Azure resources to each other, the internet, and on-\npremises networks. Key features include subnets, network security groups (NSGs), and custom DNS settings.\nNetwork Interface (NIC).\nA network interface in Azure is a communication link between a virtual machine (VM) and a virtual network. It\nallows the VM to interact with other resources within the same VNet, other VNets, and external networks.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 517, "pdfId": 517, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/517" }, "markersInGap": [], "questionText": "Each VM can have one or more network interfaces, each with its own private IP address and associated\nconfigurations.\nVirtual Machine (VM).\nA virtual machine in Azure is a scalable, on-demand computing resource provided by Microsoft. VMs can run\nvarious operating systems and applications, and they can be customized with different sizes, storage options,\nand networking configurations. VMs are commonly used for hosting applications, development and testing\nenvironments, and more.\nAzure Monitor Extension.\nThe Azure Monitor extension is a tool that collects and analyzes telemetry data from Azure resources,\nincluding VMs. It provides insights into the performance, availability, and health of your applications and\ninfrastructure. The extension can be installed on VMs to gather metrics, logs, and other diagnostic data, which\ncan be used for monitoring, alerting, and troubleshooting.\nYou plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set\nby using an Azure Resource Manager template.\nYou need to ensure that NGINX is available on all the virtual machines after they are deployed.\nWhat should you use?\nA.\na Desired State Configuration (DSC) extension\nB.\na Microsoft Intune device configuration profile\nC.\nthe Publish-AzVMDscConfiguration cmdlet\nD.\nthe New-AzConfigurationAssignment cmdlet", "stem": "Each VM can have one or more network interfaces, each with its own private IP address and associated configurations. Virtual Machine (VM). A virtual machine in Azure is a scalable, on-demand computing resource provided by Microsoft. VMs can run various operating systems and applications, and they can be customized with different sizes, storage options, and networking configurations. VMs are commonly used for hosting applications, development and testing environments, and more. Azure Monitor Extension. The Azure Monitor extension is a tool that collects and analyzes telemetry data from Azure resources, including VMs. It provides insights into the performance, availability, and health of your applications and infrastructure. The extension can be installed on VMs to gather metrics, logs, and other diagnostic data, which can be used for monitoring, alerting, and troubleshooting. You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource Manager template. You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use", "options": [ { "key": "A", "text": "a Desired State Configuration (DSC) extension" }, { "key": "B", "text": "a Microsoft Intune device configuration profile" }, { "key": "C", "text": "the Publish-AzVMDscConfiguration cmdlet" }, { "key": "D", "text": "the New-AzConfigurationAssignment cmdlet" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. a Desired State Configuration (DSC) extension.\nDesired State Configuration (DSC) extension is the most suitable tool to ensure that NGINX is available on all\nthe virtual machines in the scale set after deployment. DSC allows you to define the configuration of your\nvirtual machines, including software installation (like NGINX), and ensures that the configuration is\nmaintained across all VMs in the scale set.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 518, "pdfId": 518, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/518" }, "markersInGap": [ 517, 518 ], "questionText": "You have an Azure subscription that contains the virtual networks shown in the following table.\nThe subscription contains the virtual machines shown in the following table.\n All the virtual machines have only private IP addresses.\nYou deploy an Azure Bastion host named Bastion1 to VNet1.\nTo which virtual machines can you connect through Bastion1?\nA.\nVM1 only\nB.\nVM1 and VM2 only\nC.\nVM1 and VM3 only\nD.\nVM1, VM2, and VM3", "stem": "You have an Azure subscription that contains the virtual networks shown in the following table. The subscription contains the virtual machines shown in the following table. All the virtual machines have only private IP addresses. You deploy an Azure Bastion host named Bastion1 to VNet1. To which virtual machines can you connect through Bastion1", "options": [ { "key": "A", "text": "VM1 only" }, { "key": "B", "text": "VM1 and VM2 only" }, { "key": "C", "text": "VM1 and VM3 only" }, { "key": "D", "text": "VM1, VM2, and VM3" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B (VM1 and VM2) because Bastion is deployed to VNEt1, which is peered with VNet2.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 519, "pdfId": 519, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/519" }, "markersInGap": [], "questionText": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set\nby using an Azure Resource Manager template.\nYou need to ensure that NGINX is available on all the virtual machines after they are deployed.\nWhat should you use?\nA.\na Microsoft Intune device configuration profile\nB.\na Desired State Configuration (DSC) extension\nC.\nAzure Application Insights\nD.\nDeployment Center in Azure App Service", "stem": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource Manager template. You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use", "options": [ { "key": "A", "text": "a Microsoft Intune device configuration profile" }, { "key": "B", "text": "a Desired State Configuration (DSC) extension" }, { "key": "C", "text": "Azure Application Insights" }, { "key": "D", "text": "Deployment Center in Azure App Service" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "B. a Desired State Configuration (DSC) extension.\nDesired State Configuration (DSC) is a PowerShell-based configuration management platform that ensures a\nmachine's configuration is maintained consistently. Using the DSC extension on Azure virtual machines, you\ncan specify configurations like software installations (e.g., NGINX) and ensure that those configurations are\napplied and maintained across all virtual machines in a scale set.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 520, "pdfId": 520, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/520" }, "markersInGap": [], "questionText": "You have an Azure subscription.\nYou plan to migrate 50 virtual machines from VMware vSphere to the subscription.\nYou create a Recovery Services vault.\nWhat should you do next?\nA.\nConfigure an extended network.\nB.\nCreate a recovery plan.\nC.\nDeploy an Open Virtualization Application (OVA) template to vSphere.\nD.\nConfigure a virtual network.", "stem": "You have an Azure subscription. You plan to migrate 50 virtual machines from VMware vSphere to the subscription. You create a Recovery Services vault. What should you do next", "options": [ { "key": "A", "text": "Configure an extended network." }, { "key": "B", "text": "Create a recovery plan." }, { "key": "C", "text": "Deploy an Open Virtualization Application (OVA) template to vSphere." }, { "key": "D", "text": "Configure a virtual network." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. Configure a virtual network.\nTo migrate virtual machines (VMs) from VMware vSphere to Azure, you need to ensure that the target Azure\nenvironment is set up with a virtual network. The virtual machines that will be migrated will need to connect to\na virtual network in Azure once they are migrated, so it's essential to configure that network ahead of the\nmigration process.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 521, "pdfId": 521, "exam": "AZ-104", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/521" }, "markersInGap": [ 520, 521 ], "questionText": "HOTSPOT\n-\nYou have an Azure subscription that contains the virtual networks shown in the following table.\nEach virtual network has 50 connected virtual machines.\nYou need to implement Azure Bastion. The solution must meet the fallowing requirements:\n•Support host scaling.\n•Support uploading and downloading files.\n•Support the virtual machines on both VNet1 and VNet2.\n•Minimize the number of addresses on the Azure Bastion subnet.\nHow should you configure Azure Bastion? To answer, select the options in the answer area.\n NOTE: Each correct answer is worth one point.", "stem": "You have an Azure subscription that contains the virtual networks shown in the following table. Each virtual network has 50 connected virtual machines. You need to implement Azure Bastion. The solution must meet the fallowing requirements: •Support host scaling. •Support uploading and downloading files. •Support the virtual machines on both VNet1 and VNet2. •Minimize the number of addresses on the Azure Bastion subnet. How should you configure Azure Bastion? To answer, select the options in the answer area. NOTE: Each correct answer is worth one point.", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Subnet size: /26The recommended subnet size for Azure Bastion is /26\"Subnet size must be /26 or larger (/25,\n/24 etc.).\"\"For host scaling, a /26 or larger subnet is recommended. Using a smaller subnet space limits the\nnumber of scale units\"\"For Azure Bastion resources deployed on or after November 2, 2021, the minimum\nAzureBastionSubnet size is /26 or larger (/25, /24, etc.)\"\nPublic IP: Standard SKU with a static allocation Only Azure Bastion Standard SKU supports 'Host scaling' and\n'Upload or download files'. Besides that, Public IP address recomended by Microsoft must be Standard and\nStatic\nReferences:\nhttps://learn.microsoft.com/en-us/azure/bastion/configuration-settingshttps://learn.microsoft.com/en-\nus/azure/bastion/bastion-faq", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 522, "pdfId": 522, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/522" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains the virtual networks shown in the following table.\nYou need to ensure that all the traffic between VNet1 and VNet2 traverses the Microsoft backbone network.\nWhat should you configure?\nA.\na private endpoint\nB.\npeering\nC.\nExpress Route\nD.\na route table", "stem": "You have an Azure subscription that contains the virtual networks shown in the following table. You need to ensure that all the traffic between VNet1 and VNet2 traverses the Microsoft backbone network. What should you configure", "options": [ { "key": "A", "text": "a private endpoint" }, { "key": "B", "text": "peering" }, { "key": "C", "text": "Express Route" }, { "key": "D", "text": "a route table" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "The traffic between virtual machines in peered virtual networks uses the Microsoft backbone infrastructure.\nExpressRoute private peering supports connectivity between multiple virtual networks. Although this\nbehaviour happens by default when linking virtual networks to the same ExpressRoute circuit, Microsoft\ndoesn't recommend this solution. To establish connectivity between virtual networks, VNet peering should be\nimplemented instead for the best performance possible.\nVirtual network peering enables you to seamlessly\nconnect two or more Virtual Networks in Azure. The virtual networks appear as one for connectivity purposes.\nThe traffic between virtual machines in peered virtual networks uses the Microsoft backbone infrastructure.\nLike traffic between virtual machines in the same network, traffic is routed through Microsoft's private\nnetwork only.", "reference": "https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview\nhttps://learn.microsoft.com/en-us/azure/expressroute/virtual-network-connectivity-guidance", "references": [ "https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview", "https://learn.microsoft.com/en-us/azure/expressroute/virtual-network-connectivity-guidance" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 523, "pdfId": 523, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/523" }, "markersInGap": [ 522, 523 ], "questionText": "You have the Azure virtual networks shown in the following table.\n Which virtual networks can you peer with VNet1?\nA.\nVNet2, VNet3, and VNet4\nB.\nVNet2 only\nC.\nVNet3 and VNet4 only\nD.\nVNet2 and VNet3 only", "stem": "You have the Azure virtual networks shown in the following table. Which virtual networks can you peer with VNet1", "options": [ { "key": "A", "text": "VNet2, VNet3, and VNet4" }, { "key": "B", "text": "VNet2 only" }, { "key": "C", "text": "VNet3 and VNet4 only" }, { "key": "D", "text": "VNet2 and VNet3 only" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C:VNet3 and VNet4 only.\nVNet3 and VNet4 only (Option C) suggests that these virtual networks are compatible with VNet1 for peering,\nwhile the other VNets (VNet2) may have some constraints or conflicts that prevent successful peering with\nVNet1.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 524, "pdfId": 524, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/524" }, "markersInGap": [], "questionText": "You have an Azure subscription.\nYou are creating a new Azure container instance that will have the following settings:\n•Container name: cont1\n•SKU: Standard\n•OS type: Windows\n•Networking type: Public\n•Memory (GiB): 2.5\n•Number of CPU cores: 2\nYou discover that the Private setting for Networking type is unavailable.\nYou need to ensure that cont1 can be configured to use private networking.\nWhich setting should you change?\nA.\nMemory (GiB)\nB.\nNetworking type\nC.\nNumber of CPU cores\nD.\nOS type\nE.\nSKU", "stem": "You have an Azure subscription. You are creating a new Azure container instance that will have the following settings: •Container name: cont1 •SKU: Standard •OS type: Windows •Networking type: Public •Memory (GiB): 2.5 •Number of CPU cores: 2 You discover that the Private setting for Networking type is unavailable. You need to ensure that cont1 can be configured to use private networking. Which setting should you change", "options": [ { "key": "A", "text": "Memory (GiB)" }, { "key": "B", "text": "Networking type" }, { "key": "C", "text": "Number of CPU cores" }, { "key": "D", "text": "OS type" }, { "key": "E", "text": "SKU" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "To configure an Azure Container Instance (ACI) with private networking, the OS type must be set to Linux, as\nprivate networking is not supported for Windows containers in Azure Container Instances.\nAzure Container Instances (ACI) supports private networking only for containers running on Linux OS.\nChanging the OS type from Windows to Linux will allow you to use the private networking type.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 525, "pdfId": 525, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/525" }, "markersInGap": [], "questionText": "You have an Azure subscription that has a Recovery Services vault named Vault1. The subscription contains the\nvirtual machines shown in the following table:\nYou plan to schedule backups to occur every night at 23:00.\nWhich virtual machines can you back up by using Azure Backup?\nA.\nVM1 and VM3 only\nB.\nVM1, VM2, VM3 and VM4\nC.\nVM1 and VM2 only\nD.\nVM1 only", "stem": "You have an Azure subscription that has a Recovery Services vault named Vault1. The subscription contains the virtual machines shown in the following table: You plan to schedule backups to occur every night at 23:00. Which virtual machines can you back up by using Azure Backup", "options": [ { "key": "A", "text": "VM1 and VM3 only" }, { "key": "B", "text": "VM1, VM2, VM3 and VM4" }, { "key": "C", "text": "VM1 and VM2 only" }, { "key": "D", "text": "VM1 only" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure Backup supports backup of 64-bit Windows server operating system from Windows Server 2008.\nAzure Backup supports backup of 64-bit Windows 10 operating system.\nAzure Backup supports backup of 64-bit Ubuntu Server operating system from Ubuntu 12.04.\nAzure Backup supports backup of VM that are shutdown or offline.", "reference": "https://docs.microsoft.com/en-us/azure/backup/backup-support-matrix-iaas https://docs.microsoft.com/en-\nus/azure/virtual-machines/linux/endorsed-distros", "references": [ "https://docs.microsoft.com/en-us/azure/backup/backup-support-matrix-iaas", "https://docs.microsoft.com/en-" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 526, "pdfId": 526, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/526" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: 10 years -\nThe yearly backup point occurs to 1 March and its retention period is 10 years.\nBox 2: 36 months -\nThe monthly backup point occurs on the 1\nof every month and its retention period is 36 months.\nst", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 527, "pdfId": 527, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/527" }, "markersInGap": [ 527 ], "questionText": "You have the Azure virtual machines shown in the following table:\n You have a Recovery Services vault that protects VM1 and VM2.\nYou need to protect VM3 and VM4 by using Recovery Services.\nWhat should you do first?\nA.\nCreate a new Recovery Services vault\nB.\nCreate a storage account\nC.\nConfigure the extensions for VM3 and VM4\nD.\nCreate a new backup policy", "stem": "You have the Azure virtual machines shown in the following table: You have a Recovery Services vault that protects VM1 and VM2. You need to protect VM3 and VM4 by using Recovery Services. What should you do first", "options": [ { "key": "A", "text": "Create a new Recovery Services vault" }, { "key": "B", "text": "Create a storage account" }, { "key": "C", "text": "Configure the extensions for VM3 and VM4" }, { "key": "D", "text": "Create a new backup policy" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A Recovery Services vault is a storage entity in Azure that houses data. The data is typically copies of data, or\nconfiguration information for virtual machines\n(VMs), workloads, servers, or workstations. You can use Recovery Services vaults to hold backup data for\nvarious Azure services", "reference": "https://docs.microsoft.com/en-us/azure/site-recovery/azure-to-azure-tutorial-enable-replicatio", "references": [ "https://docs.microsoft.com/en-us/azure/site-recovery/azure-to-azure-tutorial-enable-replicatio" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 528, "pdfId": 528, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/528" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "You can define only one activity log signal per alert rule. To alert on more signals, create another alert rule.\nBox 1: 4", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 529, "pdfId": 529, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/529" }, "markersInGap": [ 529 ], "questionText": "You need 1 alert rule per 1 signal (1xIngress, 1xEgress, 1xDelete storage account, 1xRestore blob ranges).\nBox 2: 3\nYou need 3 Action Groups (1xUser1 and User3, 1xUser1 only, 1xUser1 User2 and User3). Check ‘Users to notify’\ncolumn.\nYou have an Azure subscription that contains the identities shown in the following table.\nUser1, Principal1, and Group1 are assigned the Monitoring Reader role.\nAn action group named AG1 has the Email Azure Resource Manager Role notification type and is configured to\nemail the Monitoring Reader role.\n You create an alert rule named Alert1 that uses AG1.\nYou need to identity who will receive an email notification when Alert1 is triggered.\nWho should you identify?\nA.\nUser1 and Principal1 only\nB.\nUser1, User2, Principal1, and Principal2\nC.\nUser1 only\nD.\nUser1 and User2 only", "stem": "You need 1 alert rule per 1 signal (1xIngress, 1xEgress, 1xDelete storage account, 1xRestore blob ranges). Box 2: 3 You need 3 Action Groups (1xUser1 and User3, 1xUser1 only, 1xUser1 User2 and User3). Check ‘Users to notify’ column. You have an Azure subscription that contains the identities shown in the following table. User1, Principal1, and Group1 are assigned the Monitoring Reader role. An action group named AG1 has the Email Azure Resource Manager Role notification type and is configured to email the Monitoring Reader role. You create an alert rule named Alert1 that uses AG1. You need to identity who will receive an email notification when Alert1 is triggered. Who should you identify", "options": [ { "key": "A", "text": "User1 and Principal1 only" }, { "key": "B", "text": "User1, User2, Principal1, and Principal2" }, { "key": "C", "text": "User1 only" }, { "key": "D", "text": "User1 and User2 only" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "user 1 and user 2 only.\nUser 2 because its also a member of a group that has the rights\nEmail Azure Resource Manager\nWhen you use Azure Resource Manager for email notifications, you can send email to the members of a\nsubscription's role. Email is sent to Microsoft Entra ID user or group members of the role. This includes\nsupport for roles assigned through Azure Lighthouse.\nNote\nAction Groups only supports emailing the following roles: Owner, Contributor, Reader, Monitoring Contributor,\nMonitoring Reader.\nhttps://learn.microsoft.com/en-us/azure/azure-monitor/alerts/action-groups#email-azure-resource-manager", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 530, "pdfId": 530, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/530" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: 6 -\n5 latest daily recovery points, which includes the weekly backup from the previous Sunday, plus the monthly\nrecovery point.\nBox 2: 8 -\n5 latest daily recovery points, plus two weekly backups, plus the monthly recovery point.", "reference": "https://social.technet.microsoft.com/Forums/en-US/854ab6ae-79aa-4bad-ac65-471c4d422e94/daily-\nmonthly-yearly-recovery-points-and-storage-used? forum=windowsazureonlinebackup", "references": [ "https://social.technet.microsoft.com/Forums/en-US/854ab6ae-79aa-4bad-ac65-471c4d422e94/daily-" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 531, "pdfId": 531, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/531" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Install the Application Insights Agent.\nThe Application Insights Agent (also known as the Status Monitor) can be installed on servers to monitor\napplications without modifying the application code. It is particularly useful for monitoring .NET applications\nrunning on IIS.\nSuitable for monitoring existing applications where modifying the code to include the SDK is not feasible.\nInstall the Application Insights Agent.\nInstall this on servers to monitor applications without modifying the code, especially useful for .NET\napplications on IIS.", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/app/azure-web-apps", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/app/azure-web-apps" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 532, "pdfId": 532, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/532" }, "markersInGap": [ 532 ], "questionText": "You have an Azure virtual machine named VM1.\nYou use Azure Backup to create a backup of VM1 named Backup1.\nAfter creating Backup1, you perform the following changes to VM1:\n✑\n Modify the size of VM1.\n✑\n Copy a file named Budget.xls to a folder named Data.\n✑\n Reset the password for the built-in administrator account.\n✑\n Add a data disk to VM1.\nAn administrator uses the Replace existing option to restore VM1 from Backup1.\n You need to ensure that all the changes to VM1 are restored.\nWhich change should you perform again?\nA.\nModify the size of VM1.\nB.\nReset the password for the built-in administrator account.\nC.\nAdd a data disk.\nD.\nCopy Budget.xls to Data.", "stem": "You have an Azure virtual machine named VM1. You use Azure Backup to create a backup of VM1 named Backup1. After creating Backup1, you perform the following changes to VM1: ✑ Modify the size of VM1. ✑ Copy a file named Budget.xls to a folder named Data. ✑ Reset the password for the built-in administrator account. ✑ Add a data disk to VM1. An administrator uses the Replace existing option to restore VM1 from Backup1. You need to ensure that all the changes to VM1 are restored. Which change should you perform again", "options": [ { "key": "A", "text": "Modify the size of VM1." }, { "key": "B", "text": "Reset the password for the built-in administrator account." }, { "key": "C", "text": "Add a data disk." }, { "key": "D", "text": "Copy Budget.xls to Data." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. Copy Budget.xlsto Data.\nWhen you use the Replace existing option to restore an Azure virtual machine (VM) from a backup, the\nrestoration process will revert the VM to the exact state it was in at the time the backup was created\n(Backup1). Any changes made to the VM after the backup was created will not be included in the restored VM.\nTherefore, you need to perform these changes again to ensure they are applied to the restored VM.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 533, "pdfId": 533, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/533" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: No\nTwo methods are required (Mobile phone and Security questions).\nBox 2: No\nSelf-service password reset is only enabled for Group2, and User1 is not a member of Group2.\nBox 3: No\nTo be able to add Security questions to the process, you need to be a Global Administrator. User3 is User\nAdministrator, so User3 cannot add security questions to the reset process. User Administrator doesn’t have\nMFA permissions.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/authentication/quickstart-sspr\nhttps://docs.microsoft.com/en-us/azure/active-directory/authentication/active-directory-passwords-faq\nhttps://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr#prerequisites\nhttps://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#user-administrator", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/authentication/quickstart-sspr", "https://docs.microsoft.com/en-us/azure/active-directory/authentication/active-directory-passwords-faq", "https://docs.microsoft.com/en-us/azure/active-directory/authentication/tutorial-enable-sspr#prerequisites", "https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#user-administrator" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 534, "pdfId": 534, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/534" }, "markersInGap": [ 534 ], "questionText": "Your company has a main office in London that contains 100 client computers.\nThree years ago, you migrated to Azure Active Directory (Azure AD).\nThe company's security policy states that all personal devices and corporate-owned devices must be registered or\njoined to Azure AD.\nA remote user named User1 is unable to join a personal device to Azure AD from a home network.\nYou verify that User1 was able to join devices to Azure AD in the past.\nYou need to ensure that User1 can join the device to Azure AD.\nWhat should you do?\nA.\nAssign the User administrator role to User1.\nB.\nFrom the Device settings blade, modify the Maximum number of devices per user setting.\nC.\nCreate a point-to-site VPN from the home network of User1 to Azure.\nD.\nFrom the Device settings blade, modify the Users may join devices to Azure AD setting.", "stem": "Your company has a main office in London that contains 100 client computers. Three years ago, you migrated to Azure Active Directory (Azure AD). The company's security policy states that all personal devices and corporate-owned devices must be registered or joined to Azure AD. A remote user named User1 is unable to join a personal device to Azure AD from a home network. You verify that User1 was able to join devices to Azure AD in the past. You need to ensure that User1 can join the device to Azure AD. What should you do", "options": [ { "key": "A", "text": "Assign the User administrator role to User1." }, { "key": "B", "text": "From the Device settings blade, modify the Maximum number of devices per user setting." }, { "key": "C", "text": "Create a point-to-site VPN from the home network of User1 to Azure." }, { "key": "D", "text": "From the Device settings blade, modify the Users may join devices to Azure AD setting." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "The Maximum number of devices setting enables you to select the maximum number of devices that a user\ncan have in Azure AD. If a user reaches this quota, they will not be able to add additional devices until one or\nmore of the existing devices are removed.\nIncorrect Answers:\nC: Azure AD Join enables users to join their devices to Active Directory from anywhere as long as they have\nconnectivity with the Internet.\nD: The Users may join devices to Azure AD setting enables you to select the users who can join devices to\nAzure AD. Options are All, Selected and None. The default is All.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal\nhttp://techgenix.com/pros-and-cons-azure-ad-join/", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal", "http://techgenix.com/pros-and-cons-azure-ad-join/" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 535, "pdfId": 535, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/535" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "No - On January 15, 2021, App1 will have only one backup in storage\nOn January 15th you will have 9 backups as 0 day retention is defined as indefinite.\nRetention: Set to 0 for indefinite retention.\nNo - On Febraury 6, 2021, you can access the backup of the App2 test slot from January 15, 2021\nBackup in the questions only includes the production slot. So no backup policy for test slots.\nYes - On January 15, 2021, you can restore the App2 production slot backup from January 6 to the App2 test\nslot\nYou can restore the production backup to any slot or new deployment slot\nhttps://learn.microsoft.com/en-us/azure/app-service/manage-backup?tabs=portal", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 536, "pdfId": 536, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/536" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "NO, NO, YES\nhttps://learn.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-policy\nBy default, administrator accounts are enabled for self-service password reset, and a strong default two-gate\npassword reset policy is enforced. This policy may be different from the one you have defined for your users,\nand this policy can't be changed. You should always test password reset functionality as a user without any\nAzure administrator roles assigned.\nWith a two-gate policy, administrators don't have the ability to use security questions.\nThe two-gate policy requires two pieces of authentication data, such as an email address, authenticator app,\nor a phone number.", "reference": "https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment", "references": [ "https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment" ], "note": "This question is part of a series of questions that present the same scenario. Each question in the series\ncontains a unique solution that might meet the stated goals. Some question sets might have more than one correct\nsolution, while others might not have a correct solution.", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 537, "pdfId": 537, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/537" }, "markersInGap": [], "questionText": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not\nappear in the review screen.\nYou have an Azure subscription that contains the following users in an Azure Active Directory tenant named\ncontoso.onmicrosoft.com:\nUser1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.\nYou need to create new user accounts in external.contoso.onmicrosoft.com.\nSolution: You instruct User1 to create the user accounts.\nDoes that meet the goal?\nA.\nYes\nB.\nNo", "stem": "After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com: User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com. You need to create new user accounts in external.contoso.onmicrosoft.com. Solution: You instruct User1 to create the user accounts. Does that meet the goal", "options": [ { "key": "A", "text": "Yes" }, { "key": "B", "text": "No" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Only a global administrator can add users to this tenant.", "reference": "https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/add-users-to-azure-ad", "references": [ "https://docs.microsoft.com/en-us/azure/devops/organizations/accounts/add-users-to-azure-ad" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 538, "pdfId": 538, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/538" }, "markersInGap": [], "questionText": "You have an existing Azure subscription that contains 10 virtual machines.\nYou need to monitor the latency between your on-premises network and the virtual machines.\nWhat should you use?\nA.\nService Map\nB.\nConnection troubleshoot\nC.\nNetwork Performance Monitor\nD.\nEffective routes", "stem": "You have an existing Azure subscription that contains 10 virtual machines. You need to monitor the latency between your on-premises network and the virtual machines. What should you use", "options": [ { "key": "A", "text": "Service Map" }, { "key": "B", "text": "Connection troubleshoot" }, { "key": "C", "text": "Network Performance Monitor" }, { "key": "D", "text": "Effective routes" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Network Performance Monitor is a cloud-based hybrid network monitoring solution that helps you monitor\nnetwork performance between various points in your network infrastructure. It also helps you monitor\nnetwork connectivity to service and application endpoints and monitor the performance of Azure\nExpressRoute.\nYou can monitor network connectivity across cloud deployments and on-premises locations, multiple data\ncenters, and branch offices and mission-critical multitier applications or microservices. With Performance\nMonitor, you can detect network issues before users complain.", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/insights/network-performance-monitor", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/insights/network-performance-monitor" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 539, "pdfId": 539, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/539" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: four times -\nFrom the exhibit we see that the time granularity is 6 hours: Last 30 days (Automatic - 6 hours).\nCPU Percentage Last days Automatic - hours\nBox 2: scaled up -\nScale up when:\n* You see that your workloads are hitting some performance limit such as CPU or I/O limits.\n* You need to quickly react to fix performance issues that can't be solved with classic database optimization.\n* You need a solution that allows you to change service tiers to adapt to changing latency requirements.", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/metrics-troubleshoot\nhttps://azure.microsoft.com/en-us/overview/scaling-out-vs-scaling-up", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/metrics-troubleshoot", "https://azure.microsoft.com/en-us/overview/scaling-out-vs-scaling-up" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 540, "pdfId": 540, "exam": "AZ-104", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/540" }, "markersInGap": [], "questionText": "DRAG DROP -\nYou have an Azure Linux virtual machine that is protected by Azure Backup.\nOne week ago, two files were deleted from the virtual machine.\nYou need to restore the deleted files to an on-premises Windows Server 2016 computer as quickly as possible.\nWhich four actions should you perform in sequence? To answer, move the appropriate actions from the list of\nactions to the answer area and arrange them in the correct order.\nSelect and Place:", "stem": "You have an Azure Linux virtual machine that is protected by Azure Backup. One week ago, two files were deleted from the virtual machine. You need to restore the deleted files to an on-premises Windows Server 2016 computer as quickly as possible. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Step 1: From the Azure portal, click File Recovery from the vault\nStep 2. Select a restore point that contains the deleted files\nStep 3: Download and run the script to mount a drive on the local computer\nGenerate and download script to browse and recover files:\nStep 4: Copy the files by using AzCopy\nTo restore files or folders from the recovery point, go to the virtual machine and choose the desired recovery\npoint.\nStep 0. In the virtual machine’s menu, click Backup to open the Backup dashboard.\nStep 1. In the Backup dashboard menu, click File Recovery.\nStep 2. From the Select recovery point drop-down menu, select the recovery point that holds the files you\nwant. By default, the latest recovery point is already selected.\nStep 3: To download the software used to copy files from the recovery point, click Download Executable (for\nWindows Azure VM) or Download Script (for Linux\nAzure VM, a python script is generated).\nStep 4: Copy the files by using AzCopy\nAzCopy is a command-line utility designed for copying data to/from Microsoft Azure Blob, File, and Table\nstorage, using simple commands designed for optimal performance. You can copy data between a file system\nand a storage account, or between storage accounts.\nReferences:\nhttps://docs.microsoft.com/en-us/azure/backup/backup-azure-restore-files-from-vm\nhttps://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy\nThe File Recovery menu opens.", "reference": "https://docs.microsoft.com/en-us/azure/backup/backup-azure-restore-files-from-vm\nhttps://docs.microsoft.com/en-us/azure/backup/backup-azure-vms-automation#restore-files-from-an-azure-\nvm-backup", "references": [ "https://docs.microsoft.com/en-us/azure/backup/backup-azure-restore-files-from-vm", "https://docs.microsoft.com/en-us/azure/backup/backup-azure-vms-automation#restore-files-from-an-azure-" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 541, "pdfId": 541, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/541" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: A Recovery Services vault\nYou can set up a Recovery Services vault and configure backup for multiple Azure VMs.\nBox 2: A backup policy -\nIn Choose backup policy, do one of the following:\n✑\n Leave the default policy. This backs up the VM once a day at the time specified, and retains backups in the\nvault for 30 days.\n✑\n Select an existing backup policy if you have one.\n✑\n Create a new policy, and define the policy settings.", "reference": "https://docs.microsoft.com/en-us/azure/backup/backup-azure-vms-first-look-arm", "references": [ "https://docs.microsoft.com/en-us/azure/backup/backup-azure-vms-first-look-arm" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 542, "pdfId": 542, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/542" }, "markersInGap": [], "questionText": "You have an Azure virtual machine named VM1.\nAzure collects events from VM1.\nYou are creating an alert rule in Azure Monitor to notify an administrator when an error is logged in the System\nevent log of VM1.\nWhich target resource should you monitor in the alert rule?\nA.\nvirtual machine extension\nB.\nvirtual machine\nC.\nmetric alert\nD.\nAzure Log Analytics workspace", "stem": "You have an Azure virtual machine named VM1. Azure collects events from VM1. You are creating an alert rule in Azure Monitor to notify an administrator when an error is logged in the System event log of VM1. Which target resource should you monitor in the alert rule", "options": [ { "key": "A", "text": "virtual machine extension" }, { "key": "B", "text": "virtual machine" }, { "key": "C", "text": "metric alert" }, { "key": "D", "text": "Azure Log Analytics workspace" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "For the first step to create the new alert tule, under the Create Alert section, you are going to select your Log\nAnalytics workspace as the resource, since this is a log based alert signal.", "reference": "https://docs.microsoft.com/en-us/windows-server/storage/storage-spaces/configure-azure-monitor", "references": [ "https://docs.microsoft.com/en-us/windows-server/storage/storage-spaces/configure-azure-monitor" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 543, "pdfId": 543, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/543" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains 100 virtual machines.\nYou regularly create and delete virtual machines.\nYou need to identify unattached disks that can be deleted.\nWhat should you do?\nA.\nFrom Azure Cost Management, view Cost Analysis\nB.\nFrom Azure Advisor, modify the Advisor configuration\nC.\nFrom Microsoft Azure Storage Explorer, view the Account Management properties\nD.\nFrom Azure Cost Management, view Advisor Recommendations", "stem": "You have an Azure subscription that contains 100 virtual machines. You regularly create and delete virtual machines. You need to identify unattached disks that can be deleted. What should you do", "options": [ { "key": "A", "text": "From Azure Cost Management, view Cost Analysis" }, { "key": "B", "text": "From Azure Advisor, modify the Advisor configuration" }, { "key": "C", "text": "From Microsoft Azure Storage Explorer, view the Account Management properties" }, { "key": "D", "text": "From Azure Cost Management, view Advisor Recommendations" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "From Home \"> Cost Management + Billing \"> Cost Management, scroll down on the options and select View\nRecommendations:\nAzure Cost Management / Advisor -\nFrom here you will see the recommendations for your subscription, if you have orphaned disks, they will be\nlisted.", "reference": "https://codeserendipity.com/2020/07/08/microsoft-azure-find-unattached-disks-that-can-be-deleted-and-\nother-recommendations/", "references": [ "https://codeserendipity.com/2020/07/08/microsoft-azure-find-unattached-disks-that-can-be-deleted-and-" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 544, "pdfId": 544, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/544" }, "markersInGap": [], "questionText": "You have an Azure web app named webapp1.\nUsers report that they often experience HTTP 500 errors when they connect to webapp1.\nYou need to provide the developers of webapp1 with real-time access to the connection errors. The solution must\nprovide all the connection error details.\nWhat should you do first?\nA.\nFrom webapp1, enable Web server logging\nB.\nFrom Azure Monitor, create a workbook\nC.\nFrom Azure Monitor, create a Service Health alert\nD.\nFrom webapp1, turn on Application Logging", "stem": "You have an Azure web app named webapp1. Users report that they often experience HTTP 500 errors when they connect to webapp1. You need to provide the developers of webapp1 with real-time access to the connection errors. The solution must provide all the connection error details. What should you do first", "options": [ { "key": "A", "text": "From webapp1, enable Web server logging" }, { "key": "B", "text": "From Azure Monitor, create a workbook" }, { "key": "C", "text": "From Azure Monitor, create a Service Health alert" }, { "key": "D", "text": "From webapp1, turn on Application Logging" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Raw HTTP request data is provided by Web server logging and the question mentions 500 error codes.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 545, "pdfId": 545, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/545" }, "markersInGap": [ 544 ], "questionText": "You need to catch connection error. When the connection fails it happens on web server, not within\napplication. You can do it opening the web application -> Application Service logs -> Web server logging\n(there are multiple switches there).\nYou can also see the errors live going to \"Log stream\" pane.\nWeb server logging Windows App Service file system or Azure Storage blobs Raw HTTP request data in the\n W3C extended log file format. Each log message includes data such as the HTTP method, resource URI, client\nIP, client port, user agent, response code, and so on.\nYou have an Azure web app named App1.\nYou need to monitor the availability of App1 by using a multi-step web test.\nWhat should you use in Azure Monitor?\nA.\nAzure Service Health\nB.\nAzure Application Insights\nC.\nthe Diagnostic settings\nD.\nmetrics", "stem": "You need to catch connection error. When the connection fails it happens on web server, not within application. You can do it opening the web application -> Application Service logs -> Web server logging (there are multiple switches there). You can also see the errors live going to \"Log stream\" pane. Web server logging Windows App Service file system or Azure Storage blobs Raw HTTP request data in the W3C extended log file format. Each log message includes data such as the HTTP method, resource URI, client IP, client port, user agent, response code, and so on. You have an Azure web app named App1. You need to monitor the availability of App1 by using a multi-step web test. What should you use in Azure Monitor", "options": [ { "key": "A", "text": "Azure Service Health" }, { "key": "B", "text": "Azure Application Insights" }, { "key": "C", "text": "the Diagnostic settings" }, { "key": "D", "text": "metrics" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Upload the web test -\n1. In the Application Insights portal on the Availability pane select Add Classic test, then select Multi-step as\nthe SKU.\n2. Upload your multi-step web test.\n3. Set the test locations, frequency, and alert parameters.\n4. Select Create.", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/app/availability-multistep", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/app/availability-multistep" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 546, "pdfId": 546, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/546" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: AzureActivity -\nThe AzureActivity table has entries from the Azure activity log, which provides insight into subscription-level\nor management group-level events occuring in Azure.\nLet's see only Critical entries during a specific week.\nThe where operator is common in the Kusto Query Language. where filters a table to rows that match specific\ncriteria. The following example uses multiple commands. First, the query retrieves all records for the table.\nThen, it filters the data for only records that are in the time range. Finally, it filters those results for only\nrecords that have a Critical level.\nAzureActivity -\n| where TimeGenerated > datetime(10-01-2020) and TimeGenerated < datetime(10-07-2020)\n| where Level == 'Critical'\nIncorrect:\nnot Perf: The Perf table has performance data that's collected from virtual machines that run the Log\nAnalytics agent.\nBox 2: | project -\nSelect a subset of columns: project.\nUse project to include only the columns you want. Building on the preceding example, let's limit the output to\ncertain columns:\nAzureActivity -\n| where TimeGenerated > datetime(10-01-2020) and TimeGenerated < datetime(10-07-2020)\n| where Level == 'Critical'\n| project TimeGenerated, Level, OperationNameValue, ResourceGroup, _ResourceId", "reference": "https://github.com/MicrosoftDocs/dataexplorer-docs/blob/main/data-explorer/kusto/query/tutorial.md", "references": [ "https://github.com/MicrosoftDocs/dataexplorer-docs/blob/main/data-explorer/kusto/query/tutorial.md" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 547, "pdfId": 547, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/547" }, "markersInGap": [], "questionText": "You have a Recovery Services vault named RSV1. RSV1 has a backup policy that retains instant snapshots for five\ndays and daily backup for 14 days.\nRSV1 performs daily backups of VM1. VM1 hosts a static website that was updated eight days ago.\nYou need to recover VM1 to a point eight days ago. The solution must minimize downtime.\nWhat should you do first?\nA.\nDeallocate VM1.\nB.\nRestore VM1 by using the Replace existing restore configuration option.\nC.\nDelete VM1.\nD.\nRestore VM1 by using the Create new restore configuration option.", "stem": "You have a Recovery Services vault named RSV1. RSV1 has a backup policy that retains instant snapshots for five days and daily backup for 14 days. RSV1 performs daily backups of VM1. VM1 hosts a static website that was updated eight days ago. You need to recover VM1 to a point eight days ago. The solution must minimize downtime. What should you do first", "options": [ { "key": "A", "text": "Deallocate VM1." }, { "key": "B", "text": "Restore VM1 by using the Replace existing restore configuration option." }, { "key": "C", "text": "Delete VM1." }, { "key": "D", "text": "Restore VM1 by using the Create new restore configuration option." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "D. Restore VM1 by using the Create new restore configuration option.\nThis option allows you to keep the existing VM running while restoring a new instance, minimizing downtime\nfor your static website.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 548, "pdfId": 548, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/548" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: VM1 only .\nA virtual machine may have an association to multiple DCRs, and a DCR may have multiple virtual machines\nassociated to it.\nIn the Resources tab, add the resources (virtual machines, virtual machine scale sets, Arc for servers) that\nshould have the Data Collection Rule applied.\nBox 2: Workspace1 only.\nOn the Destination tab, add one or more destinations for the data source. You can select multiple destinations\nof same of different types, for instance multiple Log\nAnalytics workspaces (i.e. \"multi-homing\").", "reference": "https://docs.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent", "references": [ "https://docs.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent" ], "note": "The Data Collection Rules (or DCR) improve on a few key areas of data collection from VMs including\nlike better control and scoping of data collection (e.g. collect from a subset of VMs for a single workspace),\ncollect once and send to both Log Analytics and Azure Monitor Metrics, send to multiple workspaces (multi-\nhoming for Linux), improved Windows event filtering, and improved extension management.\nReference:\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-rule-azure-monitor-agent", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 549, "pdfId": 549, "exam": "AZ-104", "type": "dropdown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/549" }, "markersInGap": [ 549 ], "questionText": "HOTSPOT -\nYou have the role assignment file shown in the following exhibit.\n Use the drop-down menus to select the answer choice that completes each statement based on the information\npresented in the graphic.\nNOTE: Each correct selection is worth one point.\nHot Area:", "stem": "You have the role assignment file shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box1: Owner of VM1 - User1 andUser3 are.\nBox2 : Create VM in RG1 - User1 and User4.\nUser1 - Owner of the subscription. (He can manage any resources in the subscription.)\nUser 2 - Owner of RG2(He can manage any resources in the RG2.)\nUser 3 - Owner of a single VM that is VM1.(he can manage VM1 only)\nUser 4 - Contributor of RG1.(He can manage everything in RG1, even he can delete VMs in RG1. But cannot\nchange RABC)", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 550, "pdfId": 550, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/550" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Microsoft.Compute/virtualMachines/* Perform all virtual machine actions including create, update, delete,\nstart, restart, and power off virtual machines. Execute scripts on virtual machines.\nNo,yes,yes.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 551, "pdfId": 551, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/551" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "YES\n- VM1 can access to storage1 with the rule 145 from Outbound Security Rules\nYES -\n When traffic is outbound from VMs, always we are checking Outbound Rules not Inbound Security\nRules. Default rule 65000 allow that\nNO\n- this NSG1 is associated with 1 subnet in our case Subnet 1 because there are rules for VM1\nhttps://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview#default-security-\nrules", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 552, "pdfId": 552, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/552" }, "markersInGap": [], "questionText": "You have an Azure subscription named Subscription1 that contains two Azure virtual networks named VNet1 and\nVNet2. VNet1 contains a VPN gateway named\nVPNGW1 that uses static routing. There is a site-to-site VPN connection between your on-premises network and\nVNet1.\nOn a computer named Client1 that runs Windows 10, you configure a point-to-site VPN connection to VNet1.\nYou configure virtual network peering between VNet1 and VNet2. You verify that you can connect to VNet2 from\nthe on-premises network. Client1 is unable to connect to VNet2.\nYou need to ensure that you can connect Client1 to VNet2.\nWhat should you do?\nA.\nSelect Use the remote virtual network's gateway or Route Server on VNet1 to VNet2 peering.\nB.\nSelect Use the remote virtual network s gateway or Route Server on VNet2 to VNet1 peering.\nC.\nDownload and re-install the VPN client configuration package on Client1.\nD.\nEnable BGP on VPNGW1.", "stem": "You have an Azure subscription named Subscription1 that contains two Azure virtual networks named VNet1 and VNet2. VNet1 contains a VPN gateway named VPNGW1 that uses static routing. There is a site-to-site VPN connection between your on-premises network and VNet1. On a computer named Client1 that runs Windows 10, you configure a point-to-site VPN connection to VNet1. You configure virtual network peering between VNet1 and VNet2. You verify that you can connect to VNet2 from the on-premises network. Client1 is unable to connect to VNet2. You need to ensure that you can connect Client1 to VNet2. What should you do", "options": [ { "key": "A", "text": "Select Use the remote virtual network's gateway or Route Server on VNet1 to VNet2 peering." }, { "key": "B", "text": "Select Use the remote virtual network s gateway or Route Server on VNet2 to VNet1 peering." }, { "key": "C", "text": "Download and re-install the VPN client configuration package on Client1." }, { "key": "D", "text": "Enable BGP on VPNGW1." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "C. Download and re-install the VPN client configuration package on Client1.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 553, "pdfId": 553, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/553" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1. User1 can sign in to VM1\nNo\nUser1 is assigned as Virtual Machine Contributor in MG1.\nAnd Virtual Machine Contributor can't log in to VM as a regular user.\n2. User2 can manage disks and disk snapshots of VM1\nNo\nSince User2 only has Virtual Machine User in Sub1, so he can log in to VM1 but can't manage disks or\nsnapshots\n3. User2 can manage disks and disk snapshots of VM3\nNo\nVirtual Machine Contributor only has permission to manage disks, but not disk snapshots (Disk Snapshot\nContributor permission)\nhttps://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-contributor", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 554, "pdfId": 554, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/554" }, "markersInGap": [], "questionText": "You have an Azure Active Directory (Azure AD) tenant that is linked to 10 Azure subscriptions.\nYou need to centrally monitor user activity across all the subscriptions.\nWhat should you use?\nA.\nAzure Application Insights Profiler\nB.\naccess reviews\nC.\nActivity log filters\nD.\na Log Analytics workspace", "stem": "You have an Azure Active Directory (Azure AD) tenant that is linked to 10 Azure subscriptions. You need to centrally monitor user activity across all the subscriptions. What should you use", "options": [ { "key": "A", "text": "Azure Application Insights Profiler" }, { "key": "B", "text": "access reviews" }, { "key": "C", "text": "Activity log filters" }, { "key": "D", "text": "a Log Analytics workspace" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "To centrally monitor user activity across all the Azure subscriptions, you should use a Log Analytics\nworkspace. The Azure Activity Log, which is available in the Log Analytics workspace, allows you to view and\nanalyze activity logs from Azure resources, including Azure AD, across all the subscriptions linked to your\nAzure AD tenant.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 555, "pdfId": 555, "exam": "AZ-104", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/555" }, "markersInGap": [], "questionText": "DRAG DROP -\nYou have an Azure subscription that contains a virtual machine name VM1.\nVM1 has an operating system disk named Disk1 and a data disk named Disk2.\nYou need to back up Disk2 by using Azure Backup.\nWhich three actions should you perform in sequence? To answer, move the appropriate actions from the list of\nactions to the answer area and arrange them in the correct order.\nSelect and Place:", "stem": "You have an Azure subscription that contains a virtual machine name VM1. VM1 has an operating system disk named Disk1 and a data disk named Disk2. You need to back up Disk2 by using Azure Backup. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1. Create an Azure Backup Vault.\nThis refers to creating a Recovery Services vault specifically for Azure Backup. The steps are the same as\ncreating a Recovery Services vault.\n2. Create a Backup Policy and Configure the Backup.\nPurpose: A backup policy defines how often backups are taken and how long they are retained. Configuring\nthe backup involves applying this policy to specific resources (e.g., VMs, databases).\nSteps:\nGo to the Recovery Services vault.\nCreate a new backup policy or use an existing one.\nAssign the policy to the resources you want to back up.\n3. Configure a Managed Identity.\nPurpose: A managed identity is used to grant the Recovery Services vault the necessary permissions to\naccess and back up resources.\nSteps:\nEnable a system-assigned or user-assigned managed identity for the resource (e.g., a VM).\nAssign the managed identity the appropriate role (e.g., Backup Contributor) in the Recovery Services vault.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 556, "pdfId": 556, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/556" }, "markersInGap": [], "questionText": "You have a subnet named Subnet1 that contains Azure virtual machines. A network security group (NSG) named\nNSG1 is associated to Subnet1. NSG1 only contains the default rules.\nYou need to create a rule in NSG1 to prevent the hosts on Subnet1 form connecting to the Azure portal. The hosts\nmust be able to connect to other internet hosts.\nTo what should you set Destination in the rule?\nA.\nApplication security group\nB.\nIP Addresses\nC.\nService Tag\nD.\nAny", "stem": "You have a subnet named Subnet1 that contains Azure virtual machines. A network security group (NSG) named NSG1 is associated to Subnet1. NSG1 only contains the default rules. You need to create a rule in NSG1 to prevent the hosts on Subnet1 form connecting to the Azure portal. The hosts must be able to connect to other internet hosts. To what should you set Destination in the rule", "options": [ { "key": "A", "text": "Application security group" }, { "key": "B", "text": "IP Addresses" }, { "key": "C", "text": "Service Tag" }, { "key": "D", "text": "Any" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "You can use service tags to achieve network isolation and protect your Azure resources from the general\nInternet while accessing Azure services that have public endpoints. Create inbound/outbound network\nsecurity group rules to deny traffic to/from Internet and allow traffic to/from AzureCloud or other available\nservice tags of specific Azure services.\nhttps://docs.microsoft.com/en-us/azure/virtual-network/service-tags-overview", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 557, "pdfId": 557, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/557" }, "markersInGap": [], "questionText": "You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named\nWorkspace1.\nYou need to view the error events from a table named Event.\nWhich query should you run in Workspace1?\nA.\nsearch in (Event) \"error\"\nB.\nEvent | where EventType is \"error\"\nC.\nselect * from Event where EventType == \"error\"\nD.\nGet-Event Event | where\n$_.EventType == \"error\"", "stem": "You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1. You need to view the error events from a table named Event. Which query should you run in Workspace1", "options": [ { "key": "A", "text": "search in (Event) \"error\"" }, { "key": "B", "text": "Event | where EventType is \"error\"" }, { "key": "C", "text": "select * from Event where EventType == \"error\"" }, { "key": "D", "text": "Get-Event Event | where $_.EventType == \"error\"" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "1. Event | search \"error\"\n2. Event | where EventType == \"error\"\n3. search in (Event) \"error\"", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 558, "pdfId": 558, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/558" }, "markersInGap": [], "questionText": "You have an Azure App Service web app named App1.\nYou need to collect performance traces for App1.\nWhat should you use?\nA.\nAzure Application Insights Profiler\nB.\nthe Activity log\nC.\nthe Deployment center\nD.\nthe Diagnose and solve problems settings", "stem": "You have an Azure App Service web app named App1. You need to collect performance traces for App1. What should you use", "options": [ { "key": "A", "text": "Azure Application Insights Profiler" }, { "key": "B", "text": "the Activity log" }, { "key": "C", "text": "the Deployment center" }, { "key": "D", "text": "the Diagnose and solve problems settings" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "With Application Insights Profiler, you can capture and view performance traces for your application in all\nthese dynamic situations, automatically at-scale, without negatively affecting your end users.\"\nhttps://docs.microsoft.com/en-us/azure/azure-monitor/profiler/profiler-overview", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 559, "pdfId": 559, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/559" }, "markersInGap": [ 558, 559 ], "questionText": "You have an Azure subscription that contains the storage accounts shown in the following table.\nYou deploy a web app named App1 to the West US Azure region.\nYou need to back up App1. The solution must minimize costs.\nWhich storage account should you use as the target for the backup?\nA.\nstorage1\nB.\nstorage2\nC.\nstorage3\nD.\nstorage4", "stem": "You have an Azure subscription that contains the storage accounts shown in the following table. You deploy a web app named App1 to the West US Azure region. You need to back up App1. The solution must minimize costs. Which storage account should you use as the target for the backup", "options": [ { "key": "A", "text": "storage1" }, { "key": "B", "text": "storage2" }, { "key": "C", "text": "storage3" }, { "key": "D", "text": "storage4" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "To minimize costs, you should use the storage account that is in the same region as the web app that you are\nbacking up. In this case, the web app is in the West US region, so you should use storage2.\nAzure Blob storage is generally considered to be the more cost-effective option for storing backups of a web\napp.\nAzure Blob storage has several different storage tiers, including Hot, Cool, and Archive, each with different\npricing models. The Cool storage tier is designed for infrequent access data and has the lowest storage costs.\nThis makes it the most cost-effective option for storing backups of a web app.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 560, "pdfId": 560, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/560" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "User1: Alert1 and Alert2 are triggered.\nUser2 : Alert1 and Alert2 are triggered.\nUser1 operations:\n- Microsoft.Compute/virtualMachines/write (on the VM itself, triggering Alert2)\n- Microsoft.Compute/disks/write (on the RG, triggering Alert1)\nUser2 Operations:\nMicrosoft.Resources/tags/write (on the RG, triggering Alert1)\nMicrosoft.Resources/tags/write (on the VM, triggering Alert2)\nhttps://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log-schema#administrative-\ncategory", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 561, "pdfId": 561, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/561" }, "markersInGap": [ 561 ], "questionText": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set\nby using an Azure Resource Manager template.\nYou need to ensure that NGINX is available on all the virtual machines after they are deployed.\n What should you use?\nA.\na Desired State Configuration (DSC) extension\nB.\nthe New-AzConfigurationAssignment cmdlet\nC.\nAzure Application Insights\nD.\na Microsoft Endpoint Manager device configuration profile", "stem": "You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource Manager template. You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use", "options": [ { "key": "A", "text": "a Desired State Configuration (DSC) extension" }, { "key": "B", "text": "the New-AzConfigurationAssignment cmdlet" }, { "key": "C", "text": "Azure Application Insights" }, { "key": "D", "text": "a Microsoft Endpoint Manager device configuration profile" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. a Desired State Configuration (DSC) extension.\nDesired State Configuration (DSC) extension is a PowerShell-based configuration management solution that\nensures all virtual machines in a Virtual Machine Scale Set (VMSS) are configured consistently.\nYou can use the DSC extension to install and configure NGINX automatically on all the virtual machines after\nthey are deployed.\nDSC ensures that if any VM instance is replaced (which can happen in a scale set), the new instance will also\nhave NGINX installed as per the defined configuration.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 562, "pdfId": 562, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/562" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains eight virtual machines and the resources shown in the following\ntable.\nYou need to configure access for VNET1. The solution must meet the following requirements:\n• The virtual machines connected to VNET1 must be able to communicate with the virtual machines connected to\nVNET2 by using the Microsoft backbone.\n• The virtual machines connected to VNET1 must be able to access storage1, storage2, and Azure AD by using the\nMicrosoft backbone.\nWhat is the minimum number of service endpoints you should add to VNET1?\nA.\n1\nB.\n2\nC.\n3\nD.\n5", "stem": "You have an Azure subscription that contains eight virtual machines and the resources shown in the following table. You need to configure access for VNET1. The solution must meet the following requirements: • The virtual machines connected to VNET1 must be able to communicate with the virtual machines connected to VNET2 by using the Microsoft backbone. • The virtual machines connected to VNET1 must be able to access storage1, storage2, and Azure AD by using the Microsoft backbone. What is the minimum number of service endpoints you should add to VNET1", "options": [], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview#standard-endpoints\nA standard service endpoint in Azure Storage includes the protocol (HTTPS is recommended), the storage\naccount name as the subdomain, and a fixed domain that includes the name of the service.\n2 service endpoints. VM is not a service endpoint type. So the first question is irrelevant.\nBoth storage accounts must have service endpoints in vnet 1.So the answer 2", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": true } }, { "seq": 563, "pdfId": 563, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/563" }, "markersInGap": [], "questionText": "You need to configure an Azure web app named contoso.azurewebsites.net to host www.contoso.com.\nWhat should you do first?\nA.\nCreate A records named www.contoso.com and asuid.contoso.com.\nB.\nCreate a TXT record named asuid that contains the domain verification ID.\nC.\nCreate a CNAME record named asuid that contains the domain verification ID.\nD.\nCreate a TXT record named www.contoso.com that has a value of contoso.azurewebsites.net.", "stem": "You need to configure an Azure web app named contoso.azurewebsites.net to host www.contoso.com. What should you do first", "options": [ { "key": "A", "text": "Create A records named www.contoso.com and asuid.contoso.com." }, { "key": "B", "text": "Create a TXT record named asuid that contains the domain verification ID." }, { "key": "C", "text": "Create a CNAME record named asuid that contains the domain verification ID." }, { "key": "D", "text": "Create a TXT record named www.contoso.com that has a value of contoso.azurewebsites.net." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "TXT record is always first. This step is the proof you actually own the domain and TXT record is needed to\nverify this.\nhttps://learn.microsoft.com/en-us/azure/app-service/app-service-web-tutorial-custom-domain?\ntabs=a%2Cazurecli", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 564, "pdfId": 564, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/564" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains 10 network security groups (NSGs), 10 virtual machines, and a Log\nAnalytics workspace named Workspace1. Each NSG is connected to a virtual machine.\nYou need to configure an Azure Monitor Network Insights alert that will be triggered when suspicious network\ntraffic is detected.\nWhat should you do first?\nA.\nDeploy Connection Monitor.\nB.\nConfigure data collection endpoints.\nC.\nConfigure a private link.\nD.\nConfigure NSG flow logs.", "stem": "You have an Azure subscription that contains 10 network security groups (NSGs), 10 virtual machines, and a Log Analytics workspace named Workspace1. Each NSG is connected to a virtual machine. You need to configure an Azure Monitor Network Insights alert that will be triggered when suspicious network traffic is detected. What should you do first", "options": [ { "key": "A", "text": "Deploy Connection Monitor." }, { "key": "B", "text": "Configure data collection endpoints." }, { "key": "C", "text": "Configure a private link." }, { "key": "D", "text": "Configure NSG flow logs." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "To configure an Azure Monitor Network Insights alert that will be triggered when suspicious network traffic is\ndetected, you should first configure NSG flow logs.\nNSG flow logs provide information about traffic that is allowed or denied by an NSG. By configuring NSG flow\nlogs, you will be able to monitor the traffic passing through your NSGs and detect any suspicious activity.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 565, "pdfId": 565, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/565" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "YES - \"alert is listed\" does not mean a notification in my understanding therefore yes\nNO- The date is within suppression rule boundaries therefore email will be suppressed\nYES - The date is outside suppression rule boundaries", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 566, "pdfId": 566, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/566" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains a storage account named storage1 in the North Europe Azure region.\nYou need to ensure that when blob data is added to storage1, a secondary copy is created in the East US region.\nThe solution must minimize administrative effort.\nWhat should you configure?\nA.\noperational backup\nB.\nobject replication\nC.\ngeo-redundant storage (GRS)\nD.\na lifecycle management rule", "stem": "You have an Azure subscription that contains a storage account named storage1 in the North Europe Azure region. You need to ensure that when blob data is added to storage1, a secondary copy is created in the East US region. The solution must minimize administrative effort. What should you configure", "options": [ { "key": "A", "text": "operational backup" }, { "key": "B", "text": "object replication" }, { "key": "C", "text": "geo-redundant storage (GRS)" }, { "key": "D", "text": "a lifecycle management rule" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Object replication is a feature that allows you to replicate data, such as blobs, across different storage\naccounts or containers within the same storage account. This can be configured to automatically copy data\nfrom one storage location to another, either within the same region or across different regions. Object\nreplication can be used to create disaster recovery solutions or to distribute data globally for better\nperformance and availability.\nIt is similar to GRS but it is more flexible as you can choose the storage account and container to replicate the\ndata.\nThe GRS of a North Europe region is a secondary copy of the data stored in a different region. The exact\nlocation of the secondary region will depend on the specific Azure region you have selected. For the North\nEurope region, the secondary copy is stored in the West Europe region. This means that if there is an outage or\ndisaster in the North Europe region, your data will still be available in the West Europe region. This provides a\nhigh level of data durability and protection.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 567, "pdfId": 567, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/567" }, "markersInGap": [ 566, 567 ], "questionText": "You have an Azure subscription that contains two Log Analytics workspaces named Workspace1 and Workspace2\nand 100 virtual machines that run Windows Server.\nYou need to collect performance data and events from the virtual machines. The solution must meet the following\nrequirements:\n• Logs must be sent to Workspace1 and Workspace 2.\n• All Windows events must be captured.\n• All security events must be captured.\nWhat should you install and configure on each virtual machine?\nA.\nthe Azure Monitor agent\nB.\nthe Windows Azure diagnostics extension (WAD)\n C.\nthe Windows VM agent", "stem": "You have an Azure subscription that contains two Log Analytics workspaces named Workspace1 and Workspace2 and 100 virtual machines that run Windows Server. You need to collect performance data and events from the virtual machines. The solution must meet the following requirements: • Logs must be sent to Workspace1 and Workspace 2. • All Windows events must be captured. • All security events must be captured. What should you install and configure on each virtual machine", "options": [ { "key": "A", "text": "the Azure Monitor agent" }, { "key": "B", "text": "the Windows Azure diagnostics extension (WAD)" }, { "key": "C", "text": "the Windows VM agent" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview\nAzure Monitor Agent (AMA) collects monitoring data from the guest operating system of Azure and hybrid\nvirtual machines and delivers it to Azure Monitor for use by features, insights, and other services, such as\nMicrosoft Sentinel and Microsoft Defender for Cloud. Azure Monitor Agent replaces all of Azure Monitor's\nlegacy monitoring agents.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 568, "pdfId": 568, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/568" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains a virtual machine named VM1 and an Azure function named App1.\nYou need to create an alert rule that will run App1 if VM1 stops.\nWhat should you create for the alert rule?\nA.\nan application security group\nB.\na security group that has dynamic device membership\nC.\nan action group\nD.\nan application group", "stem": "You have an Azure subscription that contains a virtual machine named VM1 and an Azure function named App1. You need to create an alert rule that will run App1 if VM1 stops. What should you create for the alert rule", "options": [ { "key": "A", "text": "an application security group" }, { "key": "B", "text": "a security group that has dynamic device membership" }, { "key": "C", "text": "an action group" }, { "key": "D", "text": "an application group" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "An action group is a collection of actions that are triggered by an Azure alert. In this scenario, you need to\ncreate an alert rule that will run App1 if VM1 stops, and for this purpose, you need to create an action group.\nAn action group defines the set of actions to be taken when an alert is triggered, such as running an Azure\nfunction, sending an email, or creating an Azure ticket.\nBy creating an action group and associating it with the alert rule, you can automate the process of running\nApp1 if VM1 stops, without the need for manual intervention. This helps ensure that critical systems, such as\nApp1, are automatically activated when necessary, improving the overall reliability and availability of your\nAzure services.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 569, "pdfId": 569, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/569" }, "markersInGap": [ 568, 569 ], "questionText": "You have an Azure subscription that contains a virtual network named VNet1.\nVNet1 uses two ExpressRoute circuits that connect to two separate on-premises datacenters.\nYou need to create a dashboard to display detailed metrics and a visual representation of the network topology.\nWhat should you use?\nA.\nAzure Monitor Network Insights\nB.\na Data Collection Rule (DCR)\nC.\nAzure Virtual Network Watcher\n D.\nLog Analytics", "stem": "You have an Azure subscription that contains a virtual network named VNet1. VNet1 uses two ExpressRoute circuits that connect to two separate on-premises datacenters. You need to create a dashboard to display detailed metrics and a visual representation of the network topology. What should you use", "options": [ { "key": "A", "text": "Azure Monitor Network Insights" }, { "key": "B", "text": "a Data Collection Rule (DCR)" }, { "key": "C", "text": "Azure Virtual Network Watcher" }, { "key": "D", "text": "Log Analytics" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "https://learn.microsoft.com/en-us/azure/network-watcher/network-insights-overview\nAzure Monitor Network Insights provides a comprehensive and visual representation through topologies, of\nhealth and metrics for all deployed network resources, without requiring any configuration. It also provides\naccess to network monitoring capabilities like Connection Monitor, flow logging for network security groups\n(NSGs), and Traffic Analytics. And it provides other network diagnostic features.\nYou deploy Azure virtual machines to three Azure regions", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nA.\nAzure Virtual Network Manager\nB.\nIP flow verify\nC.\nAzure Monitor Network Insights\nD.\nConnection troubleshoot\nE.\nelective security rules", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 570, "pdfId": 570, "exam": "AZ-104", "type": "multi_select", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/570" }, "markersInGap": [], "questionText": "Each region contains a virtual network. Each virtual network contains multiple subnets peered in a full mesh\ntopology.\nEach subnet contains a network security group (NSG) that has defined rules.\nA user reports that he cannot use port 33000 to connect from a virtual machine in one region to a virtual machine\nin another region.\nWhich two options can you use to diagnose the issue? Each correct answer presents a complete solution.\nNOTE: Each correct selection is worth one point.\nA.\nAzure Virtual Network Manager\nB.\nIP flow verify\nC.\nAzure Monitor Network Insights\nD.\nConnection troubleshoot\nE.\nelective security rules", "stem": "Each region contains a virtual network. Each virtual network contains multiple subnets peered in a full mesh topology. Each subnet contains a network security group (NSG) that has defined rules. A user reports that he cannot use port 33000 to connect from a virtual machine in one region to a virtual machine in another region. Which two options can you use to diagnose the issue? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.", "options": [ { "key": "A", "text": "Azure Virtual Network Manager" }, { "key": "B", "text": "IP flow verify" }, { "key": "C", "text": "Azure Monitor Network Insights" }, { "key": "D", "text": "Connection troubleshoot" }, { "key": "E", "text": "elective security rules" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview\nIP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of\ndirection, protocol, local IP, remote IP, local port, and a remote port. If the packet is denied by a security\ngroup, the name of the rule that denied the packet is returned. While any source or destination IP can be\nchosen, IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and\nfrom or to the on-premises environment.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 571, "pdfId": 571, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/571" }, "markersInGap": [ 570, 571 ], "questionText": "You have an Azure subscription.\nYou need to receive an email alert when a resource lock is removed from any resource in the subscription.\nWhat should you use to create an activity log alert in Azure Monitor?\n A.\na resource, a condition, and an action group\nB.\na resource, a condition, and a Microsoft 365 group\nC.\na Log Analytics workspace, a resource, and an action group\nD.\na data collection endpoint, an application security group, and a resource group", "stem": "You have an Azure subscription. You need to receive an email alert when a resource lock is removed from any resource in the subscription. What should you use to create an activity log alert in Azure Monitor", "options": [ { "key": "A", "text": "a resource, a condition, and an action group" }, { "key": "B", "text": "a resource, a condition, and a Microsoft 365 group" }, { "key": "C", "text": "a Log Analytics workspace, a resource, and an action group" }, { "key": "D", "text": "a data collection endpoint, an application security group, and a resource group" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "You create an alert rule by combining:\n- The resources to be monitored.\n- The signal or telemetry from the resource.\n- Conditions.\nThen you define these elements for the resulting alert actions by using:\n- Alert processing rules\n- Action groups", "reference": "https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-create-new-alert-rule", "references": [ "https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-create-new-alert-rule" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 572, "pdfId": 572, "exam": "AZ-104", "type": "dropdown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/572" }, "markersInGap": [ 572 ], "questionText": "HOTSPOT\n-\nYou have an Azure subscription that contains the alerts shown in the following exhibit.\nUse the drop-down menus to select the answer choice that completes each statement based on the information\npresented in the graphic.\n NOTE: Each correct selection is worth one point.", "stem": "You have an Azure subscription that contains the alerts shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "For Alert1:\ncan be changed to New or Acknowledged.\nThis implies that Alert1 is in a state that allows it to be modified either back to New or to Acknowledged.\nThe other available choices indicate that some alerts may only be changed to \"New,\" \"Acknowledged,\" or may\nnot be changeable at all.\nFor Alert2:\ncan be changed to Acknowledged or Closed.\nThis means Alert2 is in a state where it can transition to either Acknowledged (indicating recognition of the\nalert) or Closed (indicating resolution or dismissal of the alert).\nThe other choices suggest some alerts may only transition to \"Acknowledged\" or \"Closed\" individually, or not\nat all.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 573, "pdfId": 573, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/573" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: 10 years\nThe yearly backup point occurs to 1 March and its retention period is 10 years.\nBox 2: 36 months\nThe monthly backup point occurs on the 1\nof every month and its retention period is 36 months.", "reference": "https://docs.microsoft.com/en-us/microsoft-365/compliance/retention?view=o365-worldwide", "references": [ "https://docs.microsoft.com/en-us/microsoft-365/compliance/retention?view=o365-worldwide" ], "note": "Azure retention policy takes the longest period of retention for each backup. In case of conflict between\n2 different policies.\nReference:\nhttps://docs.microsoft.com/en-us/microsoft-365/compliance/retention?view=o365-worldwide", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 574, "pdfId": 574, "exam": "AZ-104", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/574" }, "markersInGap": [ 574 ], "questionText": "HOTSPOT\n-\nYou have an Azure subscription that contains the vaults shown in the following table.\nYou deploy the virtual machines shown in the following table.\n You have the backup policies shown in the following table.\nFor each of the following statements, select Yes if the statement is true. Otherwise, select No.\nNOTE: Each correct selection is worth one point.", "stem": "You have an Azure subscription that contains the vaults shown in the following table. You deploy the virtual machines shown in the following table. You have the backup policies shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1.VM1 can be backed up by using Policy1.\nThe\nYes\n option is selected.\nThis means that Policy1 is applicable to VM1, allowing it to be backed up successfully.\n2.VM2 can be backed up by using Policy3.\nThe\nNo\n option is selected.\nThis indicates that Policy3 does not apply to VM2, meaning VM2 cannot be backed up using this policy.\n3.VM2 can be backed up by using Policy2.\nThe\nYes\noption is selected.\nThis confirms that Policy2 is applicable to VM2, allowing it to be backed up successfully.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 575, "pdfId": 575, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/575" }, "markersInGap": [], "questionText": "You have an Azure subscription. The subscription contains virtual machines that connect to a virtual network\nnamed VNet1.\nYou plan to configure Azure Monitor for VM Insights.\nYou need to ensure that all the virtual machines only communicate with Azure Monitor through VNet1.\nWhat should you create first?\nA.\na data collection rule (DCR)\nB.\na Log Analytics workspace\nC.\nan Azure Monitor Private Link Scope (AMPLS)\nD.\na private endpoint", "stem": "You have an Azure subscription. The subscription contains virtual machines that connect to a virtual network named VNet1. You plan to configure Azure Monitor for VM Insights. You need to ensure that all the virtual machines only communicate with Azure Monitor through VNet1. What should you create first", "options": [ { "key": "A", "text": "a data collection rule (DCR)" }, { "key": "B", "text": "a Log Analytics workspace" }, { "key": "C", "text": "an Azure Monitor Private Link Scope (AMPLS)" }, { "key": "D", "text": "a private endpoint" } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "Azure Monitor private links are structured differently from private links to other services you might use.\nInstead of creating multiple private links, one for each resource the virtual network connects to, Azure\nMonitor uses a single private link connection, from the virtual network to an AMPLS. AMPLS is the set of all\nAzure Monitor resources to which a virtual network connects through a private link.", "reference": "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-security", "references": [ "https://learn.microsoft.com/en-us/azure/azure-monitor/logs/private-link-security" ], "note": "Each correct answer is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 576, "pdfId": 576, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/576" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1.cont1 (Container 1)\nBackup1 only.\nThis means that cont1 is configured to be backed up using Backup1 and is not using Recovery1.\n2.share1 (File Share 1)\nRecovery1 only.\nThis means that share1 is configured for recovery under Recovery1 but is not backed up using Backup1.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 577, "pdfId": 577, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/577" }, "markersInGap": [ 577 ], "questionText": "You have an Azure subscription that contains an Azure Stream Analytics job named Job1.\nYou need to monitor input events for Job1 to identify the number of events that were NOT processed.\n Which metric should you use?\nA.\nOut-of-Order Events\nB.\nOutput Events\nC.\nLate Input Events\nD.\nBacklogged Input Events", "stem": "You have an Azure subscription that contains an Azure Stream Analytics job named Job1. You need to monitor input events for Job1 to identify the number of events that were NOT processed. Which metric should you use", "options": [ { "key": "A", "text": "Out-of-Order Events" }, { "key": "B", "text": "Output Events" }, { "key": "C", "text": "Late Input Events" }, { "key": "D", "text": "Backlogged Input Events" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Correct", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 578, "pdfId": 578, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/578" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Data sent to a Log Analytics workspace can be consumed by SQL Analytics, which provides intelligent\nmonitoring of your databases including performance reports, alerts, and mitigation recommendations.\nMoreover, data in a Log Analytics workspace can be analysed alongside other monitoring data collected, and\nalso allows you to leverage other Azure Monitor features such as alerts and visualizations.\nhttps://learn.microsoft.com/en-us/azure/azure-sql/database/metrics-diagnostic-telemetry-logging-\nstreaming-export-configure?view=azuresql&tabs=azure-\nportalhttps://www.sqlservercentral.com/articles/monitoring-azure-sql-\ndatabases#:~:text=If%20not%2C%20just%20search%20for%20Log%20Analytics%\n20workspace,Set%20the%20destination%20to%20your%20Log%20Analytics%20Workspace.#:~:\ntext=If%20not%2C%20just%20search%20for,to%20your%20Log%20Analytics%20Workspace\nhttps://techcommunity.microsoft.com/t5/azure-database-\nsupport-blog/azure-sql-db-and-log-analytics-better-together-part-1/ba-p/794833", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 579, "pdfId": 579, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/579" }, "markersInGap": [], "questionText": "You have an Azure subscription. The subscription contains virtual machines that run Windows Server.\nYou have a data collection rule (DCR) named Rule1.\nYou plan to use the Azure Monitor Agent to collect events from Windows System event logs.\nYou only need to collect system events that have an ID of 1001.\nWhich type of query should you use for the data source in Rule1?\nA.\nSQL\nB.\nXPath\nC.\nKQL", "stem": "You have an Azure subscription. The subscription contains virtual machines that run Windows Server. You have a data collection rule (DCR) named Rule1. You plan to use the Azure Monitor Agent to collect events from Windows System event logs. You only need to collect system events that have an ID of 1001. Which type of query should you use for the data source in Rule1", "options": [ { "key": "A", "text": "SQL" }, { "key": "B", "text": "XPath" }, { "key": "C", "text": "KQL" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Custom data source in Azure Portal says: \"Use XPath queries to filter event logs and limit data collection\"\nTo collect specific events from Windows System event logs, such as those with an Event ID of 1001, you\nshould use an XPath query. XPath is a query language that can be used to filter XML data, which is the format\nused by Windows Event Logs. In Azure Monitor, when configuring data collection rules for collecting Windows\nevent log data, XPath queries are used to specify the criteria for the events you want to collect.\nthe correct answer is: B. XPath.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 580, "pdfId": 580, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/580" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains a virtual machine named VM1.\nYou have an on-premises datacenter that contains a domain controller named DC1. ExpressRoute is used to\nconnect the on-premises datacenter to Azure.\nYou need to use Connection Monitor to identify network latency between VM1 and DC1.\nWhat should you install on DC1?\nA.\nthe Azure Connected Machine agent for Azure Arc-enabled servers\nB.\nthe Azure Network Watcher Agent virtual machine extension\nC.\nthe Log Analytics agent\nD.\nan Azure Monitor agent extension", "stem": "You have an Azure subscription that contains a virtual machine named VM1. You have an on-premises datacenter that contains a domain controller named DC1. ExpressRoute is used to connect the on-premises datacenter to Azure. You need to use Connection Monitor to identify network latency between VM1 and DC1. What should you install on DC1", "options": [ { "key": "A", "text": "the Azure Connected Machine agent for Azure Arc-enabled servers" }, { "key": "B", "text": "the Azure Network Watcher Agent virtual machine extension" }, { "key": "C", "text": "the Log Analytics agent" }, { "key": "D", "text": "an Azure Monitor agent extension" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Connection monitor supports the Azure Monitor agent extension, which eliminates any dependency on the\nlegacy Log Analytics agent. https://learn.microsoft.com/en-us/azure/network-watcher/azure-monitor-agent-\nwith-connection-monitorThe following (older) link talks about setting up the Log Analytics agent.\nhttps://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-overview#agents-for-on-\npremises-machines", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 581, "pdfId": 581, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/581" }, "markersInGap": [], "questionText": "You have an Azure subscription that has Traffic Analytics configured.\nYou deploy a new virtual machine named VM1 that has the following settings:\n•Region: East US\n•Virtual network: VNet1\n•NIC network security group: NSG1\nYou need to monitor VM1 traffic by using Traffic Analytics.\nWhich settings should you configure?\nA.\nDiagnostic settings for VM1\nB.\nNSG flow logs for NSG1\nC.\nDiagnostic settings for NSG1\nD.\nInsights for VM1", "stem": "You have an Azure subscription that has Traffic Analytics configured. You deploy a new virtual machine named VM1 that has the following settings: •Region: East US •Virtual network: VNet1 •NIC network security group: NSG1 You need to monitor VM1 traffic by using Traffic Analytics. Which settings should you configure", "options": [ { "key": "A", "text": "Diagnostic settings for VM1" }, { "key": "B", "text": "NSG flow logs for NSG1" }, { "key": "C", "text": "Diagnostic settings for NSG1" }, { "key": "D", "text": "Insights for VM1" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "NSG flow logs are a feature of Azure Network Watcher that allows logging of information about IP traffic\nflowing through a network security group. This data can be used by Traffic Analytics to analyze network\ntraffic in your environment. By enabling NSG flow logs for NSG1, the Network Security Group associated with\nVM1, you would be able to monitor the traffic of VM1 using Traffic Analytics\nhttps://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics\nhttps://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-tutorial", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 582, "pdfId": 582, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/582" }, "markersInGap": [], "questionText": "You have an Azure subscription. The subscription contains 10 virtual machines that run Windows Server. Each\nvirtual machine hosts a website in IIS and has the Azure Monitor Agent installed.\nYou need to collect the IIS logs from each virtual machine and store them in a Log Analytics workspace.\nWhat should you configure first?\nA.\na data collection endpoint\nB.\nan Azure Monitor Private Link Scope (AMPLS)\nC.\nDiagnostic settings\nD.\nVM insights\nE.\na private endpoint", "stem": "You have an Azure subscription. The subscription contains 10 virtual machines that run Windows Server. Each virtual machine hosts a website in IIS and has the Azure Monitor Agent installed. You need to collect the IIS logs from each virtual machine and store them in a Log Analytics workspace. What should you configure first", "options": [ { "key": "A", "text": "a data collection endpoint" }, { "key": "B", "text": "an Azure Monitor Private Link Scope (AMPLS)" }, { "key": "C", "text": "Diagnostic settings" }, { "key": "D", "text": "VM insights" }, { "key": "E", "text": "a private endpoint" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A Data Collection Endpoint (DCE) is required when:\nUsing Azure Monitor Agent\nCollecting custom logs (like IIS logs)\nSending data to Log Analytics\nIt establishes the ingestion endpoint for the data.", "reference": null, "references": [], "note": "Each correct selection is worth one point.", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 583, "pdfId": 583, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/583" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "No, because the Microsoft.Storage service endpoint is configured for Subnet1, which VM1 is connected to, but\nthe policy shown is specifically for contoso101. There is no indication that VM1 can access contoso102.\nVM2 can access contoso101.\nNo, because VM2 is connected to Subnet2, and the Microsoft.Storage service endpoint is only configured for\nSubnet1, not Subnet2. Therefore, VM2 cannot access contoso101.\nVM2 uses a private IP address to access Azure AD.\nYes, because the Microsoft.AzureActiveDirectory service endpoint is enabled for Subnet2, where VM2 is\nconnected. This allows VM2 to access Azure AD using a private IP.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nA.\na Log Analytics workspace\nB.\nan Azure Monitor workbook\nC.\na storage account\nD.\na Microsoft Sentinel workspace\nE.\na Data Collection Rule (DCR) in Azure Monitor", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 584, "pdfId": 584, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/584" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. A Log Analytics workspace - Traffic Analytics requires a Log Analytics workspace to store and analyze\nnetwork traffic data.\nE. A Data Collection Rule (DCR) in Azure Monitor - You need to create a Data Collection Rule within Azure\nMonitor to specify what data should be collected and sent to the Log Analytics workspace, including the\nnetwork traffic data for Traffic Analytics.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 585, "pdfId": 585, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/585" }, "markersInGap": [], "questionText": "You have an Azure subscription that contains a virtual machine named VM1.\nYou plan to deploy an Azure Monitor alert rule that will trigger an alert when CPU usage on VM1 exceeds 80\npercent.\nYou need to ensure that the alert rule sends an email message to two users named User1 and User2.\nWhat should you create for Azure Monitor?\nA.\nan action group\nB.\na mail-enabled security group\nC.\na distribution group\nD.\na Microsoft 365 group", "stem": "You have an Azure subscription that contains a virtual machine named VM1. You plan to deploy an Azure Monitor alert rule that will trigger an alert when CPU usage on VM1 exceeds 80 percent. You need to ensure that the alert rule sends an email message to two users named User1 and User2. What should you create for Azure Monitor", "options": [ { "key": "A", "text": "an action group" }, { "key": "B", "text": "a mail-enabled security group" }, { "key": "C", "text": "a distribution group" }, { "key": "D", "text": "a Microsoft 365 group" } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A. an action group.\nIn Azure Monitor, an action group is used to define actions when an alert is triggered. Since the goal is to send\nan email to User1 and User2 when CPU usage exceeds 80% on VM1, you need to:\nCreate an Azure Monitor alert rule that monitors CPU usage on VM1.\nCreate an action group that includes email addresses for User1 and User2.\nAssociate the action group with the alert rule, so that when the alert is triggered, an email notification is sent.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 586, "pdfId": 586, "exam": "AZ-104", "type": "hotspot", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/586" }, "markersInGap": [ 585, 586 ], "questionText": "HOTSPOT -\nYou need to configure the Device settings to meet the technical requirements and the user requirements.\nWhich two settings should you modify? To answer, select the appropriate settings in the answer area.\nHot Area:", "stem": "You need to configure the Device settings to meet the technical requirements and the user requirements. Which two settings should you modify? To answer, select the appropriate settings in the answer area. Hot Area:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Selected -\nOnly selected users should be able to join devices\nBox 2: Yes -\nEnsure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to\nverify their identity.\n_______________________________________________________________________\nCase Study Description", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 587, "pdfId": 587, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/587" }, "markersInGap": [], "questionText": "Contoso Ltd\nOverview\nContoso, Ltd. is a manufacturing company that has offices worldwide. Contoso works with partner\norganizations to bring products to market.\nContoso products are manufactured by using blueprint files that the company authors and maintains.\nExisting Environment\nCurrently, Contoso uses multiple types of servers for business operations, including the following:\n✑\n File servers\n✑\n Domain controllers\n✑\n Microsoft SQL Server servers\nYour network contains an Active Directory forest named contoso.com. All servers and client computers are\njoined to Active Directory.\nYou have a public-facing application named App1.\nApp1 is comprised of the following three tiers:\n✑\n A SQL database\n✑\n A web front end\n✑\n A processing middle tier\nEach tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.\nRequirements\nPlanned Changes\nContoso plans to implement the following changes to the infrastructure:\n- Move all the tiers of App1 to Azure.\n- Move the existing product blueprint files to Azure Blob storage.\n- Create a hybrid directory to support an upcoming Microsoft Office 365 migration project.\nTechnical Requirements\nContoso must meet the following technical requirements:\n✑\n Move all the virtual machines for App1 to Azure.\n✑\n Minimize the number of open ports between the App1 tiers.\n✑\n Ensure that all the virtual machines for App1 are protected by backups.\n✑\n Copy the blueprint files to Azure over the Internet.\n✑\n Ensure that the blueprint files are stored in the archive storage tier.\n✑\n Ensure that partner access to the blueprint files is secured and temporary.\n✑\n Prevent user passwords or hashes of passwords from being stored in Azure.\n✑\n Use unmanaged standard storage for the hard disks of the virtual machines.\n✑\n Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to\nverify their identity.\nMinimize administrative effort whenever possible.\nUser Requirements\nContoso identifies the following requirements for users:\n✑\n Ensure that only users who are part of a group named Pilot can join devices to Azure AD.\n✑\n Designate a new user named Admin1 as the service administrator of the Azure subscription.\n✑\n Admin1 must receive email alerts regarding service outages.\n✑\n Ensure that a new user named User3 can create network objects for the Azure subscription.\nYou need to meet the user requirement for Admin1.\nWhat should you do?\nA.\nFrom the Azure Active Directory blade, modify the Groups\nB.\nFrom the Azure Active Directory blade, modify the Properties\nC.\nFrom the Subscriptions blade, select the subscription, and then modify the Access control (IAM) settings\nD.\nFrom the Subscriptions blade, select the subscription, and then modify the Properties", "stem": "Contoso Ltd Overview Contoso, Ltd. is a manufacturing company that has offices worldwide. Contoso works with partner organizations to bring products to market. Contoso products are manufactured by using blueprint files that the company authors and maintains. Existing Environment Currently, Contoso uses multiple types of servers for business operations, including the following: ✑ File servers ✑ Domain controllers ✑ Microsoft SQL Server servers Your network contains an Active Directory forest named contoso.com. All servers and client computers are joined to Active Directory. You have a public-facing application named App1. App1 is comprised of the following three tiers: ✑ A SQL database ✑ A web front end ✑ A processing middle tier Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only. Requirements Planned Changes Contoso plans to implement the following changes to the infrastructure: - Move all the tiers of App1 to Azure. - Move the existing product blueprint files to Azure Blob storage. - Create a hybrid directory to support an upcoming Microsoft Office 365 migration project. Technical Requirements Contoso must meet the following technical requirements: ✑ Move all the virtual machines for App1 to Azure. ✑ Minimize the number of open ports between the App1 tiers. ✑ Ensure that all the virtual machines for App1 are protected by backups. ✑ Copy the blueprint files to Azure over the Internet. ✑ Ensure that the blueprint files are stored in the archive storage tier. ✑ Ensure that partner access to the blueprint files is secured and temporary. ✑ Prevent user passwords or hashes of passwords from being stored in Azure. ✑ Use unmanaged standard storage for the hard disks of the virtual machines. ✑ Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity. Minimize administrative effort whenever possible. User Requirements Contoso identifies the following requirements for users: ✑ Ensure that only users who are part of a group named Pilot can join devices to Azure AD. ✑ Designate a new user named Admin1 as the service administrator of the Azure subscription. ✑ Admin1 must receive email alerts regarding service outages. ✑ Ensure that a new user named User3 can create network objects for the Azure subscription. You need to meet the user requirement for Admin1. What should you do", "options": [ { "key": "A", "text": "From the Azure Active Directory blade, modify the Groups" }, { "key": "B", "text": "From the Azure Active Directory blade, modify the Properties" }, { "key": "C", "text": "From the Subscriptions blade, select the subscription, and then modify the Access control (IAM) settings" }, { "key": "D", "text": "From the Subscriptions blade, select the subscription, and then modify the Properties" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Scenario:\n✑\n Designate a new user named Admin1 as the service admin for the Azure subscription.\n✑\n Admin1 must receive email alerts regarding service outages.\nFollow these steps to change the Service Administrator in the Azure portal.\n1. Make sure your scenario is supported by checking the limitations for changing the Service Administrator.\n2. Sign in to the Azure portal as the Account Administrator.\n3. Open Cost Management + Billing and select a subscription.\n4. In the left navigation, click Properties.\n5. Click Service Admin.", "reference": "https://docs.microsoft.com/en-us/azure/role-based-access-control/classic-administrators\n_______________________________________________________________________\nCase Study Description", "references": [ "https://docs.microsoft.com/en-us/azure/role-based-access-control/classic-administrators" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 588, "pdfId": 588, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/588" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: 3 -", "reference": "https://docs.microsoft.com/en-us/azure/backup/backup-create-rs-vault https://docs.microsoft.com/en-\nus/azure/backup/guidance-best-practices\n___________________________________________________________________________\nCase Study Description:", "references": [ "https://docs.microsoft.com/en-us/azure/backup/backup-create-rs-vault", "https://docs.microsoft.com/en-" ], "note": "Back up the Azure file shares and virtual machines by using Azure Backup\nReference:\nhttps://docs.microsoft.com/en-us/azure/backup/backup-create-rs-vault https://docs.microsoft.com/en-\nus/azure/backup/guidance-best-practices\n___________________________________________________________________________\nCase Study Description:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 589, "pdfId": 589, "exam": "AZ-104", "type": "drag_drop", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/589" }, "markersInGap": [], "questionText": "Contoso Ltd (Consulting Company)\nCase study\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like\nto complete each case. However, there may be additional case studies and sections on this exam. You must\nmanage your time to ensure that you are able to complete all questions included on this exam in the time\nprovided.\nTo answer the questions included in a case study, you will need to reference information that is provided in\nthe case study. Case studies might contain exhibits and other resources that provide more information about\nthe scenario that is described in the case study. Each question is independent of the other questions in this\ncase study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and\nto make changes before you move to the next section of the exam. After you begin a new section, you cannot\nreturn to this section.\nTo start the case study\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to\nexplore the content of the case study before you answer the questions. Clicking these buttons displays\ninformation such as business requirements, existing environment, and problem statements. If the case study\nhas an All Information tab, note that the information displayed is identical to the information displayed on the\nsubsequent tabs. When you are ready to answer a question, click the Question button to return to the\nquestion.\nOverview\nGeneral Overview\nContoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and\nNew York.\nEnvironment\nExisting Environment\nContoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant.\nThe network contains an on-premises Active Directory domain that syncs to the Azure AD tenant.\nThe Azure AD tenant contains the users shown in the following table.\nSub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table.\nUser1 manages the resources in RG1. User4 manages the resources in RG2.\nSub1 contains virtual machines that run Windows Server 2019 as shown in the following table\nNo network security groups (NSGs) are associated to the network interfaces or the subnets.\nSub1 contains the storage accounts shown in the following table.\nRequirements\nPlanned Changes\nContoso plans to implement the following changes:\n✑\n Create a blob container named container1 and a file share named share1 that will use the Cool storage tier.\n✑\n Create a storage account named storage5 and configure storage replication for the Blob service.\n✑\n Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.\n✑\n Associate NSG1 to the network interface of VM1.\n✑\n Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table.\n✑\n Associate NSG2 to VNET1/Subnet2.\nTechnical Requirements\nContoso must meet the following technical requirements:\n✑\n Create container1 and share1.\n✑\n Use the principle of least privilege.\n✑\n Create an Azure AD security group named Group4.\n✑\n Back up the Azure file shares and virtual machines by using Azure Backup.\n✑\n Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.\n✑\n Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1.\n✑\n Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1\n✑\n Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months.\n✑\n Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to\nthe Azure file shares.\nDRAG DROP -\nYou need to configure the alerts for VM1 and VM2 to meet the technical requirements.\nWhich three actions should you perform in sequence? To answer, move all actions from the list of actions to the\nanswer area and arrange them in the correct order.\nSelect and Place:", "stem": "Contoso Ltd (Consulting Company) Case study This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question. Overview General Overview Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York. Environment Existing Environment Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an on-premises Active Directory domain that syncs to the Azure AD tenant. The Azure AD tenant contains the users shown in the following table. Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table. User1 manages the resources in RG1. User4 manages the resources in RG2. Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table No network security groups (NSGs) are associated to the network interfaces or the subnets. Sub1 contains the storage accounts shown in the following table. Requirements Planned Changes Contoso plans to implement the following changes: ✑ Create a blob container named container1 and a file share named share1 that will use the Cool storage tier. ✑ Create a storage account named storage5 and configure storage replication for the Blob service. ✑ Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table. ✑ Associate NSG1 to the network interface of VM1. ✑ Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table. ✑ Associate NSG2 to VNET1/Subnet2. Technical Requirements Contoso must meet the following technical requirements: ✑ Create container1 and share1. ✑ Use the principle of least privilege. ✑ Create an Azure AD security group named Group4. ✑ Back up the Azure file shares and virtual machines by using Azure Backup. ✑ Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C. ✑ Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1. ✑ Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1 ✑ Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months. ✑ Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure file shares. You need to configure the alerts for VM1 and VM2 to meet the technical requirements. Which three actions should you perform in sequence? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "1 - Create a Log Analytics workspace: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-\nanalytics-workspace-overview\n2- Configure the Diagnostic settings: https://learn.microsoft.com/en-us/azure/azure-\nmonitor/essentials/diagnostic-settings\n3 - Create an alert rule: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-log\nCreate a Log Analytics workspace:\nProvides a central place to collect and analyze log data from your virtual machines. Without a Log Analytics\nworkspace, you cannot effectively gather and analyze the necessary performance metrics.\nConfigure the Diagnostic settings:\nConfiguring diagnostic settings on VM1 and VM2 ensures that performance data, including disk space\nmetrics, are sent to the Log Analytics workspace.\nCreate an alert rule:\nAfter data collection is set up, creating an alert rule based on a log search query allows you to monitor\nspecific conditions, such as the available disk space on VM1 and VM2. The alert rule will notify you when the\nfree space falls below the threshold, enabling proactive management.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 590, "pdfId": 590, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/590" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Reference:\nhttps://docs.microsoft.com/en-us/azure/governance/policy/overview\n___________________________________________________________________________\nCase Study Description:", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 591, "pdfId": 591, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/591" }, "markersInGap": [], "questionText": "Contoso Ltd (Consulting Company)\nCase study\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like\nto complete each case. However, there may be additional case studies and sections on this exam. You must\nmanage your time to ensure that you are able to complete all questions included on this exam in the time\nprovided.\nTo answer the questions included in a case study, you will need to reference information that is provided in\nthe case study. Case studies might contain exhibits and other resources that provide more information about\nthe scenario that is described in the case study. Each question is independent of the other questions in this\ncase study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and\nto make changes before you move to the next section of the exam. After you begin a new section, you cannot\nreturn to this section.\nTo start the case study\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to\nexplore the content of the case study before you answer the questions. Clicking these buttons displays\ninformation such as business requirements, existing environment, and problem statements. If the case study\nhas an All Information tab, note that the information displayed is identical to the information displayed on the\nsubsequent tabs. When you are ready to answer a question, click the Question button to return to the\nquestion.\nOverview\nGeneral Overview\nContoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and\nNew York.\nEnvironment\nExisting Environment\nContoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant.\nThe network contains an on-premises Active Directory domain that syncs to the Azure AD tenant.\nThe Azure AD tenant contains the users shown in the following table.\nSub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table.\nUser1 manages the resources in RG1. User4 manages the resources in RG2.\nSub1 contains virtual machines that run Windows Server 2019 as shown in the following table\nNo network security groups (NSGs) are associated to the network interfaces or the subnets.\nSub1 contains the storage accounts shown in the following table.\nRequirements\nPlanned Changes\nContoso plans to implement the following changes:\n✑\n Create a blob container named container1 and a file share named share1 that will use the Cool storage tier.\n✑\n Create a storage account named storage5 and configure storage replication for the Blob service.\n✑\n Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.\n✑\n Associate NSG1 to the network interface of VM1.\n✑\n Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table.\n✑\n Associate NSG2 to VNET1/Subnet2.\nTechnical Requirements\nContoso must meet the following technical requirements:\n✑\n Create container1 and share1.\n✑\n Use the principle of least privilege.\n✑\n Create an Azure AD security group named Group4.\n✑\n Back up the Azure file shares and virtual machines by using Azure Backup.\n✑\n Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.\n✑\n Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1.\n✑\n Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1\n✑\n Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months.\n✑\n Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to\nthe Azure file shares.\nYou need to ensure that you can grant Group4 Azure RBAC read only permissions to all the Azure file shares.\nWhat should you do?\nA.\nOn storage2, enable identity-based access for the file shares.\nB.\nRecreate storage2 and set Hierarchical namespace to Enabled.\nC.\nOn storage1 and storage4, change the Account kind type to StorageV2 (general purpose v2).\nD.\nCreate a shared access signature (SAS) for storage1, storage2, and storage4.", "stem": "Contoso Ltd (Consulting Company) Case study This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question. Overview General Overview Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York. Environment Existing Environment Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an on-premises Active Directory domain that syncs to the Azure AD tenant. The Azure AD tenant contains the users shown in the following table. Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table. User1 manages the resources in RG1. User4 manages the resources in RG2. Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table No network security groups (NSGs) are associated to the network interfaces or the subnets. Sub1 contains the storage accounts shown in the following table. Requirements Planned Changes Contoso plans to implement the following changes: ✑ Create a blob container named container1 and a file share named share1 that will use the Cool storage tier. ✑ Create a storage account named storage5 and configure storage replication for the Blob service. ✑ Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table. ✑ Associate NSG1 to the network interface of VM1. ✑ Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table. ✑ Associate NSG2 to VNET1/Subnet2. Technical Requirements Contoso must meet the following technical requirements: ✑ Create container1 and share1. ✑ Use the principle of least privilege. ✑ Create an Azure AD security group named Group4. ✑ Back up the Azure file shares and virtual machines by using Azure Backup. ✑ Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C. ✑ Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1. ✑ Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1 ✑ Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months. ✑ Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure file shares. You need to ensure that you can grant Group4 Azure RBAC read only permissions to all the Azure file shares. What should you do", "options": [ { "key": "A", "text": "On storage2, enable identity-based access for the file shares." }, { "key": "B", "text": "Recreate storage2 and set Hierarchical namespace to Enabled." }, { "key": "C", "text": "On storage1 and storage4, change the Account kind type to StorageV2 (general purpose v2)." }, { "key": "D", "text": "Create a shared access signature (SAS) for storage1, storage2, and storage4." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Azure Files supports identity-based authentication over Server Message Block (SMB) through on-premises\nActive Directory Domain Services (AD DS) and Azure\nActive Directory Domain Services (Azure AD DS).", "reference": "https://docs.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview\n___________________________________________________________________________\nCase Study Description:", "references": [ "https://docs.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 592, "pdfId": 592, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/592" }, "markersInGap": [ 591 ], "questionText": "Contoso Ltd (Consulting Company)\nCase study\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like\nto complete each case. However, there may be additional case studies and sections on this exam. You must\n manage your time to ensure that you are able to complete all questions included on this exam in the time\nprovided.\nTo answer the questions included in a case study, you will need to reference information that is provided in\nthe case study. Case studies might contain exhibits and other resources that provide more information about\nthe scenario that is described in the case study. Each question is independent of the other questions in this\ncase study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and\nto make changes before you move to the next section of the exam. After you begin a new section, you cannot\nreturn to this section.\nTo start the case study\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to\nexplore the content of the case study before you answer the questions. Clicking these buttons displays\ninformation such as business requirements, existing environment, and problem statements. If the case study\nhas an All Information tab, note that the information displayed is identical to the information displayed on the\nsubsequent tabs. When you are ready to answer a question, click the Question button to return to the\nquestion.\nOverview\nGeneral Overview\nContoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and\nNew York.\nEnvironment\nExisting Environment\nContoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant.\nThe network contains an on-premises Active Directory domain that syncs to the Azure AD tenant.\nThe Azure AD tenant contains the users shown in the following table.\nSub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table.\nUser1 manages the resources in RG1. User4 manages the resources in RG2.\nSub1 contains virtual machines that run Windows Server 2019 as shown in the following table\nNo network security groups (NSGs) are associated to the network interfaces or the subnets.\nSub1 contains the storage accounts shown in the following table.\nRequirements\nPlanned Changes\nContoso plans to implement the following changes:\n✑\n Create a blob container named container1 and a file share named share1 that will use the Cool storage tier.\n✑\n Create a storage account named storage5 and configure storage replication for the Blob service.\n✑\n Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.\n✑\n Associate NSG1 to the network interface of VM1.\n✑\n Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table.\n✑\n Associate NSG2 to VNET1/Subnet2.\nTechnical Requirements\nContoso must meet the following technical requirements:\n✑\n Create container1 and share1.\n✑\n Use the principle of least privilege.\n✑\n Create an Azure AD security group named Group4.\n✑\n Back up the Azure file shares and virtual machines by using Azure Backup.\n✑\n Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.\n✑\n Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1.\n✑\n Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1\n✑\n Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months.\n✑\n Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to\nthe Azure file shares.\nYou need to implement a backup solution for App1 after the application is moved.\nWhat should you create first?\nA.\na recovery plan\nB.\nan Azure Backup Server\nC.\na backup policy\nD.\na Recovery Services vault", "stem": "Contoso Ltd (Consulting Company) Case study This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question. Overview General Overview Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York. Environment Existing Environment Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an on-premises Active Directory domain that syncs to the Azure AD tenant. The Azure AD tenant contains the users shown in the following table. Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table. User1 manages the resources in RG1. User4 manages the resources in RG2. Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table No network security groups (NSGs) are associated to the network interfaces or the subnets. Sub1 contains the storage accounts shown in the following table. Requirements Planned Changes Contoso plans to implement the following changes: ✑ Create a blob container named container1 and a file share named share1 that will use the Cool storage tier. ✑ Create a storage account named storage5 and configure storage replication for the Blob service. ✑ Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table. ✑ Associate NSG1 to the network interface of VM1. ✑ Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table. ✑ Associate NSG2 to VNET1/Subnet2. Technical Requirements Contoso must meet the following technical requirements: ✑ Create container1 and share1. ✑ Use the principle of least privilege. ✑ Create an Azure AD security group named Group4. ✑ Back up the Azure file shares and virtual machines by using Azure Backup. ✑ Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C. ✑ Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1. ✑ Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1 ✑ Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months. ✑ Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure file shares. You need to implement a backup solution for App1 after the application is moved. What should you create first", "options": [ { "key": "A", "text": "a recovery plan" }, { "key": "B", "text": "an Azure Backup Server" }, { "key": "C", "text": "a backup policy" }, { "key": "D", "text": "a Recovery Services vault" } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "A Recovery Services vault is a logical container that stores the backup data for each protected resource, such\nas Azure VMs. When the backup job for a protected resource runs, it creates a recovery point inside the\nRecovery Services vault.\nScenario:\nThere are three application tiers, each with five virtual machines.\nMove all the virtual machines for App1 to Azure.\nEnsure that all the virtual machines for App1 are protected by backups.", "reference": "https://docs.microsoft.com/en-us/azure/backup/quick-backup-vm-portal\n_______________________________________________________________________\nCase Study Description", "references": [ "https://docs.microsoft.com/en-us/azure/backup/quick-backup-vm-portal" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 593, "pdfId": 593, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/593" }, "markersInGap": [], "questionText": "Contoso Ltd\nOverview\nContoso, Ltd. is a manufacturing company that has offices worldwide. Contoso works with partner\norganizations to bring products to market.\nContoso products are manufactured by using blueprint files that the company authors and maintains.\nExisting Environment\nCurrently, Contoso uses multiple types of servers for business operations, including the following:\n✑\n File servers\n✑\n Domain controllers\n✑\n Microsoft SQL Server servers\nYour network contains an Active Directory forest named contoso.com. All servers and client computers are\njoined to Active Directory.\nYou have a public-facing application named App1.\nApp1 is comprised of the following three tiers:\n✑\n A SQL database\n✑\n A web front end\n✑\n A processing middle tier\nEach tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.\nRequirements\nPlanned Changes\nContoso plans to implement the following changes to the infrastructure:\n- Move all the tiers of App1 to Azure.\n- Move the existing product blueprint files to Azure Blob storage.\n- Create a hybrid directory to support an upcoming Microsoft Office 365 migration project.\nTechnical Requirements\nContoso must meet the following technical requirements:\n✑\n Move all the virtual machines for App1 to Azure.\n✑\n Minimize the number of open ports between the App1 tiers.\n✑\n Ensure that all the virtual machines for App1 are protected by backups.\n✑\n Copy the blueprint files to Azure over the Internet.\n✑\n Ensure that the blueprint files are stored in the archive storage tier.\n✑\n Ensure that partner access to the blueprint files is secured and temporary.\n✑\n Prevent user passwords or hashes of passwords from being stored in Azure.\n✑\n Use unmanaged standard storage for the hard disks of the virtual machines.\n✑\n Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to\nverify their identity.\nMinimize administrative effort whenever possible.\nUser Requirements\nContoso identifies the following requirements for users:\n✑\n Ensure that only users who are part of a group named Pilot can join devices to Azure AD.\n✑\n Designate a new user named Admin1 as the service administrator of the Azure subscription.\n✑\n Admin1 must receive email alerts regarding service outages.\n✑\n Ensure that a new user named User3 can create network objects for the Azure subscription.\nYou need to move the blueprint files to Azure.\nWhat should you do?\nA.\nGenerate an access key. Map a drive, and then copy the files by using File Explorer.\nB.\nUse Azure Storage Explorer to copy the files.\nC.\nUse the Azure Import/Export service.\nD.\nGenerate a shared access signature (SAS). Map a drive, and then copy the files by using File Explorer.", "stem": "Contoso Ltd Overview Contoso, Ltd. is a manufacturing company that has offices worldwide. Contoso works with partner organizations to bring products to market. Contoso products are manufactured by using blueprint files that the company authors and maintains. Existing Environment Currently, Contoso uses multiple types of servers for business operations, including the following: ✑ File servers ✑ Domain controllers ✑ Microsoft SQL Server servers Your network contains an Active Directory forest named contoso.com. All servers and client computers are joined to Active Directory. You have a public-facing application named App1. App1 is comprised of the following three tiers: ✑ A SQL database ✑ A web front end ✑ A processing middle tier Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only. Requirements Planned Changes Contoso plans to implement the following changes to the infrastructure: - Move all the tiers of App1 to Azure. - Move the existing product blueprint files to Azure Blob storage. - Create a hybrid directory to support an upcoming Microsoft Office 365 migration project. Technical Requirements Contoso must meet the following technical requirements: ✑ Move all the virtual machines for App1 to Azure. ✑ Minimize the number of open ports between the App1 tiers. ✑ Ensure that all the virtual machines for App1 are protected by backups. ✑ Copy the blueprint files to Azure over the Internet. ✑ Ensure that the blueprint files are stored in the archive storage tier. ✑ Ensure that partner access to the blueprint files is secured and temporary. ✑ Prevent user passwords or hashes of passwords from being stored in Azure. ✑ Use unmanaged standard storage for the hard disks of the virtual machines. ✑ Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity. Minimize administrative effort whenever possible. User Requirements Contoso identifies the following requirements for users: ✑ Ensure that only users who are part of a group named Pilot can join devices to Azure AD. ✑ Designate a new user named Admin1 as the service administrator of the Azure subscription. ✑ Admin1 must receive email alerts regarding service outages. ✑ Ensure that a new user named User3 can create network objects for the Azure subscription. You need to move the blueprint files to Azure. What should you do", "options": [ { "key": "A", "text": "Generate an access key. Map a drive, and then copy the files by using File Explorer." }, { "key": "B", "text": "Use Azure Storage Explorer to copy the files." }, { "key": "C", "text": "Use the Azure Import/Export service." }, { "key": "D", "text": "Generate a shared access signature (SAS). Map a drive, and then copy the files by using File Explorer." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Azure Storage Explorer is a free tool from Microsoft that allows you to work with Azure Storage data on\nWindows, macOS, and Linux. You can use it to upload and download data from Azure blob storage.\nScenario:\nPlanned Changes include: move the existing product blueprint files to Azure Blob storage.\nTechnical Requirements include: Copy the blueprint files to Azure over the Internet.", "reference": "https://docs.microsoft.com/en-us/azure/machine-learning/team-data-science-process/move-data-to-azure-\nblob-using-azure-storage-explorer\n_______________________________________________________________________\nCase Study Description", "references": [ "https://docs.microsoft.com/en-us/azure/machine-learning/team-data-science-process/move-data-to-azure-" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 594, "pdfId": 594, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/594" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Yes -", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 595, "pdfId": 595, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/595" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Reference:\nhttps://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers\nhttps://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview\n___________________________________________________________________________\nCase Study Description:", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 596, "pdfId": 596, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/596" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Reference:\nhttps://docs.microsoft.com/en-us/azure/storage/blobs/object-replication-configure?tabs=portal\n___________________________________________________________________________\nCase Study Description:", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 597, "pdfId": 597, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/597" }, "markersInGap": [], "questionText": "Contoso Ltd (Consulting Company)\nCase study\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like\nto complete each case. However, there may be additional case studies and sections on this exam. You must\nmanage your time to ensure that you are able to complete all questions included on this exam in the time\nprovided.\nTo answer the questions included in a case study, you will need to reference information that is provided in\nthe case study. Case studies might contain exhibits and other resources that provide more information about\nthe scenario that is described in the case study. Each question is independent of the other questions in this\ncase study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and\nto make changes before you move to the next section of the exam. After you begin a new section, you cannot\nreturn to this section.\nTo start the case study\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to\nexplore the content of the case study before you answer the questions. Clicking these buttons displays\ninformation such as business requirements, existing environment, and problem statements. If the case study\nhas an All Information tab, note that the information displayed is identical to the information displayed on the\nsubsequent tabs. When you are ready to answer a question, click the Question button to return to the\nquestion.\nOverview\nGeneral Overview\nContoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and\nNew York.\nEnvironment\nExisting Environment\nContoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant.\nThe network contains an on-premises Active Directory domain that syncs to the Azure AD tenant.\nThe Azure AD tenant contains the users shown in the following table.\nSub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table.\nUser1 manages the resources in RG1. User4 manages the resources in RG2.\nSub1 contains virtual machines that run Windows Server 2019 as shown in the following table\nNo network security groups (NSGs) are associated to the network interfaces or the subnets.\nSub1 contains the storage accounts shown in the following table.\nRequirements\nPlanned Changes\nContoso plans to implement the following changes:\n✑\n Create a blob container named container1 and a file share named share1 that will use the Cool storage tier.\n✑\n Create a storage account named storage5 and configure storage replication for the Blob service.\n✑\n Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.\n✑\n Associate NSG1 to the network interface of VM1.\n✑\n Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table.\n✑\n Associate NSG2 to VNET1/Subnet2.\nTechnical Requirements\nContoso must meet the following technical requirements:\n✑\n Create container1 and share1.\n✑\n Use the principle of least privilege.\n✑\n Create an Azure AD security group named Group4.\n✑\n Back up the Azure file shares and virtual machines by using Azure Backup.\n✑\n Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.\n✑\n Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1.\n✑\n Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1\n✑\n Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months.\n✑\n Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to\nthe Azure file shares.\nYou need to identify which storage account to use for the flow logging of IP traffic from VM5. The solution must\nmeet the retention requirements.\nWhich storage account should you identify?\nA.\nstorage1\nB.\nstorage2\nC.\nstorage3\nD.\nstorage4", "stem": "Contoso Ltd (Consulting Company) Case study This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question. Overview General Overview Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York. Environment Existing Environment Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an on-premises Active Directory domain that syncs to the Azure AD tenant. The Azure AD tenant contains the users shown in the following table. Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table. User1 manages the resources in RG1. User4 manages the resources in RG2. Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table No network security groups (NSGs) are associated to the network interfaces or the subnets. Sub1 contains the storage accounts shown in the following table. Requirements Planned Changes Contoso plans to implement the following changes: ✑ Create a blob container named container1 and a file share named share1 that will use the Cool storage tier. ✑ Create a storage account named storage5 and configure storage replication for the Blob service. ✑ Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table. ✑ Associate NSG1 to the network interface of VM1. ✑ Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table. ✑ Associate NSG2 to VNET1/Subnet2. Technical Requirements Contoso must meet the following technical requirements: ✑ Create container1 and share1. ✑ Use the principle of least privilege. ✑ Create an Azure AD security group named Group4. ✑ Back up the Azure file shares and virtual machines by using Azure Backup. ✑ Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C. ✑ Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1. ✑ Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1 ✑ Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months. ✑ Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure file shares. You need to identify which storage account to use for the flow logging of IP traffic from VM5. The solution must meet the retention requirements. Which storage account should you identify", "options": [ { "key": "A", "text": "storage1" }, { "key": "B", "text": "storage2" }, { "key": "C", "text": "storage3" }, { "key": "D", "text": "storage4" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "For at least two reasons, storage2 is the only candidate:\n- Location: The storage account used must be in the same region as the NSG.\n- Retention is available only if you use General Purpose v2 Storage accounts (GPv2).", "reference": "https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview\n___________________________________________________________________________\nCase Study Description:", "references": [ "https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 598, "pdfId": 598, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/598" }, "markersInGap": [ 597 ], "questionText": "Contoso Ltd (Consulting Company)\nCase study\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like\nto complete each case. However, there may be additional case studies and sections on this exam. You must\nmanage your time to ensure that you are able to complete all questions included on this exam in the time\nprovided.\nTo answer the questions included in a case study, you will need to reference information that is provided in\nthe case study. Case studies might contain exhibits and other resources that provide more information about\nthe scenario that is described in the case study. Each question is independent of the other questions in this\ncase study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and\nto make changes before you move to the next section of the exam. After you begin a new section, you cannot\nreturn to this section.\nTo start the case study\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to\n explore the content of the case study before you answer the questions. Clicking these buttons displays\ninformation such as business requirements, existing environment, and problem statements. If the case study\nhas an All Information tab, note that the information displayed is identical to the information displayed on the\nsubsequent tabs. When you are ready to answer a question, click the Question button to return to the\nquestion.\nOverview\nGeneral Overview\nContoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and\nNew York.\nEnvironment\nExisting Environment\nContoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant.\nThe network contains an on-premises Active Directory domain that syncs to the Azure AD tenant.\nThe Azure AD tenant contains the users shown in the following table.\nSub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table.\nUser1 manages the resources in RG1. User4 manages the resources in RG2.\nSub1 contains virtual machines that run Windows Server 2019 as shown in the following table\nNo network security groups (NSGs) are associated to the network interfaces or the subnets.\nSub1 contains the storage accounts shown in the following table.\nRequirements\nPlanned Changes\nContoso plans to implement the following changes:\n✑\n Create a blob container named container1 and a file share named share1 that will use the Cool storage tier.\n✑\n Create a storage account named storage5 and configure storage replication for the Blob service.\n✑\n Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.\n✑\n Associate NSG1 to the network interface of VM1.\n✑\n Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table.\n✑\n Associate NSG2 to VNET1/Subnet2.\nTechnical Requirements\nContoso must meet the following technical requirements:\n✑\n Create container1 and share1.\n✑\n Use the principle of least privilege.\n✑\n Create an Azure AD security group named Group4.\n✑\n Back up the Azure file shares and virtual machines by using Azure Backup.\n✑\n Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.\n✑\n Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1.\n✑\n Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1\n✑\n Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months.\n✑\n Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to\nthe Azure file shares.\nYou discover that VM3 does NOT meet the technical requirements.\nYou need to verify whether the issue relates to the NSGs.\nWhat should you use?\nA.\nDiagram in VNet1\nB.\nDiagnostic settings in Azure Monitor\nC.\nDiagnose and solve problems in Traffic Manager profiles\nD.\nThe security recommendations in Azure Advisor\nE.\nIP flow verify in Azure Network Watcher", "stem": "Contoso Ltd (Consulting Company) Case study This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question. Overview General Overview Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York. Environment Existing Environment Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an on-premises Active Directory domain that syncs to the Azure AD tenant. The Azure AD tenant contains the users shown in the following table. Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table. User1 manages the resources in RG1. User4 manages the resources in RG2. Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table No network security groups (NSGs) are associated to the network interfaces or the subnets. Sub1 contains the storage accounts shown in the following table. Requirements Planned Changes Contoso plans to implement the following changes: ✑ Create a blob container named container1 and a file share named share1 that will use the Cool storage tier. ✑ Create a storage account named storage5 and configure storage replication for the Blob service. ✑ Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table. ✑ Associate NSG1 to the network interface of VM1. ✑ Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table. ✑ Associate NSG2 to VNET1/Subnet2. Technical Requirements Contoso must meet the following technical requirements: ✑ Create container1 and share1. ✑ Use the principle of least privilege. ✑ Create an Azure AD security group named Group4. ✑ Back up the Azure file shares and virtual machines by using Azure Backup. ✑ Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C. ✑ Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1. ✑ Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1 ✑ Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months. ✑ Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure file shares. You discover that VM3 does NOT meet the technical requirements. You need to verify whether the issue relates to the NSGs. What should you use", "options": [ { "key": "A", "text": "Diagram in VNet1" }, { "key": "B", "text": "Diagnostic settings in Azure Monitor" }, { "key": "C", "text": "Diagnose and solve problems in Traffic Manager profiles" }, { "key": "D", "text": "The security recommendations in Azure Advisor" }, { "key": "E", "text": "IP flow verify in Azure Network Watcher" } ], "answer": { "raw": "E", "keys": [ "E" ] }, "explanation": "Scenario: Contoso must meet technical requirements including:\nEnsure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in the\nMontreal office.\nIP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of\ndirection, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a security group,\nthe name of the rule that denied the packet is returned. While any source or destination IP can be chosen,\nIP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to\nthe on-premises environment.", "reference": "https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview\n________________________________________________________________________\nCase Study Description\nLitware, inc.\nOverview\nLitware, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and\nNew York.\nThe Montreal office has 2,000 employees. The Seattle office has 1,000 employees. The New York office has\n200 employees.\nAll the resources used by Litware are hosted on-premises.\nLitware creates a new Azure subscription. The Azure Active Directory (Azure AD) tenant uses a domain named\nLitware.onmicrosoft.com. The tenant uses the P1 pricing tier.\nExisting Environment\nThe network contains an Active Directory forest named Litware.com. All domain controllers are configured as\nDNS servers and host the Litware.com DNS zone.\nLitware has finance, human resources, sales, research, and information technology departments. Each\ndepartment has an organizational unit (OU) that contains all the accounts of that respective department. All\nthe user accounts have the department attribute set to their respective department. New users are added\nfrequently.\nLitware.com contains a user named User1.\nAll the offices connect by using private links.\nLitware has data centers in the Montreal and Seattle offices. Each data center has a firewall that can be\nconfigured as a VPN device.\nAll infrastructure servers are virtualized.\nThe virtualization environment contains the servers in the following table.\nLitware uses two web applications named App1 and App2. Each instance on each web application requires\n1GB of memory.\nThe Azure subscription contains the resources in the following table.\nThe network security team implements several network security groups (NSGs).\nPlanned Changes\nLitware plans to implement the following changes:\n• Deploy Azure ExpressRoute to the Montreal office.\n• Migrate the virtual machines hosted on Server1 and Server2 to Azure.\n• Synchronize on-premises Active Directory to Azure Active Directory (Azure AD).\n• Migrate App1 and App2 to two Azure web apps named webApp1 and WebApp2.\nTechnical requirements\nLitware must meet the following technical requirements:\n• Ensure that WebApp1 can adjust the number of instances automatically based on the load and can scale up\nto five instance*.\n• Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in the\nMontreal office.\n• Ensure that routing information is exchanged automatically between Azure and the routers in the Montreal\noffice.\n• Enable Azure Multi-Factor Authentication (MFA) for the users in the finance department only.\n• Ensure that webapp2.azurewebsites.net can be accessed by using the name app2.Litware.com.\n• Connect the New Your office to VNet1 over the Internet by using an encrypted connection.\n• Create a workflow to send an email message when the settings of VM4 are modified.\n• Create a custom Azure role named Role1 that is based on the Reader role.\n• Minimize costs whenever possible.", "references": [ "https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 599, "pdfId": 599, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/599" }, "markersInGap": [], "questionText": "You need to ensure that VM1 can communicate with VM4. The solution must minimize the administrative effort.\nWhat should you do?\nA.\nCreate an NSG and associate the NSG to VM1 and VM4.\nB.\nEstablish peering between VNET1 and VNET3.\nC.\nAssign VM4 an IP address of 10.0.1.5/24.\nD.\nCreate a user-defined route from VNET1 to VNET3.", "stem": "You need to ensure that VM1 can communicate with VM4. The solution must minimize the administrative effort. What should you do", "options": [ { "key": "A", "text": "Create an NSG and associate the NSG to VM1 and VM4." }, { "key": "B", "text": "Establish peering between VNET1 and VNET3." }, { "key": "C", "text": "Assign VM4 an IP address of 10.0.1.5/24." }, { "key": "D", "text": "Create a user-defined route from VNET1 to VNET3." } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Establishing peering between the virtual networks (VNETs) allows traffic to flow between them without the\nneed for additional configuration or routing. This solution minimizes administrative effort, as it requires only a\nsingle step to set up the peering. Option A, creating an NSG, would require additional rules and configuration\nto allow communication between VM1 and VM4. Option C, assigning a specific IP address to VM4, does not\naddress the issue of network communication. Option D, creating a user-defined route, would also require\nadditional configuration and management.\n________________________________________________________________________\nCase Study Description\nLitware, inc.\nOverview\nLitware, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and\nNew York.\nThe Montreal office has 2,000 employees. The Seattle office has 1,000 employees. The New York office has\n200 employees.\nAll the resources used by Litware are hosted on-premises.\nLitware creates a new Azure subscription. The Azure Active Directory (Azure AD) tenant uses a domain named\nLitware.onmicrosoft.com. The tenant uses the P1 pricing tier.\nExisting Environment\nThe network contains an Active Directory forest named Litware.com. All domain controllers are configured as\nDNS servers and host the Litware.com DNS zone.\nLitware has finance, human resources, sales, research, and information technology departments. Each\ndepartment has an organizational unit (OU) that contains all the accounts of that respective department. All\nthe user accounts have the department attribute set to their respective department. New users are added\nfrequently.\nLitware.com contains a user named User1.\nAll the offices connect by using private links.\nLitware has data centers in the Montreal and Seattle offices. Each data center has a firewall that can be\nconfigured as a VPN device.\nAll infrastructure servers are virtualized.\nThe virtualization environment contains the servers in the following table.\nLitware uses two web applications named App1 and App2. Each instance on each web application requires\n1GB of memory.\nThe Azure subscription contains the resources in the following table.\nThe network security team implements several network security groups (NSGs).\nPlanned Changes\nLitware plans to implement the following changes:\n• Deploy Azure ExpressRoute to the Montreal office.\n• Migrate the virtual machines hosted on Server1 and Server2 to Azure.\n• Synchronize on-premises Active Directory to Azure Active Directory (Azure AD).\n• Migrate App1 and App2 to two Azure web apps named webApp1 and WebApp2.\nTechnical requirements\nLitware must meet the following technical requirements:\n• Ensure that WebApp1 can adjust the number of instances automatically based on the load and can scale up\nto five instance*.\n• Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in the\nMontreal office.\n• Ensure that routing information is exchanged automatically between Azure and the routers in the Montreal\noffice.\n• Enable Azure Multi-Factor Authentication (MFA) for the users in the finance department only.\n• Ensure that webapp2.azurewebsites.net can be accessed by using the name app2.Litware.com.\n• Connect the New Your office to VNet1 over the Internet by using an encrypted connection.\n• Create a workflow to send an email message when the settings of VM4 are modified.\n• Create a custom Azure role named Role1 that is based on the Reader role.\n• Minimize costs whenever possible.", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 600, "pdfId": 600, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/600" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Create a virtual network gateway and a local network gateway.\nAzure VPN gateway. The VPN gateway service enables you to connect the VNet to the on-premises network\nthrough a VPN appliance. For more information, see\nConnect an on-premises network to a Microsoft Azure virtual network. The VPN gateway includes the\nfollowing elements:\n✑\n Virtual network gateway. A resource that provides a virtual VPN appliance for the VNet. It is responsible for\nrouting traffic from the on-premises network to the\nVNet.\n✑\n Local network gateway. An abstraction of the on-premises VPN appliance. Network traffic from the cloud\napplication to the on-premises network is routed through this gateway.\n✑\n Connection. The connection has properties that specify the connection type (IPSec) and the key shared with\nthe on-premises VPN appliance to encrypt traffic.\n✑\n Gateway subnet. The virtual network gateway is held in its own subnet, which is subject to various\nrequirements, described in the Recommendations section below.\nBox 2: Configure a site-to-site VPN connection\nOn premises create a site-to-site connection for the virtual network gateway and the local network gateway.\nScenario: Connect the New York office to VNet1 over the Internet by using an encrypted connection.\nIncorrect Answers:\nAzure ExpressRoute: Established between your network and Azure, through an ExpressRoute partner. This\nconnection is private. Traffic does not go over the internet.", "reference": "https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/vpn\n________________________________________________________________________\nCase Study Description\nLitware, inc.\nOverview\nLitware, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle and\nNew York.\nThe Montreal office has 2,000 employees. The Seattle office has 1,000 employees. The New York office has\n200 employees.\nAll the resources used by Litware are hosted on-premises.\nLitware creates a new Azure subscription. The Azure Active Directory (Azure AD) tenant uses a domain named\nLitware.onmicrosoft.com. The tenant uses the P1 pricing tier.\nExisting Environment\nThe network contains an Active Directory forest named Litware.com. All domain controllers are configured as\nDNS servers and host the Litware.com DNS zone.\nLitware has finance, human resources, sales, research, and information technology departments. Each\ndepartment has an organizational unit (OU) that contains all the accounts of that respective department. All\nthe user accounts have the department attribute set to their respective department. New users are added\nfrequently.\nLitware.com contains a user named User1.\nAll the offices connect by using private links.\nLitware has data centers in the Montreal and Seattle offices. Each data center has a firewall that can be\nconfigured as a VPN device.\nAll infrastructure servers are virtualized.\nThe virtualization environment contains the servers in the following table.\nLitware uses two web applications named App1 and App2. Each instance on each web application requires\n1GB of memory.\nThe Azure subscription contains the resources in the following table.\nThe network security team implements several network security groups (NSGs).\nPlanned Changes\nLitware plans to implement the following changes:\n• Deploy Azure ExpressRoute to the Montreal office.\n• Migrate the virtual machines hosted on Server1 and Server2 to Azure.\n• Synchronize on-premises Active Directory to Azure Active Directory (Azure AD).\n• Migrate App1 and App2 to two Azure web apps named webApp1 and WebApp2.\nTechnical requirements\nLitware must meet the following technical requirements:\n• Ensure that WebApp1 can adjust the number of instances automatically based on the load and can scale up\nto five instance*.\n• Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in the\nMontreal office.\n• Ensure that routing information is exchanged automatically between Azure and the routers in the Montreal\noffice.\n• Enable Azure Multi-Factor Authentication (MFA) for the users in the finance department only.\n• Ensure that webapp2.azurewebsites.net can be accessed by using the name app2.Litware.com.\n• Connect the New Your office to VNet1 over the Internet by using an encrypted connection.\n• Create a workflow to send an email message when the settings of VM4 are modified.\n• Create a custom Azure role named Role1 that is based on the Reader role.\n• Minimize costs whenever possible.", "references": [ "https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/hybrid-networking/vpn" ], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 601, "pdfId": 601, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/601" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "This reference architecture shows how to deploy VMs and a virtual network configured for an N-tier\napplication, using SQL Server on Windows for the data tier.\nScenario: You have a public-facing application named App1. App1 is comprised of the following three tiers:\n✑\n A SQL database\n✑\n A web front end\n✑\n A processing middle tier", "reference": "https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/n-tier/n-tier-sql-server\n________________________________________________________________________\nCase Study Description", "references": [ "https://docs.microsoft.com/en-us/azure/architecture/reference-architectures/n-tier/n-tier-sql-server" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 602, "pdfId": 602, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/602" }, "markersInGap": [], "questionText": "Contoso Ltd\n\nOverview\n\nContoso, Ltd. is a manufacturing company that has offices\nworldwide. Contoso works with partner organizations to bring products to\nmarket.\nContoso products are manufactured by using blueprint files that\nthe company authors and maintains.\n\nExisting Environment\n\nCurrently, Contoso uses multiple types of servers for business\noperations, including the following:\n✑\n File servers\n✑\n Domain controllers\n✑\n Microsoft SQL Server\nservers\n\nYour network contains an Active Directory forest named\ncontoso.com. All servers and client computers are joined to Active Directory.\nYou have a public-facing application named App1.\nApp1 is comprised of the following three tiers:\n✑\n A SQL database\n✑\n A web front end\n✑\n A processing middle tier\n\nEach tier is comprised of five virtual machines. Users access\nthe web front end by using HTTPS only.\n\nRequirements\n\nPlanned Changes\n\nContoso plans to implement\nthe following changes to the infrastructure:\n- Move all the tiers of App1 to Azure.\n- Move the existing product blueprint files to Azure Blob\nstorage.\n- Create a hybrid directory to support an upcoming Microsoft\nOffice 365 migration project.\n\nTechnical Requirements\n\nContoso must meet the\nfollowing technical requirements:\n✑\n Move all the virtual\nmachines for App1 to Azure.\n✑\n Minimize the number of\nopen ports between the App1 tiers.\n✑\n Ensure that all the\nvirtual machines for App1 are protected by backups.\n✑\n Copy the blueprint files\nto Azure over the Internet.\n✑\n Ensure that the blueprint\nfiles are stored in the archive storage tier.\n✑\n Ensure that partner\naccess to the blueprint files is secured and temporary.\n✑\n Prevent user passwords or\nhashes of passwords from being stored in Azure.\n✑\n Use unmanaged standard\nstorage for the hard disks of the virtual machines.\n✑\n Ensure that when users\njoin devices to Azure Active Directory (Azure AD), the users use a mobile phone\nto verify their identity.\n\nMinimize administrative effort whenever possible.\n\nUser Requirements\n\nContoso identifies the\nfollowing requirements for users:\n✑\n Ensure that only users\nwho are part of a group named Pilot can join devices to Azure AD.\n✑\n Designate a new user\nnamed Admin1 as the service administrator of the Azure subscription.\n✑\n Admin1 must receive email\nalerts regarding service outages.\n✑\n Ensure that a new user\nnamed User3 can create network objects for the Azure subscription.\nYou are planning the move of App1 to Azure.\nYou create a network security group (NSG).\nYou need to recommend a solution to provide users with access to App1.\nWhat should you recommend?\nA.\nCreate an incoming security rule for port 443 from the Internet. Associate the NSG to the subnet that\ncontains the web servers.\nB.\nCreate an outgoing security rule for port 443 from the Internet. Associate the NSG to the subnet that\ncontains the web servers.\nC.\nCreate an incoming security rule for port 443 from the Internet. Associate the NSG to all the subnets.\nD.\nCreate an outgoing security rule for port 443 from the Internet. Associate the NSG to all the subnets.", "stem": "Contoso Ltd Overview Contoso, Ltd. is a manufacturing company that has offices worldwide. Contoso works with partner organizations to bring products to market. Contoso products are manufactured by using blueprint files that the company authors and maintains. Existing Environment Currently, Contoso uses multiple types of servers for business operations, including the following: ✑ File servers ✑ Domain controllers ✑ Microsoft SQL Server servers Your network contains an Active Directory forest named contoso.com. All servers and client computers are joined to Active Directory. You have a public-facing application named App1. App1 is comprised of the following three tiers: ✑ A SQL database ✑ A web front end ✑ A processing middle tier Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only. Requirements Planned Changes Contoso plans to implement the following changes to the infrastructure: - Move all the tiers of App1 to Azure. - Move the existing product blueprint files to Azure Blob storage. - Create a hybrid directory to support an upcoming Microsoft Office 365 migration project. Technical Requirements Contoso must meet the following technical requirements: ✑ Move all the virtual machines for App1 to Azure. ✑ Minimize the number of open ports between the App1 tiers. ✑ Ensure that all the virtual machines for App1 are protected by backups. ✑ Copy the blueprint files to Azure over the Internet. ✑ Ensure that the blueprint files are stored in the archive storage tier. ✑ Ensure that partner access to the blueprint files is secured and temporary. ✑ Prevent user passwords or hashes of passwords from being stored in Azure. ✑ Use unmanaged standard storage for the hard disks of the virtual machines. ✑ Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity. Minimize administrative effort whenever possible. User Requirements Contoso identifies the following requirements for users: ✑ Ensure that only users who are part of a group named Pilot can join devices to Azure AD. ✑ Designate a new user named Admin1 as the service administrator of the Azure subscription. ✑ Admin1 must receive email alerts regarding service outages. ✑ Ensure that a new user named User3 can create network objects for the Azure subscription. You are planning the move of App1 to Azure. You create a network security group (NSG). You need to recommend a solution to provide users with access to App1. What should you recommend", "options": [ { "key": "A", "text": "Create an incoming security rule for port 443 from the Internet. Associate the NSG to the subnet that contains the web servers." }, { "key": "B", "text": "Create an outgoing security rule for port 443 from the Internet. Associate the NSG to the subnet that contains the web servers." }, { "key": "C", "text": "Create an incoming security rule for port 443 from the Internet. Associate the NSG to all the subnets." }, { "key": "D", "text": "Create an outgoing security rule for port 443 from the Internet. Associate the NSG to all the subnets." } ], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "Incoming and the web server subnet only, as users access the web front end by using HTTPS only.\nNote Scenario: You have a public-facing application named App1. App1 is comprised of the following three\ntiers:\n✑\n A SQL database\n✑\n A web front end\n✑\n A processing middle tier", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 603, "pdfId": 603, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/603" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Box 1: Yes-\nThe rule is configured inbound from VM1 and VM2 will allow the traffic because of stateful firewall inspection,\nthe traffic is allowed to come in. If the traffic is initiated from VM2 them it wouldn't work.-\nBox 2: Yes -\nICMP is not blocked -ping will be allow because the vnets are already peered\n traffic is initiated from VM2 and the outbound rule will block it.\nBox 3: No -\nNSG2 blocks RDP from VM2 -", "reference": "https://docs.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works\nCase Study Description:\nLitware, inc.\nOverview\nLitware, Ltd. is a consulting company that has a main office in Montreal and two branch offices in Seattle\nand New York.\nThe Montreal office has 2,000 employees. The Seattle office has 1,000 employees. The New York office has\n200 employees.\nAll the resources used by Litware are hosted on-premises.\nLitware creates a new Azure subscription. The Azure Active Directory (Azure AD) tenant uses a domain\nnamed Litware.onmicrosoft.com. The tenant uses the P1 pricing tier.\nExisting Environment\nThe network contains an Active Directory forest named Litware.com. All domain controllers are configured\nas DNS servers and host the Litware.com DNS zone.\nLitware has finance, human resources, sales, research, and information technology departments. Each\ndepartment has an organizational unit (OU) that contains all the accounts of that respective department.\nAll the user accounts have the department attribute set to their respective department. New users are\nadded frequently.\nLitware.com contains a user named User1.\nAll the offices connect by using private links.\nLitware has data centers in the Montreal and Seattle offices. Each data center has a firewall that can be\nconfigured as a VPN device.\nAll infrastructure servers are virtualized.\nThe virtualization environment contains the servers in the following table.\nLitware uses two web applications named App1 and App2. Each instance on each web application requires\n1GB of memory.\nThe Azure subscription contains the resources in the following table.\nThe network security team implements several network security groups (NSGs).\nPlanned Changes\nLitware plans to implement the following changes:\n• Deploy Azure ExpressRoute to the Montreal office.\n• Migrate the virtual machines hosted on Server1 and Server2 to Azure.\n• Synchronize on-premises Active Directory to Azure Active Directory (Azure AD).\n• Migrate App1 and App2 to two Azure web apps named webApp1 and WebApp2.\nTechnical requirements\nLitware must meet the following technical requirements:\n• Ensure that WebApp1 can adjust the number of instances automatically based on the load and can scale\nup to five instance*.\n• Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in\nthe Montreal office.\n• Ensure that routing information is exchanged automatically between Azure and the routers in the\nMontreal office.\n• Enable Azure Multi-Factor Authentication (MFA) for the users in the finance department only.\n• Ensure that webapp2.azurewebsites.net can be accessed by using the name app2.Litware.com.\n• Connect the New Your office to VNet1 over the Internet by using an encrypted connection.\n• Create a workflow to send an email message when the settings of VM4 are modified.\n• Create a custom Azure role named Role1 that is based on the Reader role.\n• Minimize costs whenever possible.", "references": [ "https://docs.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works" ], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 604, "pdfId": 604, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/604" }, "markersInGap": [], "questionText": "You need to ensure that you can add VM1 and VM2 to the backend pool of LB1.\nWhat should you do first?\nA.\nRedeploy VM1 and VM2 to the same availability zone.\nB.\nConnect VM2 to VNET1/Subnet1.\nC.\nCreate a new NSG and associate the NSG to VNET1/Subnet1.\nD.\nRedeploy VM1 and VM2 to the same availability set.", "stem": "You need to ensure that you can add VM1 and VM2 to the backend pool of LB1. What should you do first", "options": [ { "key": "A", "text": "Redeploy VM1 and VM2 to the same availability zone." }, { "key": "B", "text": "Connect VM2 to VNET1/Subnet1." }, { "key": "C", "text": "Create a new NSG and associate the NSG to VNET1/Subnet1." }, { "key": "D", "text": "Redeploy VM1 and VM2 to the same availability set." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Redeploy VM1 and VM2 to the same availability set.\nFor a LB basic it is required that the virtual machines are in a single availability set or scale set of virtual\nmachines\n\"An existing VM cannot be added to an availability set after it is created.\"\nhttps://learn.microsoft.com/en-us/azure/virtual-machines/linux/tutorial-availability-sets\nA VM can only be added to an availability set when it is created.\n\"https://learn.microsoft.com/en-us/azure/virtual-machines/windows/change-availability-set\"\nIf they are already in the same availability set , then you don't need to do B anyway, your a good little Azure\nadmin, keep it up and create your backend pool with them in it. The fact that this question is being asked with\nno option of 'nothing' means they are not already in the same AS.\n___________________________________________________________________________\nCase Study Description:", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 605, "pdfId": 605, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/605" }, "markersInGap": [], "questionText": "Contoso Ltd (Consulting Company)\nCase study\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like\nto complete each case. However, there may be additional case studies and sections on this exam. You must\nmanage your time to ensure that you are able to complete all questions included on this exam in the time\nprovided.\nTo answer the questions included in a case study, you will need to reference information that is provided in\nthe case study. Case studies might contain exhibits and other resources that provide more information about\nthe scenario that is described in the case study. Each question is independent of the other questions in this\ncase study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and\nto make changes before you move to the next section of the exam. After you begin a new section, you cannot\nreturn to this section.\nTo start the case study\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to\nexplore the content of the case study before you answer the questions. Clicking these buttons displays\ninformation such as business requirements, existing environment, and problem statements. If the case study\nhas an All Information tab, note that the information displayed is identical to the information displayed on the\nsubsequent tabs. When you are ready to answer a question, click the Question button to return to the\nquestion.\nOverview\nGeneral Overview\nContoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and\nNew York.\nEnvironment\nExisting Environment\nContoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant.\nThe network contains an on-premises Active Directory domain that syncs to the Azure AD tenant.\nThe Azure AD tenant contains the users shown in the following table.\nSub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table.\nUser1 manages the resources in RG1. User4 manages the resources in RG2.\nSub1 contains virtual machines that run Windows Server 2019 as shown in the following table\nNo network security groups (NSGs) are associated to the network interfaces or the subnets.\nSub1 contains the storage accounts shown in the following table.\nRequirements\nPlanned Changes\nContoso plans to implement the following changes:\n✑\n Create a blob container named container1 and a file share named share1 that will use the Cool storage tier.\n✑\n Create a storage account named storage5 and configure storage replication for the Blob service.\n✑\n Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.\n✑\n Associate NSG1 to the network interface of VM1.\n✑\n Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table.\n✑\n Associate NSG2 to VNET1/Subnet2.\nTechnical Requirements\nContoso must meet the following technical requirements:\n✑\n Create container1 and share1.\n✑\n Use the principle of least privilege.\n✑\n Create an Azure AD security group named Group4.\n✑\n Back up the Azure file shares and virtual machines by using Azure Backup.\n✑\n Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.\n✑\n Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1.\n✑\n Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1\n✑\n Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months.\n✑\n Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to\nthe Azure file shares.\nYou need to add VM1 and VM2 to the backend pool of LB1.\nWhat should you do first?\nA.\nConnect VM2 to VNET1/Subnet1.\nB.\nRedeploy VM1 and VM2 to the same availability zone.\nC.\nRedeploy VM1 and VM2 to the same availability set.\nD.\nCreate a new NSG and associate the NSG to VNET1/Subnet1.", "stem": "Contoso Ltd (Consulting Company) Case study This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question. Overview General Overview Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York. Environment Existing Environment Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an on-premises Active Directory domain that syncs to the Azure AD tenant. The Azure AD tenant contains the users shown in the following table. Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table. User1 manages the resources in RG1. User4 manages the resources in RG2. Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table No network security groups (NSGs) are associated to the network interfaces or the subnets. Sub1 contains the storage accounts shown in the following table. Requirements Planned Changes Contoso plans to implement the following changes: ✑ Create a blob container named container1 and a file share named share1 that will use the Cool storage tier. ✑ Create a storage account named storage5 and configure storage replication for the Blob service. ✑ Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table. ✑ Associate NSG1 to the network interface of VM1. ✑ Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table. ✑ Associate NSG2 to VNET1/Subnet2. Technical Requirements Contoso must meet the following technical requirements: ✑ Create container1 and share1. ✑ Use the principle of least privilege. ✑ Create an Azure AD security group named Group4. ✑ Back up the Azure file shares and virtual machines by using Azure Backup. ✑ Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C. ✑ Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1. ✑ Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1 ✑ Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months. ✑ Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure file shares. You need to add VM1 and VM2 to the backend pool of LB1. What should you do first", "options": [ { "key": "A", "text": "Connect VM2 to VNET1/Subnet1." }, { "key": "B", "text": "Redeploy VM1 and VM2 to the same availability zone." }, { "key": "C", "text": "Redeploy VM1 and VM2 to the same availability set." }, { "key": "D", "text": "Create a new NSG and associate the NSG to VNET1/Subnet1." } ], "answer": { "raw": "C", "keys": [ "C" ] }, "explanation": "No point in Connecting VM2 to VNET1/Subnet1 as you are going to have to redeploy it anyway.\n\"An existing VM cannot be added to an availability set after it is created.\"\nhttps://learn.microsoft.com/en-us/azure/virtual-machines/linux/tutorial-availability-sets\nA VM can only be added to an availability set when it is created.\n\"https://learn.microsoft.com/en-us/azure/virtual-machines/windows/change-availability-set\"\nIf they are already in the same availability set , then you don't need to do B anyway, your a good little Azure\nadmin, keep it up and create your backend pool with them in it. The fact that this question is being asked with\nno option of 'nothing' means they are not already in the same AS.\n___________________________________________________________________________\nCase Study Description:", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 606, "pdfId": 606, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/606" }, "markersInGap": [], "questionText": "Contoso Ltd (Consulting Company)\nCase study\nThis is a case study. Case studies are not timed separately. You can use as much exam time as you would like\nto complete each case. However, there may be additional case studies and sections on this exam. You must\nmanage your time to ensure that you are able to complete all questions included on this exam in the time\nprovided.\nTo answer the questions included in a case study, you will need to reference information that is provided in\nthe case study. Case studies might contain exhibits and other resources that provide more information about\nthe scenario that is described in the case study. Each question is independent of the other questions in this\ncase study.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and\nto make changes before you move to the next section of the exam. After you begin a new section, you cannot\nreturn to this section.\nTo start the case study\nTo display the first question in this case study, click the Next button. Use the buttons in the left pane to\nexplore the content of the case study before you answer the questions. Clicking these buttons displays\ninformation such as business requirements, existing environment, and problem statements. If the case study\nhas an All Information tab, note that the information displayed is identical to the information displayed on the\nsubsequent tabs. When you are ready to answer a question, click the Question button to return to the\nquestion.\nOverview\nGeneral Overview\nContoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and\nNew York.\nEnvironment\nExisting Environment\nContoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant.\nThe network contains an on-premises Active Directory domain that syncs to the Azure AD tenant.\nThe Azure AD tenant contains the users shown in the following table.\nSub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table.\nUser1 manages the resources in RG1. User4 manages the resources in RG2.\nSub1 contains virtual machines that run Windows Server 2019 as shown in the following table\nNo network security groups (NSGs) are associated to the network interfaces or the subnets.\nSub1 contains the storage accounts shown in the following table.\nRequirements\nPlanned Changes\nContoso plans to implement the following changes:\n✑\n Create a blob container named container1 and a file share named share1 that will use the Cool storage tier.\n✑\n Create a storage account named storage5 and configure storage replication for the Blob service.\n✑\n Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.\n✑\n Associate NSG1 to the network interface of VM1.\n✑\n Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table.\n✑\n Associate NSG2 to VNET1/Subnet2.\nTechnical Requirements\nContoso must meet the following technical requirements:\n✑\n Create container1 and share1.\n✑\n Use the principle of least privilege.\n✑\n Create an Azure AD security group named Group4.\n✑\n Back up the Azure file shares and virtual machines by using Azure Backup.\n✑\n Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.\n✑\n Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1.\n✑\n Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1\n✑\n Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months.\n✑\n Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to\nthe Azure file shares.\nYou need to ensure that VM1 can communicate with VM4. The solution must minimize administrative effort.\nWhat should you do?\nA.\nCreate a user-defined route from VNET1 to VNET3.\nB.\nCreate an NSG and associate the NSG to VM1 and VM4.\nC.\nAssign VM4 an IP address of 10.0.1.5/24.\nD.\nEstablish peering between VNET1 and VNET3.", "stem": "Contoso Ltd (Consulting Company) Case study This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided. To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study. At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section. To start the case study To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question. Overview General Overview Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York. Environment Existing Environment Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an on-premises Active Directory domain that syncs to the Azure AD tenant. The Azure AD tenant contains the users shown in the following table. Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table. User1 manages the resources in RG1. User4 manages the resources in RG2. Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table No network security groups (NSGs) are associated to the network interfaces or the subnets. Sub1 contains the storage accounts shown in the following table. Requirements Planned Changes Contoso plans to implement the following changes: ✑ Create a blob container named container1 and a file share named share1 that will use the Cool storage tier. ✑ Create a storage account named storage5 and configure storage replication for the Blob service. ✑ Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table. ✑ Associate NSG1 to the network interface of VM1. ✑ Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table. ✑ Associate NSG2 to VNET1/Subnet2. Technical Requirements Contoso must meet the following technical requirements: ✑ Create container1 and share1. ✑ Use the principle of least privilege. ✑ Create an Azure AD security group named Group4. ✑ Back up the Azure file shares and virtual machines by using Azure Backup. ✑ Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C. ✑ Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1. ✑ Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1 ✑ Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months. ✑ Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure file shares. You need to ensure that VM1 can communicate with VM4. The solution must minimize administrative effort. What should you do", "options": [ { "key": "A", "text": "Create a user-defined route from VNET1 to VNET3." }, { "key": "B", "text": "Create an NSG and associate the NSG to VM1 and VM4." }, { "key": "C", "text": "Assign VM4 an IP address of 10.0.1.5/24." }, { "key": "D", "text": "Establish peering between VNET1 and VNET3." } ], "answer": { "raw": "D", "keys": [ "D" ] }, "explanation": "Correct Answer = D\nEstablish peering between VNET1 and VNET3.\n_________________________________________________________________________________\nCase Study Description\nCase study\nThis is a case study.\nCase studies are not timed separately. You can use as much exam time as you\nwould like to complete each case.\nHowever, there may be additional case studies and sections on this\nexam. You must manage your time to ensure that you are able to complete all questions included on this exam\nin the time provided.\nTo answer the questions included in a case study, you will need to reference information that is provided in\nthe\ncase study. Case studies might contain exhibits and other resources that provide more information about the\nscenario that is described in the case study. Each question is independent of the other questions in this case\nstudy.\nAt the end of this case study, a review screen will appear. This screen allows you to review your answers and\nto make changes before you move to the next section of the exam. After you begin a new section, you cannot\nreturn to this section.\nTo start the case study\nTo display the first question in this case study, click the\nNext\nbutton. Use the buttons in the left pane to\nexplore\nthe content of the case study before you answer the questions. Clicking these buttons displays information\nsuch as business requirements, existing environment, and problem statements. If the case study has an\nAll\nInformation\ntab, note that the information displayed is identical to the information displayed on the\nsubsequent\ntabs. When you are ready to answer a question, click the\nQuestion\nbutton to return to the question.\nOverview", "reference": null, "references": [], "note": "Each correct selection is worth one point.\nHot Area:", "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 607, "pdfId": 607, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/607" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Get-AzRoleDefinition -name \"Reader\" |ConvertTo-Json\nhttps://docs.microsoft.com/en-us/azure/role-based-access-control/role-definitions-list?tabs=roles\n___________________________________________________________________________________________\nCase Study Description:\nOverview\nLitware, Inc. is a consulting company that has a main office in Montreal and two branch offices in Seattle and\nNew York.\nThe Montreal office has 2,000 employees. The Seattle office has 1,000 employees. The New York office has\n200 employees.\nAll the resources used by Litware are hosted on-premises.\nLitware creates a new Azure subscription. The Azure Active Directory (Azure AD) tenant uses a domain named\nlitware.onmicrosoft.com. The tenant uses the Premium P1 pricing tier.\nExisting Environment\nThe network contains an Active Directory forest named litware.com. All domain controllers are configured as\nDNS servers and host the litware.com DNS zone.\nLitware has finance, human resources, sales, research, and information technology departments. Each\ndepartment has an organizational unit (OU) that contains all the accounts of that respective department. All\nthe\nuser accounts have the department attribute set to their respective department. New users are added\nfrequently.\nLitware.com contains a user named User1.\nAll the offices connect by using private connections.\nLitware has data centers in the Montreal and Seattle offices. Each office has a firewall that can be configured\nas a VPN device.\nAll infrastructure servers are virtualized. The virtualization environment contains the servers in the following\ntable.\nLitware uses two web applications named App1 and App2. Each instance on each web application requires 1\nGB of memory.\nThe Azure subscription contains the resources in the following table.\nThe network security team implements several network security groups (NSGs)\nRequirements\nPlanned Changes\nLitware plans to implement the following changes:\n• Deploy Azure ExpressRoute to the Montreal office.\n• Migrate the virtual machines hosted on Server1 and Server2 to Azure.\n• Synchronize on-premises Active Directory to Azure Active Directory (Azure AD).\n• Migrate App1 and App2 to two Azure web apps named WebApp1 and WebApp2.\nTechnical Requirements\nLitware must meet the following technical requirements:\n• Ensure that WebApp1 can adjust the number of instances automatically based on the load and can scale\n• up to five instances.\n• Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in the\n• Montreal office.\n• Ensure that routing information is exchanged automatically between Azure and the routers in the Montreal\n• office.\n• Enable Azure Multi-Factor Authentication (MFA) for the users in the finance department only.\n• Ensure that webapp2.azurewebsites.net can be accessed by using the name app2.litware.com.\n• Connect the New York office to VNet1 over the Internet by using an encrypted connection.\n• Create a workflow to send an email message when the settings of VM4 are modified.\n• Create a custom Azure role named Role1 that is based on the Reader role.\n• Minimize costs whenever possible.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } }, { "seq": 608, "pdfId": 608, "exam": "AZ-104", "type": "single_choice", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/608" }, "markersInGap": [], "questionText": "You need to recommend a solution to automate the configuration for the finance department users. The solution\nmust meet the technical requirements.\nWhat should you include in the recommendation?\nA.\nAzure AD B2C\nB.\ndynamic groups and conditional access policies\nC.\nAzure AD Identity Protection\nD.\nan Azure logic app and the Microsoft Identity Management (MIM) client", "stem": "You need to recommend a solution to automate the configuration for the finance department users. The solution must meet the technical requirements. What should you include in the recommendation", "options": [ { "key": "A", "text": "Azure AD B2C" }, { "key": "B", "text": "dynamic groups and conditional access policies" }, { "key": "C", "text": "Azure AD Identity Protection" }, { "key": "D", "text": "an Azure logic app and the Microsoft Identity Management (MIM) client" } ], "answer": { "raw": "B", "keys": [ "B" ] }, "explanation": "Scenario\n:\nEnsure Azure Multi-Factor Authentication (MFA) for the users in the finance department only.\nThe recommendation is to use conditional access policies that can then be targeted to groups of users,\nspecific applications, or other conditions.\nReference\n:\nhttps://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates\n___________________________________________________________________________________________\nCase Study Description:\nOverview\nLitware, Inc. is a consulting company that has a main office in Montreal and two branch offices in Seattle and\nNew York.\nThe Montreal office has 2,000 employees. The Seattle office has 1,000 employees. The New York office has\n200 employees.\nAll the resources used by Litware are hosted on-premises.\nLitware creates a new Azure subscription. The Azure Active Directory (Azure AD) tenant uses a domain named\nlitware.onmicrosoft.com. The tenant uses the Premium P1 pricing tier.\nExisting Environment\nThe network contains an Active Directory forest named litware.com. All domain controllers are configured as\nDNS servers and host the litware.com DNS zone.\nLitware has finance, human resources, sales, research, and information technology departments. Each\ndepartment has an organizational unit (OU) that contains all the accounts of that respective department. All\nthe\nuser accounts have the department attribute set to their respective department. New users are added\nfrequently.\nLitware.com contains a user named User1.\nAll the offices connect by using private connections.\nLitware has data centers in the Montreal and Seattle offices. Each office has a firewall that can be configured\nas a VPN device.\nAll infrastructure servers are virtualized. The virtualization environment contains the servers in the following\ntable.\nLitware uses two web applications named App1 and App2. Each instance on each web application requires 1\nGB of memory.\nThe Azure subscription contains the resources in the following table.\nThe network security team implements several network security groups (NSGs)\nRequirements\nPlanned Changes\nLitware plans to implement the following changes:\n• Deploy Azure ExpressRoute to the Montreal office.\n• Migrate the virtual machines hosted on Server1 and Server2 to Azure.\n• Synchronize on-premises Active Directory to Azure Active Directory (Azure AD).\n• Migrate App1 and App2 to two Azure web apps named WebApp1 and WebApp2.\nTechnical Requirements\nLitware must meet the following technical requirements:\n• Ensure that WebApp1 can adjust the number of instances automatically based on the load and can scale\n• up to five instances.\n• Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in the\n• Montreal office.\n• Ensure that routing information is exchanged automatically between Azure and the routers in the Montreal\n• office.\n• Enable Azure Multi-Factor Authentication (MFA) for the users in the finance department only.\n• Ensure that webapp2.azurewebsites.net can be accessed by using the name app2.litware.com.\n• Connect the New York office to VNet1 over the Internet by using an encrypted connection.\n• Create a workflow to send an email message when the settings of VM4 are modified.\n• Create a custom Azure role named Role1 that is based on the Reader role.\n• Minimize costs whenever possible.\nYou download an Azure Resource Manager template based on an existing virtual machine. The template will be\nused to deploy 100 virtual machines.You need to modify the template to reference an administrative password. You\nmust prevent the password from being stored in plain text.What should you use to store the password?\nA.\nan Azure Key Vault and an access configuration\nB.\nan Azure Storage account and an access policy\nC.\na Recovery Services vault and a backup policy\nD.\nMicrosoft Entra ID Protection and an Azure policy", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 609, "pdfId": 609, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/609" }, "markersInGap": [], "questionText": "", "stem": "", "options": [], "answer": { "raw": "A", "keys": [ "A" ] }, "explanation": "A.\n✅\n Correct\nan Azure Key Vault and an access configuration\nAzure Key Vault securely stores secrets like passwords and allows ARM templates to reference them without\nexposing plain text.\nB.\n❌\n Incorrect\nan Azure Storage account and an access policy\nStorage accounts are not designed for secure secret management.\nC.\n❌\n Incorrect\na Recovery Services vault and a backup policy\nThis is used for backup and disaster recovery, not secret storage.\nD.\n❌\n Incorrect\nMicrosoft Entra ID Protection and an Azure policy\nThese are for identity protection and governance, not for storing secrets.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": false, "missingExplanation": false, "missingOptions": false } }, { "seq": 610, "pdfId": 610, "exam": "AZ-104", "type": "unknown", "source": { "certyiqUrl": "https://certyiq.com/papers/microsoft/az-104/610" }, "markersInGap": [ 610 ], "questionText": "You have an Azure subscription.\nyou plan to deploy the following file named Fielbicep.\nFor each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct\nselection is worth one point.", "stem": "You have an Azure subscription. you plan to deploy the following file named Fielbicep. For each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.", "options": [], "answer": { "raw": null, "keys": [] }, "explanation": "Statement 1: The name of the virtual network will be the same as the location of the resource group.\n❌\n No.\nThe virtual network name is hardcoded as\n'VNET1'\n, which is a string literal. The location is set\nto\nresourceGroup().location\n (e.g.,\n'eastus'\n,\n'westus'\n). A string like\n'VNET1'\n cannot equal a location string\nlike\n'eastus'\n. Therefore, this statement is false.\nStatement 2: Both subnet objects will be provisioned successfully.\n✅\n Yes.\n Although the statement says \"both\" but the template defines three subnets, all three are valid:\nSubnet-1\n with\n10.0.0.0/24\n is within\n10.0.0.0/16\nSubnet-2\n with\n10.0.1.0/24\n is within\n10.0.0.0/16\nSubnet-3\n with\n10.0.2.0/24\n is within\n10.0.0.0/16\nThere are no overlapping address ranges, and all properties are correctly formatted. The deployment will\nsucceed for all subnets.\nStatement 3: Deploying this Bicep file will error out with an error message.\n❌\n No.\n The Bicep file is syntactically correct. It uses valid resource type\n(\nMicrosoft.Network/virtualNetworks@2022-01-01\n), valid properties, and correct parameter referencing. There are\nno missing dependencies, circular references, or invalid values. The deployment will complete successfully\nwithout errors.\n\nThank you\nThank you for being so interested in the premium exam material.\nI'm glad to hear that you found it informative and helpful.", "reference": null, "references": [], "note": null, "flags": { "missingPdfId": false, "missingAnswer": true, "missingExplanation": false, "missingOptions": false } } ]