Home
Microsoft
AZ-104: Microsoft Azure Administrator Exam Dumps

Free Microsoft AZ-104 Exam Dumps

Here you can find all the free questions related with Microsoft Azure Administrator Exam (AZ-104) exam. You can also find on this page links to recently updated premium files with which you can practice for actual Microsoft Azure Administrator Exam . These premium versions are provided as AZ-104 exam practice tests, both as desktop software and browser based application, you can use whatever suits your style. Feel free to try the Microsoft Azure Administrator Exam premium files for free, Good luck with your Microsoft Azure Administrator Exam .

Question No: 191

Hotspot

You have an Azure subscription named Subscription1 that contains the following resource group:

* Name: RG1

* Region: West US

* Tag: ''tag1'': ''value1''

You assign an Azure policy named Policy1 to Subscription1 by using the following configurations:

* Exclusions: None

* Policy definition: Append tag and its default value

* Assignment name: Policy1

* Parameters:

- Tag name: Tag2

- Tag value: Value2

After Policy1 is assigned, you create a storage account that has the following configurations:

* Name: storage1

* Location: West US

* Resource group: RG1

* Tags: ''tag3'': ''value3''

You need to identify which tags are assigned to each resource.

What should you identify? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Answer

Explanation

Box 1: 'tag1': 'value1' only

Box 2: 'tag2': 'value2' and 'tag3': 'value3'

Tags applied to the resource group are not inherited by the resources in that resource group.

References:

https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-using-tags

Question No: 192

MultipleChoice

You have an Azure subscription named Subscription1 that has the following providers registered:

* Authorization

* Automation

* Resources

* Compute

* KeyVault

* Network

* Storage

* Billing

* Web

Subscription1 contains an Azure virtual machine named VM1 that has the following con figurations:

* Private IP address: 10.0.0.4 (dynamic)

* Network security group (NSG): NSG1

* Public IP address: None

* Availability set: AVSet

* Subnet: 10.0.0.0/24

* Managed disks: No

* Location: East US

You need to record all the successful and failed connection attempts to VM1.

Which three actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

Options

ARegister the Microsoft.Insights resource provider

BAdd an Azure Network Watcher connection monitor

CRegister the Microsoft.LogAnalytics provider

DEnable Azure Network Watcher in the East US Azure region

ECreate an Azure Storage account

FEnable Azure Network Watcher flow logs

Answer
C, D, EExplanation

NSG flow log data is written to an Azure Storage account. You need to create an Azure Storage account, With an Azure Storage account NSG flow logs can be enabled.

Enable network watcher in the East US region.

NSG flow logging requires the Microsoft.Insights provider.

References:

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-portal

Question No: 193

Hotspot

You have an Azure subscription that contains the resources shown in the following table.

VMSS1 is set to VM (virtual machines) orchestration mode.

You need to deploy a new Azure virtual machine named VM1, and then add VM1 to VMSS1.

Which resource group and location should you use to deploy VM1? To answer, select the appropriate options in the

NOTE: Each correct selection is worth one point.

Answer

Question No: 194

MultipleChoice

You have an Azure subscription that contains a virtual network named VNET1. VNET1 contains the subnets shown in the following table.

Each virtual machine uses a static IP address.

You need to create network security groups (NSGs) to meet following requirements:

* Allow web requests from the internet to VM3, VM4, VM5, and VM6.

* Allow all connections between VM1 and VM2.

* Allow Remote Desktop connections to VM1.

* Prevent all other network traffic to VNET1.

What is the minimum number of NSGs you should create?

Options

D12

Answer
AExplanation

Note: A network security group (NSG) contains a list of security rules that allow or deny network traffic to resources connected to Azure Virtual Networks (VNet). NSGs can be associated to subnets, individual VMs (classic), or individual network interfaces (NIC) attached to VMs (Resource Manager).

Each network security group also contains default security rules.

References:

https://docs.microsoft.com/en-us/azure/virtual-network/security-overview#default-security-rules

Question No: 195

Hotspot

You have an Azure subscription named Subscription1 that contains the virtual networks in the following table.

Subscripton1 contains the virtual machines in the following table.

In Subscription1, you create a load balancer that has the following configurations:

* Name: LB1

* SKU: Basic

* Type: Internal

* Subnet: Subnet12

* Virtual network: VNET1

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: each correct selection is worth one point.

Answer

Explanation

Statement 1 :Basic load balancer supports Virtual machine in a single Availability set or virtual machine scale set (VMSS) only . Hence this statement is correct.

Statement 2 :Basic load balancer supports Virtual machine in a single Availability set or virtual scale set only or one standalone VM. VM3 and VM4 are not part of any availability set or VMSS .Hence this statement is incorrect.

Statement 3 :Basic load balancer supports Virtual machine in a single Availability set or virtual scale set only or one standalone VM. VM5 and VM6 are not part of any availability set or VMSS .Hence this statement is incorrect.

References:

https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview

Question No: 196

MultipleChoice

You have an Azure subscription that contains a virtual machine named VM1. VM1 hosts a line-of-business application that is available 24 hours a day. VM1 has one network interface and one managed disk. VM1 uses the D4s v3 size.

You plan to make the following changes to VM1:

* Change the size to D8s v3.

* Add a 500-GB managed disk.

* Add the Puppet Agent extension.

* Attach an additional network interface.

Which change will cause downtime for VM1?

Options

AAdd a 500-GB managed disk.

BAttach an additional network interface.

CAdd the Puppet Agent extension.

DChange the size to D8s v3.

Answer
DExplanation

While resizing the VM it must be in a stopped state.

References:

https://azure.microsoft.com/en-us/blog/resize-virtual-machines/

Question No: 197

Hotspot

You have an Azure Active Directory (Azure AD) tenant that contains three global administrators named Admin1, Admin2, and Admin3.

The tenant is associated to an Azure subscription. Access control for the subscription is configured as shown in the Access control exhibit. (Click the Exhibit tab.)

You sign in to the Azure portal as Admin1 and configure the tenant as shown in the Tenant exhibit. (Click the Exhibit tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Explanation

They are all Global admins so they can all modify user permission. i.e add self as owner etc.

You can be GA in one of the subscription, it doesn't mean that you can create the resources in all subscription. As a Global Administrator in Azure Active Directory (Azure AD), you might not have access to all subscriptions and management groups in your directory. Azure AD and Azure resources are secured independently from one another. That is, Azure AD role assignments do not grant access to Azure resources, and Azure role assignments do not grant access to Azure AD.

However, if you are a Global Administrator in Azure AD, you can assign yourself access to all Azure subscriptions and management groups in your directory

Answer

Explanation

https://docs.microsoft.com/en-gb/azure/role-based-access-control/elevate-access-global-admin

Question No: 198

Hotspot

You plan to use Azure Network Watcher to perform the following tasks:

* Task1: Identify a security rule that prevents a network packet from reaching an Azure virtual machine

* Task2: Validate outbound connectivity from an Azure virtual machine to an external host

Which feature should you use for each task? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Answer

Explanation

Task 1: IP flow verify

The IP flow verify capability enables you to specify a source and destination IPv4 address, port, protocol (TCP or UDP), and traffic direction (inbound or outbound). IP flow verify then tests the communication and informs you if the connection succeeds or fails. If the connection fails, IP flow verify tells you which security rule allowed or denied the communication, so that you can resolve the problem.

Task 2: Connection troubleshoot

The connection troubleshoot capability enables you to test a connection between a VM and another VM, an FQDN, a URI, or an IPv4 address. The test returns similar information returned when using the connection monitor capability, but tests the connection at a point in time, rather than monitoring it over time.

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview

https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-connectivity-overview

Question No: 199

Hotspot

You have an Azure virtual machine named VM1 that connects to a virtual network named VNet1. VM1 has the following configurations:

* Subnet: 10.0.0.0/24

* Availability set: AVSet

* Network security group (NSG): None

* Private IP address: 10.0.0.4 (dynamic)

* Public IP address: 40.90.219.6 (dynamic)

You deploy a standard, Internet-facing load balancer named slb1.

You need to configure slb1 to allow connectivity to VM1.

Which changes should you apply to VM1 as you configure slb1? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Answer

Explanation

Box 1:Remove the public IP address from VM1

If the Public IP on VM1 is set to Dynamic, that means it is a Public IP with Basic SKU because Public IPs with Standard SKU have Static assignments by default, that cannot be changed. We cannot associate Basic SKUs IPs with Standard SKUs LBs. One cannot create a backend SLB pool if the VM to be associated has a Public IP. For Private IP it doesn't matter weather it is dynamic or static, still we can add the such VM into the SLB backend pool.

Box 2:Create and configure an NSG

Standard Load Balancer is built on the zero trust network security model at its core. Standard Load Balancer secure by default and is part of your virtual network. The virtual network is a private and isolated network. This means Standard Load Balancers and Standard Public IP addresses are closed to inbound flows unless opened by Network Security Groups. NSGs are used to explicitly permit allowed traffic. If you do not have an NSG on a subnet or NIC of your virtual machine resource, traffic is not allowed to reach this resource. To learn more about NSGs and how to apply them for your scenario, see Network Security Groups. Basic Load Balancer is open to the internet by default.

https://docs.microsoft.com/en-us/azure/load-balancer/quickstart-load-balancer-standard-public-portal

https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview

Question No: 200

Hotspot

You have an Azure subscription that contains the resources in the following table.

You install the Web Server server role (IIS) on VM1 and VM2, and then and VM1 and VM2 to LB1.

Answer

Limited Time Offer

25%

Off

Get Premium AZ-104 Questions as Interactive Web-Based Practice Test or PDF