CertBlaze

Microsoft

AZ-104 Free Practice Questions — Page 10

Question 93

You have an Azure subscription that contains a resource group named RG1 and a virtual network named VNet1. You plan to create an Azure container instance named container1. You need to be able to configure DNS name label scope reuse for container1. What should you configure for container1?

A. the private networking type
B. the public networking type
C. a new subnet on VNet1
D. a confidential SKU
Show Answer
Correct Answer: B
Explanation:
DNS name label scope reuse applies to the public DNS name assigned to an Azure Container Instance. The DNS name label scope reuse setting is available only when the container instance uses the public networking type, because private networking does not expose a public DNS label. A new subnet or confidential SKU are unrelated to this feature.

Question 94

HOTSPOT - You have an Azure AD tenant. You need to create a Microsoft 365 group that contains only members of a marketing department in France. How should you complete the dynamic membership rule? To answer, select the appropriate options in the answer area. NOTE: Each correct answer is worth one point.

Illustration for AZ-104 question 94
Show Answer
Correct Answer: user.department and -eq
Explanation:
Use the user department attribute to match Marketing, combine both conditions with AND, and compare the country attribute for exact equality to France.

Question 95

You have an Azure subscription named Subscription1 that contains virtual network named VNet1. VNet1 is in a resource group named RG1. User named User1 has the following roles for Subscription1: • Reader • Security Admin • Security Reader You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do?

A. Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1.
B. Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.
C. Assign User1 the Network Contributor role for VNet1.
D. Assign User1 the User Access Administrator role for VNet1.
Show Answer
Correct Answer: D
Explanation:
To assign Azure RBAC roles, a principal needs the Microsoft.Authorization/roleAssignments/write permission, which is included in the Owner and User Access Administrator built-in roles. Contributor and Network Contributor can manage resources but cannot grant access. Assigning User Access Administrator at the VNet1 scope allows User1 to assign the Reader role for that virtual network.

Question 96

You have an Azure subscription named Subscription1 that contains virtual network named VNet1. VNet1 is in a resource group named RG1. A user named User1 has the following roles for Subscription1: • Reader • Security Admin • Security Reader You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do?

A. Assign User1 the Contributor role for VNet1.
B. Assign User1 the Network Contributor role for VNet1.
C. Assign User1 the User Access Administrator role for VNet1.
D. Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1.
Show Answer
Correct Answer: C
Explanation:
To assign Azure RBAC roles (such as the Reader role) to other users for a specific resource, the user needs permission to manage access. The User Access Administrator role grants permission to manage role assignments on the scoped resource. Contributor and Network Contributor can manage resources but cannot grant access or assign RBAC roles. The existing Reader, Security Admin, and Security Reader roles do not provide role assignment permissions.

Question 98

You have an Azure subscription that contains the virtual networks shown in the following table. The subscription contains the virtual machines shown in the following table. All the virtual machines have only private IP addresses. You deploy an Azure Bastion host named Bastion1 to VNet1. To which virtual machines can you connect through Bastion1?

A. VM1 only
B. VM1 and VM2 only
C. VM1 and VM3 only
D. VM1, VM2, and VM3
Show Answer
Correct Answer: B
Explanation:
Azure Bastion can connect to VMs in the same virtual network and in directly peered virtual networks. It does not support transitive (chained) peering. With Bastion1 deployed in VNet1, it can reach VM1 (in VNet1) and VM2 (in directly peered VNet2), but not VM3 if it is only reachable through VNet2 via transitive peering.

Question 99

DRAG DROP - You have an Azure subscription that contains a resource group named RG1. You plan to create an Azure Resource Manager (ARM) template to deploy a new virtual machine named VM1. VM1 must support the capture of performance data. You need to specify resource dependencies for the ARM template. In which order should you deploy the resources? To answer, move all resources from the list of resources to the answer area and arrange them in the correct order.

Illustration for AZ-104 question 99
Show Answer
Correct Answer: virtual network network interface virtual machine Azure Monitor extension
Explanation:
A network interface depends on the virtual network, the virtual machine depends on the network interface, and the Azure Monitor VM extension can only be installed after the VM exists.

Question 100

HOTSPOT - You have an Azure subscription that contains the resource groups shown in the following table. You create the following Azure Resource Manager (ARM) template named deploy.json. You deploy the template by running the following cmdlet. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 100 Illustration for AZ-104 question 100 Illustration for AZ-104 question 100 Illustration for AZ-104 question 100
Show Answer
Correct Answer: Yes No No
Explanation:
The template defines resource group location as eastus. The deployment cmdlet's -Location is only for deployment metadata at subscription scope. copyIndex() generates RG0-RG3, but RG1 and RG2 already exist, so the deployment cannot create four new resource groups.

Question 102

You plan to create the Azure web apps shown in the following table. What is the minimum number of App Service plans you should create for the web apps?

A. 1
B. 2
C. 3
D. 4
Show Answer
Correct Answer: B
Explanation:
An App Service plan is tied to a single operating system (Windows or Linux), but it can host multiple apps using different supported runtimes on that OS. ASP.NET 4.8 requires Windows. Python App Service is supported on Linux (standard App Service). .NET 6 and PHP can run on either Windows or Linux, so they can be placed with whichever OS minimizes plans. Therefore, the minimum is one Windows App Service plan (ASP.NET 4.8, optionally .NET 6/PHP) and one Linux App Service plan (Python, optionally .NET 6/PHP): 2 plans.

Question 103

HOTSPOT - You have an Azure subscription that contains the virtual networks shown in the following table. The subscription contains the virtual machines shown in the following table. Each virtual machine contains only a private IP address. You create an Azure bastion for VNet1 as shown in the following exhibit. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 103 Illustration for AZ-104 question 103 Illustration for AZ-104 question 103 Illustration for AZ-104 question 103
Show Answer
Correct Answer: No Yes No
Explanation:
Basic Bastion does not support native client (mstsc.exe) connections. Basic Bastion supports portal-based RDP/SSH and can connect to VMs in directly peered VNets, so SSH to VM2 is supported. VM3 is not directly peered with the Bastion VNet (transitive peering is not supported), so it cannot be reached through Bastion1.

Question 104

HOTSPOT - You have an Azure subscription that contains the virtual networks shown in the following table. The subnets have the IP address spaces shown in the following table. You plan to create a container app named contapp1 in the East US Azure region. You need to create a container app environment named con-env1 that meets the following requirements: • Uses its own virtual network. • Uses its own subnet. • Is connected to the smallest possible subnet. To which virtual networks can you connect con-env1, and which subnet mask should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 104 Illustration for AZ-104 question 104 Illustration for AZ-104 question 104
Show Answer
Correct Answer: Virtual network: VNet3 only Subnet mask: /23
Explanation:
Azure Container Apps environment (consumption) requires a dedicated subnet with a minimum size of /23. VNet1 has only a /24 worth of free space remaining, VNet2 is fully allocated by its existing /17 subnets, and only VNet3 has sufficient unallocated address space to create a new dedicated /23 subnet.

$19

Get all 555 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full AZ-104 study guide →