CertBlaze

Microsoft

AZ-104 Free Practice Questions — Page 18

Question 178

HOTSPOT - You have an Azure subscription that contains the storage account shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 178 Illustration for AZ-104 question 178
Show Answer
Correct Answer: 3 1
Explanation:
A container supports a maximum of 5 stored access policies; 2 already exist, so 3 more can be added. The container already has one time-based immutable policy; you can additionally create one legal hold policy, so 1 more immutable blob storage policy can be added.

Question 179

HOTSPOT - You have an Azure subscription that contains a user named User1 and a storage account named storage1. The storage1 account contains the resources shown in the following table. User1 is assigned the following roles for storage1: • Storage Blob Data Reader • Storage Table Data Contributor • Storage File Data SMB Share Contributor For storage1, you create a shared access signature (SAS) named SAS1 that has the settings shown in the following exhibit. (Click the Exhibit tab.) To which resources can User1 write by using SAS1 and key1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 179 Illustration for AZ-104 question 179 Illustration for AZ-104 question 179
Show Answer
Correct Answer: key1: Table1, folder1, and container1 SAS1: Table1 only
Explanation:
A storage account access key provides full data access across storage services, independent of Azure RBAC. The SAS shown is restricted to the Table service (despite write permissions), so it can only be used to write to Table1.

Question 180

HOTSPOT - You plan to deploy the following Azure Resource Manager (ARM) template. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 180 Illustration for AZ-104 question 180
Show Answer
Correct Answer: No Yes No
Explanation:
The subnet name resolves from the variable 'netname' to 'APP1', not the literal 'netname'. The resourceId() calls omit a resource group, so ARM resolves the referenced VNet in the deployment resource group; therefore the deployment must target the resource group containing VNET1. The template defines 'sku' as a variable, not a parameter, so it cannot be supplied at deployment time.

Question 181

HOTSPOT - Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the servers shown in the following table. You plan to migrate contoso.com to Azure. You create an Azure virtual network named VNET1 that has the following settings: • Address space: 10.0.0.0/16 • Subnet: o Name: Subnet1 o IPv4: 10.0.1.0/24 You need to move DC1 to VNET1. The solution must ensure that the member servers in contoso.com can resolve AD DS DNS names. How should you configure DC1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 181 Illustration for AZ-104 question 181
Show Answer
Correct Answer: IP address: Obtain an IP address automatically Name resolution: Configure VNET1 to use a custom DNS server
Explanation:
10.0.1.3 is an Azure-reserved IP address in the subnet, while the other static IP options are outside the valid subnet. AD DS clients must continue using the domain controller/DNS server for name resolution, so configure the virtual network to use the domain controller as a custom DNS server.

Question 182

You need to ensure that VM1 can communicate with VM4. The solution must minimize administrative effort. What should you do?

A. Create a user-defined route from VNET1 to VNET3.
B. Create an NSG and associate the NSG to VM1 and VM4.
C. Assign VM4 an IP address of 10.0.1.5/24.
D. Establish peering between VNET1 and VNET3.
Show Answer
Correct Answer: D
Explanation:
VNet peering is the Azure-native way to enable private connectivity between virtual networks with minimal administrative effort. User-defined routes alone do not create connectivity between separate VNets, an NSG only filters traffic, and changing VM4's IP address does not connect different VNets. If VNET1 and VNET3 are separate and need direct communication, establishing peering between them is the correct solution.

Question 183

HOTSPOT - You have an Azure subscription that is linked to an Azure AD tenant. The tenant contains two users named User1 and User2. The subscription contains the resources shown in the following table. The subscription contains the alert rules shown in the following table. The users perform the following action: • User1 creates a new virtual disk and attaches the disk to VM1 • User2 creates a new resource tag and assigns the tag to RG1 and VM1 Which alert rules are triggered by each user? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 183 Illustration for AZ-104 question 183 Illustration for AZ-104 question 183
Show Answer
Correct Answer: User1: Alert1 and Alert2 are triggered User2: Alert1 and Alert2 are triggered
Explanation:
Alert1 monitors all administrative operations within RG1 (including resources in the resource group). Alert2 monitors all administrative operations on VM1. Attaching a new disk updates VM1, and tagging VM1 is also a write operation on the VM; tagging RG1 is a write on the resource group, so both alerts fire in each scenario.

Question 184

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure?

A. Session persistence to None
B. a health probe
C. Session persistence to Client IP
D. Idle Time-out (minutes) to 20
Show Answer
Correct Answer: C
Explanation:
To ensure that a client is consistently served by the same backend web server across requests, configure the Azure Load Balancer's session persistence (also called source IP affinity) to Client IP. Health probes only determine backend availability, idle timeout controls connection timeout behavior, and session persistence set to None distributes requests without client affinity.

Question 185

You have two Azure virtual machines named VM1 and VM2 that run Windows Server. The virtual machines are in a subnet named Subnet1. Subnet1 is in a virtual network named VNet1. You need to prevent VM1 from accessing VM2 on port 3389. What should you do?

A. Create a network security group (NSG) that has an outbound security rule to deny destination port 3389 and apply the NSG to the network interface of VM1.
B. Configure Azure Bastion in VNet1.
C. Create a network security group (NSG) that has an outbound security rule to deny source port 3389 and apply the NSG to Subnet1.
D. Create a network security group (NSG) that has an inbound security rule to deny source port 3389 and apply the NSG to Subnet1.
Show Answer
Correct Answer: A
Explanation:
An NSG outbound rule evaluates the destination port for traffic leaving VM1. Denying destination port 3389 on an NSG applied to VM1's network interface prevents VM1 from initiating RDP connections. Options C and D incorrectly match on the source port rather than the destination port, and Azure Bastion does not enforce VM-to-VM traffic restrictions. While the rule as written blocks RDP from VM1 to any destination, it still satisfies the stated requirement; a more specific rule could also match VM2's IP address.

Question 186

You have an Azure subscription that contains the resources shown in the following table. You configure Azure Site Recovery to replicate VM1 between the US East and West US regions. You perform a test failover of VM1 and specify VNET2 as the target virtual network. When the test version of VM1 is created, to which subnet will the virtual machine be connected?

A. TestSubnet1
B. DemoSubnet1
C. RecoverySubnetA
D. RecoverySubnetB
Show Answer
Correct Answer: B
Explanation:
For Azure Site Recovery Azure-to-Azure failover, if the target virtual network does not contain a subnet with the same name as the source subnet, Site Recovery connects the failed-over VM to the first subnet in alphabetical order within the selected target virtual network. Given the listed target subnets, DemoSubnet1 is alphabetically first.

Question 188

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure?

A. Protocol to UDP
B. Session persistence to None
C. Floating IP (direct server return) to Disabled
D. Session persistence to Client IP
Show Answer
Correct Answer: D
Explanation:
Configure the Azure Load Balancer's session persistence (load distribution mode) to Client IP. This enables source IP affinity so requests from the same client are consistently directed to the same backend VM, providing session stickiness. Changing the protocol, disabling floating IP, or setting session persistence to None does not provide client affinity.

$19

Get all 555 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full AZ-104 study guide →