CertBlaze

Microsoft

AZ-104 Free Practice Questions — Page 20

Question 200

HOTSPOT - You have an Azure subscription. The subscription contains a storage account named storage1 that has the lifecycle management rules shown in the following table. On June 1, you store two blobs in storage1 as shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 200 Illustration for AZ-104 question 200 Illustration for AZ-104 question 200
Show Answer
Correct Answer: No No No
Explanation:
Rule1 archives container1 blobs after more than 3 days, taking precedence over cooling. Rule2 applies after more than 5 days but archive is the cheaper/cooler action when both apply. File2 is still Hot on June 1. File2 is deleted after more than 10 days by Rule3, so it is not archived on June 16.

Question 201

HOTSPOT - You have an Azure AD tenant named contoso.com. You have two external partner organizations named fabrikam.com and litwareinc.com. Fabrikam.com is configured as a connected organization. You create an access package as shown in the Access package exhibit. (Click the Access package tab.) You configure the external user lifecycle settings as shown in the Lifecycle exhibit. (Click the Lifecycle tab.) For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 201 Illustration for AZ-104 question 201 Illustration for AZ-104 question 201
Show Answer
Correct Answer: No Yes Yes
Explanation:
Only configured connected organizations can request the access package, so litwareinc.com cannot. Access package assignments expire after 365 days, removing the user from the package resources (Group1). External user lifecycle then removes the guest account from the tenant 30 days later, for a total of 395 days.

Question 203

HOTSPOT - You have an Azure App Service web app named app1. You configure autoscaling as shown in following exhibit. You configure the autoscale rule criteria as shown in the following exhibit. Use the drop-down menus to select the answer choice that answers each question based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 203 Illustration for AZ-104 question 203 Illustration for AZ-104 question 203
Show Answer
Correct Answer: 3 instances 5 minutes
Explanation:
Starts with 1 instance. The rule scales out by 1 after the CPU threshold has been exceeded for the configured duration (10 minutes). Autoscale continues evaluating metrics during cooldown; after the 5-minute cooldown, if the previous 10-minute window still satisfies the rule, it can scale out again. Thus after 15 minutes there are 3 instances, and the minimum wait before another instance is the 5-minute cooldown.

Question 204

You have an on-premises server that contains a folder named D:\Folder1. You need to copy the contents of D:\Folder1 to the public container in an Azure Storage account named contosodata. Which command should you run?

A. az storage blob copy start D:\Folder1 https://contosodata.blob.core.windows.net/public
B. azcopy sync D:\folder1 https://contosodata.blob.core.windows.net/public --snapshot
C. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public --recursive
D. az storage blob copy start-batch D:\Folder1 https://contosodata.blob.core.windows.net/public
Show Answer
Correct Answer: C
Explanation:
To upload the contents of a local directory to an Azure Blob Storage container, use AzCopy with the copy command and the --recursive flag. The az storage blob copy commands are for server-side blob-to-blob copies, not uploading from a local file system. The sync command is intended for synchronization scenarios rather than a straightforward copy.

Question 205

You have an Azure subscription that contains a storage account named storage1. You plan to create a blob container named container1. You need to use customer-managed key encryption for container1. Which key should you use?

A. an EC key that uses the P-384 curve only
B. an EC key that uses the P-521 curve only
C. an EC key that uses the P-384 curve or P-521 curve only
D. an RSA key with a key size of 4096 only
E. an RSA key type with a key size of 2048, 3072, or 4096 only
Show Answer
Correct Answer: E
Explanation:
Azure Storage customer-managed keys support RSA and RSA-HSM keys with sizes 2048, 3072, or 4096 bits. Elliptic curve (EC) keys are not supported for Azure Storage encryption with customer-managed keys, and the service does not require only 4096-bit RSA keys.

Question 206

HOTSPOT - You have an Azure subscription. You create the following file named Deploy.json. You connect to the subscription and run the following commands. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 206 Illustration for AZ-104 question 206 Illustration for AZ-104 question 206
Show Answer
Correct Answer: Yes No Yes
Explanation:
The template uses a copy count of 3 to create three storage accounts. The resource group is also created by the preceding command, totaling four created resources. Storage account location is set to resourceGroup().location, so they are created in Central US, not West US. copyIndex() starts at 0, so the first storage account name is prefixed with 0.

Question 207

HOTSPOT - You have an Azure subscription. You plan to deploy a storage account named storage1 by using the following Azure Resource Manager (ARM) template. For each of the following statements, select Yes if the statement is hue. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 207 Illustration for AZ-104 question 207
Show Answer
Correct Answer: No No Yes
Explanation:
Point-in-time restore (restorePolicy) is enabled for only 6 days, so changes cannot be rolled back after 7 days. The storage account location does not restrict client access to the East US region. Standard_LRS maintains three locally redundant copies within a single Azure region.

Question 208

DRAG DROP - You have an Azure subscription named Sub1 that contains two users named User1 and User2. You need to assign role-based access control (RBAC) roles to User1 and User2. The users must be able to perform the following tasks in Sub1: • User1 must view the data in any storage account. • User2 must assign users the Contributor role for storage accounts. The solution must use the principle of least privilege. Which RBAC role should you assign to each user? To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 208
Show Answer
Correct Answer: User1: Reader and Data Access User2: Owner
Explanation:
Reader and Data Access allows viewing storage account data without managing resources. Assigning RBAC roles requires Owner (or User Access Administrator, which is not available among the choices), so Owner is the least-privileged valid option provided.

Question 209

You have an Azure subscription that contains the resources shown in the following table. You need to manage outbound traffic from VNET1 by using Firewall1. What should you do first?

A. Configure the Hybrid Connection Manager.
B. Upgrade ASP1 to the Premium SKU.
C. Create a route table.
D. Create an Azure Network Watcher.
Show Answer
Correct Answer: C
Explanation:
To direct and manage outbound traffic from a virtual network through Azure Firewall, the first step is to create a user-defined route table (UDR) that routes the desired outbound traffic to the firewall, then associate it with the appropriate subnet. The other options are unrelated: Hybrid Connection Manager is for App Service Hybrid Connections, upgrading an App Service Plan is not the first requirement for VNet outbound routing, and Network Watcher is a monitoring/troubleshooting service rather than a traffic-routing prerequisite.

Question 210

You have an Azure subscription that contains 10 virtual machines, a key vault named Vault1, and a network security group (NSG) named NSG1. All the resources are deployed to the East US Azure region. The virtual machines are protected by using NSG1. NSG1 is configured to block all outbound traffic to the internet. You need to ensure that the virtual machines can access Vault1. The solution must use the principle of least privilege and minimize administrative effort What should you configure as the destination of the outbound security rule for NSG1?

A. an application security group
B. a service tag
C. an IP address range
Show Answer
Correct Answer: B
Explanation:
Use a service tag as the destination in the outbound NSG rule, specifically the AzureKeyVault service tag. Service tags are maintained by Microsoft and automatically track the service's IP ranges, minimizing administrative effort. An application security group applies to Azure VM NICs rather than Azure PaaS services like Key Vault, and IP address ranges require manual maintenance as service IPs change. While the AzureKeyVault service tag allows access to Azure Key Vault endpoints rather than only a single vault, it is the intended NSG mechanism and best matches the requirements given.

$19

Get all 555 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full AZ-104 study guide →