CertBlaze

Microsoft

AZ-104 Free Practice Questions — Page 21

Question 199

HOTSPOT - You have an Azure subscription that contains a resource group named RG1. You plan to use an Azure Resource Manager (ARM) template named template1 to deploy resources. The solution must meet the following requirements: • Deploy new resources to RG1. • Remove all the existing resources from RG1 before deploying the new resources. How should you complete the command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 199
Show Answer
Correct Answer: -ResourceGroupName Complete
Explanation:
-ResourceGroupName specifies RG1 as the deployment target. Complete mode removes all existing resources in the resource group that are not defined in the ARM template before deploying new resources.

Question 200

HOTSPOT - You have an Azure subscription that contains an Azure Kubernetes Service (AKS) cluster named Cluster1. Cluster1 hosts a node pool named Pool1 that has four nodes. You need to perform a coordinated upgrade of Cluster1. The solution must meet the following requirements: • Deploy two new nodes to perform the upgrade. • Minimize costs. How should you complete the command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 200
Show Answer
Correct Answer: update --max-surge 2
Explanation:
A coordinated AKS upgrade uses max surge to temporarily add nodes during the upgrade. Updating the existing node pool with --max-surge 2 deploys two temporary nodes only for the upgrade process, meeting the requirement while minimizing ongoing costs.

Question 201

You have an Azure subscription that contains 20 virtual machines, a network security group (NSG) named NSG1, and two virtual networks named VNET1 and VNET2 that are peered. You plan to deploy an Azure Bastion Basic SKU host named Bastion1 to VNET1. You need to configure NSG1 to allow inbound access to the virtual machines via Bastion1. Which port should you configure for the inbound security rule?

A. 22
B. 443
C. 389
D. 8080
Show Answer
Correct Answer: A
Explanation:
Azure Bastion connects to target virtual machines over their private IPs using the native management ports (SSH 22 for Linux, RDP 3389 for Windows). The question asks for the inbound NSG rule on the virtual machines to allow access via Bastion, not the port used to access Bastion itself. Port 443 is for client/portal-to-Bastion traffic, not Bastion-to-VM traffic. Since 3389 is not an option, the correct choice is SSH port 22.

Question 202

DRAG DROP - You have an Azure subscription that contains a virtual machine named VM1. You need to back up VM1. The solution must ensure that backups are stored across three availability zones in the primary region. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Illustration for AZ-104 question 202
Show Answer
Correct Answer: Create a Recovery Services vault. Set replication to Zone-redundant storage (ZRS). For VM1, create a backup policy and configure the backup.
Explanation:
Backups for Azure VMs are stored in a Recovery Services vault. To ensure storage across three availability zones in the primary region, the vault must use Zone-redundant storage (ZRS). After the vault and its replication setting are in place, a backup policy can be created and applied to VM1.

Question 203

HOTSPOT - You have an Azure subscription that contains a storage account named storage1. The storage1 account contains a container named container1. You need to create a lifecycle management rule for storage1 that will automatically move the blobs in container1 to the lowest-cost tier after 90 days. How should you complete the rule? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 203
Show Answer
Correct Answer: tierToArchive tprefixMatch
Explanation:
The lowest-cost blob tier is Archive, so the baseBlob action must be tierToArchive after 90 days. To target only blobs in container1, the filter must use prefixMatch with the container name prefix (container1/).

Question 205

HOTSPOT - You have an Azure AD tenant named contoso.com. You have two external partner organizations named fabrikam.com and litwareinc.com. Fabrikam.com is configured as a connected organization. You create an access package as shown in the Access package exhibit. (Click the Access package tab.) You configure the external user lifecycle settings as shown in the Lifecycle exhibit. (Click the Lifecycle tab.) For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 205 Illustration for AZ-104 question 205 Illustration for AZ-104 question 205
Show Answer
Correct Answer: No No Yes
Explanation:
Only connected organizations can request the access package, so litwareinc.com users cannot be assigned. Access package assignments expire after 365 days, which removes users from Group1, but this is an expiration, not a removal event as stated. External user lifecycle settings specify removal from the tenant 30 days after the last assignment ends, resulting in removal after 395 days.

Question 206

HOTSPOT - You are creating an Azure Kubernetes Services (AKS) cluster as shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 206 Illustration for AZ-104 question 206
Show Answer
Correct Answer: modify the Network configuration setting AKS-managed Azure Active Directory
Explanation:
Windows node pools in AKS require Azure CNI networking; the cluster is currently using kubenet, so the network configuration must be changed. Integration with Azure Container Registry is configured through AKS-managed Azure Active Directory (or identity), which enables assigning the required pull permissions.

Question 207

HOTSPOT - You have an Azure App Service web app named app1. You configure autoscaling as shown in following exhibit. You configure the autoscale rule criteria as shown in the following exhibit. Use the drop-down menus to select the answer choice that answers each question based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 207 Illustration for AZ-104 question 207 Illustration for AZ-104 question 207
Show Answer
Correct Answer: 3 instances 5 minutes
Explanation:
The scale-out rule triggers after CPU >70% for a 10-minute duration, adding 1 instance (from 1 to 2). Metrics continue to be evaluated during cooldown, so after the 5-minute cooldown, the rule can trigger again if the last 10 minutes still exceed the threshold, adding another instance (total 3). The minimum time before an additional scale-out after the first is the 5-minute cooldown.

Question 208

You have an on-premises server that contains a folder named D:\Folder1. You need to copy the contents of D:\Folder1 to the public container in an Azure Storage account named contosodata. Which command should you run?

A. az storage blob copy start D:\Folder1 https://contosodata.blob.core.windows.net/public
B. azcopy sync D:\folder1 https://contosodata.blob.core.windows.net/public --snapshot
C. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public --recursive
D. az storage blob copy start-batch D:\Folder1 https://contosodata.blob.core.windows.net/public
Show Answer
Correct Answer: C
Explanation:
To copy the contents of a local folder to an Azure Blob container from an on-premises server, AzCopy is the appropriate tool. The command `azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public --recursive` uploads all files and subfolders to the target container. The `--recursive` flag is required for directories. The `az storage blob copy` commands are for copying blobs between Azure locations, not from a local file system, and `azcopy sync` is intended for ongoing synchronization rather than a straightforward copy.

Question 209

You have an Azure subscription that contains a storage account named storage1. You plan to create a blob container named container1. You need to use customer-managed key encryption for container1. Which key should you use?

A. an EC key that uses the P-384 curve only
B. an EC key that uses the P-521 curve only
C. an EC key that uses the P-384 curve or P-521 curve only
D. an RSA key with a key size of 4096 only
E. an RSA key type with a key size of 2048, 3072, or 4096 only
Show Answer
Correct Answer: E
Explanation:
Azure Storage customer-managed key (CMK) encryption supports only RSA or RSA-HSM keys stored in Azure Key Vault. Supported RSA key sizes are 2048, 3072, and 4096 bits. Elliptic Curve (EC) keys are not supported for Azure Storage encryption. Therefore, the correct choice is an RSA key type with a key size of 2048, 3072, or 4096.

$19

Get all 558 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full AZ-104 study guide →