CertBlaze

Microsoft

AZ-104 Free Practice Questions — Page 26

Question 253

You have an on-premises datacenter and an Azure subscription. You plan to connect the datacenter to Azure by using ExpressRoute. You need to deploy an ExpressRoute gateway. The solution must meet the following requirements: ✑ Support up to 10 Gbps of traffic. ✑ Support availability zones. ✑ Support FastPath. ✑ Minimize costs. Which SKU should you deploy?

A. ERGw1AZ
B. ERGw2
C. ErGw3
D. ErGw3AZ
Show Answer
Correct Answer: D
Explanation:
The gateway must support 10 Gbps throughput, Availability Zones, and FastPath while minimizing cost. Only ErGw3AZ meets all requirements: it supports up to 10 Gbps, is zone-redundant (Availability Zones), and supports FastPath. ERGw1AZ lacks required throughput, and ERGw2/ErGw3 do not support Availability Zones.

Question 254

You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1. You need to view the error events from a table named Event. Which query should you run in Workspace1?

A. Get-Event Event | where {$_.EventType == "error"}
B. Event | search "error"
C. select * from Event where EventType == "error"
D. search in (Event) * | where EventType ג€"eq ג€errorג€
Show Answer
Correct Answer: B
Explanation:
Azure Log Analytics uses Kusto Query Language (KQL), not PowerShell or SQL. The `search` operator is valid KQL and can be used to find records containing the term "error" within the Event table. Options A and C use PowerShell/SQL syntax, which are not supported, and option D uses invalid syntax.

Question 255

HOTSPOT - You have an Azure subscription that contains the hierarchy shown in the following exhibit. You create an Azure Policy definition named Policy1. To which Azure resources can you assign Policy1 and which Azure resources can you specify as exclusions from Policy1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

Illustration for AZ-104 question 255 Illustration for AZ-104 question 255
Show Answer
Correct Answer: You can assign Policy1 to: Tenant Root Group, ManagementGroup1, Subscription1, and RG1 only You can exclude Policy1 from: ManagementGroup1, Subscription1, RG1, and VM1 only
Explanation:
Azure Policy assignments support scopes at management group, subscription, resource group, and (via CLI/PowerShell) individual resources. In the given hierarchy, assignments can be made from the Tenant Root Group down to RG1, but not required at VM level in exam context. Exclusions can only be defined at child scopes of the assignment and cannot include the tenant root, so exclusions are valid for management group, subscription, resource group, and individual resources like VM1.

Question 256

You have an Azure subscription that contains a storage account named storage1. The storage1 account contains a file share named share1. The subscription is linked to a hybrid Azure Active Directory (Azure AD) tenant that contains a security group named Group1. You need to grant Group1 the Storage File Data SMB Share Elevated Contributor role for share1. What should you do first?

A. Enable Active Directory Domain Service (AD DS) authentication for storage1.
B. Grant share-level permissions by using File Explorer.
C. Mount share1 by using File Explorer.
D. Create a private endpoint.
Show Answer
Correct Answer: A
Explanation:
To assign the **Storage File Data SMB Share Elevated Contributor** role to an Azure AD security group, the storage account must first be configured to use identity-based authentication over SMB. Enabling **Active Directory Domain Services (AD DS)** (now Microsoft Entra Domain Services) authentication for the storage account is a prerequisite before any Azure AD group can be granted share-level RBAC permissions. The other options are subsequent or unrelated steps.

Question 257

HOTSPOT - You have an Azure subscription that has diagnostic logging enabled and is configured to send logs to a Log Analytics workspace. You are investigating a service outage. You need to view the event time, the event name, and the affected resources. How should you complete the query? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

Illustration for AZ-104 question 257
Show Answer
Correct Answer: Box 1: AzureActivity Box 2: | project
Explanation:
AzureActivity contains Azure Activity Log events, including event time, operation name, and affected resources. The project operator selects only the required columns (TimeGenerated, OperationNameValue, _ResourceId) after filtering critical events.

Question 258

HOTSPOT - You configure the custom role shown in the following exhibit. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:

Illustration for AZ-104 question 258 Illustration for AZ-104 question 258
Show Answer
Correct Answer: dataActions assignableScopes
Explanation:
Signing in to a virtual machine uses the permission Microsoft.Compute/virtualMachines/login/action, which is a data plane permission and must be added under dataActions. Restricting where a custom role can be assigned is controlled by assignableScopes, which should be set to the specific resource group (RG1).

Question 259

You have an Azure Subscription that contains a storage account named storageacct1234 and two users named User1 and User2. You assign User1 the roles shown in the following exhibit. Which two actions can User1 perform? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

A. Assign roles to User2 for storageacct1234.
B. Upload blob data to storageacct1234.
C. Modify the firewall of storageacct1234.
D. View blob data in storageacct1234.
E. View file shares in storageacct1234.
Show Answer
Correct Answer: B, D
Explanation:
User1 has the Storage Blob Data Contributor role, which grants read, write, and delete permissions for blob data, allowing blob uploads. User1 also has the Reader role, which provides management-plane read access to view resources and, combined with blob data permissions, allows viewing blob data. User1 cannot assign roles, modify firewall settings, or view file shares because those actions require Owner/User Access Administrator or file-specific data roles.

Question 260

HOTSPOT - You have two Azure virtual machines as shown in the following table. You create the Azure DNS zones shown in the following table. You perform the following actions: ✑ ׀¢׀¾ fabrikam.com, you add a virtual network link to vnet1 and enable auto registration. ✑ For contoso.com, you assign vm1 and vm2 the Owner role. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

Illustration for AZ-104 question 260 Illustration for AZ-104 question 260 Illustration for AZ-104 question 260
Show Answer
Correct Answer: No Yes Yes
Explanation:
Public DNS zones (contoso.com) do not support VM auto-registration; assigning Owner role has no effect on DNS records. The private DNS zone (fabrikam.com) is linked to vnet1 with auto-registration enabled, so all VMs in vnet1 register their private IPs regardless of OS or configured DNS suffix.

Question 261

You plan to create the Azure web apps shown in the following table. What is the minimum number of App Service plans you should create for the web apps?

A. 1
B. 2
C. 3
D. 4
Show Answer
Correct Answer: B
Explanation:
Azure App Service plans are bound to a single operating system (Windows or Linux), and you cannot mix Windows and Linux apps in the same plan. From the runtimes listed: ASP.NET (.NET Framework 4.7) requires Windows, while Ruby 2.6 is supported only on Linux App Service. Although .NET Core 3.x and PHP 7.3 can run on both Windows and Linux, the OS-specific requirements force at least one Windows plan and one Linux plan. Therefore, the minimum number of App Service plans required is 2.

Question 262

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Active Directory (Azure AD) tenant named contoso.com. You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: You create a PowerShell script that runs the New-AzureADMSInvitation cmdlet for each external user. Does this meet the goal?

A. Yes
B. No
Show Answer
Correct Answer: A
Explanation:
The New-AzureADMSInvitation cmdlet is designed to invite external users to an Azure AD tenant and create guest user objects upon invitation. Running this cmdlet in a PowerShell script for each email address in the CSV file will successfully create guest user accounts for all 500 external users, meeting the stated goal.

$19

Get all 558 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full AZ-104 study guide →