AZ-104 Online Practice Questions and Answers

Correct Answer:

Task 1: IP flow verify The IP flow verify capability enables you to specify a source and destination IPv4 address, port, protocol (TCP or UDP), and traffic direction (inbound or outbound). IP flow verify then tests the communication and informs you if the connection succeeds or fails. If the connection fails, IP flow verify tells you which security rule allowed or denied the communication, so that you can resolve the problem.

Task 2: Connection troubleshoot The connection troubleshoot capability enables you to test a connection between a VM and another VM, an FQDN, a URI, or an IPv4 address. The test returns similar information returned when using the connection monitor capability, but tests the connection at a point in time, rather than monitoring it over time.

Reference: https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-connectivity-overview

Correct Answer:

Box 1: a computer joined in the Active Directory domain The Active Directory domain service stores passwords in the form of a hash value representation, of the actual user password.

Box 2: Stored in both Azure AD and in the Active Director domain The Active Directory domain service stores passwords in the form of a hash value representation, of the actual user password.

To synchronize your password, Azure AD Connect sync extracts your password hash from the on- premises Active Directory instance.

References:

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hash- synchronization

Correct Answer:

Box 1: retained until manually deleted

Since by default PeekLock shall be enabled in Queue, so it will move to DeadLetter after 2hours and stays there until manually deleted. Messages in the dead letter queue should be deleted manually.

Box 2: deleted immediately

Once a message is pulled, it will be deleted immediately. It does not make sense to keep the message further 5 minutes "locked" in the queue. Locking the message makes sense, for the case, when processing the message from a receiver,

to lock the message, to avoid processing/receiving the message simultaneously by another receiver.

The receiving client initiates settlement of a received message with a positive acknowledgment when it calls Complete at the API level. This indicates to the broker that the message has been successfully processed and the message is

removed from the queue or subscription.

Reference:

https://docs.microsoft.com/en-us/azure/service-bus-messaging/message-expiration https://docs.microsoft.com/en-us/azure/service-bus-messaging/message-transfers-locks-settlement

Correct Answer: CDE

Step 1 (E): Install the Azure File Sync agent on Server1 The Azure File Sync agent is a downloadable package that enables Windows Server to be synced with an Azure file share

Step 2 (D): Register Server1.

Register Windows Server with Storage Sync Service

Registering your Windows Server with a Storage Sync Service establishes a trust relationship between your server (or cluster) and the Storage Sync Service.

Step 3 (C): Create a sync group and a cloud endpoint.

A sync group defines the sync topology for a set of files. Endpoints within a sync group are kept in sync with each other. A sync group must contain one cloud endpoint, which represents an Azure file share and one or more server endpoints.A

server endpoint represents a path on registered server.

References:

https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide

Correct Answer: A

You can't delete a vault that contains backup data. So in this case at first you have to delete the backup of 'SQLD01' before you attempt to delete the vault.

Reference:

https://docs.microsoft.com/en-us/azure/backup/backup-azure-delete-vault

Correct Answer: C

Email will only be sent to Azure AD user members of the Monitoring Reader role. Email will not be sent to Azure AD groups or service principals.

Reference: https://docs.microsoft.com/en-us/azure/azure-monitor/platform/action-groups

Correct Answer: A

Shared Access Signatures (SAS) allows for limited-time fine grained access control to resources. So you can generate URL, specify duration (for month of April) and disseminate URL to 10 team members. On May 1, the SAS token is

automatically invalidated, denying team members continued access.

Reference:

https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview

Correct Answer: A

The virtual machine you attach a network interface to and the virtual network you connect it to must exist in the same location, here West US, also referred to as a region.

References:

https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface

Correct Answer: E

Password writeback is a feature enabled with Azure AD Connect that allows password changes in the cloud to be written back to an existing on-premises directory in real time.

References:

https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-sspr-writeback

Correct Answer: B

Instead: You create an Azure Log Analytics workspace and configure the data settings.

You install the Microsoft Monitoring Agent on VM1.

You create an alert in Azure Monitor and specify the Log Analytics workspace as the source.

Reference:

https://docs.microsoft.com/en-us/azure/azure-monitor/platform/agents-overview

Correct Answer: B

The Logic App Operator role only lets you read, enable and disable logic app. With it you can view the logic app and run history, and enable/disable. Cannot edit or update the definition.

You would need the Logic App Contributor role.

References:

https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app

Correct Answer: B

An Azure container registry stores and manages private Docker container images, similar to the way Docker Hub stores public Docker images. You can use the Docker command-line interface (Docker CLI) for login, push, pull, and other

operations on your container registry. After you login to the registry you can run push command to upload the image.

Below is an sample of that command

docker push myregistry.azurecr.io/samples/nginx

Run the az acr build command : Correct Choice

az acr build command queues a quick build, providing streaming logs for an Azure Container Registry

az acr build --registry

[--agent-pool]

[--auth-mode {Default, None}]

[--build-arg]

[--file]

[--image]

[--no-format]

[--no-logs]

[--no-push]

[--no-wait]

[--platform]

[--resource-group]

[--secret-build-arg]

[--subscription]

[--target]

[--timeout]

[]

Create a host pool on Cluster1 : Incorrect Choice

Host pools are a collection of one or more identical virtual machines (VMs) within Windows Virtual Desktop environments. It won't deploy the app to the cluster.

Run the docker push command : Incorrect Choice

Use docker push to share your images to the Docker Hub registry or to a self-hosted one. It won't deploy the app to the cluster.

Run the docker build command : Incorrect Choice

This command will build an image from a Dockerfile. But in the question it has been said that image file is already built and need to deploy. This command will not deploy the image.

Reference:

https://docs.microsoft.com/en-us/cli/azure/acr?view=azure-cli-latest#az-acr-build

https://docs.docker.com/engine/reference/commandline/push/

https://docs.microsoft.com/en-us/azure/virtual-desktop/create-host-pools-azure-marketplace

https://docs.docker.com/engine/reference/commandline/build/

https://docs.microsoft.com/en-us/azure/container-registry/container-registry-get-started-docker-cli

Correct Answer: C

Azure Load Balancer distribution modes

Azure Load Balancer supports the following distribution modes for routing connections to instances in the backend pool:

*

Session persistence: Client IP Traffic from the same client IP is routed to the same backend instance

*

Session persistence: Client IP and protocol Traffic from the same client IP and protocol is routed to the same backend instance

*

Etc.

Reference: https://learn.microsoft.com/en-us/azure/load-balancer/distribution-mode-concepts

Correct Answer: A

Therefore, the most direct and crucial dependency for VM1 among the listed resources is NIC1. The NIC acts as the bridge between the VM and the other network resources like the virtual network, public IP, and network security group. Hence, it's essential to ensure that NIC1 is deployed before VM1.

https://learn.microsoft.com/en-us/azure/templates/microsoft.compute/virtualmachines?pivots=deployment-language-arm-template https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/resource-dependency https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorial-create-templates-with-dependent-resources?tabs=CLI

Correct Answer: A

With Application Insights Profiler, you can capture and view performance traces for your application in all these dynamic situations, automatically at-scale, without negatively affecting your end users. https://learn.microsoft.com/en-us/azure/azure-monitor/profiler/profiler-overview