0% found this document useful (0 votes)
648 views

AZ-104 Part2

Uploaded by

ph6116
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
648 views

AZ-104 Part2

Uploaded by

ph6116
Copyright
© © All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
You are on page 1/ 108

10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

- Expert Verified, Online, Free.

Custom View Settings

Question #24 Topic 4

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json.
You receive a notification that VM1 will be affected by maintenance.
You need to move VM1 to a different host immediately.
Solution: From the Redeploy blade, you click Redeploy.
Does this meet the goal?

A. Yes

B. No

Correct Answer: A
When you redeploy a VM, it moves the VM to a new node within the Azure infrastructure and then powers it back on, retaining all your
configuration options and associated resources.
References:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/redeploy-to-new-node

Question #25 Topic 4

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json.
You receive a notification that VM1 will be affected by maintenance.
You need to move VM1 to a different host immediately.
Solution: From the Update management blade, you click Enable.
Does this meet the goal?

A. Yes

B. No

Correct Answer: B
You would need to redeploy the VM.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/redeploy-to-new-node

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 1/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #26 Topic 4

You have an Azure subscription that contains a web app named webapp1.
You need to add a custom domain named www.contoso.com to webapp1.
What should you do first?

A. Create a DNS record

B. Add a connection string

C. Upload a certificate.

D. Stop webapp1.

Correct Answer: A
You can use either a CNAME record or an A record to map a custom DNS name to App Service.
Reference:
https://docs.microsoft.com/en-us/Azure/app-service/app-service-web-tutorial-custom-domain

Question #27 Topic 4

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains the resources shown in the following table.

VM1 connects to VNET1.


You need to connect VM1 to VNET2.
Solution: You move VM1 to RG2, and then you add a new network interface to VM1.
Does this meet the goal?

A. Yes

B. No

Correct Answer: B
Instead you should delete VM1. You recreate VM1, and then you add the network interface for VM1.
Note: When you create an Azure virtual machine (VM), you must create a virtual network (VNet) or use an existing VNet. You can change the
subnet a VM is connected to after it's created, but you cannot change the VNet.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/network-overview

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 2/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #28 Topic 4

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains the resources shown in the following table.

VM1 connects to VNET1.


You need to connect VM1 to VNET2.
Solution: You delete VM1. You recreate VM1, and then you create a new network interface for VM1 and connect it to VNET2.
Does this meet the goal?

A. Yes

B. No

Correct Answer: A
You should delete VM1. You recreate VM1, and then you add the network interface for VM1.
Note: When you create an Azure virtual machine (VM), you must create a virtual network (VNet) or use an existing VNet. You can change the
subnet a VM is connected to after it's created, but you cannot change the VNet.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/network-overview

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 3/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #29 Topic 4

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains the resources shown in the following table.

VM1 connects to VNET1.


You need to connect VM1 to VNET2.
Solution: You turn off VM1, and then you add a new network interface to VM1.
Does this meet the goal?

A. Yes

B. No

Correct Answer: B
Instead you should delete VM1. You recreate VM1, and then you add the network interface for VM1.
Note: When you create an Azure virtual machine (VM), you must create a virtual network (VNet) or use an existing VNet. You can change the
subnet a VM is connected to after it's created, but you cannot change the VNet.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/network-overview

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 4/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #30 Topic 4

HOTSPOT -
You have an Azure subscription named Subscription1 that contains the quotas shown in the following table.

You deploy virtual machines to Subscription1 as shown in the following table.

You plan to deploy the virtual machines shown in the following table.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

The total regional vCPUs is 20 so that means a maximum total of 20 vCPUs across all the different VM sizes. The deallocated VM with 16
vCPUs counts towards the total. VM20 and VM1 are using 18 of the maximum 20 vCPUs leaving only two vCPUs available.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/quotas

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 5/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #31 Topic 4

HOTSPOT -
You have an Azure subscription that contains an Azure Availability Set named WEBPROD-AS-USE2 as shown in the following exhibit.

You add 14 virtual machines to WEBPROD-AS-USE2.


Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 6/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Correct Answer:

Box 1: 2 -
There are 10 update domains. The 14 VMs are shared across the 10 update domains so four update domains will have two VMs and six update
domains will have one VM. Only one update domain is rebooted at a time. Therefore, a maximum of two VMs will be offline.

Box 2: 7 -
There are 2 fault domains. The 14 VMs are shared across the 2 fault domains, so 7 VMs in each fault domain. A rack failure will affect one fault
domain so 7 VMs will be offline.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/manage-availability

Question #32 Topic 4

You deploy an Azure Kubernetes Service (AKS) cluster named Cluster1 that uses the IP addresses shown in the following table.

You need to provide internet users with access to the applications that run in Cluster1.
Which IP address should you include in the DNS record for Cluster1?

A. 131.107.2.1

B. 10.0.10.11

C. 172.17.7.1

D. 192.168.10.2

Correct Answer: A

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 7/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #33 Topic 4

You have a deployment template named Template1 that is used to deploy 10 Azure web apps.
You need to identify what to deploy before you deploy Template1. The solution must minimize Azure costs.
What should you identify?

A. five Azure Application Gateways

B. one App Service plan

C. 10 App Service plans

D. one Azure Traffic Manager

E. one Azure Application Gateway

Correct Answer: B
You create Azure web apps in an App Service plan.
Reference:
https://docs.microsoft.com/en-us/azure/app-service/overview-hosting-plans

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 8/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #34 Topic 4

HOTSPOT -
You plan to deploy an Azure container instance by using the following Azure Resource Manager template.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the template.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 9/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Correct Answer:

Question #35 Topic 4

You have an Azure subscription that contains a virtual machine named VM1. VM1 hosts a line-of-business application that is available 24 hours a
day. VM1 has one network interface and one managed disk. VM1 uses the D4s v3 size.
You plan to make the following changes to VM1:
✑ Change the size to D8s v3.
✑ Add a 500-GB managed disk.
✑ Add the Puppet Agent extension.
✑ Enable Desired State Configuration Management.
Which change will cause downtime for VM1?

A. Enable Desired State Configuration Management

B. Add a 500-GB managed disk

C. Change the size to D8s v3

D. Add the Puppet Agent extension

Correct Answer: C
While resizing the VM it must be in a stopped state.
Reference:
https://azure.microsoft.com/en-us/blog/resize-virtual-machines/

Question #36 Topic 4

You have an app named App1 that runs on an Azure web app named webapp1.
The developers at your company upload an update of App1 to a Git repository named Git1.
Webapp1 has the deployment slots shown in the following table.

You need to ensure that the App1 update is tested before the update is made available to users.
Which two actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. Swap the slots

B. Deploy the App1 update to webapp1-prod, and then test the update

C. Stop webapp1-prod

D. Deploy the App1 update to webapp1-test, and then test the update

E. Stop webapp1-test

Correct Answer: AD

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 10/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #37 Topic 4

You have an Azure subscription named Subscription1 that has the following providers registered:
✑ Authorization
✑ Automation
✑ Resources
✑ Compute
✑ KeyVault
✑ Network
✑ Storage
✑ Billing
✑ Web
Subscription1 contains an Azure virtual machine named VM1 that has the following configurations:
✑ Private IP address: 10.0.0.4 (dynamic)
✑ Network security group (NSG): NSG1
✑ Public IP address: None
✑ Availability set: AVSet
✑ Subnet: 10.0.0.0/24

Managed disks: No -

✑ Location: East US
You need to record all the successful and failed connection attempts to VM1.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. Enable Azure Network Watcher in the East US Azure region.

B. Add an Azure Network Watcher connection monitor.

C. Register the MicrosoftLogAnalytics provider.

D. Create an Azure Storage account.

E. Register the Microsoft.Insights resource provider.

F. Enable Azure Network Watcher flow logs.

Correct Answer: AEF


You can log network traffic that flows through an NSG with Network Watcher's NSG flow log capability.
✑ In the Azure portal, enable Network Watcher
✑ Register Insights provider. NSG flow logging requires the Microsoft.Insights provider.
✑ Enable NSG flow log. NSG flow log data is written to an Azure Storage account, Subscription1 has storage.
Reference:
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-portal

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 11/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #38 Topic 4

You need to deploy an Azure virtual machine scale set that contains five instances as quickly as possible.
What should you do?

A. Deploy five virtual machines. Modify the Availability Zones settings for each virtual machine.

B. Deploy five virtual machines. Modify the Size setting for each virtual machine.

C. Deploy one virtual machine scale set that is set to VM (virtual machines) orchestration mode.

D. Deploy one virtual machine scale set that is set to ScaleSetVM orchestration mode.

Correct Answer: D
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/orchestration-modes

Question #39 Topic 4

You plan to create the Azure web apps shown in the following table.

What is the minimum number of App Service plans you should create for the web apps?

A. 1

B. 2

C. 3

D. 4

Correct Answer: A

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 12/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #40 Topic 4

HOTSPOT -
You have a pay-as-you-go Azure subscription that contains the virtual machines shown in the following table.

You create the budget shown in the following exhibit.

The AG1 action group contains a user named [email protected] only.


Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 13/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Correct Answer:

Box 1: VM1 is turned off, and VM2 continues to run


The budget alerts are for Resource Group RG1, which include VM1, but not VM2.
Box 2: one email notification will be sent each month.
Budget alerts for Resource Group RG1, which include VM1, but not VM2.VM1 consumes 20 Euro/day. The 50%, 500 Euro limit, will be reached in
25 days, and an email will be sent.
The 70% and 100% alert conditions will not be reached within a month, and they don't trigger email actions anyway.
Credit alerts: Credit alerts are generated automatically at 90% and at 100% of your Azure credit balance. Whenever an alert is generated, it's
reflected in cost alerts and in the email sent to the account owners. 90% and 100% will not be reached though.
Reference:
https://docs.microsoft.com/en-us/azure/cost-management-billing/costs/cost-mgt-alerts-monitor-usage-spending

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 14/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #41 Topic 4

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were
deployed by using templates.
You need to view the date and time when the resources were created in RG1.
Solution: From the Subscriptions blade, you select the subscription, and then click Programmatic deployment.
Does this meet the goal?

A. Yes

B. No

Correct Answer: B
From the RG1 blade, click Deployments. You see a history of deployment for the resource group.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorial-create-first-template?tabs=azure-powershell

Question #42 Topic 4

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains the resources shown in the following table.

VM1 connects to VNET1.


You need to connect VM1 to VNET2.
Solution: You create a new network interface, and then you add the network interface to VM1.
Does this meet the goal?

A. Yes

B. No

Correct Answer: B
You should delete VM1. You recreate VM1, and then you add the network interface for VM1.
Note: When you create an Azure virtual machine (VM), you must create a virtual network (VNet) or use an existing VNet. You can change the
subnet a VM is connected to after it's created, but you cannot change the VNet.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/network-overview

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 15/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #43 Topic 4

You have an Azure Active Directory (Azure AD) tenant named adatum.com that contains the users shown in the following table.

Adatum.com has the following configurations:


✑ Users may join devices to Azure AD is set to User1.
✑ Additional local administrators on Azure AD joined devices is set to None.
You deploy Windows 10 to a computer named Computer1. User1 joins Computer1 to adatum.com.
You need to identify the local Administrator group membership on Computer1.
Which users are members of the local Administrators group?

A. User1 only

B. User2 only

C. User1 and User2 only

D. User1, User2, and User3 only

E. User1, User2, User3, and User4

Correct Answer: C
Users may join devices to Azure AD - This setting enables you to select the users who can register their devices as Azure AD joined devices.
The default is All.
Additional local administrators on Azure AD joined devices - You can select the users that are granted local administrator rights on a device.
Users added here are added to the Device Administrators role in Azure AD. Global administrators, here User2, in Azure AD and device owners
are granted local administrator rights by default.
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/devices/device-management-azure-portal

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 16/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #44 Topic 4

HOTSPOT -
You have Azure subscriptions named Subscription1 and Subscription2.
Subscription1 has following resource groups:

RG1 includes a web app named App1 in the West Europe location.
Subscription2 contains the following resource groups:

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Box 1: No -
RG2 is read only. ReadOnly means authorized users can read a resource, but they cannot delete or update the resource.

Box 2: Yes -

Box 3: Yes -
Note:
App Service resources are region-specific and cannot be moved directly across regions. You can move the App Service resource by creating a
copy of your existing App Service resource in the target region, then move your content over to the new app. You can then delete the source app
and App Service plan.
To make copying your app easier, you can clone an individual App Service app into an App Service plan in another region.
Reference:
https://docs.microsoft.com/en-us/azure/app-service/manage-move-across-regions https://docs.microsoft.com/en-us/azure/azure-resource-
manager/management/move-limitations/app-service-move-limitations

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 17/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #45 Topic 4

HOTSPOT -
You have an Azure subscription named Subscription1 that contains the following resource group:
✑ Name: RG1
✑ Region: West US
✑ Tag: ‫ג‬€tag1‫ ג‬:€‫ג‬€value1‫ג‬€
You assign an Azure policy named Policy1 to Subscription1 by using the following configurations:
✑ Exclusions: None
✑ Policy definition: Append a tag and its value to resources
✑ Assignment name: Policy1
✑ Parameters:
✑ Tag name: tag2
✑ Tag value: value2
After Policy1 is assigned, you create a storage account that has the following configuration:
✑ Name: storage1
✑ Location: West US
✑ Resource group: RG1
✑ Tags: ‫ג‬€tag3‫ ג‬:€‫ג‬€value3‫ג‬€
You need to identify which tags are assigned to each resource.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Box 1: "tag1": "value1" only -


Box 2: "tag2": "value2" and "tag3": "value3" only
Tags applied to the resource group are not inherited by the resources in that resource group.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-using-tags

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 18/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #46 Topic 4

HOTSPOT -
You have an Azure subscription named Subscription1.
In Subscription1, you create an alert rule named Alert1.
The Alert1 action group is configured as shown in the following exhibit.

Alert1 alert criteria triggered every minute.


Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Box 1: 60 -
One alert per minute will trigger one email per minute.

Box 2: 12 -
No more than 1 SMS every 5 minutes can be send, which equals 12 per hour.
Note: Rate limiting is a suspension of notifications that occurs when too many are sent to a particular phone number, email address or device.
Rate limiting ensures that alerts are manageable and actionable.
The rate limit thresholds are:
✑ SMS: No more than 1 SMS every 5 minutes.
✑ Voice: No more than 1 Voice call every 5 minutes
https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 19/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

✑ Email: No more than 100 emails in an hour.

✑ Other actions are not rate limited.


Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/platform/alerts-rate-limiting

Question #47 Topic 4

You have an Azure subscription named Subscription1 that contains the resources shown in the following table.

You create virtual machines in Subscription1 as shown in the following table.

You plan to use Vault1 for the backup of as many virtual machines as possible.
Which virtual machines can be backed up to Vault1?

A. VM1 only

B. VM3 and VMC only

C. VM1, VM2, VM3, VMA, VMB, and VMC

D. VM1, VM3, VMA, and VMC only

E. VM1 and VM3 only

Correct Answer: D
To create a vault to protect virtual machines, the vault must be in the same region as the virtual machines. If you have virtual machines in
several regions, create a
Recovery Services vault in each region.
Reference:
https://docs.microsoft.com/bs-cyrl-ba/azure/backup/backup-create-rs-vault

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 20/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #48 Topic 4

You have an Azure Kubernetes Service (AKS) cluster named AKS1.


You need to configure cluster autoscaler for AKS1.
Which two tools should you use? Each correct answer presents a complete solution.
NOTE: Each correct selection is worth one point.

A. the kubectl command

B. the az aks command

C. the Set-AzVm cmdlet

D. the Azure portal

E. the Set-AzAks cmdlet

Correct Answer: AB
A: The following example uses the kubectl autoscale command to autoscale the number of pods in the azure-vote-front deployment. If average
CPU utilization across all pods exceeds 50% of their requested usage, the autoscaler increases the pods up to a maximum of 10 instances. A
minimum of 3 instances is then defined for the deployment: kubectl autoscale deployment azure-vote-front --cpu-percent=50 --min=3 --max=10
B: Use the az aks update command to enable and configure the cluster autoscaler on the node pool for the existing cluster.
Reference:
https://docs.microsoft.com/en-us/azure/aks/tutorial-kubernetes-scale https://docs.microsoft.com/en-us/azure/aks/cluster-autoscaler

Question #49 Topic 4

You create the following resources in an Azure subscription:


✑ An Azure Container Registry instance named Registry1
✑ An Azure Kubernetes Service (AKS) cluster named Cluster1
You create a container image named App1 on your administrative workstation.
You need to deploy App1 to Cluster1.
What should you do first?

A. Run the docker push command.

B. Create an App Service plan.

C. Run the az acr build command.

D. Run the az aks create command.

Correct Answer: C
You should sign in and push a container image to Container Registry.
Run the az acr build command to build and push the container image. az acr build \
--image contoso-website \
--registry $ACR_NAME \
--file Dockerfile .
Reference:
https://docs.microsoft.com/en-us/learn/modules/aks-deploy-container-app/5-exercise-deploy-app

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 21/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #50 Topic 4

You have an Azure subscription that contains the resources shown in the following table.

You need to configure a proximity placement group for VMSS1.


Which proximity placement groups should you use?

A. Proximity2 only

B. Proximity1, Proximity2, and Proximity3

C. Proximity1 only

D. Proximity1 and Proximity3 only

Correct Answer: A
Resource Group location of VMSS1 is the RG2 location, which is West US.
Only Proximity2, which also in RG2, is location in West US
Reference:
https://azure.microsoft.com/en-us/blog/introducing-proximity-placement-groups/

Question #51 Topic 4

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were
deployed by using templates.
You need to view the date and time when the resources were created in RG1.
Solution: From the Subscriptions blade, you select the subscription, and then click Resource providers.
Does this meet the goal?

A. Yes

B. No

Correct Answer: B

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 22/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #52 Topic 4

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were
deployed by using templates.
You need to view the date and time when the resources were created in RG1.
Solution: From the RG1 blade, you click Automation script.
Does this meet the goal?

A. Yes

B. No

Correct Answer: B
From the RG1 blade, click Deployments. You see a history of deployment for the resource group.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorial-create-first-template?tabs=azure-powershell

Question #53 Topic 4

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were
deployed by using templates.
You need to view the date and time when the resources were created in RG1.
Solution: From the RG1 blade, you click Deployments.
Does this meet the goal?

A. Yes

B. No

Correct Answer: A
From the RG1 blade, click Deployments. You see a history of deployment for the resource group.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-tutorial-create-first-template?tabs=azure-powershell

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 23/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #54 Topic 4

You have an Azure subscription named Subscription1.


You deploy a Linux virtual machine named VM1 to Subscription1.
You need to monitor the metrics and the logs of VM1.
What should you use?

A. Azure HDInsight

B. Linux Diagnostic Extension (LAD) 3.0

C. the AzurePerformanceDiagnostics extension

D. Azure Analysis Services

Correct Answer: C
You can use extensions to configure diagnostics on your VMs to collect additional metric data.
The basic host metrics are available, but to see more granular and VM-specific metrics, you need to install the Azure diagnostics extension on
the VM. The Azure diagnostics extension allows additional monitoring and diagnostics data to be retrieved from the VM.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/linux/tutorial-monitoring

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 24/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #55 Topic 4

HOTSPOT -
You have an Azure subscription named Subscription1. Subscription1 contains a virtual machine named VM1.
You install and configure a web server and a DNS server on VM1.
VM1 has the effective network security rules shown in the following exhibit:

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Box 1:
Rule2 blocks ports 50-60, which includes port 53, the DNS port. Internet users can reach to the Web server, since it uses port 80.
Box 2:
If Rule2 is removed internet users can reach the DNS server as well.
Note: Rules are processed in priority order, with lower numbers processed before higher numbers, because lower numbers have higher priority.

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 25/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Once traffic matches a rule, processing stops. As a result, any rules that exist with lower priorities (higher numbers) that have the same
attributes as rules with higher priorities are not processed.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

Question #56 Topic 4

You plan to deploy three Azure virtual machines named VM1, VM2, and VM3. The virtual machines will host a web app named App1.
You need to ensure that at least two virtual machines are available if a single Azure datacenter becomes unavailable.
What should you deploy?

A. all three virtual machines in a single Availability Zone

B. all virtual machines in a single Availability Set

C. each virtual machine in a separate Availability Zone

D. each virtual machine in a separate Availability Set

Correct Answer: C
Use availability zones to protect from datacenter level failures.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/manage-availability https://docs.microsoft.com/en-us/azure/virtual-
machines/windows/tutorial-availability-sets

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 26/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #57 Topic 4

You have an Azure virtual machine named VM1 that runs Windows Server 2019.
You save VM1 as a template named Template1 to the Azure Resource Manager library.
You plan to deploy a virtual machine named VM2 from Template1.
What can you configure during the deployment of VM2?

A. operating system

B. administrator username

C. virtual machine size

D. resource group

Correct Answer: B
When deploying a virtual machine from a template, you must specify:
✑ the Resource Group name and location for the VM
✑ the administrator username and password
✑ an unique DNS name for the public IP
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/ps-template

Question #58 Topic 4

You have an Azure subscription that contains an Azure virtual machine named VM1. VM1 runs a financial reporting app named App1 that does not
support multiple active instances.
At the end of each month, CPU usage for VM1 peaks when App1 runs.
You need to create a scheduled runbook to increase the processor performance of VM1 at the end of each month.
What task should you include in the runbook?

A. Add the Azure Performance Diagnostics agent to VM1.

B. Modify the VM size property of VM1.

C. Add VM1 to a scale set.

D. Increase the vCPU quota for the subscription.

E. Add a Desired State Configuration (DSC) extension to VM1.

Correct Answer: E
Reference:
https://docs.microsoft.com/en-us/azure/automation/automation-quickstart-dsc-configuration

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 27/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #59 Topic 4

You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource
Manager template.
You need to ensure that NGINX is available on all the virtual machines after they are deployed.
What should you use?

A. Deployment Center in Azure App Service

B. A Desired State Configuration (DSC) extension

C. the New-AzConfigurationAssignment cmdlet

D. a Microsoft Intune device configuration profile

Correct Answer: B
Azure virtual machine extensions are small packages that run post-deployment configuration and automation on Azure virtual machines.
In the following example, the Azure CLI is used to deploy a custom script extension to an existing virtual machine, which installs a Nginx
webserver. az vm extension set \
--resource-group myResourceGroup \
--vm-name myVM --name customScript \
--publisher Microsoft.Azure.Extensions \
--settings '{"commandToExecute": "apt-get install -y nginx"}
Note:
There are several versions of this question in the exam. The question has two correct answers:
1. a Desired State Configuration (DSC) extension
2. Azure Custom Script Extension
The question can have other incorrect answer options, including the following:
✑ the Publish-AzVMDscConfiguration cmdlet
✑ Azure Application Insights
Reference:
https://docs.microsoft.com/en-us/azure/architecture/framework/devops/automation-configuration

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 28/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #60 Topic 4

HOTSPOT -
You deploy an Azure Kubernetes Service (AKS) cluster that has the network profile shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Box 1: 10.244.0.0/16 -
The Pod CIDR.
Note: The --pod-cidr should be a large address space that isn't in use elsewhere in your network environment. This range includes any on-
premises network ranges if you connect, or plan to connect, your Azure virtual networks using Express Route or a Site-to-Site VPN connection.
This address range must be large enough to accommodate the number of nodes that you expect to scale up to. You can't change this address
range once the cluster is deployed if you need more addresses for additional nodes.

Box 2: 10.0.0.0/16 -
The --service-cidr is used to assign internal services in the AKS cluster an IP address.
Reference:
https://docs.microsoft.com/en-us/azure/aks/configure-kubenet

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 29/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 30/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #61 Topic 4

HOTSPOT -
You have the App Service plan shown in the following exhibit.

The scale-in settings for the App Service plan are configured as shown in the following exhibit.

The scale out rule is configured with the same duration and cool down tile as the scale in rule.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 31/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

NOTE: Each correct selection is worth one point.


Hot Area:

Correct Answer:

Box 1: 5 -
The maximum 5 will kept as the CPU Usage >= 30.

Box 2: 3 -
As soon as the average CPU usage drops below 30%, the count will decrease by 1. After the 5 minute cool-down it will decrease by another 1,
reaching 3.
Reference:
https://docs.microsoft.com/en-us/azure/azure-monitor/learn/tutorial-autoscale-performance-schedule

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 32/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #62 Topic 4

You have an Azure virtual machine named VM1 that runs Windows Server 2019. The VM was deployed using default drive settings.
You sign in to VM1 as a user named User1 and perform the following actions:
✑ Create files on drive C.
✑ Create files on drive D.
✑ Modify the screen saver timeout.
✑ Change the desktop background.
You plan to redeploy VM1.
Which changes will be lost after you redeploy VM1?

A. the modified screen saver timeout

B. the new desktop background

C. the new files on drive D

D. the new files on drive C

Correct Answer: C

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 33/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #63 Topic 4

You have an Azure subscription.


You have an on-premises virtual machine named VM1. The settings for VM1 are shown in the exhibit. (Click the Exhibit tab.)

You need to ensure that you can use the disks attached to VM1 as a template for Azure virtual machines.
What should you modify on VM1?

A. the memory

B. the network adapters

C. the hard drive

D. the processor

E. Integration Services

Correct Answer: C
From the exhibit we see that the disk is in the VHDX format.
Before you upload a Windows virtual machine (VM) from on-premises to Microsoft Azure, you must prepare the virtual hard disk (VHD or
VHDX). Azure supports only generation 1 VMs that are in the VHD file format and have a fixed sized disk. The maximum size allowed for the
VHD is 1,023 GB. You can convert a generation 1 VM from the VHDX file system to VHD and from a dynamically expanding disk to fixed-sized.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/prepare-for-upload-vhd-image

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 34/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #64 Topic 4

HOTSPOT -
You have an Azure subscription that contains a virtual machine scale set. The scale set contains four instances that have the following
configurations:
✑ Operating system: Windows Server 2016
✑ Size: Standard_D1_v2
You run the get-azvmss cmdlet as shown in the following exhibit:

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 35/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Correct Answer:

The Get-AzVmssVM cmdlet gets the model view and instance view of a Virtual Machine Scale Set (VMSS) virtual machine.

Box 1: 0 -
The enableAutomaticUpdates parameter is set to false. To update existing VMs, you must do a manual upgrade of each existing VM.

Box 2: 4 -
Enabling automatic OS image upgrades on your scale set helps ease update management by safely and automatically upgrading the OS disk for
all instances in the scale set.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-upgrade-scale-set
https://docs.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-upgrade

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 36/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #65 Topic 4

You have an Azure subscription named Subscription1 that is used by several departments at your company. Subscription1 contains the resources
in the following table:

Another administrator deploys a virtual machine named VM1 and an Azure Storage account named storage2 by using a single Azure Resource
Manager template.
You need to view the template used for the deployment.
From which blade can you view the template that was used for the deployment?

A. VM1

B. RG1

C. storage2

D. container1

Correct Answer: B
View template from deployment history
1. Go to the resource group for your new resource group. Notice that the portal shows the result of the last deployment. Select this link.

2. You see a history of deployments for the group. In your case, the portal probably lists only one deployment. Select this deployment.

3. The portal displays a summary of the deployment. The summary includes the status of the deployment and its operations and the values that
you provided for parameters. To see the template that you used for the deployment, select View template.

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 37/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #66 Topic 4

You have an Azure web app named App1. App1 has the deployment slots shown in the following table:

InRw
efeebreanpcpe1:-test, you test several changes to App1.
Yohuttpbsa:c//kduopcsA.m
ppic1r.osoft.com/en-us/azure/azure-resource-manager/resource-manager-export-template
You swap webapp1-test for webapp1-prod and discover that App1 is experiencing performance issues.
You need to revert to the previous version of App1 as quickly as possible.
What should you do?

A. Redeploy App1

B. Swap the slots

C. Clone App1

D. Restore the backup of App1

Correct Answer: B
When you swap deployment slots, Azure swaps the Virtual IP addresses of the source and destination slots, thereby swapping the URLs of the
slots. We can easily revert the deployment by swapping back.
Reference:
https://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 38/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #67 Topic 4

HOTSPOT -
You have an Azure subscription named Subscription1. Subscription1 contains two Azure virtual machines VM1 and VM2. VM1 and VM2 run
Windows Server
2016.
VM1 is backed up daily by Azure Backup without using the Azure Backup agent.
VM1 is affected by ransomware that encrypts data.
You need to restore the latest backup of VM1.
To which location can you restore the backup? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Note: The new VM must be in the same region.


Reference:
https://docs.microsoft.com/en-us/azure/backup/backup-azure-arm-restore-vms

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 39/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #68 Topic 4

You plan to back up an Azure virtual machine named VM1.


You discover that the Backup Pre-Check status displays a status of Warning.
What is a possible cause of the Warning status?

A. VM1 is stopped.

B. VM1 does not have the latest version of the Azure VM Agent (WaAppAgent.exe) installed.

C. VM1 has an unmanaged disk.

D. A Recovery Services vault is unavailable.

Correct Answer: B
The Warning state indicates one or more issues in VM‫ג‬€™s configuration that might lead to backup failures and provides recommended steps
to ensure successful backups. Not having the latest VM Agent installed, for example, can cause backups to fail intermittently and falls in this
class of issues.
Reference:
https://azure.microsoft.com/en-us/blog/azure-vm-backup-pre-checks/

Question #69 Topic 4

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json.
You receive a notification that VM1 will be affected by maintenance.
You need to move VM1 to a different host immediately.
Solution: From the Overview blade, you move the virtual machine to a different resource group.
Does this meet the goal?

A. Yes

B. No

Correct Answer: B
You would need to redeploy the VM.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/redeploy-to-new-node

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 40/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #70 Topic 4

HOTSPOT -
You have an Azure subscription.
You plan to use Azure Resource Manager templates to deploy 50 Azure virtual machines that will be part of the same availability set.
You need to ensure that as many virtual machines as possible are available if the fabric fails or during servicing.
How should you configure the template? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Box 1: 2 -
Use two fault domains.
2 or 3 is max, depending on which region you are in.

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 41/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Box 2: 20 -
Use 20 for platformUpdateDomainCount
Increasing the update domain (platformUpdateDomainCount) helps with capacity and availability planning when the platform reboots nodes. A
higher number for the pool (20 is max) means that fewer of their nodes in any given availability set would be rebooted at once.
Reference:
https://www.itprotoday.com/microsoft-azure/check-if-azure-region-supports-2-or-3-fault-domains-managed-disks
https://github.com/Azure/acs-engine/issues/1030

Question #71 Topic 4

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure virtual machine named VM1 that runs Windows Server 2016.
You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour.
Solution: You create an Azure Log Analytics workspace and configure the Agent configuration settings. You install the Microsoft Monitoring Agent
on VM1. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source.
Does this meet the goal?

A. Yes

B. No

Correct Answer: A
Alerts in Azure Monitor can identify important information in your Log Analytics repository. They are created by alert rules that automatically
run log searches at regular intervals, and if results of the log search match particular criteria, then an alert record is created and it can be
configured to perform an automated response.
The Log Analytics agent collects monitoring data from the guest operating system and workloads of virtual machines in Azure, other cloud
providers, and on- premises. It collects data into a Log Analytics workspace.
References:
https://docs.microsoft.com/en-us/azure/azure-monitor/learn/tutorial-response https://docs.microsoft.com/en-us/azure/azure-
monitor/platform/agents-overview

Topic 5 - Question Set 5

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 42/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #1 Topic 5

HOTSPOT -
You have an Azure subscription that contains a virtual network named VNet1. VNet1 uses an IP address space of 10.0.0.0/16 and contains the
VPN Gateway and subnets in the following table:

Subnet1 contains a virtual appliance named VM1 that operates as a router.


You create a routing table named RT1.
You need to route all inbound traffic from the VPN gateway to VNet1 through VM1.
How should you configure RT1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 43/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #2 Topic 5

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?

A. Floating IP (direct server return) to Enabled

B. Floating IP (direct server return) to Disabled

C. a health probe

D. Session persistence to Client IP and Protocol

Correct Answer: D
With Sticky Sessions when a client starts a session on one of your web servers, session stays on that specific server. To configure An Azure
Load-Balancer For
Sticky Sessions set Session persistence to Client IP.
On the following image you can see sticky session configuration:

Note:
There are several versions of this question in the exam. The question can have other incorrect answer options, including the following:
1. Idle Time-out (minutes) to 20
2. Protocol to UDP
Reference:
https://cloudopszone.com/configure-azure-load-balancer-for-sticky-sessions/

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 44/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #3 Topic 5

HOTSPOT -
You have an Azure subscription that contains the virtual machines shown in the following table:

VM1 and VM2 use public IP addresses. From Windows Server 2019 on VM1 and VM2, you allow inbound Remote Desktop connections.
Subnet1 and Subnet2 are in a virtual network named VNET1.
The subscription contains two network security groups (NSGs) named NSG1 and NSG2. NSG1 uses only the default rules.
NSG2 uses the default rules and the following custom incoming rule:
✑ Priority: 100
✑ Name: Rule1
✑ Port: 3389
✑ Protocol: TCP
✑ Source: Any
✑ Destination: Any
✑ Action: Allow
NSG1 is associated to Subnet1. NSG2 is associated to the network interface of VM2.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 45/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #4 Topic 5

HOTSPOT -
You have a virtual network named VNET1 that contains the subnets shown in the following table:

You have Azure virtual machines that have the network configurations shown in the following table:

For NSG1, you create the inbound security rule shown in the following table:

For NSG2, you create the inbound security rule shown in the following table:

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Box 1: Yes -
The inbound security rule for NSG1 allows TCP port 1433 from 10.10.2.0/24 (or Subnet2 where VM2 and VM3 are located) to 10.10.1.0/24 (or
Subnet1 where
VM1 is located) while the inbound security rule for NSG2 blocks TCP port 1433 from 10.10.2.5 (or VM2) to 10.10.1.5 (or VM1). However, the
NSG1 rule has a higher priority (or lower value) than the NSG2 rule.

Box 2: Yes -
No rule explicitly blocks communication from VM1. The default rules, which allow communication, are thus applied.

Box 3: Yes -
https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 46/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

No rule explicitly blocks communication between VM2 and VM3 which are both on Subnet2. The default rules, which allow communication, are
thus applied.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 47/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #5 Topic 5

HOTSPOT -
You have an Azure subscription named Subscription1.
Subscription1 contains the virtual machines in the following table:

Subscription1 contains a virtual network named VNet1 that has the subnets in the following table:

VM3 has multiple network adapters, including a network adapter named NIC3. IP forwarding is enabled on NIC3. Routing is enabled on VM3.
You create a route table named RT1 that contains the routes in the following table:

You apply RT1 to Subnet1 and Subnet2.


For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

IP forwarding enables the virtual machine a network interface is attached to:


✑ Receive network traffic not destined for one of the IP addresses assigned to any of the IP configurations assigned to the network interface.
✑ Send network traffic with a different source IP address than the one assigned to one of a network interface's IP configurations.
The setting must be enabled for every network interface that is attached to the virtual machine that receives traffic that the virtual machine
needs to forward. A virtual machine can forward traffic whether it has multiple network interfaces or a single network interface attached to it.

Box 1: Yes -
The routing table allows connections from VM3 to VM1 and VM2. And as IP forwarding is enabled on VM3, VM3 can connect to VM1.

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 48/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Box 2: No -
VM3, which has IP forwarding, must be turned on, in order for VM2 to connect to VM1.

Box 3: Yes -
The routing table allows connections from VM1 and VM2 to VM3. IP forwarding on VM3 allows VM1 to connect to VM2 via VM3.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview https://www.quora.com/What-is-IP-forwarding

Question #6 Topic 5

Your on-premises network contains an SMB share named Share1.


You have an Azure subscription that contains the following resources:
✑ A web app named webapp1
✑ A virtual network named VNET1
You need to ensure that webapp1 can connect to Share1.
What should you deploy?

A. an Azure Application Gateway

B. an Azure Active Directory (Azure AD) Application Proxy

C. an Azure Virtual Network Gateway

Correct Answer: C
A Site-to-Site VPN gateway connection can be used to connect your on-premises network to an Azure virtual network over an IPsec/IKE (IKEv1
or IKEv2) VPN tunnel.
This type of connection requires a VPN device, a VPN gateway, located on-premises that has an externally facing public IP address assigned to
it.
Incorrect Answers:
B: Application Proxy is a feature of Azure AD that enables users to access on-premises web applications from a remote client.
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 49/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #7 Topic 5

You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource
Manager template.
You need to ensure that NGINX is available on all the virtual machines after they are deployed.
What should you use?

A. the Publish-AzVMDscConfiguration cmdlet

B. Azure Application Insights

C. Azure Custom Script Extension

D. the New-AzConfigurationAssignement cmdlet

Correct Answer: C
Note:
There are several versions of this question in the exam. The question has two correct answers:
1. a Desired State Configuration (DSC) extension
2. Azure Custom Script Extension
The question can have other incorrect answer options, including the following:
✑ Deployment Center in Azure App Service
✑ a Microsoft Intune device configuration profile
Reference:
https://docs.microsoft.com/en-us/azure/architecture/framework/devops/automation-configuration

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 50/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #8 Topic 5

HOTSPOT -
You have an Azure subscription named Sub1.
You plan to deploy a multi-tiered application that will contain the tiers shown in the following table.

You need to recommend a networking solution to meet the following requirements:


✑ Ensure that communication between the web servers and the business logic tier spreads equally across the virtual machines.
✑ Protect the web servers from SQL injection attacks.
Which Azure resource should you recommend for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Box 1: an internal load balancer


Azure Internal Load Balancer (ILB) provides network load balancing between virtual machines that reside inside a cloud service or a virtual
network with a regional scope.
Box 2: an application gateway that uses the WAF tier
Azure Web Application Firewall (WAF) on Azure Application Gateway provides centralized protection of your web applications from common
exploits and vulnerabilities. Web applications are increasingly targeted by malicious attacks that exploit commonly known vulnerabilities.
Reference:
https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 51/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #9 Topic 5

Your company has three offices. The offices are located in Miami, Los Angeles, and New York. Each office contains datacenter.
You have an Azure subscription that contains resources in the East US and West US Azure regions. Each region contains a virtual network. The
virtual networks are peered.
You need to connect the datacenters to the subscription. The solution must minimize network latency between the datacenters.
What should you create?

A. three Azure Application Gateways and one On-premises data gateway

B. three virtual hubs and one virtual WAN

C. three virtual WANs and one virtual hub

D. three On-premises data gateways and one Azure Application Gateway

Correct Answer: C
Reference:
https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 52/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #10 Topic 5

HOTSPOT -
You plan to deploy five virtual machines to a virtual network subnet.
Each virtual machine will have a public IP address and a private IP address.
Each virtual machine requires the same inbound and outbound security rules.
What is the minimum number of network interfaces and network security groups that you require? To answer, select the appropriate options in the
answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Box 1: 5 -
A public and a private IP address can be assigned to a single network interface.

Box 2: 1 -
You can associate zero, or one, network security group to each virtual network subnet and network interface in a virtual machine. The same
network security group can be associated to as many subnets and network interfaces as you choose.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface-addresses

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 53/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #11 Topic 5

You have an Azure subscription that contains the resources shown in the following table.

LB1 is configured as shown in the following table.

You plan to create new inbound NAT rules that meet the following requirements:
✑ Provide Remote Desktop access to VM1 from the internet by using port 3389.
✑ Provide Remote Desktop access to VM2 from the internet by using port 3389.
What should you create on LB1 before you can create the new inbound NAT rules?

A. a frontend IP address

B. a load balancing rule

C. a health probe

D. a backend pool

Correct Answer: A

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 54/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #12 Topic 5

HOTSPOT -
You have Azure virtual machines that run Windows Server 2019 and are configured as shown in the following table.

You create a private Azure DNS zone named adatum.com. You configure the adatum.com zone to allow auto registration from VNET1.
Which A records will be added to the adatum.com zone for each virtual machine? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

The virtual machines are registered (added) to the private zone as A records pointing to their private IP addresses.
Reference:
https://docs.microsoft.com/en-us/azure/dns/private-dns-overview https://docs.microsoft.com/en-us/azure/dns/private-dns-scenarios

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 55/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #13 Topic 5

HOTSPOT -
You have an Azure virtual network named VNet1 that connects to your on-premises network by using a site-to-site VPN. VNet1 contains one
subnet named
Sunet1.
Subnet1 is associated to a network security group (NSG) named NSG1. Subnet1 contains a basic internal load balancer named ILB1. ILB1 has
three Azure virtual machines in the backend pool.
You need to collect data about the IP addresses that connects to ILB1. You must be able to run interactive queries from the Azure portal against
the collected data.
What should you do? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Box 1: An Azure Log Analytics workspace


In the Azure portal you can set up a Log Analytics workspace, which is a unique Log Analytics environment with its own data repository, data
sources, and solutions

Box 2: ILB1 -
Reference:
https://docs.microsoft.com/en-us/azure/log-analytics/log-analytics-quick-create-workspace https://docs.microsoft.com/en-us/azure/load-
balancer/load-balancer-standard-diagnostics

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 56/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #14 Topic 5

You have the Azure virtual networks shown in the following table.

To which virtual networks can you establish a peering connection from VNet1?

A. VNet2 andVNet3 only

B. VNet2 only

C. VNet3 and VNet4 only

D. VNet2, VNet3, and VNet4

Correct Answer: C
Address spaces must not overlap to enable VNet Peering.
Incorrect Answers:
A, B, D: The address space for VNet2 overlaps with VNet1. We therefore cannot establish a peering between VNet2 and VNet1.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/tutorial-connect-virtual-networks-portal https://docs.microsoft.com/en-
us/azure/virtual-network/virtual-networks-faq#vnet-peering

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 57/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #15 Topic 5

You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains four subnets named Gateway, Perimeter, NVA, and
Production.
The NVA subnet contains two network virtual appliances (NVAs) that will perform network traffic inspection between the Perimeter subnet and the
Production subnet.
You need to implement an Azure load balancer for the NVAs. The solution must meet the following requirements:
✑ The NVAs must run in an active-active configuration that uses automatic failover.
✑ The load balancer must load balance traffic to two services on the Production subnet. The services have different IP addresses.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. Deploy a basic load balancer

B. Deploy a standard load balancer

C. Add two load balancing rules that have HA Ports and Floating IP enabled

D. Add two load balancing rules that have HA Ports enabled and Floating IP disabled

E. Add a frontend IP configuration, a backend pool, and a health probe

F. Add a frontend IP configuration, two backend pools, and a health probe

Correct Answer: BCF


A standard load balancer is required for the HA ports.
Two backend pools are needed as there are two services with different IP addresses.
Floating IP rule is used where backend ports are reused.
Incorrect Answers:
E: HA Ports are not available for the basic load balancer.
Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-overview https://docs.microsoft.com/en-us/azure/load-
balancer/load-balancer-multivip-overview

Question #16 Topic 5

You have an Azure subscription named Subscription1 that contains two Azure virtual networks named VNet1 and VNet2. VNet1 contains a VPN
gateway named
VPNGW1 that uses static routing. There is a site-to-site VPN connection between your on-premises network and VNet1.
On a computer named Client1 that runs Windows 10, you configure a point-to-site VPN connection to VNet1.
You configure virtual network peering between VNet1 and VNet2. You verify that you can connect to VNet2 from the on-premises network. Client1
is unable to connect to VNet2.
You need to ensure that you can connect Client1 to VNet2.
What should you do?

A. Download and re-install the VPN client configuration package on Client1.

B. Select Allow gateway transit on VNet1.

C. Select Allow gateway transit on VNet2.

D. Enable BGP on VPNGW1

Correct Answer: A
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 58/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #17 Topic 5

HOTSPOT -
You have an Azure subscription. The subscription contains virtual machines that run Windows Server 2016 and are configured as shown in the
following table.

You create a public Azure DNS zone named adatum.com and a private Azure DNS zone named contoso.com.
You create a virtual network link for contoso.com as shown in the following exhibit.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 59/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Correct Answer:

Question #18 Topic 5

You have an Azure subscription that contains the resources in the following table.

Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances
https://docs.microsoft.com/en-us/azure/dns/private-dns-autoregistration

To which subnets can you apply NSG1?

A. the subnets on VNet1 only

B. the subnets on VNet2 and VNet3 only

C. the subnets on VNet2 only

D. the subnets on VNet3 only

E. the subnets on VNet1, VNet2, and VNet3

Correct Answer: D
All Azure resources are created in an Azure region and subscription. A resource can only be created in a virtual network that exists in the same
region and subscription as the resource.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-vnet-plan-design-arm

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 60/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #19 Topic 5

DRAG DROP -
You have an Azure subscription that contains two virtual networks named VNet1 and VNet2. Virtual machines connect to the virtual networks.
The virtual networks have the address spaces and the subnets configured as shown in the following table.

You need to add the address space of 10.33.0.0/16 to VNet1. The solution must ensure that the hosts on VNet1 and VNet2 can communicate.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and
arrange them in the correct order.
Select and Place:

Correct Answer:

Step 1: Remove peering between Vnet1 and VNet2.


You can't add address ranges to, or delete address ranges from a virtual network's address space once a virtual network is peered with another
virtual network.
To add or remove address ranges, delete the peering, add or remove the address ranges, then re-create the peering.
Step 2: Add the 10.44.0.0/16 address space to VNet1.

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 61/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Step 3: Recreate peering between VNet1 and VNet2


Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 62/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #20 Topic 5

HOTSPOT -
You have an Azure subscription that contains the resource groups shown in the following table.

RG1 contains the resources shown in the following table.

VM1 is running and connects to NIC1 and Disk1. NIC1 connects to VNET1.
RG2 contains a public IP address named IP2 that is in the East US location. IP2 is not assigned to a virtual machine.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Box 1: Yes -

You can move storage -

Box 2: No -
You can't move to a new resource group a NIC that is attached to a virtual machine.

Box 3: No -
Azure Public IPs are region specific and can't be moved from one region to another.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources https://docs.microsoft.com/en-
us/azure/virtual-network/move-across-regions-publicip-powershell

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 63/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #21 Topic 5

You have an Azure web app named webapp1.


You have a virtual network named VNET1 and an Azure virtual machine named VM1 that hosts a MySQL database. VM1 connects to VNET1.
You need to ensure that webapp1 can access the data hosted on VM1.
What should you do?

A. Deploy an internal load balancer

B. Peer VNET1 to another virtual network

C. Connect webapp1 to VNET1

D. Deploy an Azure Application Gateway

Correct Answer: D

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 64/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #22 Topic 5

You create an Azure VM named VM1 that runs Windows Server 2019.
VM1 is configured as shown in the exhibit. (Click the Exhibit tab.)

You need to enable Desired State Configuration for VM1.


What should you do first?

A. Connect to VM1.

B. Start VM1.

C. Capture a snapshot of VM1.

D. Configure a DNS name for VM1.

Correct Answer: B
Status is Stopped (Deallocated).
The DSC extension for Windows requires that the target virtual machine is able to communicate with Azure.
The VM needs to be started.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/extensions/dsc-windows

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 65/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #23 Topic 5

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.
You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.
You need to ensure that visitors are serviced by the same web server for each request.
What should you configure?

A. Floating IP (direct server return) to Disabled

B. Session persistence to None

C. Floating IP (direct server return) to Enabled

D. Session persistence to Client IP

Correct Answer: D
With Sticky Sessions when a client starts a session on one of your web servers, session stays on that specific server. To configure An Azure
Load-Balancer For
Sticky Sessions set Session persistence to Client IP or to Client IP and protocol.
On the following image you can see sticky session configuration:
Note:
✑ Client IP and protocol specifies that successive requests from the same client IP address and protocol combination will be handled by the
same virtual machine.
✑ Client IP specifies that successive requests from the same client IP address will be handled by the same virtual machine.
Reference:
https://cloudopszone.com/configure-azure-load-balancer-for-sticky-sessions/

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 66/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #24 Topic 5

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains the following resources:
✑ A virtual network that has a subnet named Subnet1
✑ Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1
✑ A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop connections
NSG-Subnet1 has the default inbound security rules only.
NSG-VM1 has the default inbound security rules and the following custom inbound security rule:
✑ Priority: 100
✑ Source: Any
✑ Source port range: *
✑ Destination: *
✑ Destination port range: 3389
✑ Protocol: UDP
✑ Action: Allow
VM1 has a public IP address and is connected to Subnet1. NSG-VM1 is associated to the network interface of VM1. NSG-Subnet1 is associated to
Subnet1.
You need to be able to establish Remote Desktop connections from the internet to VM1.
Solution: You add an inbound security rule to NSG-Subnet1 that allows connections from the Any source to the *destination for port range 3389
and uses the TCP protocol. You remove NSG-VM1 from the network interface of VM1.
Does this meet the goal?

A. Yes

B. No

Correct Answer: B
The default port for RDP is TCP port 3389. A rule to permit RDP traffic must be created automatically when you create your VM.
Note on NSG-Subnet1: Azure routes network traffic between all subnets in a virtual network, by default.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/troubleshooting/troubleshoot-rdp-connection

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 67/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #25 Topic 5

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains the following resources:
✑ A virtual network that has a subnet named Subnet1
✑ Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1
✑ A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop connections
NSG-Subnet1 has the default inbound security rules only.
NSG-VM1 has the default inbound security rules and the following custom inbound security rule:
✑ Priority: 100
✑ Source: Any
✑ Source port range: *
✑ Destination: *

Destination port range: 3389 -

✑ Protocol: UDP
✑ Action: Allow
VM1 has a public IP address and is connected to Subnet1. NSG-VM1 is associated to the network interface of VM1. NSG-Subnet1 is associated to
Subnet1.
You need to be able to establish Remote Desktop connections from the internet to VM1.
Solution: You add an inbound security rule to NSG-Subnet1 that allows connections from the internet source to the VirtualNetwork destination for
port range 3389 and uses the UDP protocol.
Does this meet the goal?

A. Yes

B. No

Correct Answer: B
The default port for RDP is TCP port 3389. A rule to permit RDP traffic must be created automatically when you create your VM.
Note on NSG-Subnet1: Azure routes network traffic between all subnets in a virtual network, by default.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/troubleshooting/troubleshoot-rdp-connection

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 68/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #26 Topic 5

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains the following resources:
✑ A virtual network that has a subnet named Subnet1
✑ Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1
✑ A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop connections
NSG-Subnet1 has the default inbound security rules only.
NSG-VM1 has the default inbound security rules and the following custom inbound security rule:
✑ Priority: 100
✑ Source: Any
✑ Source port range: *
✑ Destination: *
✑ Destination port range: 3389
✑ Protocol: UDP
✑ Action: Allow
VM1 has a public IP address and is connected to Subnet1. NSG-VM1 is associated to the network interface of VM1. NSG-Subnet1 is associated to
Subnet1.
You need to be able to establish Remote Desktop connections from the internet to VM1.
Solution: You add an inbound security rule to NSG-Subnet1 and NSG-VM1 that allows connections from the internet source to the VirtualNetwork
destination for port range 3389 and uses the TCP protocol.
Does this meet the goal?

A. Yes

B. No

Correct Answer: A
The default port for RDP is TCP port 3389. A rule to permit RDP traffic must be created automatically when you create your VM.
Note on NSG-Subnet1: Azure routes network traffic between all subnets in a virtual network, by default.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-machines/troubleshooting/troubleshoot-rdp-connection

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 69/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #27 Topic 5

HOTSPOT -
You have a virtual network named VNet1 that has the configuration shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 70/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Correct Answer:

Box 1: add an address space -


Your IaaS virtual machines (VMs) and PaaS role instances in a virtual network automatically receive a private IP address from a range that you
specify, based on the address space of the subnet they are connected to. We need to add the 192.168.1.0/24 address space.

Box 2: add a network interface -


The 10.2.1.0/24 network exists. We need to add a network interface.
Reference:
https://docs.microsoft.com/en-us/office365/enterprise/designing-networking-for-microsoft-azure-iaas

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 71/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #28 Topic 5

You have an Azure subscription that contains a virtual network named VNET1. VNET1 contains the subnets shown in the following table.

Each virtual machine uses a static IP address.


You need to create network security groups (NSGs) to meet following requirements:
✑ Allow web requests from the internet to VM3, VM4, VM5, and VM6.
✑ Allow all connections between VM1 and VM2.
✑ Allow Remote Desktop connections to VM1.
✑ Prevent all other network traffic to VNET1.
What is the minimum number of NSGs you should create?

A. 1

B. 3

C. 4

D. 12

Correct Answer: C
Each network security group also contains default security rules.
Note: A network security group (NSG) contains a list of security rules that allow or deny network traffic to resources connected to Azure Virtual
Networks (VNet).
NSGs can be associated to subnets, individual VMs (classic), or individual network interfaces (NIC) attached to VMs (Resource Manager).
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/security-overview#default-security-rules

Question #29 Topic 5

You have an Azure subscription that contains the resources shown in the following table.

The Not allowed resource types Azure policy that has policy enforcement enabled is assigned to RG1 and uses the following parameters:
Microsoft.Network/virtualNetworks
Microsoft.Compute/virtualMachines
In RG1, you need to create a new virtual machine named VM2, and then connect VM2 to VNET1.
What should you do first?

A. Remove Microsoft.Compute/virtualMachines from the policy.

B. Create an Azure Resource Manager template

C. Add a subnet to VNET1.

D. Remove Microsoft.Network/virtualNetworks from the policy.

Correct Answer: A
The Not allowed resource types Azure policy prohibits the deployment of specified resource types. You specify an array of the resource types to
block.
Virtual Networks and Virtual Machines are prohibited.
Reference:
https://docs.microsoft.com/en-us/azure/governance/policy/samples/not-allowed-resource-types

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 72/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #30 Topic 5

Your company has an Azure subscription named Subscription1.


The company also has two on-premises servers named Server1 and Server2 that run Windows Server 2016. Server1 is configured as a DNS server
that has a primary DNS zone named adatum.com. Adatum.com contains 1,000 DNS records.
You manage Server1 and Subscription1 from Server2. Server2 has the following tools installed:
✑ The DNS Manager console
✑ Azure PowerShell
✑ Azure CLI 2.0
You need to move the adatum.com zone to an Azure DNS zone in Subscription1. The solution must minimize administrative effort.
What should you use?

A. Azure CLI

B. Azure PowerShell

C. the Azure portal

D. the DNS Manager console

Correct Answer: B
Step 1: Installing the DNS migration script
Open an elevated PowerShell window (Administrative mode) and run following command install-script PrivateDnsMigrationScript

Step 2: Running the script -


Execute following command to run the script

PrivateDnsMigrationScript.ps1 -
Reference:
https://docs.microsoft.com/en-us/azure/dns/private-dns-migration-guide

Question #31 Topic 5

You have a public load balancer that balances ports 80 and 443 across three virtual machines named VM1, VM2, and VM3.
You need to direct all the Remote Desktop Protocol (RDP) connections to VM3 only.
What should you configure?

A. an inbound NAT rule

B. a new public load balancer for VM3

C. a frontend IP configuration

D. a load balancing rule

Correct Answer: A
Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/tutorial-load-balancer-port-forwarding-portal https://pixelrobots.co.uk/2017/08/azure-
load-balancer-for-rds/

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 73/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #32 Topic 5

HOTSPOT -
You have an Azure subscription named Subscription1 that contains the virtual networks in the following table.

Subscription1 contains the virtual machines in the following table.

In Subscription1, you create a load balancer that has the following configurations:
✑ Name: LB1
✑ SKU: Basic
✑ Type: Internal
✑ Subnet: Subnet12
✑ Virtual network: VNET1
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-overview

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 74/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #33 Topic 5

HOTSPOT -
You have an Azure virtual machine that runs Windows Server 2019 and has the following configurations:
✑ Name: VM1
✑ Location: West US
✑ Connected to: VNET1
✑ Private IP address: 10.1.0.4
✑ Public IP addresses: 52.186.85.63
✑ DNS suffix in Windows Server: Adatum.com
You create the Azure DNS zones shown in the following table.

You need to identify which DNS zones you can link to VNET1 and the DNS zones to which VM1 can automatically register.
Which zones should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Reference:
https://docs.microsoft.com/en-us/azure/dns/private-dns-overview

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 75/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #34 Topic 5

DRAG DROP -
You have an on-premises network that you plan to connect to Azure by using a site-so-site VPN.
In Azure, you have an Azure virtual network named VNet1 that uses an address space of 10.0.0.0/16 VNet1 contains a subnet named Subnet1 that
uses an address space of 10.0.0.0/24.
You need to create a site-to-site VPN to Azure.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and
arrange them in the correct order.
NOTE: More than one order of answer choice is correct. You will receive credit for any of the correct orders you select.
Select and Place:

Correct Answer:

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 76/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #35 Topic 5

You have an Azure subscription that contains the resources in the following table.

VM1 and VM2 are deployed from the same template and host line-of-business applications.
You configure the network security group (NSG) shown in the exhibit. (Click the Exhibit tab.)

You need to prevent users of VM1 and VM2 from accessing websites on the Internet over TCP port 80.
What should you do?

A. Disassociate the NSG from a network interface

B. Change the Port_80 inbound security rule.

C. Associate the NSG to Subnet1.

D. Change the DenyWebSites outbound security rule.

Correct Answer: C
You can associate or dissociate a network security group from a network interface or subnet.
The NSG has the appropriate rule to block users from accessing the Internet. We just need to associate it with Subnet1.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-group

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 77/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #36 Topic 5

You have two subscriptions named Subscription1 and Subscription2. Each subscription is associated to a different Azure AD tenant.
Subscription1 contains a virtual network named VNet1. VNet1 contains an Azure virtual machine named VM1 and has an IP address space of
10.0.0.0/16.
Subscription2 contains a virtual network named VNet2. VNet2 contains an Azure virtual machine named VM2 and has an IP address space of
10.10.0.0/24.
You need to connect VNet1 to VNet2.
What should you do first?

A. Move VM1 to Subscription2.

B. Move VNet1 to Subscription2.

C. Modify the IP address space of VNet2.

D. Provision virtual network gateways.

Correct Answer: D
The virtual networks can be in the same or different regions, and from the same or different subscriptions. When connecting VNets from
different subscriptions, the subscriptions do not need to be associated with the same Active Directory tenant.
Configuring a VNet-to-VNet connection is a good way to easily connect VNets. Connecting a virtual network to another virtual network using the
VNet-to-VNet connection type (VNet2VNet) is similar to creating a Site-to-Site IPsec connection to an on-premises location. Both connectivity
types use a VPN gateway to provide a secure tunnel using IPsec/IKE, and both function the same way when communicating.
The local network gateway for each VNet treats the other VNet as a local site. This lets you specify additional address space for the local
network gateway in order to route traffic.
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-portal

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 78/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #37 Topic 5

You plan to create an Azure virtual machine named VM1 that will be configured as shown in the following exhibit.

The planned disk configurations for VM1 are shown in the following exhibit.

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 79/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

You need to ensure that VM1 can be created in an Availability Zone.


Which two settings should you modify? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. Use managed disks

B. OS disk type

C. Availability options

D. Size

E. Image

Correct Answer: AC
A: Your VMs should use managed disks if you want to move them to an Availability Zone by using Site Recovery.
C: When you create a VM for an Availability Zone, Under Settings > High availability, select one of the numbered zones from the Availability zone
dropdown.

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 80/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Reference:
https://docs.microsoft.com/en-us/azure/site-recovery/move-azure-vms-avset-azone https://docs.microsoft.com/en-us/azure/virtual-
machines/windows/create-portal-availability-zone

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 81/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #38 Topic 5

HOTSPOT -
You have an Azure subscription that contains the resources shown in the following table.

VMSS1 is set to VM (virtual machines) orchestration mode.


You need to deploy a new Azure virtual machine named VM1, and then add VM1 to VMSS1.
Which resource group and location should you use to deploy VM1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Box 1: RG1, RG2, or RG3 -


The resource group stores metadata about the resources. When you specify a location for the resource group, you're specifying where that
metadata is stored.

Box 2: West US only -


Note: Virtual machine scale sets will support 2 distinct orchestration modes:
ScaleSetVM ‫ג‬€" Virtual machine instances added to the scale set are based on the scale set configuration model. The virtual machine instance
lifecycle - creation, update, deletion - is managed by the scale set.
VM (virtual machines) ‫ג‬€" Virtual machines created outside of the scale set can be explicitly added to the scaleset.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 82/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #39 Topic 5

HOTSPOT -
You have an Azure subscription that contains three virtual networks named VNET1, VNET2, and VNET3.
Peering for VNET1 is configured as shown in the following exhibit.

Peering for VNET2 is configured as shown in the following exhibit.

Peering for VNET3 is configured as shown in the following exhibit.

How can packets be routed between the virtual networks? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 83/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Correct Answer:

Box 1. VNET2 and VNET3 -

Box 2: VNET1 -
Gateway transit is disabled.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

Question #40 Topic 5

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site
connection uses a self-signed certificate.
From Azure, you download and install the VPN client configuration package on a computer named Computer2.
You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2.
Solution: You modify the Azure Active Directory (Azure AD) authentication policies.
Does this meet the goal?

A. Yes

B. No

Correct Answer: B
Instead export the client certificate from Computer1 and install the certificate on Computer2.
Note:
Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from
the self-signed root certificate, and then export and install the client certificate. If the client certificate is not installed, authentication fails.
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 84/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #41 Topic 5

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site
connection uses a self-signed certificate.
From Azure, you download and install the VPN client configuration package on a computer named Computer2.
You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2.
Solution: You join Computer2 to Azure Active Directory (Azure AD).
Does this meet the goal?

A. Yes

B. No

Correct Answer: B
A client computer that connects to a VNet using Point-to-Site must have a client certificate installed.
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site

Question #42 Topic 5

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups.
Another administrator plans to create several network security groups (NSGs) in the subscription.
You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks.
Solution: You create a resource lock, and then you assign the lock to the subscription.
Does this meet the goal?

A. Yes

B. No

Correct Answer: B

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 85/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #43 Topic 5

You have an Azure subscription named Subscription1. Subscription1 contains a virtual machine named VM1.
You have a computer named Computer1 that runs Windows 10. Computer1 is connected to the Internet.
You add a network interface named vm1173 to VM1 as shown in the exhibit. (Click the Exhibit tab.)

From Computer1, you attempt to connect to VM1 by using Remote Desktop, but the connection fails.
You need to establish a Remote Desktop connection to VM1.
What should you do first?

A. Change the priority of the RDP rule

B. Attach a network interface

C. Delete the DenyAllInBound rule

D. Start VM1

Correct Answer: D
Incorrect Answers:
A: Rules are processed in priority order, with lower numbers processed before higher numbers, because lower numbers have higher priority.
Once traffic matches a rule, processing stops. RDP already has the lowest number and thus the highest priority.
B: The network interface has already been added to VM.
C: The Outbound rules are fine.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 86/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #44 Topic 5

You have the Azure virtual machines shown in the following table.

A DNS service is installed on VM1.


You configure the DNS servers settings for each virtual network as shown in the following exhibit.

You need to ensure that all the virtual machines can resolve DNS names by using the DNS service on VM1.
What should you do?

A. Configure a conditional forwarder on VM1

B. Add service endpoints on VNET1

C. Add service endpoints on VNET2 and VNET3

D. Configure peering between VNET1, VNET2, and VNET3

Correct Answer: D
Virtual network peering enables you to seamlessly connect networks in Azure Virtual Network. The virtual networks appear as one for
connectivity purposes. The traffic between virtual machines uses the Microsoft backbone infrastructure.
Incorrect Answers:
B, C: Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over an optimized route over the Azure
backbone network.
Endpoints allow you to secure your critical Azure service resources to only your virtual networks. Service Endpoints enables private IP
addresses in the VNet to reach the endpoint of an Azure service without needing a public IP address on the VNet.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview https://docs.microsoft.com/en-
us/azure/virtual-network/virtual-network-peering-overview

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 87/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #45 Topic 5

HOTSPOT -
You have an Azure subscription that contains the Azure virtual machines shown in the following table.

You add inbound security rules to a network security group (NSG) named NSG1 as shown in the following table.

You run Azure Network Watcher as shown in the following exhibit.

You run Network Watcher again as shown in the following exhibit.

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 88/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Box 1: No -
It limits traffic to VM2, but not VM1 traffic.

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 89/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Box 2: Yes -
Yes, the destination is VM2.

Box 3: No -
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works

Question #46 Topic 5

You have the Azure virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 contains three Azure virtual machines. Each
virtual machine has a public IP address.
The virtual machines host several applications that are accessible over port 443 to users on the Internet.
Your on-premises network has a site-to-site VPN connection to VNet1.
You discover that the virtual machines can be accessed by using the Remote Desktop Protocol (RDP) from the Internet and from the on-premises
network.
You need to prevent RDP access to the virtual machines from the Internet, unless the RDP connection is established from the on-premises
network. The solution must ensure that all the applications can still be accessed by the Internet users.
What should you do?

A. Modify the address space of the local network gateway

B. Create a deny rule in a network security group (NSG) that is linked to Subnet1

C. Remove the public IP addresses from the virtual machines

D. Modify the address space of Subnet1

Correct Answer: B
You can use a site-to-site VPN to connect your on-premises network to an Azure virtual network. Users on your on-premises network connect by
using the RDP or
SSH protocol over the site-to-site VPN connection. You don't have to allow direct RDP or SSH access over the internet.
Reference:
https://docs.microsoft.com/en-us/azure/security/fundamentals/network-best-practices

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 90/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #47 Topic 5

You have an Azure subscription that contains the resources in the following table.

Subnet1 is associated to VNet1. NIC1 attaches VM1 to Subnet1.


You need to apply ASG1 to VM1.
What should you do?

A. Associate NIC1 to ASG1

B. Modify the properties of ASG1

C. Modify the properties of NSG1

Correct Answer: A
Application Security Group can be associated with NICs.
References:
https://docs.microsoft.com/en-us/azure/virtual-network/security-overview#application-security-groups

Question #48 Topic 5

You have an Azure subscription named Subscription1 that contains an Azure virtual network named VNet1. VNet1 connects to your on-premises
network by using
Azure ExpressRoute.
You plan to prepare the environment for automatic failover in case of ExpressRoute failure.
You need to connect VNet1 to the on-premises network by using a site-to-site VPN. The solution must minimize cost.
Which three actions should you perform? Each correct answer presents part of the solution.
NOTE: Each correct selection is worth one point.

A. Create a connection

B. Create a local site VPN gateway

C. Create a VPN gateway that uses the VpnGw1 SKU

D. Create a gateway subnet

E. Create a VPN gateway that uses the Basic SKU

Correct Answer: ADE


Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 91/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #49 Topic 5

HOTSPOT -
You have peering configured as shown in the following exhibit.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Box 1: vNET6 only -


Peering status to both VNet1 and Vnet2 are disconnected.

Box 2: delete peering1 -


Peering to Vnet1 is Enabled but disconnected. We need to update or re-create the remote peering to get it back to Initiated state.
Reference:
https://blog.kloud.com.au/2018/10/19/address-space-maintenance-with-vnet-peering/

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 92/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 93/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #50 Topic 5

HOTSPOT -
You have an Azure subscription that contains the resources in the following table.

You install the Web Server server role (IIS) on VM1 and VM2, and then add VM1 and VM2 to LB1.
LB1 is configured as shown in the LB1 exhibit. (Click the LB1 tab.)

Rule1 is configured as shown in the Rule1 exhibit. (Click the Rule1 tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 94/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

NOTE: Each correct selection is worth one point.


Hot Area:

Correct Answer:

Box 1: Yes -
A Basic Load Balancer supports virtual machines in a single availability set or virtual machine scale set.

Box 2: Yes -
When using load-balancing rules with Azure Load Balancer, you need to specify health probes to allow Load Balancer to detect the backend
endpoint status. The configuration of the health probe and probe responses determine which backend pool instances will receive new flows.
You can use health probes to detect the failure of an application on a backend endpoint. You can also generate a custom response to a health
probe and use the health probe for flow control to manage load or planned downtime. When a health probe fails, Load Balancer will stop
sending new flows to the respective unhealthy instance. Outbound connectivity is not impacted, only inbound connectivity is impacted.

Box 3: No -
Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/skus
https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-custom-probe-overview

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 95/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #51 Topic 5

HOTSPOT -
You have an Azure virtual machine named VM1 that connects to a virtual network named VNet1. VM1 has the following configurations:
✑ Subnet: 10.0.0.0/24
✑ Availability set: AVSet
✑ Network security group (NSG): None
✑ Private IP address: 10.0.0.4 (dynamic)
✑ Public IP address: 40.90.219.6 (dynamic)
You deploy a standard, Internet-facing load balancer named slb1.
You need to configure slb1 to allow connectivity to VM1.
Which changes should you apply to VM1 as you configure slb1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Change the private IP address of VM1 to static


Box 1: Remove the public IP address from VM1
Note: A public load balancer can provide outbound connections for virtual machines (VMs) inside your virtual network. These connections are
accomplished by translating their private IP addresses to public IP addresses. Public Load Balancers are used to load balance internet traffic to
your VMs.
Box 2: Create and configure an NSG
NSGs are used to explicitly permit allowed traffic. If you do not have an NSG on a subnet or NIC of your virtual machine resource, traffic is not
allowed to reach this resource.
Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-overview

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 96/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #52 Topic 5

You have an Azure subscription that contains the resources shown in the following table.

You need to create a network interface named NIC1.


In which location can you create NIC1?

A. East US and North Europe only

B. East US only

C. East US, West Europe, and North Europe

D. East US and West Europe only

Correct Answer: B
Before creating a network interface, you must have an existing virtual network in the same location and subscription you create a network
interface in.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 97/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #53 Topic 5

You have Azure virtual machines that run Windows Server 2019 and are configured as shown in the following table.

You create a public Azure DNS zone named adatum.com and a private Azure DNS zone named contoso.com.
For controso.com, you create a virtual network link named link1 as shown in the exhibit. (Click the Exhibit tab.)

You discover that VM1 can resolve names in contoso.com but cannot resolve names in adatum.com. VM1 can resolve other hosts on the Internet.
You need to ensure that VM1 can resolve host names in adatum.com.
What should you do?

A. Update the DNS suffix on VM1 to be adatum.com

B. Configure the name servers for adatum.com at the domain registrar

C. Create an SRV record in the contoso.com zone

D. Modify the Access control (IAM) settings for link1

Correct Answer: A
If you use Azure Provided DNS then appropriate DNS suffix will be automatically applied to your virtual machines. For all other options you must
either use Fully
Qualified Domain Names (FQDN) or manually apply appropriate DNS suffix to your virtual machines.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 98/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #54 Topic 5

HOTSPOT -
You plan to use Azure Network Watcher to perform the following tasks:
✑ Task1: Identify a security rule that prevents a network packet from reaching an Azure virtual machine.
✑ Task2: Validate outbound connectivity from an Azure virtual machine to an external host.
Which feature should you use for each task? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Box 1: IP flow verify -


At some point, a VM may become unable to communicate with other resources, because of a security rule. The IP flow verify capability enables
you to specify a source and destination IPv4 address, port, protocol (TCP or UDP), and traffic direction (inbound or outbound). IP flow verify
then tests the communication and informs you if the connection succeeds or fails. If the connection fails, IP flow verify tells you which.

Box 2: Connection troubleshoot -


Diagnose outbound connections from a VM: The connection troubleshoot capability enables you to test a connection between a VM and
another VM, an FQDN, a
URI, or an IPv4 address. The test returns similar information returned when using the connection monitor capability, but tests the connection at
a point in time, rather than monitoring it over time, as connection monitor does. Learn more about how to troubleshoot connections using
connection-troubleshoot.
Reference:
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 99/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #55 Topic 5

HOTSPOT -
You have an Azure subscription that contains the Azure virtual machines shown in the following table.

You configure the network interfaces of the virtual machines to use the settings shown in the following table.

From the settings of VNET1 you configure the DNS servers shown in the following exhibit.

The virtual machines can successfully connect to the DNS server that has an IP address of 192.168.10.15 and the DNS server that has an IP
address of
193.77.134.10.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Box 1: Yes -
You can specify DNS server IP addresses in the VNet settings. The setting is applied as the default DNS server(s) for all VMs in the VNet.

Box 2: No -
You can set DNS servers per VM or cloud service to override the default network settings.

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 100/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Box 3: Yes -
You can set DNS servers per VM or cloud service to override the default network settings.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq#name-resolution-dns

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 101/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #56 Topic 5

HOTSPOT -
You have an Azure subscription that contains the resource groups shown in the following table.

RG1 contains the resources shown in the following table.

You need to identify which resources you can move from RG1 to RG2, and which resources you can move from RG2 to RG1.
Which resources should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Hot Area:

Correct Answer:

Box 1: IP1, Storage1 -


IP addresses and storage accounts can be moved.
Virtual networks cannot be moved.

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 102/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

There is no lock on RG1.

Box 2: None -
There is a delete lock on RG2.
Note: When you apply a lock at a parent scope, all resources within that scope inherit the same lock. Even resources you add later inherit the
lock from the parent.
The most restrictive lock in the inheritance takes precedence.
CanNotDelete means authorized users can still read and modify a resource, but they can't delete the resource.
ReadOnly means authorized users can read a resource, but they can't delete or update the resource. Applying this lock is similar to restricting all
authorized users to the permissions granted by the Reader role.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources https://docs.microsoft.com/en-us/azure/azure-
resource-manager/management/move-support-resources

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 103/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #57 Topic 5

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains the virtual machines shown in the following table.

You deploy a load balancer that has the following configurations:


✑ Name: LB1
✑ Type: Internal
✑ SKU: Standard
✑ Virtual network: VNET1
You need to ensure that you can add VM1 and VM2 to the backend pool of LB1.
Solution: You create a Basic SKU public IP address, associate the address to the network interface of VM1, and then start VM1.
Does this meet the goal?

A. Yes

B. No

Correct Answer: B
A Backend Pool configured by IP address has the following limitations:
✑ Standard load balancer only
Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/backend-pool-management

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 104/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #58 Topic 5

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains the virtual machines shown in the following table.

You deploy a load balancer that has the following configurations:


✑ Name: LB1
✑ Type: Internal
✑ SKU: Standard
✑ Virtual network: VNET1
You need to ensure that you can add VM1 and VM2 to the backend pool of LB1.
Solution: You create a Standard SKU public IP address, associate the address to the network interface of VM1, and then stop VM2.
Does this meet the goal?

A. Yes

B. No

Correct Answer: B
A Backend Pool configured by IP address has the following limitations:
✑ Standard load balancer only
Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/backend-pool-management

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 105/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #59 Topic 5

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains the virtual machines shown in the following table.

You deploy a load balancer that has the following configurations:


✑ Name: LB1
✑ Type: Internal
✑ SKU: Standard
✑ Virtual network: VNET1
You need to ensure that you can add VM1 and VM2 to the backend pool of LB1.
Solution: You create two Standard public IP addresses and associate a Standard SKU public IP address to the network interface of each virtual
machine.
Does this meet the goal?

A. Yes

B. No

Correct Answer: A
A Backend Pool configured by IP address has the following limitations:
✑ Standard load balancer only
Reference:
https://docs.microsoft.com/en-us/azure/load-balancer/backend-pool-management

Question #60 Topic 5

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site
connection uses a self-signed certificate.
From Azure, you download and install the VPN client configuration package on a computer named Computer2.
You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2.
Solution: You export the client certificate from Computer1 and install the certificate on Computer2.
Does this meet the goal?

A. Yes

B. No

Correct Answer: A
Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from
the self-signed root certificate, and then export and install the client certificate. If the client certificate is not installed, authentication fails.
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 106/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #61 Topic 5

You have an Azure virtual machine named VM1.


The network interface for VM1 is configured as shown in the exhibit. (Click the Exhibit tab.)

You deploy a web server on VM1, and then create a secure website that is accessible by using the HTTPS protocol. VM1 is used as a web server
only.
You need to ensure that users can connect to the website from the Internet.
What should you do?

A. Modify the protocol of Rule4

B. Delete Rule1

C. For Rule5, change the Action to Allow and change the priority to 401

D. Create a new inbound rule that allows TCP protocol 443 and configure the rule to have a priority of 501.

Correct Answer: C
HTTPS uses port 443.
Rule2, with priority 500, denies HTTPS traffic.
Rule5, with priority changed from 2000 to 401, would allow HTTPS traffic.
Note: Priority is a number between 100 and 4096. Rules are processed in priority order, with lower numbers processed before higher numbers,
because lower numbers have higher priority. Once traffic matches a rule, processing stops. As a result, any rules that exist with lower priorities
(higher numbers) that have the same attributes as rules with higher priorities are not processed.
Note:
There are several versions of this question in the exam. The question has two possible correct answers:
1. Change the priority of Rule3 to 450.
2. For Rule5, change the Action to Allow and change the priority to 401.
Other incorrect answer options you may see on the exam include the following:
✑ Modify the action of Rule1.
✑ Change the priority of Rule6 to 100.
✑ For Rule4, change the protocol from UDP to Any.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 107/108
10/4/21, 10:57 AM AZ-104 Exam – Free Actual Q&As, Page 1 | ExamTopics

Question #62 Topic 5

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that
might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups.
Another administrator plans to create several network security groups (NSGs) in the subscription.
You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks.
Solution: From the Resource providers blade, you unregister the Microsoft.ClassicNetwork provider.
Does this meet the goal?

A. Yes

B. No

Correct Answer: B
You should use a policy definition.
Resource policy definition used by Azure Policy enables you to establish conventions for resources in your organization by describing when the
policy is enforced and what effect to take. By defining conventions, you can control costs and more easily manage your resources.
Reference:
https://docs.microsoft.com/en-us/azure/azure-policy/policy-definition

https://www.examtopics.com/exams/microsoft/az-104/custom-view/ 108/108

You might also like