Try Free Latest Microsoft AZ-104 Practice Exam To Test Yourself

1. You manage a virtual network named VNet1 that is hosted in the West US region. Two virtual machines named VM1 and VM2, both running Windows Server, are on VNet1. You need to monitor traffic between VM1 and VM2 for a period of five hours.

As a solution, you propose to create a connection monitor in Azure Network Watcher. Does this solution meet the goal?

2. You have an Azure subscription that contains the virtual machines shown in the following table.





You deploy a load balancer that has the following configurations:

• NameLB1

• Type: internal

• SKU: Standard

• Virtual network: VNET1

You need to ensure that you can add VM1 and VM2 to the backend pool of LB1.

Solution: You disassociate the public IP address from the network interface of VM2.

Does this meet the goal?

3. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some

question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure subscription that contains the following resources:

✑ A virtual network that has a subnet named Subnet1

✑ Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1

✑ A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop connections

NSG-Subnet1 has the default inbound security rules only.

NSG-VM1 has the default inbound security rules and the following custom inbound security rule:

✑ Priority: 100

✑ Source: Any

✑ Source port range: *

✑ Destination: *

✑ Destination port range: 3389

✑ Protocol: UDP

✑ Action: Allow

VM1 connects to Subnet1. NSG1-VM1 is associated to the network interface of VM1. NSG-Subnet1 is associated to Subnet1.

You need to be able to establish Remote Desktop connections from the internet to VM1.

Solution: You add an inbound security rule to NSG-Subnet1 that allows connections from the Internet source to the VirtualNetwork destination for port range 3389 and uses the UDP protocol.

Does this meet the goal?

4. DRAG DROP

You are developing an Azure web app named WebApp1. WebApp1 uses an Azure App Service plan named Plan1 that uses the B1 pricing tier.

You need to configure WebApp1 to add additional instances of the app when CPU usage exceeds 70 percent for 10 minutes.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

5. You have an Azure subscription.

You plan to deploy an Azure Kubernetes Services (AKS) cluster to support an app named APP1. On-premises clients connect to App1 by using the IP address of the pod.

For the AKS cluster, you need to choose a network type that will support App1.

What should you choose?

6. You need to meet the technical requirement for VM4.

What should you create and configure?

7. HOTSPOT

You enable password reset for contoso.onmicrosoft.com as shown in the Password Reset exhibit (Click the Password Reset tab.)





You configure the authentication methods for password reset as shown in the Authentication Methods exhibit. (Click the Authentication Methods tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

You enable password reset for contoso.onmicrosoft.com as shown in the Password Reset exhibit (Click the Password Reset tab.)

You configure the authentication methods for password reset as shown in the Authentication Methods exhibit. (Click the Authentication Methods tab.)

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

8. HOTSPOT

Your company has offices in New York and Los Angeles.

You have an Azure subscription that contains an Azure virtual network named VNet1. Each office has a site-to-site VPN connection to VNet1.

Each network uses the address spaces shown in the following table.





You need to ensure that all Internet-bound traffic from VNet1 is routed through the New York office.

What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

9. HOTSPOT

You have two Azure virtual machines as shown in the following table.





You create the Azure DNS zones shown in the following table.





You perform the following actions:

✑ To fabrikam.com, you add a virtual network link to vnet1 and enable auto registration.

✑ For contoso.com, you assign vm1 and vm2 the Owner role.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worm one point.

10. You have an Azure Active Directory (Azure AD) tenant that has Azure AD Privileged Identity Management configured.

You have 10 users who are assigned the Security Administrator role for the tenant.

You need the users to verify whether they still require the Security Administrator role.

What should you do?

11. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json.

You receive a notification that VM1 will be affected by maintenance.

You need to move VM1 to a different host immediately.

Solution: From the Overview blade, you move the virtual machine to a different resource group.

Does this meet the goal?

12. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these

questions will not appear in the review screen.

You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site connection uses a self-signed certificate.

From Azure, you download and install the VPN client configuration package on a computer named Computer2.

You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2.

Solution: You export the client certificate from Computer1 and install the certificate on Computer2.

Does this meet this goal?

13. HOTSPOT

You need to create a bar chart that shows the number of distinct computers that have sent heartbeats each week.

How should you complete the Log Analytics query? To answer, select the appropriate options in the answer area. NOTE; Each correct selection is worth one point.

14. HOTSPOT

You have an Azure Subscription named Subcription1.has

Subcription1 contains the virtual machines in the following table.





Subcription1 contains the virtual machines in the following table.





VM3 has multiple network, including a network adapter named NIC3, IP forwarding is enabled on NIC3. Routing is enabled on VM3.

You create a route table named RT1 that contains the routes in the following table.





You apply RT1 to subnet1 and Sybnet2.

For each of the following statements, select Yes if the statements is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

15. You have an Azure subscription that contains a user account named User1.

You need to ensure that User1 can assign a policy to the tenant root management group.

What should you do?

16. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

Your company registers a domain name of contoso.com.

You create an Azure DNS zone named contoso.com, and then you add an A record to the zone for a host named www that has an IP address of 131.107.1.10.

You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address.

You need to resolve the name resolution issue.

Solution: You add an NS record to the contoso.com Azure DNS zone.

17. You have an Azure subscription that contains a web app named webapp1. You need to add a custom domain named www.contoso.com to webapp1.

What should you do first?

18. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You deploy an Azure Kubernetes Service (AKS) cluster named AKS1.

You need to deploy a YAML file to AKS1.

Solution: From the Azure CLI, you run azcopy.

Does this meet the goal?

19. HOTSPOT

You have a hybrid deployment of Azure Active Directory (Azure AD) that contains the users shown in the following table.





You need to modify the JobTitle and UsageLocation attributes for the users.

For which users can you modify the- attributes from Azure AD? To answer, select the appropriate options in the answer area.

20. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups.

Another administrator plans to create several network security groups (NSGs) in the subscription.

You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks.

Solution: You assign a built-in policy definition to the subscription.

Does this meet the goal?

21. Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

Your company makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option has been configured as the usage model.

After the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD) obtains a different company and adding the new employees to Azure Active Directory (Azure AD), you are informed that these employees should also make use of Multi-Factor Authentication.

To achieve this, the Per Enabled User setting must be set for the usage model.

Solution: You reconfigure the existing usage model via the Azure portal.

Does the solution meet the goal?

22. HOTSPOT

You have an Azure subscription named Subscription1. Subscription1 contains two Azure virtual machines named VM1 and VM2. VM1 and VM2 run Windows Server 2016.

VM1 is backed up daily by Azure Backup without using the Azure Backup agent.

VM1 is affected by ransomware that encrypts data.

You need to restore the latest backup of VM1.

To which location can you restore the backup? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

23. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You manage a virtual network named VNet1 that is hosted in the West US Azure region.

VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.

You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.

Solution: From Azure Network Watcher, you create a packet capture.

Does this meet the goal?

24. HOTSPOT

You have an Azure virtual network named VNet1 that connects to your on-premises network by using a site-to-site VPN. VMet1 contains one subnet named Subnet1.

Subnet1 is associated to a network security group (NSG) named NSG1. Subnet1 contains a basic internal load balancer named ILB1. ILB1 has three Azure virtual machines in the backend pool.

You need to collect data about the IP addresses that connects to ILB1. You must be able to run interactive queries from the Azure portal against the collected data.

What should you do? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

25. HOTSPOT

You have an Azure subscription named Subscription1.

Subscription1 contains the resources in the following table.





VNet1 is in RG1. VNet2 is in RG2. There is no connectivity between VNet1 and Vnet2.

An administrator named Admin1 creates an Azure virtual machine named VM1 in RG1. VM1 uses a disk named Disk1 and connects to VNet1. Admin1 then installs a custom application in VM1.

You need to move the custom application to Vnet2. The solution must minimize administrative effort.

Which two actions should you perform? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

26. You have an Azure subscription that contains the resources shown in the following table.





VM1 connects to VNET1.

You need to connect VM1 to VNET2.

Solution: You turn off VM1, and then you add a new network interface to VM1.

Does this meet the goal?

27. DRAG DROP

You have an Azure subscription that contains two virtual networks named VNet1 and VNet2. Virtual machines connect to the virtual networks.

The virtual networks n on-premises server named Server1 the configured as shown in the following table.





You need to add the address space of 10.33.0.0/16 to VNet1. The solution must ensure that the hosts on VNet1 and VNet2 can communicate.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

28. You recently created a new Azure subscription that contains a user named Admin1.

Admin1 attempts to deploy an Azure Marketplace resource by using an Azure Resource Manager template. Admin1 deploys the template by using Azure PowerShell and receives the following error message: “User failed validation to purchase resources. Error message: “Legal terms have not been accepted for this item on this subscription. To accept legal terms, please go to the Azure portal (http://go.microsoft.com/fwlink/?LinkId=534873) and configure programmatic deployment for the Marketplace item or create it there for the first time.”

You need to ensure that Admin1 can deploy the Marketplace resource successfully.

What should you do?

29. HOTSPOT

You have an Azure subscription that contains the resources shown in the following table





In Azure Cloud Shell, you need to create a virtual machine by using an Azure Resource Manager (ARM) template.

How should you complete the command? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

30. HOTSPOT

You have an Azure subscription.

You plan to use an Azure Resource Manager template to deploy a virtual network named VNET1 that will use Azure Bastion.

How should you complete the template? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

31. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json.

You receive a notification that VM1 will be affected by maintenance.

You need to move VM1 to a different host immediately.

Solution: From the Update management blade, you click enable.

Does this meet the goal?

32. You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.

Subscription1 has a user named User1.

User1 has the following roles;

• Reader

• Security Admin

• Security Reader

You need to ensure that User1 can assign the Reader role for VNet1 to other users.

What should you do?

33. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure subscription that contains the following resources:

✑ A virtual network that has a subnet named Subnet1

✑ Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1

✑ A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop connections

NSG-Subnet1 has the default inbound security rules only.

NSG-VM1 has the default inbound security rules and the following custom inbound security rule:

✑ Priority: 100

✑ Source: Any

✑ Source port range: *

✑ Destination: *

✑ Destination port range: 3389

✑ Protocol: UDP

✑ Action: Allow

VM1 connects to Subnet1. NSG1-VM1 is associated to the network interface of VM1. NSG-Subnet1 is associated to Subnet1.

You need to be able to establish Remote Desktop connections from the internet to VM1.

Solution: You modify the custom rule for NSG-VM1 to use the internet as a source and TCP as a protocol.

Does this meet the goal?

34. HOTSPOT

You have an Azure Storage account named storage1.

You have an Azure App Service app named app1 and an app named App2 that runs in an Azure container instance. Each app uses a managed identity.

You need to ensure that App1 and App2 can read blobs from storage1 for the next 30 days.

What should you configure in storage1 for each app?

35. HOTSPOT

You manage two Azure subscriptions named Subscription1 and Subscription2.

Subscription1 has following virtual networks:





The virtual networks contain the following subnets:





Subscription2 contains the following virtual network:

✑ Name: VNETA

✑ Address space: 10.10.128.0/17

✑ Location: Canada Central

VNETA contains the following subnets:





For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

36. Your on-premises network contains an SMB share named Share1.

You have an Azure subscription that contains the following resources:

A web app named webapp1

A virtual network named VNET1

You need to ensure that webapp1 can connect to Share1.

What should you deploy?

37. HOTSPOT

You have an Azure subscription that contains a virtual network named VNet1.

VNet1 uses an IP address space of 10.0.0.0/16 and contains the subnets in the following table.





Subnet1 contains a virtual appliance named VM1 that operates as a router.

You create a routing table named RT1.

You need to route all inbound traffic to VNet1 through VM1.

How should you configure RT1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

38. This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure subscription named Subscription1 that contains the resources shown in the following table.





VM1 connects to a virtual network named VNET2 by using a network interface named NIC1.

You need to create a new network interface named NIC2 for VM1.

Solution: You create NIC2 in RG1 and Central US.

Does this meet the goal?

39. You have an Azure subscription named Subscription1. Subscription1 contains a virtual machine named VM1.

You have a computer named Computer1 that runs Windows 10. Computer1 is connected to the Internet.

You add a network interface named Interface1 to VM1 as shown in the exhibit (Click the Exhibit button.)





From Computer1, you attempt to connect to VM1 by using Remote Desktop, but the connection fails.

You need to establish a Remote Desktop connection to VM1.

What should you do first?

40. HOTSPOT

You have an Azure subscription named Subscription1.

Subscription1 contains the virtual machines in the following table.





Subscription1 contains a virtual network named VNet1 that has the subnets in the following table.





VM3 has a network adapter named NIC3. IP forwarding is enabled on NIC3. Routing is enabled on VM3.

You create a route table named RT1.

RT1 is associated to Subnet1 and Subnet2 and contains the routes in the following table.





You apply RT1 to Subnet1.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

41. HOTSPOT

You have an Azure subscription named Subscription1.

You have a virtualization environment that contains the virtualization server in the following table.





The virtual machines are configured as shown on the following table.





All the virtual machines use basic disks. VM1 is protected by using BitLocker Drive Encryption (BitLocker). You plan to use Azure Site Recovery to migrate the virtual machines to Azure.

Which virtual machines can you migrate? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

42. You have an Azure subscription that contains a user account named User1.

You need to ensure that User1 can assign a policy to the tenant root management group.

What should you do?

43. You are deploying a containerized web application in Azure.

When deploying the web app, which of the following are valid container image sources?

44. DRAG DROP

You create an Azure Migrate project named TestMig in a resource group named test-migration.

You need to discover which on-premises virtual machines to assess for migration.

Which three actions should you perform in sequence? To answer, select the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

45. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure subscription named Subscription1 that contains the resources shown in the following table.





VM1 connects to a virtual network named VNET2 by using a network interface named NIC1.

You need to create a new network interface named NIC2 for VM1.

Solution: You create NIC2 in RG2 and Central US.

Does this meet the goal?

46. You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:





User1 creates a new Azure Active Directory tenant named

external.contoso.onmicrosoft.com.

You need to create new user accounts in external.contoso.com.onmicrosoft.com.

Solution: You instruct User1 to create the user accounts.

47. Your company has three offices. The offices are located in Miami, Los Angeles, and New York. Each office contains a datacenter.

You have an Azure subscription that contains resources in the East US and West US Azure regions. Each region contains a virtual network. The virtual networks are peered.

You need to connect the datacenters to the subscription. The solution must minimize network latency between the datacenters.

What should you create?

48. HOTSPOT

You implement The planned changes for NSG1 and NSG2.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

49. Your company has a main office in London that contains 100 client computers.

Three years ago, you migrated to Azure Active Directory (Azure AD).

The company’s security policy states that all personal devices and corporate-owned devices must be

registered or joined to Azure AD.

A remote user named User1 is unable to join a personal device to Azure AD from a home network.

You verify that other users can join their devices to Azure AD.

You need to ensure that User1 can join the device to Azure AD.

What should you do?

50. You create an Azure subscription that is associated to a basic Azure Active Directory (Azure AD) tenant. You need to receive an email notification when any user activates an administrative role.

What should you do?

51. HOTSPOT

You have an Azure subscription.

You deploy a virtual machine scale set that is configure as shown in the following exhibit.





Use the drop-down menus to select the answer choice that answers each questions based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

52. HOTSPOT

You have an Azure subscription that contains the virtual machines shown in the following table.





VM1 and VM2 use public IP addresses. From Windows Server 2019 on VM1 and VM2, you allow inbound Remote Desktop connections.

Subnet1 and Subnet2 are in a virtual network named VNET1.

The subscription contains two network security groups (NSGs) named NSG1 and NSG2.

NSG1 uses only the default rules.

NSG2 uses the default and the following custom incoming rule:

✑ Priority: 100

✑ Name: Rule1

✑ Port: 3389

✑ Protocol: TCP

✑ Source: Any

✑ Destination: Any

✑ Action: Allow

NSG1 connects to Subnet1. NSG2 connects to the network interface of VM2.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

53. Your network contains an on-premises Active Directory forest named contoso.com that contains two domains named contoso.com and east.contoso.com.

The forest contains the users shown in the following table.





You plan to sync east.contoso.com to an Azure Active Directory (Azure AD) tenant by using Azure AD Connect.

You need to select an account for Azure AD Connect to use to connect to the forest.

Which account should you select?

54. You have an Azure subscription that contains a storage account named account1.

You plan to upload the disk files of a virtual machine to account1 from your on-premises network. The on-premises network uses a public IP address space of 131.107.1.0/24.

You plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be attached to a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24.

You need to configure account1 to meet the following requirements:

✑ Ensure that you can upload the disk files to account1.

✑ Ensure that you can attach the disks to VM1.

✑ Prevent all other access to account1.

Which two actions should you perform? Each correct selection presents part of the solution. NOTE: Each correct selection is worth one point.

55. You have an Azure tenant that contains two subscriptions named Subscription1 and Subscription2.

In Subscription1, you deploy a virtual machine named Server1 that runs Windows Server 2016. Server1 uses managed disks.

You need to move Server1 to Subscription2. The solution must minimize administration effort.

What should you do first?

56. You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com.

You hire a temporary vendor. The vendor uses a Microsoft account that has a sign-in of [email protected].

You need to ensure that the vendor can authenticate to the tenant by using [email protected].

What should you do?

57. HOTSPOT

You have the Azure resources shown on the following exhibit.





You plan to track resource usage and prevent the deletion of resources.

To which resources can you apply locks and tags? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

58. You have an Azure Active Directory (Azure AD) tenant.

You plan to delete multiple users by using Bulk delete in the Azure Active Directory admin center.

You need to create and upload a file for the bulk delete.

Which user attributes should you include in the file?

59. DRAG DROP

You need to use Azure Automation State Configuration to manage the ongoing consistency of virtual machine configurations.

Which five actions should you perform in sequence? To answer, move the appropriate action from the list of actions to the answer area and arrange them in the correct order. NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.

60. You are configuring Azure Active Directory (AD) Privileged Identity Management.

You need to provide a user named Admm1 with read access to a resource group named RG1 for only one month.

The user role must be assigned immediately.

What should you do?

61. You discover that VM3 does NOT meet the technical requirements. You need to verify whether the issue relates to the NSGs.

What should you use?

62. Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

Your company has an Azure Active Directory (Azure AD) subscription.

You want to implement an Azure AD conditional access policy.

The policy must be configured to require members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when they connect to Azure AD from untrusted locations.

Solution: You access the Azure portal to alter the session control of the Azure AD conditional access policy.

Does the solution meet the goal?

63. You have an Azure subscription that contains a user named User1.

You need to ensure that User1 can deploy virtual machines and manage virtual networks.

The solution must use the principle of least privilege.

Which role-based access control (RBAC) role should you assign to User1?

64. You have an Azure subscription that contains the resources in the following table.





Subnet1 is associated to VNet1. NIC1 attaches VM1 to Subnet1.

You need to apply ASG1 to VM1.

What should you do?

65. DRAG DROP

You have an Azure subscription that contains the storage accounts shown in in the following table.

You plan to use AzCopy to copy a blob from container 1 directly to share1.

You need to identity which authentication method to use when you use AzCopy.

What should you identify for each account? To answer, drag the appropriate authentication methods to the correct accounts Each method may be used once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

66. DRAG DROP

You have an Azure subscription that contains the following resources:

• a virtual network named VNet1

• a replication policy named ReplPolicy1

• a Recovery Services vault named Vault1

• an Azure Storage account named Storage1

You have an Amazon Web Services (AWS) EC2 virtual machine named VM1 that runs Windows Server 2019.

You need to migrate VM1 to VNet1 by using Azure Site Recovery.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

67. Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

Your company has an Azure Active Directory (Azure AD) tenant named weyland.com that is configured for hybrid coexistence with the on-premises Active Directory domain.

You have a server named DirSync1 that is configured as a DirSync server.

You create a new user account in the on-premise Active Directory. You now need to replicate the user information to Azure AD immediately.

Solution: You restart the NetLogon service on a domain controller.

Does the solution meet the goal?

68. You have an Azure subscription that contains the following storage account:





You need 10 create a request to Microsoft Support to perform a live migration of storage1 to Zone Redundant Storage (ZRS) replication.

How should you modify storage1 before the Live migration?

69. You have an Azure web app named webapp1.

Users report that they often experience HTTP 500 errors when they connect to webapp1.

You need to provide the developers of webapp1 with real-time access to the connection errors. The solution must provide all the connection error details.

What should you do first?

70. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure web app named App1. App1 runs in an Azure App Service plan named Plan1. Plan1 is associated to the Free pricing tier.

You discover that App1 stops each day after running continuously for 60 minutes.

You need to ensure that App1 can run continuously for the entire day.

Solution: You add a continuous WebJob to App1.

Does this meet the goal?

71. Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

Your company’s Azure solution makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option has been configured as the usage model.

After the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD) obtains a different company and adding the new employees to Azure Active Directory (Azure AD), you are informed that these employees should also make use of Multi-Factor Authentication.

To achieve this, the Per Enabled User setting must be set for the usage model.

Solution: You create a new Multi-Factor Authentication provider with a backup from the existing Multi-Factor Authentication provider data.

Does the solution meet the goal?

72. HOTSPOT

You have a sync group named Sync1 that has a cloud endpoint. The cloud endpoint includes a file named File1.txt.

You on-premises network contains servers that run Windows Server 2016.

The servers are configured as shown in the following table.





You add Share1 as an endpoint for Sync1. One hour later, you add Share2 as an endpoint for Sync1.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

73. HOTSPOT

You have an Azure subscription named Subscription1 that contains the resources in the following table.





You install the Web Server server role (IIS) on WM1 and VM2, and then add VM1 and VM2 to LB1.

LB1 is configured as shown in the LB1 exhibit. (Click the Exhibit button.)





Rule1 is configured as shown in the Rule1 exhibit. (Click the Exhibit button.)





For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

74. HOTSPOT

You have an Azure web app named App1 that has two deployment slots named Production and Staging.

Each slot has the unique settings shown in the following table.





You perform a slot swap.

What are the configurations of the Production slot after the swap? To answer, select the appropriate options in the answer area. NOTE: Each correction is worth one point.

75. You have an Azure subscription named Subscription1 that has the following providers registered:

✑ Authorization

✑ Automation

✑ Resources

✑ Compute

✑ KeyVault

✑ Network

✑ Storage

✑ Billing

✑ Web

Subscription1 contains an Azure virtual machine named VM1 that has the following con figurations:

* Private IP address: 10.0.0.4 (dynamic)

* Network security group (NSG): NSG1

* Public IP address: None

* Availability set: AVSet

* Subnet: 10.0.0.0/24

* Managed disks: No

* Location: East US

You need to record all the successful and failed connection attempts to VM1.

Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

76. HOTSPOT

You have an Azure Migrate project that has the following assessment properties:

✑ Target location: East US

✑ Storage redundancy: Locally redundant

✑ Comfort factor: 2.0

✑ Performance history: 1 month

✑ Percentile utilization: 95th

✑ Pricing tier: Standard

✑ Offer: Pay as you go

You discover the following two virtual machines:

✑ A virtual machine named VM1 that runs Windows Server 2016 and has 10 CPU cores at 20 percent utilization

✑ A virtual machine named VM2 that runs Windows Server 2012 and has four CPU cores at 50 percent utilization

How many CPU cores will Azure Migrate recommend for each virtual machine? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

77. You have an Azure subscription that contains the resources in the following table.





To which subnets can you apply NSG1?

78. HOTSPOT

Your network contains an Active Directory domain. The domain contains a user named User1.

The domain is synced to Azure Active Directory (Azure AD) as shown in the following exhibit.





Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic NOTE: Each correct selection is worth one point.

79. You are planning to deploy an Ubuntu Server virtual machine to your company’s Azure subscription.

You are required to implement a custom deployment that includes adding a particular trusted root certification authority (CA).

Which of the following should you use to create the virtual machine?

80. DRAG DROP

You have an on-premises network that you plan to connect to Azure by using a site-to-site VPN.

In Azure, you have an Azure virtual network named VNet1 that uses an address space of 10.0.0.0/16. VNet1 contains a subnet named Subnet1 that uses an address space of 10.0.0.0/24.

You need to create a site-to-site VPN to Azure.

Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.

81. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure virtual machine named VM1 that runs Windows Server 2016.

You need to create an alert in Azure when more than two error events are logged to the System log on VM1 within an hour.

Solution: You create an Azure Log Analytics workspace and configure the data settings. You add an extension to VM1. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source.

Does this meet the goal?

82. HOTSPOT

You plan to create a new Azure Active Directory (Azure AD) role.

You need to ensure that the new role can view all the resources in the Azure subscription and issue support requests to Microsoft. The solution must use the principle of least privilege.

How should you complete the JSON definition? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

83. You have a service deployed to a Kubernetes cluster.

Another application needs to access the service via the private IP address of the pod.

Which of the following would you define as the networking type for the cluster to meet this requirement?

84. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site connection uses a self-signed certificate.

From Azure, you download and install the VPN client configuration package on a computer named Computer2.

You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2.

Solution: On Computer2, you set the Startup type for the IPSec Policy Agent service to Automatic.

Does this meet the goal?

85. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

Your company has 100 users located in an office in Paris.

The on-premises network contains the servers shown in the following table.





You create a new subscription. You need to move all the servers to Azure.

Solution: You run azcopy.exe.

Does this meet the goal?

86. DRAG DROP

You have an Azure subscription named Subscription1.

You create an Azure Storage account named Contoso storage, and then you create a file share named data.

Which UNC path should you include in a script that references files from the data file share? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

87. HOTSPOT

You have an Azure subscription that contains the virtual networks shown in the following table.





You have the virtual machines shown in the following table.





You have the virtual network interfaces shown in the following table.





Server1 is a DNS server that contains the resources shown in the following table.





You have an Azure private DNS zone named contoso.com that has a virtual network link to VNET2 and the records shown in the following table.





For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

88. HOTSPOT

You need to create storage5. The solution must support the planned changes.

Which type of storage account should you use, and which account should you configure as the destination storage account? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

89. You have an A2ure virtual machine named VMV

The network interface for VM1 is configured as shown in the exhibit (Click the Exhibit tab.)





You deploy a web server on VM1. and then create a secure website that is accessible by using the HTTPS protocol. VM1 is used as a web server only.

You need to ensure that users can connect to the website from the internet.

What should you do?

90. HOTSPOT

You have an Azure subscription that contains the virtual networks shown in the following table.





The subscription contains the private DNS zones shown in the following table.





You add virtual network links to the private DNS zones as shown in the following table.





For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

91. You have an Azure subscription that contains the storage accounts shown in the following table.





You need to identify which storage account can be converted to zone-redundant storage (ZRS) replication by requesting a live migration from Azure support.

What should you identify?

92. HOTSPOT

You create a virtual machine scale set named Scale1.

Scale1 is configured as shown in the following exhibit.





Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

93. CORRECT TEXT

You have an Azure Storage account named storage1 that stores images.

You need to create a new storage account and replicate the images in storage1 to the new account by using object replication.

How should you configure the new account? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

94. You plan to create the Azure web apps shown in the following table.





What is the minimum number of App Service plans you should create for the web apps?

95. You have an Azure virtual machine named VM1.

You use Azure Backup to create a backup of VM1 named Backup1.

After creating Backup1, you perform the following changes to VM1:

✑ Modify the size of VM1.

✑ Copy a file named Budget.xls to a folder named Data.

✑ Reset the password for the built-in administrator account.

✑ Add a data disk to VM1.

An administrator uses the Replace existing option to restore VM1 from Backup1.

You need to ensure that all the changes to VM1 are restored.

Which change should you perform again?

96. HOTSPOT

You have an Azure subscription.

The subscription contains virtual machines that run Windows Server 2016 and are configured as shown in the following table.

97. HOTSPOT

You have an Azure subscription that contains the resources in the following table.





You install the Web Server server role (IIS) on VM1 and VM2, and then and VM1 and VM2 to LB1.

LB1 is configured as shown in the LB1 exhibit. (Click the LB1 tab.)





Rule1 is configure as shown in the Rule1 exhibit. (Click the Rule tab.)





For each of the following statements, select Yes if the statements is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

98. You have an Azure subscription named Subscription1 that contains the storage accounts shown in the following table:





You plan to use the Azure Import/Export service to export data from Subscription1.

You need to identify which storage account can be used to export the data.

What should you identify?

99. HOTSPOT

You have an Azure Active Directory (Azure AD) tenant named adatum.com.

Adatum.com contains the groups in the following table.





You create two user accounts that are configured as shown in the following table.





To which groups do User1 and User2 belong? To answer. select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

100. HOTSPOT

You have an Azure subscription named Subscription1 that contains the resources shown in the following table.





In storage1, you create a blob container named blob1 and a file share named share1.

Which resources can be backed up to Vault1 and Vault2? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

101. HOTSPOT

You have Azure virtual machines that run Windows Server 2019 and are configured as shown in the following table.





You create a private Azure DNS zone named adatum.com. You configure the adatum.com zone to allow auto registration from VNET1.

Which A records will be added to the adatum.com zone for each virtual machine? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

102. HOTSPOT

You need to recommend a solution for App1. The solution must meet the technical requirements.

What should you include in the recommendation? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

103. You have an Azure subscription named Subscription1 that contains an Azure virtual network named VNet1. VNet1 connects to your on-premises network by using Azure ExpressRoute.

You need to connect VNet1 to the on-premises network by using a site-to-site VPN. The solution must minimize cost.

Which three actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

104. HOTSPOT

You have an Azure Service Bus.

You create a queue named Queue1.

Queue1 is configured as shown in the following exhibit.





Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

105. HOTSPOT

You have a pay-as-you-go Azure subscription that contains the virtual machines shown in the following table.





You create the budget shown in the following exhibit.





The AG1 action group contains a user named [email protected] only.

Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

106. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You manage a virtual network named VNet1 that is hosted in the West US Azure region.

VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.

You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.

Solution: From Azure Network Watcher, you create a connection monitor.

Does this meet the goal?

107. HOTSPOT

VM1 is running and connects to NIC1 and Disk1. NIC1 connects to VNET1.

RG2 contains a public IP address named IP2 that is in the East US location. IP2 is not assigned to a virtual machine.

For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

108. You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.

You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.

You need to ensure that visitors are serviced by the same web server for each request.

What should you configure?

109. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:





User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.

You need to create new user accounts in external.contoso.onmicrosoft.com.

Solution: You instruct User4 to create the user accounts.

Does that meet the goal?

110. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json.

You receive a notification that VM1 will be affected by maintenance.

You need to move VM1 to a different host immediately.

Solution: Solution: From the Overview blade, you move the virtual machine to a different subscription.

Does this meet the goal?

111. You have a Microsoft SQL Server Always On availability group on Azure virtual machines. You need to configure an Azure internal load balancer as a listener for the availability group.

What should you do?

112. Your company registers a domain name of contoso.com.

You create an Azure DNS named contoso.com and then you add an A record to the zone for a host named www that has an IP address of 131.107.1.10.

You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address.

You need to resolve the name resolution issue.

Solution: You modify the name server at the domain registrar.

Does this meet the goal?

113. You have two Azure Active Directory (Azure AD) tenants named contoso.com and fabrikam.com.

You have a Microsoft account that you use to sign in to both tenants.

You need to configure the default sign-in tenant for the Azure portal.

What should you do?

114. Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You deploy an Azure Kubernetes Service (AKS) cluster named AKS1.

You need to deploy a YAML file to AKS1.

Solution: From Azure Cloud Shell, you run az aks.

Does this meet the goal?

115. HOTSPOT

You have an Azure Kubernetes Service (AKS) cluster named AKS1 and a computer named Computer1 that runs Windows 10. Computer1 that has the Azure CLI installed.

You need to install the kubectl client on Computer1.

Which command should you run? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

116. HOTSPOT

You have an Azure subscription that contains the resources shown in the following table:





You assign a policy to RG6 as shown in the following table:





To RG6, you apply the tag: RGroup: RG6.

You deploy a virtual network named VNET2 to RG6.

Which tags apply to VNET1 and VNET2? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

117. You have an Azure subscription that contains the resources shown in the following table.





You need to deploy Application1 to Cluster1.

Which command should you run?

118. You have an Azure subscription named Subscription 1 and an on-premises deployment of Microsoft System Center Service Manager Subscription! contains a virtual machine named VM1.

You need to ensure that an alert is set in Service Manager when the amount of available memory on VM1 is below 10 percent.

What should you do first?

119. Which blade should you instruct the finance department auditors to use?

120. Topic 4, Contoso Ltd (Consulting Company)



Case study

This is a case study. Case studies are not timed separately. You can use as much exam time as you would like to complete each case. However, there may be additional case studies and sections on this exam. You must manage your time to ensure that you are able to complete all questions included on this exam in the time provided.



To answer the questions included in a case study, you will need to reference information that is provided in the case study. Case studies might contain exhibits and other resources that provide more information about the scenario that is described in the case study. Each question is independent of the other questions in this case study.



At the end of this case study, a review screen will appear. This screen allows you to review your answers and to make changes before you move to the next section of the exam. After you begin a new section, you cannot return to this section.



To start the case study

To display the first question in this case study, click the Next button. Use the buttons in the left pane to explore the content of the case study before you answer the questions. Clicking these buttons displays information such as business requirements, existing environment, and problem statements. If the case study has an All Information tab, note that the information displayed is identical to the information displayed on the subsequent tabs. When you are ready to answer a question, click the Question button to return to the question.



Overview

General Overview

Contoso, Ltd. is a consulting company that has a main office in Montreal and branch offices in Seattle and New York.



Environment

Existing Environment

Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an on-premises Active Directory domain that syncs to the Azure AD tenant.



The Azure AD tenant contains the users shown in the following table.







Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table.







User1 manages the resources in RG1. User4 manages the resources in RG2.

Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table







No network security groups (NSGs) are associated to the network interfaces or the subnets.

Sub1 contains the storage accounts shown in the following table.







Requirements

Planned Changes

Contoso plans to implement the following changes:

✑ Create a blob container named container1 and a file share named share1 that will use the Cool storage tier.

✑ Create a storage account named storage5 and configure storage replication for the Blob service.

✑ Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.





✑ Associate NSG1 to the network interface of VM1.

✑ Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table.





✑ Associate NSG2 to VNET1/Subnet2.



Technical Requirements

Contoso must meet the following technical requirements:

✑ Create container1 and share1.

✑ Use the principle of least privilege.

✑ Create an Azure AD security group named Group4.

✑ Back up the Azure file shares and virtual machines by using Azure Backup.

✑ Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.

✑ Enable User1 to create Azure policy definitions and User2 to assign Azure policies to RG1.

✑ Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1

✑ Enable flow logging for IP traffic from VM5 and retain the flow logs for a period of eight months.

✑ Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure file shares.



HOTSPOT

You need to create container1 and share1.

Which storage accounts should you use for each resource? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

121. DRAG DROP

You have an Azure subscription that contains an Azure virtual machine named VM1. VM1 runs Windows Server 2016 and is part of an availability set.

VM1 has virtual machine-level backup enabled.

VM1 is deleted.

You need to restore VM1 from the backup. VM1 must be part of the availability set.

Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.