Microsoft AZ-104 Exam Dumps

Microsoft Azure Administrator

Microsoft AZ-104 Sample Questions

Question # 1

Note: This question is part of a series of questions that present the same scenario. Each question in the seriescontains a unique solution that might meet the stated goals. Some question sets might have more than onecorrect solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questionswill not appear in the review screen.You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure ResourceManager template named ARM1.json.You receive a notification that VM1 will be affected by maintenance.You need to move VM1 to a different host immediately.Solution: From the Overview blade, you move the virtual machine to a different subscription.Does this meet the goal?

A. Yes
B. No 

Answer: B

Show Answer

Question # 2

You have an Azure Active Directory (Azure AD) tenant named contoso.com.You have a CSV file that contains the names and email addresses of 500 external users.You need to create a quest user account in contoso.com for each of the 500 external users.Solution: from Azure AD in the Azure portal, you use the Bulk create user operation.Does this meet the goal?

A. Yes
B. No

Answer: B

Show Answer

Question # 3

You create an App Service plan named plan1 and an Azure web app named webapp1. You discover that theoption to create a staging slot is unavailable. You need to create a staging slot for plan1.What should you do first?

A. From webapp1, modify the Application settings.
B. From webapp1, add a custom domain.
C. From plan1, scale up the App Service plan.
D. From plan1, scale out the App Service plan.

Answer: C

Show Answer

Question # 4

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, thesequestions will not appear in the review screen.You manage a virtual network named VNet1 that is hosted in the West US Azure region.VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.Solution: From Performance Monitor, you create a Data Collector Set (DCS).Does this meet the goal?

A. Yes  
B. No  

Answer: B

Show Answer

Question # 5

You have an Azure subscription That contains a Recovery Services vault named Vault1.You need to enable multi-user authorization (MAU) for Vaultl. Which resource should you create first?

A. a managed identity   
B. a resource guard   
C. an administrative unit   
D. a custom Azure role   

Answer: B

Show Answer

Question # 6

You have two subscriptions named Subscription1 and Subscription2. Each subscription is associated to adifferent Azure AD tenant.Subscription1 contains a virtual network named VNet1. VNet1 contains an Azure virtual machine named VM1and has an IP address space of 10.0.0.0/16.Subscription2 contains a virtual network named VNet2. VNet2 contains an Azure virtual machine named VM2and has an IP address space of 10.10.0.0/24. You need to connect VNet1 to VNet2. What should you do first? 

A. Move VM1 to Subscription2.   
B. Modify the IP address space of VNet2.   
C. Provision virtual network gateways.   
D. Move VNet1 to Subscription2.   

Answer: C

Show Answer

Question # 7

You have an Azure subscription that contains 20 virtual machines, a network security group (NSG) named NSG1, and two virtual networks named VNET1 and VNET2 that are peered. You plan to deploy an Azure Bastion Basic SKU host named Bastion1 to VNET1. You need to configure NSG1 to allow inbound access from the internet to Bastion1. Which port should you configure for the inbound security rule?

A. 22  
B. 443  
C. 3389  
D. 8080  

Answer: B

Show Answer

Question # 8

You have an Azure subscription.Users access the resources in the subscription from either home or from customer sites. From home, usersmust establish a point-to-site VPN to access the Azure resources. The users on the customer sites access theAzure resources by using site-to-site VPNs.You have a line-of-business app named App1 that runs on several Azure virtual machine. The virtual machinesrun Windows Server 2016.You need to ensure that the connections to App1 are spread across all the virtual machines.What are two possible Azure services that you can use? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.

A. a public load balancer   
B. Traffic Manager   
C. an Azure Content Delivery Network (CDN)   
D. an internal load balancer   
E. an Azure Application Gateway   

Answer: D,E

Show Answer

Question # 9

You have an Azure subscription that contains a user named User1.You need to ensure that User1 can deploy virtual machines and manage virtual networks. The solution mustuse the principle of least privilege.Which role-based access control (RBAC) role should you assign to User1?

A. Owner  
B. Virtual Machine Administrator Login   
C. Contributor  
D. Virtual Machine Contributor   

Answer: D

Show Answer

Question # 10

You have an Azure subscription.You have 100 Azure virtual machines.You need to quickly identify underutilized virtual machines that can have their service tier changed to a lessexpensive offering.Which blade should you use?

A. Metrics  
B. Customer insights   
C. Monitor  
D. Advisor  

Answer: .

Show Answer

Question # 11

You have an Azure subscription that contains two virtual machines named VM1 and VM2You create an Azure load balancer.You plan to create a load balancing rule that will load balance HTTPS traffic between VM1 and VM2.Which two additional load balance resources should you create before you can create the load balancing rule?Each correct answer presents part of the solutionMOTL Each correct selection 5 worth one point.

A. a frontend IP address   
B. a backend pool   
C. a health probe   
D. an inbound NAT rule   
E.  a virtual network  

Answer: A,C

Show Answer

Question # 12

Note: This question is part of a series of questions that present the same scenario. Each question in the seriescontains a unique solution that might meet the stated goals. Some question sets might have more than onecorrect solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questionswill not appear in the review screen.You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the requiredrole to enable Traffic Analytics for an Azure subscription.Solution: You assign the Traffic Manager Contributor role at the subscription level to Admin1

A. Yes  
B. NO  

Answer: B

Show Answer

Question # 13

Note: This question is part of a series of questions that present the same scenario. Each question in the seriescontains a unique solution that might meet the stated goals. Some question sets might have more than onecorrect solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, thesequestions will not appear in the review screen.You manage a virtual network named VNet1 that is hosted in the West US Azure region.VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.Solution: From Azure Monitor, you create a metric on Network in and Network Out.Does this meet the goal?

A. Yes  
B. No  

Answer: B

Show Answer

Question # 14

You have an Azure virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 contains three Azure virtual machines. Each virtual machine has a public IP address.The virtual machines host several applications that are accessible over port 443 to user on the Internet.Your on-premises network has a site-to-site VPN connection to VNet1.You discover that the virtual machines can be accessed by using the Remote Desktop Protocol (RDP) from theInternet and from the on-premises network.You need to prevent RDP access to the virtual machines from the Internet, unless the RDP connection isestablished from the on-premises network. The solution must ensure that all the applications can still beaccesses by the Internet users.What should you do?

A. Modify the address space of the local network gateway.   
B. Remove the public IP addresses from the virtual machines.   
C. Modify the address space of Subnet1.   
D. Create a deny rule in a network security group (NSG) that is linked to Subnet1.   

Answer: D

Show Answer

Question # 15

You have an Azure Kubernetes Service (AKS) cluster named AKS1.You need to configure cluster autoscaler for AKS1.Which two tools should you use? Each correct answer presents a complete solution,NOTE: Each correct selection is worth one point

A. the set-AzAKs cmdlet   
B. the Azure portal   
C. The az aks command   
D. the kubect1 command   
E. the set Azure cmdlet   

Answer: B,C

Show Answer

Question # 16

You have an Azure Storage account named storage1.You plan to use AzCopy to copy data to storage1.You need to identify the storage services in storage1 to which you can copy the data.What should you identify?

A. blob, file, table, and queue   
B. blob and file only   
C. file and table only   
D. file only   
E. blob, table, and queue only   

Answer: B

Show Answer

Question # 17

You have an Azur« subscription that contains a virtual machine named VM1 and an Azure key vault named KV1.You need to configure encryption for VM1. The solution must meet the following requirements:• Store and use the encryption key in KV1.• Maintain encryption if VM1 is downloaded from Azure.• Encrypt both the operating system disk and the data disks.Which encryption method should you use?

A. encryption at host
B. customer-managed keys   
C. Azure Disk Encryption   
D. Confidential disk encryption   

Answer: C

Show Answer

Question # 18

You have a Microsoft 365 tenant and an Azure Active Directory (Azure AD) tenant named contoso.com.You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft SharePointdocument library named Library1.You need to create groups for the users. The solution must ensure that the groups are deleted automaticallyafter 180 days.Which two groups should you create? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.

A. a Security group that uses the Assigned membership type   
B.an Office 365 group that uses the Assigned membership type   
C. an Office 365 group that uses the Dynamic User membership type  
D. a Security group that uses the Dynamic User membership type   
E. a Security group that uses the Dynamic Device membership type   

Answer: B,C

Show Answer

Question # 19

Note: This question is part of a series of questions that present the same scenario. Each question in the seriescontains a unique solution that might meet the stated goals. Some question sets might have more than onecorrect solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questionswill not appear in the review screen.You have an Azure Active Directory (Azure AD) tenant named Adatum and an Azure Subscription namedSubscription1. Adatum contains a group named Developers. Subscription1 contains a resource group namedDev.You need to provide the Developers group with the ability to create Azure logic apps in the Dev resourcegroup.Solution: On Subscription1, you assign the Logic App Operator role to the Developers group.Does this meet the goal?

A. Yes  
B. No  

Answer: B

Show Answer

Question # 20

You deploy Azure virtual machines to three Azure regions.Each region contains a virtual network. Each virtual network contains multiple subnets peered in a full meshtopology.Each subnet contains a network security group (NSG) that has defined rules.A user reports that he cannot use port 33000 to connect from a virtual machine in one region to a virtualmachine in another region.Which two options can you use to diagnose the issue? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.

A. Azure Virtual Network Manager   
B. IP flow verify   
C. Azure Monitor Network Insights   
D. Connection troubleshoot   
E. elective security rules   

Answer: B,D

Show Answer