Free AZ-104 Sample Questions and 100% Cover Real Exam Questions (Updated 832 Questions)
Download Real Microsoft AZ-104 Exam Dumps Test Engine Exam Questions
To prepare for the Microsoft AZ-104 Certification Exam, candidates should have a strong understanding of cloud computing principles and be familiar with the Azure portal, Azure PowerShell, and Azure CLI. They should also have experience in managing Azure services and be able to implement and monitor Azure solutions, configure Azure storage, and manage Azure virtual networks. Candidates who pass the exam will earn the Microsoft Certified: Azure Administrator Associate certification, which demonstrates their expertise in managing Azure resources and services. Microsoft Azure Administrator Exam certification is recognized by employers worldwide and can lead to career advancement opportunities in cloud computing and IT infrastructure management.
IT enthusiasts who want to hone their basic Azure skills a bit more and cement their feet in the industry can take the help of the Microsoft AZ-104 exam. Packed with substantial awareness of Azure storage and identities, passing this test is a fabulous way to have in-depth subject matter knowledge that is needed for end-to-end Azure administrators.
The Microsoft AZ-104 exam consists of 40-60 multiple-choice questions that need to be completed within 150 minutes. The questions are designed to test the candidate's knowledge and real-world experience in Azure administration. AZ-104 exam is available in several languages, including English, Chinese, French, German, Japanese, Portuguese, and Spanish.
NEW QUESTION # 330
You create a Recovery Services vault backup policy named Policy1 as shown in the following exhibit.
Answer:
Explanation:
Explanation
NEW QUESTION # 331
You have an Azure web app named App1 that has two deployment slots named Production and Staging. Each slot has the unique settings shown in the following table.
You perform a slot swap.
What are the configurations of the Production slot after the swap? To answer, select the appropriate options in the answer area.
NOTE: Each correction is worth one point.
Answer:
Explanation:
Which settings are swapped?
When you clone configuration from another deployment slot, the cloned configuration is editable. Some configuration elements follow the content across a swap (not slot specific), whereas other configuration elements stay in the same slot after a swap (slot specific). The following lists show the settings that change when you swap slots.
Box 1 : On
Settings that are swapped:
General settings, such as framework version, 32/64-bit, web sockets
App settings (can be configured to stick to a slot)
Connection strings (can be configured to stick to a slot)
Handler mappings
Public certificates
WebJobs content
Hybrid connections *
Virtual network integration *
Service endpoints *
Azure Content Delivery Network *
Features marked with an asterisk (*) are planned to be unswapped.
So web sockets settings will be swapped. So Production will have web sockets settings from "Off" to " On" after the swap slot.
Box 2: App1-prod.contoso.com
Settings that aren't swapped:
Publishing endpoints
Custom domain names
Non-public certificates and TLS/SSL settings
Scale settings
WebJobs schedulers
IP restrictions
Always On
Diagnostic settings
Cross-origin resource sharing (CORS)
So Custom domain names will not be swapped. So Production will have Custom domain names of its own after the swap slot.
Reference:
https://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots#what-happens-during-a-swap
NEW QUESTION # 332
You have an Azure subscription named Subscription1 that contains the following resource group:
Name: RG1
Region: West US
Tag: "tag1": "value1"
You assign an Azure policy named Policy1 to Subscription1 by using the following configurations:
Exclusions: None
Policy definition: Append tag and its default value
Assignment name: Policy1
Parameters:
- Tag name: Tag2
- Tag value: Value2
After Policy1 is assigned, you create a storage account that has the following configurations:
Name: storage1
Location: West US
Resource group: RG1
Tags: "tag3": "value3"
You need to identify which tags are assigned to each resource.
What should you identify? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Explanation:
Box 1: " tag1 " : " value1 " only
Box 2: " tag2 " : " value2 " and " tag3 " : " value3 "
Tags applied to the resource group are not inherited by the resources in that resource group.
References:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-using-tags
NEW QUESTION # 333
You have an Azure Active Directory (Azure AD) tenant that has Azure AD Privileged Identity Management configured.
You have 10 users who are assigned the Security Administrator role for the tenant.
You need the users to verify whether they still require the Security Administrator role.
What should you do?
- A. From Azure AD Identity Protection, configure the Weekly Digest.
- B. From Azure AD Privileged Identity Management, create a conditional access policy.
- C. From Azure AD Identity Protection, configure a user risk policy.
- D. From Azure AD Privileged Identity Management, create an access review.
Answer: D
Explanation:
Explanation
References:
https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-start-securi To reduce the risk associated with stale role assignments, you should regularly review access. You can use Azure AD Privileged Identity Management (PIM) to create access reviews for privileged Azure AD roles. You can also configure recurring access reviews that occur automatically.
Steps:
1. Sign in to Azure portal with a user that is a member of the Privileged role administrator role.
2. Open Azure AD Privileged Identity Management.
3. Select Azure AD roles.
4. Under Manage, select Access reviews, and then select New.
References:
https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-how-to-start-securi
NEW QUESTION # 334
You have an Azure subscription that contains the virtual networks shown in the following table.
Each virtual network has 50 connected virtual machines.
You need to implement Azure Bastion. The solution must meet the following requirements:
* Support host scaling.
* Support uploading and downloading files.
* Support the virtual machines on both VNet1 and VNet2.
* Minimize the number of addresses on the Azure Bastion subnet.
How should you configure Azure Bastion? To answer, select the options in the answer area.
NOTE: Each correct answer is worth one point.
Answer:
Explanation:
Explanation:
Azure Bastion is a fully managed service that provides secure and seamless RDP/SSH connectivity to your virtual machines directly through the Azure portal - without exposing those VMs to public IP addresses.
To meet the stated requirements, let's evaluate each configuration point using verified Azure documentation principles:
1## Support for host scaling:
Host scaling (auto-scale) is available only in the Standard SKU of Azure Bastion. The Basic SKU supports a single Bastion host instance and does not scale. Therefore, to support scaling, we must use the Standard SKU.
2## Support uploading and downloading files:
The file upload/download (RDP/SSH clipboard transfer) feature is supported only by the Standard SKU of Azure Bastion. The Basic SKU does not support these advanced capabilities.
3## Support for VMs in both VNet1 and VNet2:
Since VNet1 and VNet2 are in the same region (East US) and are peered, one Bastion host can be deployed in VNet1 and used to connect to VMs in both VNets. Cross-VNet connectivity for Bastion requires VNet peering and the Standard SKU.
4## Minimize the number of addresses on the Azure Bastion subnet:
Azure Bastion requires a dedicated subnet named AzureBastionSubnet.
* The minimum supported subnet size is /26 for the Standard SKU (as it supports scaling and multiple instances).
* The Basic SKU can use /27, but since we are using Standard SKU (for scaling and file transfer), the minimum possible subnet size is /26.This meets the requirement to minimize address space usage while supporting scaling.
5## Public IP requirements:
* The Standard SKU Bastion requires a Public IP address of SKU = Standard with Static allocation.
* Basic SKU Bastion can work with Basic Public IPs, but not Standard SKU Bastion.Hence, we must use a Standard SKU Public IP with Static allocation.
# Final Verified Configuration (per Microsoft Azure Administrator Documentation):
* Subnet size: /26
* Public IP: Standard SKU with a static allocation
Rationale Summary:
This configuration supports scaling, file transfer, cross-VNet connectivity, and minimal address consumption, satisfying all requirements as per official Azure documentation on Azure Bastion Standard SKU and Bastion network design guidelines.
NEW QUESTION # 335
You have an Azure subscription named Sub1.
You plan to deploy a multi-tiered application that will contain the tiers shown in the following table.
You need to recommend a networking solution to meet the following requirements:
Ensure that communication between the web servers and the business logic tier spreads equally across the virtual machines.
Protect the web servers from SQL injection attacks.
Which Azure resource should you recommend for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview
NEW QUESTION # 336
You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table:
User3 is the owner of Group1.
Group2 is a member of Group1.
You configure an access review named Review1 as shown in the following exhibit:
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review
NEW QUESTION # 337
You have an Azure subscription.
You need to receive an email alert when a resource lock is removed from any resource in the subscription What should you use to create an activity log alert in Azure Monitor?
- A. a resource, a condition, and a Microsoft 365 group
- B. a resource, a condition, and an action group
- C. a data collection endpoint, an application security group, and a resource group
- D. a Log Analytics workspace, a resource, and an action group
Answer: B
NEW QUESTION # 338
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these
questions will not appear in the review screen.
You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site connection uses a self-signed certificate.
From Azure, you download and install the VPN client configuration package on a computer named Computer2.
You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2.
Solution: You export the client certificate from Computer1 and install the certificate on Computer2.
Does this meet this goal?
- A. No
- B. Yes
Answer: B
Explanation:
Each client computer that connects to a VNet using Point-to-Site must have a client certificate installed. You generate a client certificate from the self-signed root certificate, and then export and install the client certificate. If the client certificate is not installed, authentication fails.
References:
https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-certificates-point-to-site
NEW QUESTION # 339
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer.
The effective network security configurations for VM2 are shown in the following exhibit.
You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail.
You verify that the Load Balancer rules are configured correctly.
You need to ensure that connections to App1 can be established successfully from
131.107.100.50 over TCP port 443.
Solution: You create an inbound security rule that denies all traffic from the 131.107.100.50 source and has a priority 4096.
Does this meet the goal?
- A. No
- B. Yes
Answer: A
Explanation:
Correct:
* No correct answers at the moment.
Incorrect:
* You create an inbound security rule that allows any traffic from the AzureLoadBalancer source and has a cost of 150.
Cost settings does not affect blocked connections.
* You create an inbound security rule that denies all traffic from the 131.107.100.50 source and has a cost of 64999.
Cost settings does not affect blocked connections.
* You create an inbound security rule that denies all traffic from the 131.107.100.50 source and has a priority 4096.
A deny rule does not allow more traffic.
* You create an inbound security rule that denies all traffic from the 131.107.100.50 source and has a priority of 64999.
A deny rule does not allow more traffic.
* You delete the BlockAllOther443 inbound security rule.
The Allow_131.107.100.50 rule is already overriding this block rule.
* You modify the priority of the Allow_131.107.100.50 inbound security rule.
This rule, with priority 100, already has the highest priority of all the rules.
Reference:
https://fastreroute.com/azure-network-security-groups-explained/
NEW QUESTION # 340
You have an Azure subscription that contains an Azure Storage account.
You plan to create an Azure container instance named container1 that will use a Docker image named Image1. Image1 contains a Microsoft SQL Server instance that requires persistent storage.
You need to configure a storage service for Container1.
What should you use?
- A. Azure Queue storage
- B. Azure Table storage
- C. Azure Files
- D. Azure Blob storage
Answer: C
Explanation:
Azure file shares can be used as persistent volumes for stateful containers. Containers deliver
"build once, run anywhere" capabilities that enable developers to accelerate innovation. For the containers that access raw data at every start, a shared file system is required to allow these containers to access the file system no matter which instance they run on.
https://docs.microsoft.com/en-us/azure/storage/files/storage-files-introduction
NEW QUESTION # 341
You have an Azure subscription named Subscription1. Subscription1 contains two Azure virtual machines named VM1 and VM2. VM1 and VM2 run Windows Server 2016.
VM1 is backed up daily by Azure Backup without using the Azure Backup agent.
VM1 is affected by ransomware that encrypts data.
You need to restore the latest backup of VM1.
To which location can you restore the backup? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/backup/backup-azure-arm-restore-vms
https://docs.microsoft.com/en-us/azure/backup/backup-azure-restore-files-from-vm#system-requirements
NEW QUESTION # 342
You need to identify the storage requirements for Contoso.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/machine-learning/team-data-science-process/move-data-to-azure-blob-using-azure-storage-explorer
https://docs.microsoft.com/en-us/azure/storage/tables/table-storage-overview
https://www.serverless360.com/blog/azure-blob-storage-vs-file-storage
NEW QUESTION # 343
You have an Azure Storage account named storage1.
You have an Azure App Service app named app1 and an app named App2 that runs in an Azure container instance. Each app uses a managed identity.
You need to ensure that App1 and App2 can read blobs from storage1 for the next 30 days.
What should you configure in storage1 for each app?
Answer:
Explanation:
NEW QUESTION # 344
You have an Azure subscription.
You create an Azure container registry and a container image
You need to push the container image to the container registry by using the Azure Command-Line Interface (CU).
You sign in to the container registry.
Which action should you perform next?
- A. Configure a YAML file.
- B. Deploy a container group.
- C. lag a container image with the name of the container registry's login server.
- D. List the images in the container registry.
Answer: C
Explanation:
To push a container image to Azure Container Registry (ACR) using the Azure CLI, the image must first be tagged with the registry's login server name name. This is a mandatory step in the Docker workflow.
After signing in to the registry using az acr login, the local container image must be tagged in the following format:
<registry-name>.azurecr.io/<image-name>:<tag>
Azure documentation specifies that Docker determines the target registry based on the image tag. If the image is not tagged with the registry's login server name, Docker will not know where to push the image.
Listing images, deploying container groups, or configuring YAML files are optional or later steps and are not required to push an image to ACR.
Final Answer: A. Tag a container image with the name of the container registry's login server
NEW QUESTION # 345
You have an Azure subscription that is linked to an Azure AD tenant. The tenant contains the custom role-based access control (RBAC) roles shown in the following table.
From the Azure portal, you need to create two custom roles named Role3 and Role4. Role3 will be an Azure subscription role. Role4 will be an Azure AD role. Which roles can you clone to create the new roles? To answer, select the appropriate options in the answer area.
Answer:
Explanation:
NEW QUESTION # 346
You have an Azure subscription that contains the vaults shown in the following table.
You deploy the virtual machines shown in the following table.
Each of the following statements, select Yes if the statement is true. Otherwise, select No NOTE: Each cored selection it worth one point.
Answer:
Explanation:
Explanation:
NEW QUESTION # 347
You have an Azure subscription that contains a web app named webapp1. You need to add a custom domain named www.contoso.com to webapp1. What should you do first?
- A. Upload a certificate.
- B. Create a DNS record.
- C. Stop webapp1.
- D. Add a connection string.
Answer: B
Explanation:
You can use either a CNAME record or an A record to map a custom DNS name to App Service. You should use CNAME records for all custom DNS names except root domains (for example, contoso.com). For root domains, use A records. Reference:
https://docs.microsoft.com/en-us/Azure/app-service/app-service-web-tutorial-custom-domain
NEW QUESTION # 348
You have an Azure subscription named Sub1.
You plan to deploy a multi-tiered application that will contain the tiers shown in the following table.
You need to recommend a networking solution to meet the following requirements:
Ensure that communication between the web servers and the business logic tier spreads equally across the virtual machines.
Protect the web servers from SQL injection attacks.
Which Azure resource should you recommend for each requirement? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/web-application-firewall/ag/ag-overview
NEW QUESTION # 349
You need to ensure that VM1 can communicate with VM4. The solution must minimize administrative effort.
What should you do?
- A. Create an NSG and associate the NSG to VMI and VM4.
- B. Create a user-defined route from VNET1 to VNET3.
- C. Assign VM4 an IP address of 10.0.1.5/24.
- D. Establish peering between VNET1 and VNET3.
Answer: C
Explanation:
Reference:
https://docs.microsoft.com/en-us/azure/vpn-gateway/tutorial-site-to-site-portal
NEW QUESTION # 350
You need to create a bar chart that shows the number of distinct computers that have sent heartbeats each week. How should you complete the Log Analytics query? To answer, select the appropriate options in the answer are a. NOTE: Each correct selection is worth one point.
Answer:
Explanation:
NEW QUESTION # 351
You have an Azure subscription that contains a virtual network named VNET1. VNET1 contains the subnets shown in the following table.
Each virtual machine uses a static IP address.
You need to create network security groups (NSGs) to meet following requirements:
Allow web requests from the internet to VM3, VM4, VM5, and VM6.
Allow all connections between VM1 and VM2.
Allow Remote Desktop connections to VM1.
Prevent all other network traffic to VNET1.
What is the minimum number of NSGs you should create?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: C
NEW QUESTION # 352
Your network is configured as shown in the following exhibit.
The firewalls are configured as shown in the following table.
Prod1 contains a vCenter server.
You install an Azure Migrate Collector on Test1.
You need to discover the virtual machines.
Which TCP port should be allowed on each firewall? To answer, drag the appropriate ports to the correct firewalls. Each port may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.
NOTE: Each correct selection is worth one point.
Answer:
Explanation:
References:
https://docs.microsoft.com/en-us/azure/migrate/concepts-collector
References:
https://docs.microsoft.com/en-us/azure/migrate/migrate-appliance
NEW QUESTION # 353
......
New AZ-104 exam dumps Use Updated Microsoft Exam: https://testinsides.actualpdf.com/AZ-104-real-questions.html
