Free AZ-104 Sample Questions — Microsoft Azure Administrator

You have an Azure subscription that contains a virtual machine named VM1 and an Azure function named App1. You need to create an alert rule that will run App1 if VM1 stops. What should you create for the alert rule?

• A. an application security group
• B. a security group that has dynamic device membership
• C. an action group
• D. an application group

Your company has an Azure subscription. You need to deploy a number of Azure virtual machines (VMs) using Azure Resource Manager (ARM) templates. You have been informed that the VMs will be included in a single availability set. You are required to make sure that the ARM template you configure allows for as many VMs as possible to remain accessible in the event of fabric failure or maintenance. Which of the following is the value that you should configure for the platformUpdateDomainCount property?

• A. 10
• B. 20
• C. 30
• D. 40

You have an Azure subscription named Subscription1. You have 5 TB of data that you need to transfer to Subscription1. You plan to use an Azure Import/Export job. What can you use as the destination of the imported data?

• A. a virtual machine
• B. an Azure Cosmos DB database
• C. Azure File Storage
• D. the Azure File Sync Storage Sync Service

You plan to move a distributed on-premises app named App1 to an Azure subscription. After the planned move, App1 will be hosted on several Azure virtual machines. You need to ensure that App1 always runs on at least eight virtual machines during planned Azure maintenance. What should you create?

• A. one virtual machine scale set that has 10 virtual machines instances
• B. one Availability Set that has three fault domains and one update domain
• C. one Availability Set that has 10 update domains and one fault domain
• D. one virtual machine scale set that has 12 virtual machines instances

You have two subscriptions named Subscription1 and Subscription2. Each subscription is associated to a different Azure AD tenant. Subscription1 contains a virtual network named VNet1. VNet1 contains an Azure virtual machine named VM1 and has an IP address space of 10.0.0.0/16. Subscription2 contains a virtual network named VNet2. VNet2 contains an Azure virtual machine named VM2 and has an IP address space of 10.10.0.0/24. You need to connect VNet1 to VNet2. What should you do first?

• A. Move VM1 to Subscription2
• B. Move VNet1 to Subscription2
• C. Modify the IP address space of VNet2
• D. Provision virtual network gateways

You have an Azure subscription that contains a resource group named RG1 and a virtual network named VNet1. You plan to create an Azure container instance named container1. You need to be able to configure DNS name label scope reuse for container1. What should you configure for container1?

• A. the private networking type
• B. the public networking type
• C. a new subnet on VNet1
• D. a confidential SKU

You have an Azure subscription that contains an Azure container registry named ContReg1. You enable the Admin user for ContReg1. Which username can you use to sign in to ContReg1?

• A. root
• B. admin
• C. administrator
• D. ContReg1

You have an Azure App Services web app named App1. You plan to deploy App1 by using Web Deploy. You need to ensure that the developers of App1 can use their Azure AD credentials to deploy content to App1. The solution must use the principle of least privilege. What should you do?

• A. Assign the Owner role to the developers
• B. Configure app-level credentials for FTPS
• C. Assign the Website Contributor role to the developers
• D. Configure user-level credentials for FTPS

You have an Azure web app named webapp1. You have a virtual network named VNET1 and an Azure virtual machine named VM1 that hosts a MySQL database. VM1 connects to VNET1. You need to ensure that webapp1 can access the data hosted on VM1. What should you do?

• A. Deploy an internal load balancer
• B. Peer VNET1 to another virtual network
• C. Connect webapp1 to VNET1
• D. Deploy an Azure Application Gateway

You have an Azure subscription that contains a Recovery Services vault named Vault1. You need to enable multi-user authorization (MAU) for Vault1. Which resource should you create first?

• A. an administrative unit
• B. a managed identity
• C. a resource guard
• D. a custom Azure role

You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure?

• A. a health probe
• B. Floating IP (direct server return) to Enabled
• C. Session persistence to Client IP and protocol
• D. Protocol to UDP

You have an Azure subscription that contains a storage account named storage1. The storage1 account contains a container named container1. You need to configure access to container1. The solution must meet the following requirements: • Only allow read access. • Allow both HTTP and HTTPS protocols. • Apply access permissions to all the content in the container. What should you use?

• A. an access policy
• B. a shared access signature (SAS)
• C. Azure Content Delivery Network (CDN)
• D. access keys

You have an Azure subscription that contains a virtual machine named VM1 and an Azure key vault named KV1. You need to configure encryption for VM1. The solution must meet the following requirements: • Store and use the encryption key in KV1. • Maintain encryption if VM1 is downloaded from Azure. • Encrypt both the operating system disk and the data disks. Which encryption method should you use?

• A. customer-managed keys
• B. Confidential disk encryption
• C. Azure Disk Encryption
• D. encryption at host

You have an Azure subscription that contains a storage account named storage1. The storage1 account contains a file share named share1. The subscription is linked to a hybrid Azure Active Directory (Azure AD) tenant that contains a security group named Group1. You need to grant Group1 the Storage File Data SMB Share Elevated Contributor role for share1. What should you do first?

• A. Enable Active Directory Domain Service (AD DS) authentication for storage1
• B. Grant share-level permissions by using File Explorer
• C. Mount share1 by using File Explorer
• D. Create a private endpoint

You have two Azure virtual machines named VM1 and VM2. You have two Recovery Services vaults named RSV1 and RSV2. VM2 is backed up to RSV1. You need to back up VM2 to RSV2. What should you do first?

• A. From the RSV1 blade, click Backup items and stop the VM2 backup
• B. From the RSV2 blade, click Backup. From the Backup blade, select the backup for the virtual machine, and then click Backup
• C. From the VM2 blade, click Disaster recovery, click Replication settings, and then select RSV2 as the Recovery Services vault
• D. From the RSV1 blade, click Backup Jobs and export the VM2 job

You need to identify which storage account to use for the flow logging of IP traffic from VM5. The solution must meet the retention requirements. Which storage account should you identify?

• A. storage1
• B. storage2
• C. storage3
• D. storage4

You deploy Azure virtual machines to three Azure regions Each region contains a virtual network. Each virtual network contains multiple subnets peered in a full mesh topology. Each subnet contains a network security group (NSG) that has defined rules. A user reports that he cannot use port 33000 to connect from a virtual machine in one region to a virtual machine in another region. Which two options can you use to diagnose the issue? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

• A. Azure Virtual Network Manager
• B. IP flow verify
• C. Azure Monitor Network Insights
• D. Connection troubleshoot
• E. elective security rules

You have an Azure Active Directory (Azure AD) tenant that contains 5,000 user accounts. You create a new user account named AdminUser1. You need to assign the User administrator administrative role to AdminUser1. What should you do from the user account properties?

• A. From the Licenses blade, assign a new license
• B. From the Directory role blade, modify the directory role
• C. From the Groups blade, invite the user account to a new group

You have an on-premises server that contains a folder named D:\Folder1. You need to copy the contents of D:\Folder1 to the public container in an Azure Storage account named contosodata. Which command should you run?

• A. https://contosodata.blob.core.windows.net/public
• B. azcopy sync D:\folder1 https://contosodata.blob.core.windows.net/public --snapshot
• C. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public --recursive
• D. az storage blob copy start-batch D:\Folder1 https://contosodata.blob.core.windows.net/public

You have an Azure subscription that contains a virtual machine named VM1. VM1 hosts a line-of-business application that is available 24 hours a day. VM1 has one network interface and one managed disk. VM1 uses the D4s v3 size. You plan to make the following changes to VM1: ✑ Change the size to D8s v3. ✑ Add a 500-GB managed disk. ✑ Add the Puppet Agent extension. ✑ Enable Desired State Configuration Management. Which change will cause downtime for VM1?

• A. Enable Desired State Configuration Management
• B. Add a 500-GB managed disk
• C. Change the size to D8s v3
• D. Add the Puppet Agent extension