Microsoft Azure Administrator practice questions

1. Question 1 of 25

   Your company has an Azure Active Directory (Azure AD) tenant that is configured for hybrid coexistence with the on-premises Active Directory domain. You plan to deploy several new virtual machines (VMs) in Azure. The VMs will have the same operating system and custom software requirements. You configure a reference VM in the on-premise virtual environment. You then generalize the VM to create an image. You need to upload the image to Azure to ensure that it is available for selection when you create the new Azure VMs. Which PowerShell cmdlets should you use?

   • AAdd-AzVM
   • BAdd-AzVhd
   • CAdd-AzImage
   • DAdd-AzImageDataDisk

   Show answer

   Correct answer: B

   How others answered

   • B89%

   Explanation

   "New-AzVM" is for creating new VMs, not uploading images. "Add-AzImage" does not exist. the correct command is "New-AzImage". "Add-AzImageDataDisk" Adds a data disk to an image object. "Add-AzVhd" seems to be the correct option, sing the it "Uploads a virtual hard disk from an on-premises machine to Azure (managed disk or blob)." (https://docs.microsoft.com/en-us/powershell/module/az.compute/add-azvhd?view=azps-8.3.0)

   Adapted from community discussion by NaoVaz · 2024-09-20 · 79 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 1 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

   1. N

      NaoVaz

      2024-09-20

      Selected B79 upvotes

      "New-AzVM" is for creating new VMs, not uploading images. "Add-AzImage" does not exist. the correct command is "New-AzImage". "Add-AzImageDataDisk" Adds a data disk to an image object. "Add-AzVhd" seems to be the correct option, sing the it "Uploads a virtual hard disk from an on-premises machine to Azure (managed disk or blob)." (https://docs.microsoft.com/en-us/powershell/module/az.compute/add-azvhd?view=azps-8.3.0)

   2. C

      Chi1987

      2021-09-28

      52 upvotes

      Correct answer. Example for how you do this: Add-AzVhd -ResourceGroupName $resourceGroup -Destination $urlOfUploadedImageVhd ` -LocalFilePath $localPath

   3. D

      Dankho

      2024-10-19

      25 upvotes

      how does a person from 1 year, 6 months ago reply to someone from 4 weeks, 1 day ago. Riddle me that...

   4. J

      jersonmartinez

      2023-04-24

      13 upvotes

      It command does not exists. It only exist `New-AzImage`. That's different.

2. Question 2 of 25

   Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company has a Microsoft SQL Server Always On availability group configured on their Azure virtual machines (VMs). You need to configure an Azure internal load balancer as a listener for the availability group. Solution: You enable Floating IP. Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Correct answer: A

   How others answered

   • A84%
   • B16%

   Explanation

   The load balancing rules configure how the load balancer routes traffic to the SQL Server instances. For this load balancer, you enable direct server return because only one of the two SQL Server instances owns the availability group listener resource at a time. >> Floating IP (direct server return) Enabled

   Adapted from community discussion by Bloodwar · 2021-07-18 · 72 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 2 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

   1. B

      Bloodwar

      2021-07-18

      72 upvotes

      The load balancing rules configure how the load balancer routes traffic to the SQL Server instances. For this load balancer, you enable direct server return because only one of the two SQL Server instances owns the availability group listener resource at a time. >> Floating IP (direct server return) Enabled

   2. R

      ricardona

      2023-02-24

      31 upvotes

      Yes, enabling Floating IP on the Azure internal load balancer as a listener for the availability group can meet the goal. By enabling Floating IP, the load balancer will use a floating IP address as the source IP address for outbound flows from the backend pool. This will ensure that the IP address used by the backend pool remains the same even if a VM is restarted or replaced, which is important for maintaining the listener for the availability group.

   3. E

      edengoforit

      2022-01-31

      12 upvotes

      If you want to reuse the backend port across multiple rules, you must enable Floating IP in the rule definition. When Floating IP is enabled, Azure changes the IP address mapping to the Frontend IP address of the Load Balancer frontend instead of backend instance's IP. Without Floating IP, Azure exposes the VM instances' IP. Enabling Floating IP changes the IP address mapping to the Frontend IP of the load Balancer to allow for additional flexibility. https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-floating-ip

   4. T

      Timock

      2021-11-08

      8 upvotes

      This is the why: Some application scenarios prefer or require the same port to be used by multiple application instances on a single VM in the backend pool. Common examples of port reuse include: clustering for high availability/network virtual appliances/exposing multiple TLS endpoints without re-encryption. If you want to reuse the backend port across multiple rules, you must enable Floating IP in the rule definition. https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-floating-ip The is the how: The link below is a step by step guide for creating an Azure internal load blancer as a listener for an availability group... "Backend Port 1433. This value is ignored because this rule uses Floating IP (direct server return)." https://docs.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/availability-group-load-balancer-portal-configure

3. Question 3 of 25

   Select 5

   Your company has an Azure subscription that includes a Recovery Services vault. You want to use Azure Backup to schedule a backup of your company's virtual machines (VMs) to the Recovery Services vault. Which of the following VMs can you back up? Choose all that apply.

   • AVMs that run Windows 10.
   • BVMs that run Windows Server 2012 or higher.
   • CVMs that have NOT been shut down.
   • DVMs that run Debian 8.2+.
   • EVMs that have been shut down.

   Show answer

   Correct answer: A, B, C, D, E

   How others answered

   • ABCDE57%
   • BDE24%

   Only 57% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Answer : ABCDE Azure Backup supports backup of 64-bit Windows server operating system from Windows Server 2008. Azure Backup supports backup of 64-bit Windows 10 operating system. Azure Backup supports backup of 64-bit Debian operating system from Debian 7.9+. Azure Backup supports backup of VM that are shutdown or offline. Reference: https://docs.microsoft.com/en-us/azure/backup/backup-support-matrix-iaas

   Adapted from community discussion by RVivek · 2024-10-26 · 11 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • azure.microsoft.com documentation
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 3 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

   1. R

      RVivek

      2024-10-26

      Selected A, B, C, D, E11 upvotes

      Answer : ABCDE Azure Backup supports backup of 64-bit Windows server operating system from Windows Server 2008. Azure Backup supports backup of 64-bit Windows 10 operating system. Azure Backup supports backup of 64-bit Debian operating system from Debian 7.9+. Azure Backup supports backup of VM that are shutdown or offline. Reference: https://docs.microsoft.com/en-us/azure/backup/backup-support-matrix-iaas

   2. S

      sca88

      2024-11-03

      7 upvotes

      Copilot it's very helpfull but don't think that is God. Often it's wrong. Windows 10 is supported https://learn.microsoft.com/en-us/azure/backup/backup-support-matrix-iaas I use copilot too, and it give me the same response that it gave to you. I reported the error and he answer as follow: " You’re right, and I apologize for the confusion. According to the Azure Backup support matrix, Azure Backup does support backing up VMs running Windows 10. Here are the correct options: A. VMs that run Windows 10: Supported. B. VMs that run Windows Server 2012 or higher: Supported. D. VMs that run Debian 8.2+: Supported. E. VMs that have been shut down: Supported, with the backup being crash-consistent. Both running and shut down VMs can be backed up, so Option C is also technically correct, but it doesn’t add new information since both states are supported. Thank you for pointing that out! If you have any more questions or need further clarification, feel free to ask"

   3. M

      maxustermann

      2023-07-22

      4 upvotes

      Wrong, given answer is correct: https://learn.microsoft.com/en-us/azure/backup/backup-azure-backup-faq#what-operating-systems-are-supported-for-backup- "For Azure VM Linux backups, Azure Backup supports the list of distributions endorsed by Azure, except Core OS Linux and 32-bit operating system. Other bring-your-own Linux distributions might work as long as the VM agent is available on the VM, and support for Python exists."

   4. N

      NaoVaz

      2022-09-12

      Selected A, B, C, D, E4 upvotes

      All Operating Systems are supported and it does not matter if the VM is running or not.

4. Question 4 of 25

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Active Directory (Azure AD) tenant named contoso.com. You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: From Azure AD in the Azure portal, you use the Bulk create user operation. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Correct answer: B

   How others answered

   • B93%

   Explanation

   "Bulk Create" is for new Azure AD Users. For Guests: - Use "Bulk invite users" to prepare a comma-separated value (.csv) file with the user information and invitation preferences - Upload the .csv file to Azure AD - Verify the users were added to the directory

   Adapted from community discussion by gabyrever · 2022-09-17 · 51 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 4 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

   1. G

      gabyrever

      2022-09-17

      Selected B51 upvotes

      "Bulk Create" is for new Azure AD Users. For Guests: - Use "Bulk invite users" to prepare a comma-separated value (.csv) file with the user information and invitation preferences - Upload the .csv file to Azure AD - Verify the users were added to the directory

   2. K

      km_2022

      2023-01-21

      7 upvotes

      Answer is B - Bulk Invite would be the option not Bulk Create Login to Azure Active Directory Admin Center https://aad.portal.azure.com Click on “Users” >> Click on “New Guest User” from the toolbar >> Choose “Invite User” and then click on “I want to invite guest users in bulk” (You can also use “Bulk Invite” under “Bulk Activities” to invite multiple external users.)

   3. K

      KSoul

      2022-08-30

      Selected B5 upvotes

      "Bulk invite" is used for inviting multiple guest users to the organization (Azure Ad) using CSv. file "Bulk Create" is used to add multiple users to the azure AD using csv. file

   4. O

      OrwellMB

      2022-11-02

      5 upvotes

      Your link says explicitly: Select Bulk operations > Bulk invite. The answer in the question is: Bulk CREATE user. If you look at the screenshot in the link (https://learn.microsoft.com/en-us/azure/active-directory/external-identities/media/tutorial-bulk-invite/bulk-invite-button.png) you see that not the Bulk CREATE is selected. -> B

5. Question 5 of 25

   Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements. Your company's Azure solution makes use of Multi-Factor Authentication for when users are not in the office. The Per Authentication option has been configured as the usage model. After the acquisition of a smaller business and the addition of the new staff to Azure Active Directory (Azure AD) obtains a different company and adding the new employees to Azure Active Directory (Azure AD), you are informed that these employees should also make use of Multi-Factor Authentication. To achieve this, the Per Enabled User setting must be set for the usage model. Solution: You create a new Multi-Factor Authentication provider with a backup from the existing Multi-Factor Authentication provider data. Does the solution meet the goal?

   • AYes
   • BNo

   Show answer

   Correct answer: B

   How others answered

   • B87%

   Explanation

   Effective September 1st, 2018 new auth providers may no longer be created. Existing auth providers may continue to be used and updated, but migration is no longer possible. Multi-factor authentication will continue to be available as a feature in Azure AD Premium licenses. https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-authprovider

   Adapted from community discussion by Souban07 · 2023-07-07 · 4 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 5 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

   1. W

      walkaway

      2023-01-26

      Selected B14 upvotes

      It is a big NO now in 2023. If you still see this question, never say YES.

   2. G

      ggogel

      2023-11-20

      Selected B7 upvotes

      A would have been the correct answer, but as of 1st September 2018 MFA Providers are discontinued and can not be created anymore. As of today, the only way to use MFA is if the user has a license assigned that includes the MFA feature.

   3. C

      Cool_Z

      2022-10-14

      Selected B7 upvotes

      Effective September 1st, 2018 new auth providers may no longer be created. So option B(No) is the correct answer.

   4. A

      asuarez

      2024-09-30

      Selected B6 upvotes

      Creating a new Multi-Factor Authentication provider with a backup from the existing provider data does not change the usage model from Per Authentication to Per Enabled User. You would need to specifically change the Multi-Factor Authentication settings to the Per Enabled User model to meet the requirements.

6. Question 6 of 25

   You have an Azure subscription named Subscription1. Subscription1 contains the resource groups in the following table.

   

   RG1 has a web app named WebApp1. WebApp1 is located in West Europe. You move WebApp1 to RG2. What is the effect of the move?

   • AThe App Service plan for WebApp1 remains in West Europe. Policy2 applies to WebApp1.
   • BThe App Service plan for WebApp1 moves to North Europe. Policy2 applies to WebApp1.
   • CThe App Service plan for WebApp1 remains in West Europe. Policy1 applies to WebApp1.
   • DThe App Service plan for WebApp1 moves to North Europe. Policy1 applies to WebApp1.

   Show answer

   Correct answer: A

   How others answered

   • A86%

   Explanation

   Correct Answer: A You can only move a resource to a Resource Group or Subscription, but the location stays the same. When you move WebApp1 to RG2, the resource will be restricted based on the policy of the new Resource Group (Policy2).

   Adapted from community discussion by mlantonis · 2021-05-17 · 132 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 6 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

   1. M

      mlantonis

      2021-05-17

      132 upvotes

      Correct Answer: A You can only move a resource to a Resource Group or Subscription, but the location stays the same. When you move WebApp1 to RG2, the resource will be restricted based on the policy of the new Resource Group (Policy2).

   2. N

      NaoVaz

      2022-09-13

      Selected A22 upvotes

      A) "The App Service Plan for WebApp1 remains in West Europe. Policy2 applies to WebApp1". When moving resources between Resource Groups, you change the Resource Group only and not the resource Location\Region. "Moving a resource only moves it to a new resource group or subscription. It doesn't change the location of the resource." - https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription But because the WebApp1 now is in a new Resource Group, now the policies that are scoped to the new RG will be applied to the WebApp.

   3. V

      Veks

      2022-04-22

      20 upvotes

      I agree with the answer (A is correct), but your comments don't seem correct. you are moving app from one region to another. Procedure is listed below: - Create a back up of the source app. - Create an app in a new App Service plan, in the target region. - Restore the back up in the target app - If you use a custom domain, bind it preemptively to the target app with 'awverify'. and enable the domain in the target app. - Configure everything else in your target app to be the same as the source app and verify your configuration. - When you're ready for the custom domain to point to the target app, remap the domain name. Here it states that you have to create new AppService plan in new region. So old plan stays where it is. Reference: https://docs.microsoft.com/en-us/azure/app-service/manage-move-across-regions

   4. F

      FabioVi

      2021-12-23

      11 upvotes

      Tested in a lab. I moved an App Service Plan to a RG that was in a different region. The move went OK, and the App Service Plan retained its original region. So, A is correct.

7. Question 7 of 25

   Select 2

   You have a Microsoft 365 tenant and an Azure Active Directory (Azure AD) tenant named contoso.com. You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft SharePoint document library named Library1. You need to create groups for the users. The solution must ensure that the groups are deleted automatically after 180 days. Which two groups should you create? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • Aa Microsoft 365 group that uses the Assigned membership type
   • Ba Security group that uses the Assigned membership type
   • Ca Microsoft 365 group that uses the Dynamic User membership type
   • Da Security group that uses the Dynamic User membership type
   • Ea Security group that uses the Dynamic Device membership type

   Show answer

   Correct answer: A, C

   How others answered

   • AC90%

   Explanation

   This is a different question. The reason why A and C is correct is because the answer specifies that the group needs automatic deletion and that's only supported by Microsoft 365 groups.

   Adapted from community discussion by MrBlueSky · 2023-03-02 · 30 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 7 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

   1. K

      kennynelcon

      2022-05-20

      Selected A, C58 upvotes

      Correct Answer: A and C Only O365 groups support automatic deletion after 180 days.

   2. M

      MrBlueSky

      2023-03-02

      30 upvotes

      This is a different question. The reason why A and C is correct is because the answer specifies that the group needs automatic deletion and that's only supported by Microsoft 365 groups.

   3. L

      Lazylinux

      2022-06-16

      17 upvotes

      i Agree A&C Security groups are used to give group members access to applications, resources and assign licenses. Group members can be users, devices, service principals, and other groups. Microsoft 365 groups are used for collaboration, giving members access to a shared mailbox, calendar, files, SharePoint site, and so on. Group members can only be users. With the increase in usage of Microsoft 365 groups and Microsoft Teams, administrators and users need a way to clean up unused groups and teams. A Microsoft 365 groups expiration policy can help remove inactive groups from the system and make things cleaner. When a group expires, all of its associated services (the mailbox, Planner, SharePoint site, team, etc.) are also deleted. When a group expires it is "soft-deleted" which means it can still be recovered for up to 30 days.

   4. C

      ConanBarb

      2024-09-20

      9 upvotes

      Sorry y'all AC:s, but you're wrong Correct, according to Microsoft own sample exam questions is: CD Microsoft exam question answers: "a security group that uses the dynamic membership type" "a Microsoft 365 group that uses the dynamic membership type" Corresponds to A. a Microsoft 365 group that uses the Assigned membership type B. a Security group that uses the Assigned membership type x C. a Microsoft 365 group that uses the Dynamic User membership type x D. a Security group that uses the Dynamic User membership type E. a Security group that uses the Dynamic Device membership type "Rationale: Groups that use dynamic membership rules reduce the overhead of access management by providing attribute-based membership and access to resources. Based on membership rules the membership, and resulting access, can be granted and removed automatically." https://learn.microsoft.com/en-us/certifications/resources/az-104-sample-questions

8. Question 8 of 25

   You have an Azure subscription linked to an Azure Active Directory tenant. The tenant includes a user account named User1. You need to ensure that User1 can assign a policy to the tenant root management group. What should you do?

   • AAssign the Owner role for the Azure Subscription to User1, and then modify the default conditional access policies.
   • BAssign the Owner role for the Azure subscription to User1, and then instruct User1 to configure access management for Azure resources.
   • CAssign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources.
   • DCreate a new management group and delegate User1 as the owner of the new management group.

   Show answer

   Correct answer: C

   How others answered

   • C85%

   Explanation

   Correct Answer: C No one is given default access to the root management group. Azure AD Global Administrators are the only users that can elevate themselves to gain access. Once they have access to the root management group, the global administrators can assign any Azure role to other users to manage it.

   Adapted from community discussion by mlantonis · 2021-05-17 · 321 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 8 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

   1. M

      mlantonis

      2021-05-17

      321 upvotes

      Correct Answer: C No one is given default access to the root management group. Azure AD Global Administrators are the only users that can elevate themselves to gain access. Once they have access to the root management group, the global administrators can assign any Azure role to other users to manage it.

   2. R

      Rajash

      2021-04-30

      64 upvotes

      Ans C: No one is given default access to the root management group. Azure AD Global Administrators are the only users that can elevate themselves to gain access. Once they have access to the root management group, the global administrators can assign any Azure role to other users to manage it.

   3. N

      Negrinho

      2021-05-01

      49 upvotes

      No, the correctly answer is B. C is to control Azure AD (Global Administrators), not to control Management group. If you need to control Management group, use: Access control (IAM)> Add role assignment> Role> Owner or Contributor (in this case you will use Owner). Don't exist "Global Administrators" inside of Access control (IAM)> Add role assignment. The link between Azure AD and Management group will allow that you choose an user of your Azure AD, but not will inherit Azure AD role.

   4. N

      Netspud

      2022-01-17

      19 upvotes

      After looking at this for a while (cos it was doing my head in), the important bit would be for B we are assigning Owner for the Subscription, It needs to be Owner for the Tenant Root. (which is said but was not instantly clear to me). So it has to be (C) Global Admin which will the elevate it's self to Root owner. Another of those questions you really have to pick apart. So C is the correct answer.

9. Question 9 of 25

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription. Solution: You assign the Network Contributor role at the subscription level to Admin1. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Correct answer: A

   How others answered

   • A56%
   • B44%

   Only 56% agreed on this answer — treat it as contested rather than settled.

   Explanation

   Correct Answer: A - Yes Your account must have any one of the following Azure roles at the subscription scope: Owner, Contributor, Reader, or Network Contributor. Network Contributor role - Lets you manage networks, but not access to them. Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. Reference: https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics#user-access-requirements https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

   Adapted from community discussion by mlantonis · 2021-05-17 · 140 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

   Supporting references

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   View community discussion4

   Candidate context

   Question 9 discussion

   These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

   1. M

      mlantonis

      2021-05-17

      140 upvotes

      Correct Answer: A - Yes Your account must have any one of the following Azure roles at the subscription scope: Owner, Contributor, Reader, or Network Contributor. Network Contributor role - Lets you manage networks, but not access to them. Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. Reference: https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics#user-access-requirements https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

   2. L

      lodo

      2020-12-12

      8 upvotes

      At the link you provided is stated: Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, reader, or network contributor. So answer is Yes

   3. E

      Exilic

      2024-09-20

      Selected A5 upvotes

      ChatGPT B. No Assigning the Network Contributor role to Admin1 at the subscription level does not meet the goal of enabling Traffic Analytics for the Azure subscription. The Network Contributor role provides permissions to manage network resources, such as virtual networks and network interfaces, but it does not grant the necessary permissions to enable Traffic Analytics. To enable Traffic Analytics for an Azure subscription, you need to assign the Log Analytics Contributor or the Network Watcher Contributor role to Admin1 at the subscription level. These roles provide the necessary permissions to configure and enable Traffic Analytics.

   4. R

      rsharma007

      2021-09-18

      7 upvotes

      they are two different permissions- a NC role can manage the resources, but he/she can't grant access to those resources to anyone else. That can be done by roles with 'access' permissions such as 'owner'

10. Question 10 of 25

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription. Solution: You assign the Owner role at the subscription level to Admin1. Does this meet the goal?

    • AYes
    • BNo

    Show answer

    Correct answer: A

    How others answered

    • A81%
    • B19%

    Explanation

    Correct Answer: A Your account must have any one of the following Azure roles at the subscription scope: Owner, Contributor, Reader, or Network Contributor. Network Contributor role - Lets you manage networks, but not access to them. Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. Reference: https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics#user-access-requirements https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

    Adapted from community discussion by mlantonis · 2021-05-17 · 73 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 10 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

    1. M

       mlantonis

       2021-05-17

       73 upvotes

       Correct Answer: A Your account must have any one of the following Azure roles at the subscription scope: Owner, Contributor, Reader, or Network Contributor. Network Contributor role - Lets you manage networks, but not access to them. Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. Reference: https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics#user-access-requirements https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

    2. D

       DrMiyu

       2022-06-17

       5 upvotes

       Agree that YES the Owner gives enough right to do it BUT it gives too much also. The purpose is to "assign the required role to enable Traffic Analytics". Not to more ... So I wouldn't give the owner ship ... This is tricky question, it should be removed from the exam as it can lead to miss configuration.

    3. [

       [Removed]

       2023-06-29

       Selected A3 upvotes

       https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles Grants full access to manage all resources, including the ability to assign roles in Azure RBAC.

    4. A

       Athul07

       2023-06-03

       2 upvotes

       A. Yes Assigning the Owner role at the subscription level to Admin1 meets the goal of enabling Traffic Analytics for an Azure subscription. The Owner role has full access to all resources within the subscription, including the ability to enable Traffic Analytics. By assigning the Owner role to Admin1 at the subscription level, Admin1 will have the necessary permissions and control to enable and configure Traffic Analytics for the Azure subscription. Therefore, the provided solution meets the goal.

11. Question 11 of 25

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription. Solution: You assign the Reader role at the subscription level to Admin1. Does this meet the goal?

    • AYes
    • BNo

    Show answer

    Correct answer: B

    How others answered

    • B81%
    • A19%

    Explanation

    Correct Answer: A - Yes Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, reader, or network contributor. Reader role - View all resources, but does not allow you to make any changes. Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. Reference: https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics#user-access-requirements https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

    Adapted from community discussion by mlantonis · 2021-05-17 · 98 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 11 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

    1. A

       asmodeus

       2020-12-02

       101 upvotes

       Traffic Analytics requires the following prerequisites: A Network Watcher enabled subscription. Network Security Group (NSG) flow logs enabled for the NSGs you want to monitor. An Azure Storage account, to store raw flow logs. An Azure Log Analytics workspace, with read and write access. Your account must meet one of the following to enable traffic analytics: Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, reader, or network contributor.

    2. M

       mlantonis

       2021-05-17

       98 upvotes

       Correct Answer: A - Yes Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, reader, or network contributor. Reader role - View all resources, but does not allow you to make any changes. Traffic Analytics is a cloud-based solution that provides visibility into user and application activity in cloud networks. Traffic analytics analyzes Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. Reference: https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics#user-access-requirements https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

    3. M

       mac_ani

       2023-05-02

       79 upvotes

       Answer is NO. Refer the following link: https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics-faq Your account must meet one of the following to enable traffic analytics: Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, or network contributor.

    4. R

       rodolfodc

       2023-05-03

       29 upvotes

       Answer is NO. Your account must meet one of the following to enable traffic analytics: Your account must have any one of the following Azure roles at the subscription scope: owner, contributor, or network contributor.

12. Question 12 of 25

    You have an Azure subscription that contains a resource group named TestRG. You use TestRG to validate an Azure deployment. TestRG contains the following resources:

    

    You need to delete TestRG. What should you do first?

    • AModify the backup configurations of VM1 and modify the resource lock type of VNET1
    • BRemove the resource lock from VNET1 and delete all data in Vault1
    • CTurn off VM1 and remove the resource lock from VNET1
    • DTurn off VM1 and delete all data in Vault1

    Show answer

    Correct answer: B

    How others answered

    • B67%
    • A22%

    Only 67% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Correct Answer: B When you delete a resource group, all of its resources are also deleted. Deleting a resource group deletes all of its template deployments and currently stored operations. As an administrator, you can lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources. The lock overrides any permissions the user might have. You can't delete a vault that contains backup data. Once backup data is deleted, it will go into the soft deleted state. So you have to remove the lock on order to delete the VNET and delete the backups in order to delete the vault. Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/delete-resource-group?tabs=azure-powershell https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources https://docs.microsoft.com/en-us/azure/backup/backup-azure-delete-vault#before-you-start

    Adapted from community discussion by mlantonis · 2021-05-17 · 307 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 12 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

    1. M

       mlantonis

       2021-05-17

       307 upvotes

       Correct Answer: B When you delete a resource group, all of its resources are also deleted. Deleting a resource group deletes all of its template deployments and currently stored operations. As an administrator, you can lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources. The lock overrides any permissions the user might have. You can't delete a vault that contains backup data. Once backup data is deleted, it will go into the soft deleted state. So you have to remove the lock on order to delete the VNET and delete the backups in order to delete the vault. Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/delete-resource-group?tabs=azure-powershell https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources https://docs.microsoft.com/en-us/azure/backup/backup-azure-delete-vault#before-you-start

    2. D

       Dips88

       2021-04-30

       127 upvotes

       Answer should be B. A recovery service vault can not deleted unless all its backups are deleted permanently. And along with that definitely resource lock has to be removed on vnet

    3. M

       Mazinger

       2024-09-20

       Selected B7 upvotes

       B. Remove the resource lock from VNET1 and delete all data in Vault1. Before you can delete TestRG, you must remove any dependencies that are associated with the resources in TestRG. In this scenario, VNET1 has a resource lock of type delete, which means it cannot be deleted until the resource lock is removed. Additionally, Vault1 contains backups of VM1, so you must delete all the data in Vault1 before deleting TestRG. To do this, you can follow these steps: 1. Navigate to the VNET1 resource in the Azure portal. 2. Under Settings, select Locks. 3. Select the delete lock for VNET1 and then click Delete. 4. Navigate to the Vault1 resource in the Azure portal. 5. Delete all the backup data associated with VM1. 6. After all backup data has been deleted, delete Vault1. 7. Once VNET1 and Vault1 are deleted, you can delete TestRG. By removing the resource lock from VNET1 and deleting all data in Vault1, you ensure that all dependencies associated with TestRG have been removed before deleting the resource group.

    4. M

       monus

       2021-10-01

       11 upvotes

       backup can be taken even if vm is powered off. so, I think the answer is A.

13. Question 13 of 25

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription. Solution: You assign the Traffic Manager Contributor role at the subscription level to Admin1. Does this meet the goal?

    • AYes
    • BNo

    Show answer

    Correct answer: B

    How others answered

    • B98%

    Explanation

    Q.36 Assign Network Contributor role at subscription level to Admin1  Yes Q.37 Assign Owner role at subscription level to Admin1  Yes Q.38 Assign Reader role at subscription level to Admin1  Yes Q.52 Assign Traffic Manager Contributor role at subscription level to Admin1  No

    Adapted from community discussion by GoldenFox · 2021-12-09 · 260 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 13 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

    1. G

       GoldenFox

       2021-12-09

       260 upvotes

       Q.36 Assign Network Contributor role at subscription level to Admin1  Yes Q.37 Assign Owner role at subscription level to Admin1  Yes Q.38 Assign Reader role at subscription level to Admin1  Yes Q.52 Assign Traffic Manager Contributor role at subscription level to Admin1  No

    2. F

       flyingcolours87

       2023-06-21

       31 upvotes

       Reader role is not applicable anymore. Only correct answers are 'owner, contributor, or network contributor'.

    3. M

       Marski

       2022-01-27

       27 upvotes

       Clever cheat question by MS. You need to know. Got to know. These are traps. I dont like these anyway.

    4. D

       DarkAngel76

       2022-03-11

       19 upvotes

       It looks like there's an error in that Microsoft Docs page as per issue published on GitHub at https://github.com/MicrosoftDocs/azure-docs/issues/77499.

14. Question 14 of 25

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:

    

    User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com. You need to create new user accounts in external.contoso.onmicrosoft.com. Solution: You instruct User2 to create the user accounts. Does that meet the goal?

    • AYes
    • BNo

    Show answer

    Correct answer: B

    How others answered

    • B92%

    Explanation

    Correct, but the explanation is not. User1 is global admin of contoso.onmicrosoft.com. As he created the new tenant called external.contoso.onmicrosoft.com, he will be the OWNER. Check the scope not just the role, tho.

    Adapted from community discussion by aaa112 · 2020-12-21 · 98 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 14 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

    1. A

       aaa112

       2020-12-21

       98 upvotes

       Correct, but the explanation is not. User1 is global admin of contoso.onmicrosoft.com. As he created the new tenant called external.contoso.onmicrosoft.com, he will be the OWNER. Check the scope not just the role, tho.

    2. M

       mlantonis

       2021-05-18

       84 upvotes

       Correct Answer: A - Yes Only User1 has access to the new Tenant, because User1 created the Tenant and became automatically Global Admin.

    3. C

       CommanderBigMac

       2023-02-08

       53 upvotes

       Putting this here, hope it helps someone. Question was reworded at some point, changing the answer to B: No. https://learn.microsoft.com/en-us/answers/questions/1163804/need-clear-understanding-on-the-permissions-global

    4. R

       r3tr0penguin

       2021-05-27

       31 upvotes

       Then if User2 want to create new user on external.contoso.onmicrosoft.com , he can't right ? because User2 is not the one who create tenant external.contoso.onmicrosoft.com that mean User 2 don't be OWNER

15. Question 15 of 25

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:

    

    User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com. You need to create new user accounts in external.contoso.onmicrosoft.com. Solution: You instruct User3 to create the user accounts. Does that meet the goal?

    • AYes
    • BNo

    Show answer

    Correct answer: B

    How others answered

    • B83%
    • A17%

    Explanation

    The answer is No! I tested this. 1. I created a new Tenant contosogmpp. 2. Added 2 users, User1 and User 2 in this tenant and gave them global privileges 3. I logged through User1 and created a new tenant called externalcontossgmpp 4. Now when I logged in through User2 and try to switch tenants, the new tenant externalcontossgmpp is not available at all for User2. Hence User1 needs to invite User2 first

    Adapted from community discussion by pgmpp · 2022-08-23 · 62 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 15 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

    1. P

       pgmpp

       2022-08-23

       62 upvotes

       The answer is No! I tested this. 1. I created a new Tenant contosogmpp. 2. Added 2 users, User1 and User 2 in this tenant and gave them global privileges 3. I logged through User1 and created a new tenant called externalcontossgmpp 4. Now when I logged in through User2 and try to switch tenants, the new tenant externalcontossgmpp is not available at all for User2. Hence User1 needs to invite User2 first

    2. L

       ltkiller

       2022-05-30

       12 upvotes

       B:No, when you create a new tenant, the creator is the only global admin and owner, he must first give access to others to allow anything. https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-access-create-new-tenant#your-user-account-in-the-new-tenant

    3. N

       NinjaSchoolProfessor

       2022-07-06

       Selected B7 upvotes

       To add or delete users you must be a User administrator or Global administrator. This question doesn't provide enough information as there isn't enough information to determine if User 2 is a GA in the same tenant or another tenant. When information like this is not provided, assume they cannot. (That said, vague questions like this shouldn't be on the exam)

    4. L

       Lazylinux

       2022-06-22

       Selected B2 upvotes

       I Luv Honey Because it is B..for sure without doubt B Global Administrator Users with this role have access to all administrative features in Azure Active Directory, as well as services that use Azure Active Directory identities like the Microsoft 365 Defender portal, the Microsoft Purview compliance portal, Exchange Online, SharePoint Online, and Skype for Business Online. Furthermore, Global Administrators can elevate their access to manage all Azure subscriptions and management groups. This allows Global Administrators to get full access to all Azure resources using the respective Azure AD Tenant. The person who signs up for the Azure AD organization becomes a Global Administrator. There can be more than one Global Administrator at your company. Global Administrators can reset the password for any user and all other administrators. The par you need to pay attention too is "Administrators to get full access to all Azure resources using the respective Azure AD" the WORD RESPECTIVE..meaning the AD tenant in which the global admin belong and hence USER 2 can in no way access yet create any AD resource unless been delegated by USER1 some form of access

16. Question 16 of 25

    Select 2

    You have an Azure Subscription that contains a storage account named storageacct1234 and two users named User1 and User2. You assign User1 the roles shown in the following exhibit.

    

    Which two actions can User1 perform? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

    • AAssign roles to User2 for storageacct1234.
    • BUpload blob data to storageacct1234.
    • CModify the firewall of storageacct1234.
    • DView blob data in storageacct1234.
    • EView file shares in storageacct1234.

    Show answer

    Correct answer: B, D

    How others answered

    • BD99%

    Explanation

    For example, if you assign the Storage Blob Data Contributor role to user Mary at the level of a container named sample-container, then Mary is granted read, write, and delete access to all of the blobs in that container. However, if Mary wants to view a blob in the Azure portal, then the Storage Blob Data Contributor role by itself will not provide sufficient permissions to navigate through the portal to the blob in order to view it. The additional permissions are required to navigate through the portal and view the other resources that are visible there.

    Adapted from community discussion by pmsiva · 2022-10-14 · 18 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 16 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

    1. P

       pmsiva

       2022-10-14

       18 upvotes

       For example, if you assign the Storage Blob Data Contributor role to user Mary at the level of a container named sample-container, then Mary is granted read, write, and delete access to all of the blobs in that container. However, if Mary wants to view a blob in the Azure portal, then the Storage Blob Data Contributor role by itself will not provide sufficient permissions to navigate through the portal to the blob in order to view it. The additional permissions are required to navigate through the portal and view the other resources that are visible there.

    2. J

       jp_mcgee

       2022-11-17

       10 upvotes

       B&D is Correct. Tried this in the Lab A. User1 cannot add role assignment (disabled) B. Worked - User1 can upload blob data C. Nope D. Worked - User1 can view blob data E. Error - The client 'user1@..... does not have authorization to perform action 'Microsoft.Storage/storageAccounts/listKeys/action' over scope '/subscriptions/...../resourceGroups/rg1/providers/Microsoft.Storage/storageAccounts/storage1234

    3. B

       Ben756

       2023-09-14

       9 upvotes

       E is not the answer. The Reader role only grants User1 the permission to view the properties and metadata of the storage account, not the data inside it.

    4. D

       Dan_The_Man1

       2022-11-20

       8 upvotes

       For those thinking E - NO. Blob Storage does not support "File Shares". Azure Files/shares supports File Shares. So E is wrong.

17. Question 17 of 25

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Active Directory (Azure AD) tenant named contoso.com. You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: From Azure AD in the Azure portal, you use the Bulk invite users operation. Does this meet the goal?

    • AYes
    • BNo

    Show answer

    Correct answer: B

    How others answered

    • B73%
    • A27%

    Only 73% agreed on this answer — treat it as contested rather than settled.

    Explanation

    The Answer supplied is correct, it is No. Reason: The question states "You have a CSV file that contains the names and email addresses of 500 external users." This implies that the required fields (Email and Redirection URL)are missing from the .csv file. Here are the csv field pre-requisites that are needed for bulk upload of external users: https://learn.microsoft.com/en-us/azure/active-directory/external-identities/tutorial-bulk-invite#prerequisites

    Adapted from community discussion by Georgego · 2023-01-17 · 71 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 17 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

    1. G

       Georgego

       2023-01-17

       Selected B71 upvotes

       The Answer supplied is correct, it is No. Reason: The question states "You have a CSV file that contains the names and email addresses of 500 external users." This implies that the required fields (Email and Redirection URL)are missing from the .csv file. Here are the csv field pre-requisites that are needed for bulk upload of external users: https://learn.microsoft.com/en-us/azure/active-directory/external-identities/tutorial-bulk-invite#prerequisites

    2. S

       shadad

       2023-03-02

       18 upvotes

       He is not talking about the idea of using the Bulk, its the CSV file that not containing the right requirements for this task! you need the Email + Redirection URL so you can use it with Bulk invite.......not the Email + names !! This Question mentioned on many versions. pay attention to the words.

    3. N

       ncseffai

       2023-10-08

       Selected B10 upvotes

       I tried it on my azure subscription. If you go to Entra/Users/Bulk operations/invite users, you can download a template csv. The CSV contains the redirect URL header. When I deleted the redirectURL value and uploaded the CSV. It gave the following error messgage: The csv file you uploaded is not valid. Please verify operation type and correct csv file. Line 3 is missing a property required for user invite: Redirection url [inviteRedirectURL] Required When I deleted the whole redirectURL header/column then it have the following error: CSV file missing required header: inviteRedirectURL

    4. S

       SindhuM

       2023-03-20

       8 upvotes

       When u upload the csv without redirection URL "The csv file you uploaded is not valid. Please verify operation type and correct csv file. Line 3 is missing a property required for user invite: Redirection url [inviteRedirectURL] Required"

18. Question 18 of 25

    You have an Azure subscription that contains the resources shown in the following table.

    

    You need to assign User1 the Storage File Data SMB Share Contributor role for share1. What should you do first?

    • AEnable identity-based data access for the file shares in storage1.
    • BModify the security profile for the file shares in storage1.
    • CSelect Default to Azure Active Directory authorization in the Azure portal for storage1.
    • DConfigure Access control (IAM) for share1.

    Show answer

    Correct answer: D

    How others answered

    • D52%
    • A47%

    Only 52% agreed on this answer — treat it as contested rather than settled.

    Explanation

    It should be A, I just created a storage account, then created a file share, went to IAM, and it says : To give individual accounts access to the file share (Kerberos), enable identity-based authentication for the storage account.

    Adapted from community discussion by macrawat · 2023-03-15 · 119 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 18 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

    1. M

       macrawat

       2023-03-15

       119 upvotes

       It should be A, I just created a storage account, then created a file share, went to IAM, and it says : To give individual accounts access to the file share (Kerberos), enable identity-based authentication for the storage account.

    2. A

       AnonFox

       2023-05-17

       14 upvotes

       Stop using ChatGPT for these questions. "As an AI language model, my training is based on data up until September 2021." You work in IT, for God's sake.. Stay up to date!!

    3. W

       WreckIT

       2023-03-11

       Selected D7 upvotes

       D. Configure Access control (IAM) for share1. To assign an Azure role to an Azure AD identity, using the Azure portal, follow these steps: In the Azure portal, go to your file share, or create a file share. Select Access Control (IAM). Select Add a role assignment In the Add role assignment blade, select the appropriate built-in role from the Role list. Storage File Data SMB Share Reader Storage File Data SMB Share Contributor Storage File Data SMB Share Elevated Contributor Leave Assign access to at the default setting: Azure AD user, group, or service principal. Select the target Azure AD identity by name or email address. The selected Azure AD identity must be a hybrid identity and cannot be a cloud only identity. This means that the same identity is also represented in AD DS. Select Save to complete the role assignment operation. https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-assign-permissions?tabs=azure-portal

    4. Y

       yettie79

       2023-04-04

       10 upvotes

       A is correct I am getting the same message when I go to IAM on File Share. 'To give individual accounts access to the file share (Kerberos), enable identity-based authentication for the storage account'

19. Question 19 of 25

    You have an Azure subscription named AZPT1 that contains the resources shown in the following table:

    

    You create a new Azure subscription named AZPT2. You need to identify which resources can be moved to AZPT2. Which resources should you identify?

    • AVM1, storage1, VNET1, and VM1Managed only
    • BVM1 and VM1Managed only
    • CVM1, storage1, VNET1, VM1Managed, and RVAULT1
    • DRVAULT1 only

    Show answer

    Correct answer: C

    How others answered

    • C69%
    • A31%

    Only 69% agreed on this answer — treat it as contested rather than settled.

    Explanation

    Correct Answer: C All of them. Moving a resource only moves it to a new Resource Group or Subscription. It doesn't change the location of the resource. Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources#microsoftcompute https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources#microsoftnetwork https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources#microsoftstorage https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources#microsoftrecoveryservices

    Adapted from community discussion by mlantonis · 2024-09-20 · 174 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • azure.microsoft.com documentation
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 19 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

    1. M

       mlantonis

       2024-09-20

       174 upvotes

       Correct Answer: C All of them. Moving a resource only moves it to a new Resource Group or Subscription. It doesn't change the location of the resource. Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources#microsoftcompute https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources#microsoftnetwork https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources#microsoftstorage https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources#microsoftrecoveryservices

    2. K

       klexams

       2022-10-26

       18 upvotes

       Yep. In saying that, there are some limitations on some resources eg. standard LB resource cannot be moved.

    3. O

       OmarMac

       2024-09-20

       7 upvotes

       The answer is C. https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription Microsoft.Compute virtualMachines disks Microsoft.Network networkInterfaces publicIPAddresses networkSecurityGroups virtualNetworks Microsoft.Storage storageAccounts https://azure.microsoft.com/en-us/updates/azure-backup-support-to-move-recovery-services-vaults/#:~:text=A%20Recovery%20Services%20vault%20is,needs%20natively%20in%20the%20cloud.&text=Flexibility%20to%20move%20across%20subscriptions,across%20resource%20groups%20and%20subscriptions. You can move the vault across resource groups and subscriptions.

    4. K

       KC21

       2024-12-17

       Selected C4 upvotes

       You can move a Recovery Services Vault associated with a VM if you are also moving the VM itself to a different Azure subscription, but you need to ensure the VM is moved to the same subscription within the same tenant and you must also move the VM to the same subscription as the vault to maintain backup functionality. https://learn.microsoft.com/en-us/azure/backup/backup-azure-move-recovery-services-vault https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription

20. Question 20 of 25

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Active Directory (Azure AD) tenant named contoso.com. You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: You create a PowerShell script that runs the New-MgUser cmdlet for each external user. Does this meet the goal?

    • AYes
    • BNo

    Show answer

    Correct answer: B

    How others answered

    • B97%

    Explanation

    The `New-MgUser` cmdlet is part of the Microsoft Graph PowerShell module, and it's used for creating new users in Azure AD. However, when creating guest users (or B2B users), you typically would invite them rather than create them like regular members. The cmdlet you'd want to use for inviting external guest users is `New-AzureADMSInvitation` if you're using the AzureAD module or a related command in the Microsoft Graph module. Given the provided solution, the answer is: B. No

    Adapted from community discussion by iamchoy · 2023-09-15 · 22 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 20 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

    1. I

       iamchoy

       2023-09-15

       Selected B22 upvotes

       The `New-MgUser` cmdlet is part of the Microsoft Graph PowerShell module, and it's used for creating new users in Azure AD. However, when creating guest users (or B2B users), you typically would invite them rather than create them like regular members. The cmdlet you'd want to use for inviting external guest users is `New-AzureADMSInvitation` if you're using the AzureAD module or a related command in the Microsoft Graph module. Given the provided solution, the answer is: B. No

    2. R

       Rams786

       2023-09-22

       5 upvotes

       This question was on my exam on 22 Sep 2023. scored 900 i answered B

    3. T

       tech07

       2023-06-26

       Selected B3 upvotes

       New-AzureADMSInvitation or New-MgInvitation can be used to invite users, Not New-MgUser https://learn.microsoft.com/en-us/powershell/microsoftgraph/azuread-msoline-cmdlet-map?view=graph-powershell-1.0#users

    4. M

       MHguy

       2023-07-24

       3 upvotes

       new-mguser seems only for creating new users, not guest: https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.users/new-mguser?view=graph-powershell-1.0&preserve-view=true for the guest under microsoft graph is that one: New-MgInvitation https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.identity.signins/new-mginvitation?view=graph-powershell-1.0&preserve-view=true

21. Question 21 of 25

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Active Directory (Azure AD) tenant named contoso.com. You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: You create a PowerShell script that runs the New-MgInvitation cmdlet for each external user. Does this meet the goal?

    • AYes
    • BNo

    Show answer

    Correct answer: A

    How others answered

    • A85%
    • B15%

    Explanation

    The New-MgInvitation cmdlet is part of the Microsoft Graph PowerShell module. It's used to create an invitation to an external user. When the invited user redeems their invitation, a guest user is created in the directory. If you use a PowerShell script that loops through each external user in the CSV file and runs the New-MgInvitation cmdlet for each of them, it will send out invitation emails to each of those external users. Once an external user accepts the invitation, they'll be added to the Azure AD tenant as a guest user. So, using the New-MgInvitation cmdlet in a PowerShell script for each external user does meet the goal of creating a guest user account in contoso.com for each of the 500 external users. The answer is: A. Yes

    Adapted from community discussion by iamchoy · 2023-09-15 · 29 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 21 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

    1. I

       iamchoy

       2023-09-15

       Selected A29 upvotes

       The New-MgInvitation cmdlet is part of the Microsoft Graph PowerShell module. It's used to create an invitation to an external user. When the invited user redeems their invitation, a guest user is created in the directory. If you use a PowerShell script that loops through each external user in the CSV file and runs the New-MgInvitation cmdlet for each of them, it will send out invitation emails to each of those external users. Once an external user accepts the invitation, they'll be added to the Azure AD tenant as a guest user. So, using the New-MgInvitation cmdlet in a PowerShell script for each external user does meet the goal of creating a guest user account in contoso.com for each of the 500 external users. The answer is: A. Yes

    2. S

       Shark006

       2023-10-14

       16 upvotes

       The cmdlet New-MgInvitation requires the Redirection URL. "The URL the user should be redirected to once the invitation is redeemed. Required." Reference: https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.identity.signins/new-mginvitation?view=graph-powershell-1.0 So the answer is: B. No

    3. B

       Batiste2023

       2023-11-08

       8 upvotes

       As you run the command from a script, you can hardcode a redirection URL into it. A is correct, I would say!

    4. J

       jackill

       2023-06-25

       Selected A4 upvotes

       https://learn.microsoft.com/en-us/azure/active-directory/external-identities/bulk-invite-powershell#send-bulk-invitations describes exactly the same task required by this question, and the proposed script uses New-AzureADMSInvitation cmdlet. But page https://learn.microsoft.com/en-us/powershell/microsoftgraph/overview?view=graph-powershell-1.0 says: "Microsoft Graph PowerShell is the replacement for the Azure AD PowerShell and MSOnline modules and is recommended for interacting with Azure AD.". By searching the Microsoft Graph PowerShell command equivalent of New-AzureADMSInvitation in this page https://learn.microsoft.com/en-us/powershell/microsoftgraph/azuread-msoline-cmdlet-map?view=graph-powershell-1.0#users I find the command New-MgInvitation. So my reply to this question is "A" : yes.

22. Question 22 of 25

    You recently created a new Azure subscription that contains a user named Admin1. Admin1 attempts to deploy an Azure Marketplace resource by using an Azure Resource Manager template. Admin1 deploys the template by using Azure PowerShell and receives the following error message: `User failed validation to purchase resources. Error message: `Legal terms have not been accepted for this item on this subscription. To accept legal terms, please go to the Azure portal (http://go.microsoft.com/fwlink/?LinkId=534873) and configure programmatic deployment for the Marketplace item or create it there for the first time.` You need to ensure that Admin1 can deploy the Marketplace resource successfully. What should you do?

    • AFrom Azure PowerShell, run the Set-AzApiManagementSubscription cmdlet
    • BFrom the Azure portal, register the Microsoft.Marketplace resource provider
    • CFrom Azure PowerShell, run the Set-AzMarketplaceTerms cmdlet
    • DFrom the Azure portal, assign the Billing administrator role to Admin1

    Show answer

    Correct answer: C

    How others answered

    • C100%

    Explanation

    For anyone wondering how we are supposed to know this while studying for 104, it's hiding here under VM docs: https://learn.microsoft.com/en-us/azure/virtual-machines/windows/cli-ps-findimage

    Adapted from community discussion by Techfall · 2023-02-27 · 44 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 22 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

    1. M

       mlantonis

       2021-05-17

       271 upvotes

       Correct Answer: C Set-AzMarketplaceTerms -Publisher -Product -Name [-Accept] [-Terms ] [-DefaultProfile ] [-WhatIf] [-Confirm] [ ]

    2. T

       Techfall

       2023-02-27

       44 upvotes

       For anyone wondering how we are supposed to know this while studying for 104, it's hiding here under VM docs: https://learn.microsoft.com/en-us/azure/virtual-machines/windows/cli-ps-findimage

    3. F

       flash007

       2021-05-30

       11 upvotes

       Right away the billing administrator is not correct as the question mentions powershell so you are left with 3 choices. It doesn't mention API so again that one appears to be wrong too. Leaving just 2 choices B & C. again it is mentioning Powershell so answer B mentions the azure portal which is no powershell. So that leaves C because it does indeed mention powershell and mentions Marketplace which is used in the question too.

    4. M

       Mozbius_

       2022-01-23

       10 upvotes

       Again another question/topic NOT covered in Microsoft instructor-led Az-104 course!!! I can't believe that money got spent TWICE (I went twice to make sure that I understood everything) on that course just to see question not even covered in the online course!!!! Freakin' annoying!!! And then they have the audacity of saying to not visit "Brain dumps"...

23. Question 23 of 25

    You have an Azure subscription named Subscription1 that contains the storage accounts shown in the following table:

    

    You plan to use the Azure Import/Export service to export data from Subscription1. You need to identify which storage account can be used to export the data. What should you identify?

    • Astorage1
    • Bstorage2
    • Cstorage3
    • Dstorage4

    Show answer

    Correct answer: D

    How others answered

    • D95%

    Explanation

    Correct Answer: D Azure Import/Export service supports the following of storage accounts: ✑ Standard General Purpose v2 storage accounts (recommended for most scenarios) ✑ Blob Storage accounts ✑ General Purpose v1 storage accounts (both Classic or Azure Resource Manager deployments), Azure Import/Export service supports the following storage types: ✑ Import supports Azure Blob storage and Azure File storage ✑ Export supports Azure Blob storage. Azure Files not supported. Only storage4 can be exported. Reference: https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-requirements

    Adapted from community discussion by mlantonis · 2021-05-17 · 225 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 23 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

    1. M

       mlantonis

       2021-05-17

       225 upvotes

       Correct Answer: D Azure Import/Export service supports the following of storage accounts: ✑ Standard General Purpose v2 storage accounts (recommended for most scenarios) ✑ Blob Storage accounts ✑ General Purpose v1 storage accounts (both Classic or Azure Resource Manager deployments), Azure Import/Export service supports the following storage types: ✑ Import supports Azure Blob storage and Azure File storage ✑ Export supports Azure Blob storage. Azure Files not supported. Only storage4 can be exported. Reference: https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-requirements

    2. N

       nfett

       2021-04-30

       10 upvotes

       From the provided link. I assume since they table in the question notes "Storage" its being disregarded as an invalid option. Thus the answer blob appears to be correct. Standard General Purpose v2 storage accounts (recommended for most scenarios) Blob Storage accounts

    3. N

       NaoVaz

       2022-09-14

       Selected D6 upvotes

       D) "storage4" Azure Import/Export service supports the following types of storage accounts: - Standard General Purpose v2 storage accounts (recommended for most scenarios) - Blob Storage accounts - General Purpose v1 storage accounts (both Classic or Azure Resource Manager deployments) The following list of storage types is supported with Azure Import/Export service: - Import: * Azure Blob Storage -> Block blobs and Page blobs supported * Azure Files storage -> Files supported - Export: * Azure Blob Storage -> Block blobs, Page blobs, and Append blobs supported Reference: https://docs.microsoft.com/en-us/azure/import-export/storage-import-export-requirements#supported-storage-accounts

    4. C

       c75e123

       2024-12-20

       3 upvotes

       Correct: The following list of storage types is supported with Azure Import/Export service. Import Azure Blob Storage: Block blobs and Page blobs Azure Files storage: Files Export: Azure Blob Storage: Block blobs, Page blobs, and Append blobs Azure Files not supported Export from archive tier not supported https://learn.microsoft.com/en-us/azure/import-export/storage-import-export-requirements#supported-storage-types

24. Question 24 of 25

    You have an Azure subscription that contains the storage accounts shown in the following table.

    

    You need to identify which storage account can be converted to zone-redundant storage (ZRS) replication by requesting a live migration from Azure support. What should you identify?

    • Astorage1
    • Bstorage2
    • Cstorage3
    • Dstorage4

    Show answer

    Correct answer: B

    How others answered

    • B100%

    Explanation

    This is one of those ridiculous questions that would imply we should memorize the 50 different combinations of storage type, replication type, versus live migration support. Useless info to keep in your head, why would they test for this. The support rules around live migration support are horrendous. Bleh.

    Adapted from community discussion by diligent176 · 2020-12-25 · 314 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 24 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

    1. D

       diligent176

       2020-12-25

       314 upvotes

       This is one of those ridiculous questions that would imply we should memorize the 50 different combinations of storage type, replication type, versus live migration support. Useless info to keep in your head, why would they test for this. The support rules around live migration support are horrendous. Bleh.

    2. F

       fedztedz

       2020-12-19

       145 upvotes

       Answer is correct. It is storage2. The key to the answer in this question is "Live migration" - You can do Live migration to ZRS from LRS or GRS only. - Also this only applies on General Purpose v2 storage.

    3. B

       balflearchen

       2021-01-11

       65 upvotes

       Complain here is useless. And from your point of view, all certificate exams should be ridiculous. Back to the question, answer B is correct. "Live migration is supported only for storage accounts that use LRS or GRS replication. If your account uses RA-GRS, then you need to first change your account's replication type to either LRS or GRS before proceeding. This intermediary step removes the secondary read-only endpoint provided by RA-GRS before migration." "ZRS supports general-purpose v2 accounts only"

    4. J

       JohnnyChimpo

       2023-01-24

       57 upvotes

       This is why I use brain dumps. Memorizing every available feature in different sku's for all resources is completely pointless. In a real life scenario anyone would just google this information or refer to Microsoft documentation. Microsoft puts too much emphasis on this. Instead they should focus more on users understanding the core concepts and how they apply to live scenarios.

25. Question 25 of 25

    Select 2

    You have an Azure subscription that contains a storage account named account1. You plan to upload the disk files of a virtual machine to account1 from your on-premises network. The on-premises network uses a public IP address space of 131.107.1.0/24. You plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be attached to a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24. You need to configure account1 to meet the following requirements: ✑ Ensure that you can upload the disk files to account1. ✑ Ensure that you can attach the disks to VM1. ✑ Prevent all other access to account1. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

    • AFrom the Networking blade of account1, select Selected networks.
    • BFrom the Networking blade of account1, select Allow trusted Microsoft services to access this storage account.
    • CFrom the Networking blade of account1, add the 131.107.1.0/24 IP address range.
    • DFrom the Networking blade of account1, add VNet1.
    • EFrom the Service endpoints blade of VNet1, add a service endpoint.

    Show answer

    Correct answer: A, C

    How others answered

    • AC65%
    • CD24%

    Only 65% agreed on this answer — treat it as contested rather than settled.

    Explanation

    From someone who did a "lot of research" you clearly have no idea what you're talking about. B is not selected by default with A. You clearly don't understand what "Allow trusted Microsoft services to access this storage account", as this has nothing to do with the question. The question CLEARLY says that you plan do upload from the on-premises network with PUBLIC ip address 131.107.1.0/24. A, C are the only possible combination to answer this question. For other options: - B, theres no need to involve Microsoft trusted services here. - D, that only works if there is a site-to-site VPN, and that is NOT stated in the problem. - E, theres nothing to do with the problem.

    Adapted from community discussion by epomatti · 2022-04-21 · 47 community upvotes. Third-party contribution; reviewed by our quality filter, not independently verified.

    Supporting references

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    View community discussion4

    Candidate context

    Question 25 discussion

    These are quality-filtered excerpts from third-party community discussion. They can be useful reasoning signals, but they are not official answers and have not been independently verified by AZ-104 or CertExamHQ.

    1. E

       epomatti

       2022-04-21

       47 upvotes

       From someone who did a "lot of research" you clearly have no idea what you're talking about. B is not selected by default with A. You clearly don't understand what "Allow trusted Microsoft services to access this storage account", as this has nothing to do with the question. The question CLEARLY says that you plan do upload from the on-premises network with PUBLIC ip address 131.107.1.0/24. A, C are the only possible combination to answer this question. For other options: - B, theres no need to involve Microsoft trusted services here. - D, that only works if there is a site-to-site VPN, and that is NOT stated in the problem. - E, theres nothing to do with the problem.

    2. K

       klexams

       2022-04-03

       40 upvotes

       Too many mixed answers here. Decided to spend hours reading MS Docs! K, let's settle this one once and for all. Technically all answers are correct, however you can only choose 2. So here we go: B, C, D depends on A. And B is selected by default btw (once you do A). E has to be done for the disk to be used by VM1. So the correct answer is A and E. A which will cover B C D. And E as explained above. Hope this helps!

    3. N

       NaoVaz

       2022-09-14

       Selected A, C9 upvotes

       A) "From the Networking blade of account1, select Selected networks." & C) "From the Networking blade of account1, add the 131.107.1.0/24 IP address range. " Reference: https://docs.microsoft.com/en-us/azure/storage/common/storage-network-security?tabs=azure-portal#managing-ip-network-rules

    4. G

       GoldenDisciple2

       2023-09-01

       10 upvotes

       When I see this question on the exam, I'm going to close my eyes and click 2 answers. Hopefully I get it right. lol

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-104 practice, question 1 of 25