AZ-104 practice questions 101–110

1. Question 101 · 570 in bank

   You have an Azure subscription that contains a user named User1. You need to ensure that User1 can deploy virtual machines and manage virtual networks. The solution must use the principle of least privilege. Which role-based access control (RBAC) role should you assign to User1?

   • AOwner
   • BVirtual Machine Contributor
   • CContributor
   • DVirtual Machine Administrator Login

   Show answer

   Answer: C

   Explanation

   Should the answer be C. Contributor? Answer B, only allows the managing of the VM's and not the Virtual Networks as stated in the question.

   Source: Adapted from community discussion — wooyourdaddy

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 102 · 570 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant that contains three global administrators named Admin1, Admin2, and Admin3. The tenant is associated to an Azure subscription. Access control for the subscription is configured as shown in the Access control exhibit. (Click the Access Control tab.)

   

   You sign in to the Azure portal as Admin1 and configure the tenant as shown in the Tenant exhibit. (Click the Tenant tab.)

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: No - Only Admin3, the owner, can assign ownership. Box 2: Yes - Box 3: No - Reference: https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/add-change-subscription-administrator

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 103 · 570 in bank

   You have an Azure subscription named Subscription1 that contains an Azure virtual machine named VM1. VM1 is in a resource group named RG1. VM1 runs services that will be used to deploy resources to RG1. You need to ensure that a service running on VM1 can manage the resources in RG1 by using the identity of VM1. What should you do first?

   • AFrom the Azure portal, modify the Managed Identity settings of VM1
   • BFrom the Azure portal, modify the Access control (IAM) settings of RG1
   • CFrom the Azure portal, modify the Access control (IAM) settings of VM1
   • DFrom the Azure portal, modify the Policies settings of RG1

   Show answer

   Answer: A

   Explanation

   Correct Answer: A Managed identities for Azure resources provides Azure services with an automatically managed identity in Azure Active Directory. You can use this identity to authenticate to any service that supports Azure AD authentication, without having credentials in your code. You can enable and disable the system-assigned managed identity for VM using the Azure portal. RBAC manages who has access to Azure resources, what areas they have access to and what they can do with those resources. Examples of Role Based Access Control (RBAC) include: Allowing an app to access all resources in a resource group Policies on the other hand focus on resource properties during deployment and for already existing resources. As an example, a policy can be issued to ensure users can only deploy DS series VMs within a specified resource

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 104 · 570 in bank

   You have an Azure subscription that contains a resource group named TestRG. You use TestRG to validate an Azure deployment. TestRG contains the following resources:

   

   You need to delete TestRG. What should you do first?

   • AModify the backup configurations of VM1 and modify the resource lock type of VNET1
   • BRemove the resource lock from VNET1 and delete all data in Vault1
   • CTurn off VM1 and remove the resource lock from VNET1
   • DTurn off VM1 and delete all data in Vault1

   Show answer

   Answer: B

   Explanation

   Correct Answer: B When you delete a resource group, all of its resources are also deleted. Deleting a resource group deletes all of its template deployments and currently stored operations. As an administrator, you can lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources. The lock overrides any permissions the user might have. You can't delete a vault that contains backup data. Once backup data is deleted, it will go into the soft deleted state. So you have to remove the lock on order to delete the VNET and delete the backups in order to delete the vault. Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/delete-resource-group?tabs=azure-powershell https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources https://docs.microsoft.com/en-us/azure/backup/backup-azure-delete-vault#before-you-start

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 105 · 570 in bank

   HOTSPOT - You have an Azure Active Directory (Azure AD) tenant named contoso.com that contains the users shown in the following table:

   

   User3 is the owner of Group1. Group2 is a member of Group1. You configure an access review named Review1 as shown in the following exhibit:

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/active-directory/governance/create-access-review

   Source: Adapted from community discussion — AlleyC

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 106 · 570 in bank

   You have an Azure DNS zone named adatum.com. You need to delegate a subdomain named research.adatum.com to a different DNS server in Azure. What should you do?

   • ACreate an NS record named research in the adatum.com zone.
   • BCreate a PTR record named research in the adatum.com zone.
   • CModify the SOA record of adatum.com.
   • DCreate an A record named *.research in the adatum.com zone.

   Show answer

   Answer: A

   Explanation

   Correct Answer: A An NS record or (name server record) tells recursive name servers which name servers are authoritative for a zone. You can have as many NS records as you would like in your zone file. The benefit of having multiple NS records is the redundancy of your DNS service. You need to create a name server (NS) record for the zone. Reference: https://docs.microsoft.com/en-us/azure/dns/delegate-subdomain

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn

   Next question

7. Question 107 · 570 in bank

   DRAG DROP - You have an Azure Active Directory (Azure AD) tenant that has the contoso.onmicrosoft.com domain name. You have a domain name of contoso.com registered at a third-party registrar. You need to ensure that you can create Azure AD users that have names containing a suffix of @contoso.com. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   1. Add the custom domain name to your directory 2. Add a DNS entry for the domain name at the domain name registrar 3. Verify the custom domain name in Azure AD Reference: https://docs.microsoft.com/en-us/azure/dns/dns-web-sites-custom-domain

   Source: Adapted from community discussion — Navigati0n

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 108 · 570 in bank

   You have a registered DNS domain named contoso.com. You create a public Azure DNS zone named contoso.com. You need to ensure that records created in the contoso.com zone are resolvable from the internet. What should you do?

   • ACreate NS records in contoso.com.
   • BModify the SOA record in the DNS domain registrar.
   • CCreate the SOA record in contoso.com.
   • DModify the NS records in the DNS domain registrar.

   Show answer

   Answer: D

   Explanation

   Correct answer - D. Registrar “owns” the tld and will have their NS registered against the domain by default. By changing the registrar NS records to point to your Azure DNS NS records you take ownership into your Azure DNS.

   Source: Adapted from community discussion — Eltooth

   References

   • Microsoft Learn

   Next question

9. Question 109 · 570 in bank

   HOTSPOT - You have an Azure subscription that contains a storage account named storage1. The subscription is linked to an Azure Active Directory (Azure AD) tenant named contoso.com that syncs to an on-premises Active Directory domain. The domain contains the security principals shown in the following table.

   

   In Azure AD, you create a user named User2. The storage1 account contains a file share named share1 and has the following configurations.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/storage/files/storage-files-identity-ad-ds-assign-permissions?tabs=azure-portal

   Source: Adapted from community discussion — Mozbius_

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 110 · 570 in bank

    HOTSPOT - You have an Azure subscription named Subscription1 that contains a virtual network VNet1. You add the users in the following table.

    

    Which user can perform each configuration? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Box 1: User1 and User3 only. User1: The Owner Role lets you manage everything, including access to resources. User3: The Network Contributor role lets you manage networks, including creating subnets. Box 2: User1 only. The Security Admin role: In Security Center only: Can view security policies, view security states, edit security policies, view alerts and recommendations, dismiss alerts and recommendations. Reference: https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles https://docs.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftnetwork

    Source: Adapted from community discussion — NaoVaz

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-104 practice, question 101. 570 questions available.