AZ-104 practice questions 111–120

1. Question 111 · 570 in bank

   HOTSPOT - You have the Azure resources shown on the following exhibit.

   

   You plan to track resource usage and prevent the deletion of resources. To which resources can you apply locks and tags? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Sub1, RG1, and VM1 only - You can lock a subscription, resource group, or resource to prevent other users in your organization from accidentally deleting or modifying critical resources. Box 2: Sub1, RG1, and VM1 only - You apply tags to your Azure resources, resource groups, and subscriptions. Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources?tabs=json

   Source: Adapted from community discussion — Omar_Aladdin

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 112 · 570 in bank

   You have an Azure Active Directory (Azure AD) tenant. You plan to delete multiple users by using Bulk delete in the Azure Active Directory admin center. You need to create and upload a file for the bulk delete. Which user attributes should you include in the file?

   • AThe user principal name and usage location of each user only
   • BThe user principal name of each user only
   • CThe display name of each user only
   • DThe display name and usage location of each user only
   • EThe display name and user principal name of each user only

   Show answer

   Answer: B

   Explanation

   To perform a bulk delete of users in Azure Active Directory, you need to create and upload a CSV file that contains the list of users to be deleted. The file should include the user principal name (UPN) of each user only. Therefore, the answer is B. The user principal name of each user only. When you use the bulk delete feature in the Azure Active Directory admin center, you need to specify the UPN for each user that you want to delete. The UPN is a unique identifier for each user in Azure AD and is the primary way that Azure AD identifies and manages user accounts. Including additional attributes like the display name or usage location is not required for the bulk delete operation, as the UPN is the only mandatory attribute for the user account. However, you may include additional attributes in the CSV file if you want to keep track of the metadata associated with each user account.

   Source: Adapted from community discussion — Mazinger

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 113 · 570 in bank

   HOTSPOT - You have an Azure subscription named Sub1 that contains the Azure resources shown in the following table.

   

   You assign an Azure policy that has the following settings: ✑ Scope: Sub1 ✑ Exclusions: Sub1/RG1/VNET1 ✑ Policy definition: Append a tag and its value to resources ✑ Policy enforcement: Enabled ✑ Tag name: Tag4 ✑ Tag value: value4 You assign tags to the resources as shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: No - The Azure Policy will add Tag4 to RG1. Box 2: No - Tags applied to the resource group or subscription aren't inherited by the resources although you can enable inheritance with Azure Policy. Storage1 has Tag3: Value1 and the Azure Policy will add Tag4. Box 3: No - Tags applied to the resource group or subscription aren't inherited by the resources so VNET1 does not have Tag2. VNET1 has Tag3:value2. VNET1 is excluded from the Azure Policy so Tag4 will not be added to VNET1. Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources?tabs=json

   Source: Adapted from community discussion — Lionred

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 114 · 570 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription. Solution: You assign the Traffic Manager Contributor role at the subscription level to Admin1. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Q.36 Assign Network Contributor role at subscription level to Admin1  Yes Q.37 Assign Owner role at subscription level to Admin1  Yes Q.38 Assign Reader role at subscription level to Admin1  Yes Q.52 Assign Traffic Manager Contributor role at subscription level to Admin1  No

   Source: Adapted from community discussion — GoldenFox

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 115 · 570 in bank

   HOTSPOT - You have the Azure management groups shown in the following table:

   

   You add Azure subscriptions to the management groups as shown in the following table:

   

   You create the Azure policies shown in the following table:

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: No - Virtual networks are not allowed at the root and is inherited. Deny overrides allowed. Box 2: Yes - Virtual Machines can be created on a Management Group provided the user has the required RBAC permissions. Box 3: Yes - Subscriptions can be moved between Management Groups provided the user has the required RBAC permissions. Reference: https://docs.microsoft.com/en-us/azure/governance/management-groups/overview https://docs.microsoft.com/en-us/azure/governance/management-groups/manage#moving-management-groups-and-subscriptions

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 116 · 570 in bank

   You have three offices and an Azure subscription that contains an Azure Active Directory (Azure AD) tenant. You need to grant user management permissions to a local administrator in each office. What should you use?

   • AAzure AD roles
   • Badministrative units
   • Caccess packages in Azure AD entitlement management
   • DAzure roles

   Show answer

   Answer: B

   Explanation

   The answer is correct Administrative units restrict permissions in a role to any portion of your organization that you define. You could, for example, use administrative units to delegate the Helpdesk Administrator role to regional support specialists, so they can manage users only in the region that they support.

   Source: Adapted from community discussion — HananS

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 117 · 570 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named Dev. You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group. Solution: On Dev, you assign the Logic App Contributor role to the Developers group. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   Explanation

   Answer "Yes" is correct. Logic App Contributor role will allow you to create Logic Apps. See here: https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app?tabs=azure-portal "Your Azure subscription requires Contributor permissions for the resource group that contains that logic app resource. If you create a logic app resource, you automatically have Contributor access."

   Source: Adapted from community discussion — MrMacro

   References

   • Microsoft Learn

   Next question

8. Question 118 · 570 in bank

   HOTSPOT - You have an Azure Load Balancer named LB1. You assign a user named User1 the roles shown in the following exhibit.

   

   Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#virtual-machine-contributor https://docs.microsoft.com/en-us/azure/role-based-access-control/rbac-and-directory-admin-roles

   Source: Adapted from community discussion — NaoVaz

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 119 · 570 in bank

   HOTSPOT - You configure the custom role shown in the following exhibit.

   

   Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: roletype - You need to configure Azure RBAC policy to determine who can log in to the VM. Two Azure roles are used to authorize VM login: Virtual Machine Administrator Login: Users with this role assigned can log in to an Azure virtual machine with administrator privileges. Virtual Machine User Login: Users with this role assigned can log in to an Azure virtual machine with regular user privileges. Note, example roletype: "roleName": "Virtual Machine Administrator Login", "roleType": "BuiltInRole", "type": "Microsoft.Authorization/roleDefinitions" Box 2: assignableScopes - Azure role-based access control (Azure RBAC) is the authorization system you use to manage access to Azure resources. To grant access, you assign roles to users, groups, service principals, or managed identities at a particular scope. When you assign roles, you must specify a scope. Scope is the set of resources the access applies to. In Azure, you can specify a scope at four levels from broad to narrow: management group, subscription, resource group, and resource. Reference: https://docs.microsoft.com/en-us/azure/active-directory/devices/howto-vm-sign-in-azure-ad-windows https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal

   Source: Adapted from community discussion — pkkalra

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 120 · 570 in bank

    You have an Azure subscription that contains a storage account named storage1. The storage1 account contains a file share named share1. The subscription is linked to a hybrid Azure Active Directory (Azure AD) tenant that contains a security group named Group1. You need to grant Group1 the Storage File Data SMB Share Elevated Contributor role for share1. What should you do first?

    • AEnable Active Directory Domain Service (AD DS) authentication for storage1.
    • BGrant share-level permissions by using File Explorer.
    • CMount share1 by using File Explorer.
    • DCreate a private endpoint.

    Show answer

    Answer: A

    Explanation

    A. Enable Active Directory Domain Service (AD DS) authentication for storage1. To grant the Group1 the Storage File Data SMB Share Elevated Contributor role for share1, you need to enable Active Directory Domain Service (AD DS) authentication for the storage account. By enabling AD DS authentication, you allow Azure AD security groups to be used for granting access control to file shares in the storage account. This enables you to assign roles, such as the Storage File Data SMB Share Elevated Contributor role, to the security group Group1 for the specific file share share1. Once AD DS authentication is enabled and the security group is assigned the appropriate role, Group1 will have the necessary permissions to access and manage the file share. Therefore, enabling Active Directory Domain Service (AD DS) authentication for storage1 is the first step you should take to grant Group1 the Storage File Data SMB Share Elevated Contributor role for share1.

    Source: Adapted from community discussion — Athul07

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-104 practice, question 111. 570 questions available.