AZ-104 practice questions 121–130

1. Question 121 · 570 in bank

   You have 15 Azure subscriptions. You have an Azure Active Directory (Azure AD) tenant that contains a security group named Group1. You plan to purchase additional Azure subscription. You need to ensure that Group1 can manage role assignments for the existing subscriptions and the planned subscriptions. The solution must meet the following requirements: ✑ Use the principle of least privilege. ✑ Minimize administrative effort. What should you do?

   • AAssign Group1 the Owner role for the root management group.
   • BAssign Group1 the User Access Administrator role for the root management group.
   • CCreate a new management group and assign Group1 the User Access Administrator role for the group.
   • DCreate a new management group and assign Group1 the Owner role for the group.

   Show answer

   Answer: B

   Explanation

   B) " Assign Group1 the User Access Administrator role for the root management group." To be able to assign licenses to all current and future subscriptions, while minimizing the administrative effort, one should apply the role to the Root Management Group. And because we should use the principle of least privilege we should chose the User Access Administrator role instead of the Owner one.

   Source: Adapted from community discussion — NaoVaz

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 122 · 570 in bank

   HOTSPOT - You have an Azure subscription that contains the hierarchy shown in the following exhibit.

   

   You create an Azure Policy definition named Policy1. To which Azure resources can you assign Policy1 and which Azure resources can you specify as exclusions from Policy1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Tenant Root Group, ManagementGroup1, Subscription1, RG1, and VM1 Once your business rules have been formed, the policy definition or initiative is assigned to any scope of resources that Azure supports, such as management groups, subscriptions, resource groups, or individual resources. Note: Azure provides four levels of scope: management groups, subscriptions, resource groups, and resources. The following image shows an example of these layers. Box 2: ManagementGroup1, Subscription1, RG1, and VM1 You can exclude a subscope from the assignment. Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview

   Source: Adapted from community discussion — Ntinsky

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 123 · 570 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:

   

   User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com. You need to create new user accounts in external.contoso.onmicrosoft.com. Solution: You instruct User2 to create the user accounts. Does that meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Correct, but the explanation is not. User1 is global admin of contoso.onmicrosoft.com. As he created the new tenant called external.contoso.onmicrosoft.com, he will be the OWNER. Check the scope not just the role, tho.

   Source: Adapted from community discussion — aaa112

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 124 · 570 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:

   

   User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com. You need to create new user accounts in external.contoso.onmicrosoft.com. Solution: You instruct User4 to create the user accounts. Does that meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   B:No, when you create a new tenant, the creator is the only global admin and owner, he must first give access to others to allow anything. https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-access-create-new-tenant#your-user-account-in-the-new-tenant

   Source: Adapted from community discussion — ltkiller

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 125 · 570 in bank

   You have an Azure policy as shown in the following exhibit:

   

   What is the effect of the policy?

   • AYou are prevented from creating Azure SQL servers anywhere in Subscription 1.
   • BYou can create Azure SQL servers in ContosoRG1 only.
   • CYou are prevented from creating Azure SQL Servers in ContosoRG1 only.
   • DYou can create Azure SQL servers in any resource group within Subscription 1.

   Show answer

   Answer: B

   Explanation

   Correct Answer: B You are prevented from creating Azure SQL servers anywhere in Subscription 1, except from ContosoRG1. There’s an Exclusion on ContosoRG1. Not allowed resource types (Deny): Prevents a list of resource types from being deployed.

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn

   Next question

6. Question 126 · 570 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:

   

   User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com. You need to create new user accounts in external.contoso.onmicrosoft.com. Solution: You instruct User3 to create the user accounts. Does that meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   The answer is No! I tested this. 1. I created a new Tenant contosogmpp. 2. Added 2 users, User1 and User 2 in this tenant and gave them global privileges 3. I logged through User1 and created a new tenant called externalcontossgmpp 4. Now when I logged in through User2 and try to switch tenants, the new tenant externalcontossgmpp is not available at all for User2. Hence User1 needs to invite User2 first

   Source: Adapted from community discussion — pgmpp

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 127 · 570 in bank

   You have two Azure subscriptions named Sub1 and Sub2. An administrator creates a custom role that has an assignable scope to a resource group named RG1 in Sub1. You need to ensure that you can apply the custom role to any resource group in Sub1 and Sub2. The solution must minimize administrative effort. What should you do?

   • ASelect the custom role and add Sub1 and Sub2 to the assignable scopes. Remove RG1 from the assignable scopes.
   • BCreate a new custom role for Sub1. Create a new custom role for Sub2. Remove the role from RG1.
   • CCreate a new custom role for Sub1 and add Sub2 to the assignable scopes. Remove the role from RG1.
   • DSelect the custom role and add Sub1 to the assignable scopes. Remove RG1 from the assignable scopes. Create a new custom role for Sub2.

   Show answer

   Answer: A

   Explanation

   A) " Select the custom role and add Sub1 and Sub2 to the assignable scopes. Remove RG1 from the assignable scopes. " To assure the solution minimizes the administrative effort, we just need to change the assignable scope list of the custom role. Reference: https://docs.microsoft.com/en-us/azure/role-based-access-control/custom-roles#custom-role-properties

   Source: Adapted from community discussion — NaoVaz

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 128 · 570 in bank

   Select 2

   You have an Azure Subscription that contains a storage account named storageacct1234 and two users named User1 and User2. You assign User1 the roles shown in the following exhibit.

   

   Which two actions can User1 perform? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • AAssign roles to User2 for storageacct1234.
   • BUpload blob data to storageacct1234.
   • CModify the firewall of storageacct1234.
   • DView blob data in storageacct1234.
   • EView file shares in storageacct1234.

   Show answer

   Answer: BD

   Explanation

   For example, if you assign the Storage Blob Data Contributor role to user Mary at the level of a container named sample-container, then Mary is granted read, write, and delete access to all of the blobs in that container. However, if Mary wants to view a blob in the Azure portal, then the Storage Blob Data Contributor role by itself will not provide sufficient permissions to navigate through the portal to the blob in order to view it. The additional permissions are required to navigate through the portal and view the other resources that are visible there.

   Source: Adapted from community discussion — pmsiva

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 129 · 570 in bank

   You have an Azure App Services web app named App1. You plan to deploy App1 by using Web Deploy. You need to ensure that the developers of App1 can use their Azure AD credentials to deploy content to App1. The solution must use the principle of least privilege. What should you do?

   • AAssign the Owner role to the developers
   • BConfigure app-level credentials for FTPS
   • CAssign the Website Contributor role to the developers
   • DConfigure user-level credentials for FTPS

   Show answer

   Answer: C

   Explanation

   C. Assign the Website Contributor role to the developers. To allow the developers of App1 to use their Azure AD credentials to deploy content to App1 using Web Deploy, you should assign the Website Contributor role to the developers. This role provides the necessary permissions for developers to deploy content to the web app, but does not grant them excessive permissions that could be used to make unwanted changes. Option A is not recommended as it would grant excessive permissions to the developers, which could be used to make unwanted changes. Option B and D are not relevant to the scenario as the question is specifically asking for how to use Azure AD credentials for Web Deploy, not FTPS. Option C is a potential solution, but the Website Contributor role provides a more targeted and appropriate level of permissions for the scenario.

   Source: Adapted from community discussion — Mazinger

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 130 · 570 in bank

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Active Directory (Azure AD) tenant named contoso.com. You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: From Azure AD in the Azure portal, you use the Bulk invite users operation. Does this meet the goal?

    • AYes
    • BNo

    Show answer

    Answer: B

    Explanation

    The Answer supplied is correct, it is No. Reason: The question states "You have a CSV file that contains the names and email addresses of 500 external users." This implies that the required fields (Email and Redirection URL)are missing from the .csv file. Here are the csv field pre-requisites that are needed for bulk upload of external users: https://learn.microsoft.com/en-us/azure/active-directory/external-identities/tutorial-bulk-invite#prerequisites

    Source: Adapted from community discussion — Georgego

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-104 practice, question 121. 570 questions available.