AZ-104 practice questions 131–140

1. Question 131 · 570 in bank

   HOTSPOT - You have an Azure subscription that is linked to an Azure AD tenant. The tenant contains the custom role-based access control (RBAC) roles shown in the following table.

   

   From the Azure portal, you need to create two custom roles named Role3 and Role4. Role3 will be an Azure subscription role. Role4 will be an Azure AD role. Which roles can you clone to create the new roles? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Thanks. Answer should be Role3: Role1 and built-in Azure subscription roles only Role4: Role2 only Explanation: You cannot clone built-in Azure AD role

   Source: Adapted from community discussion — jimmyyml

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 132 · 570 in bank

   DRAG DROP - You have an Azure subscription named Sub1 that contains two users named User1 and User2. You need to assign role-based access control (RBAC) roles to User1 and User2. The users must be able to perform the following tasks in Sub1: • User1 must view the data in any storage account. • User2 must assign users the Contributor role for storage accounts. The solution must use the principle of least privilege. Which RBAC role should you assign to each user? To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Answer is correct. "Reader and Data Access": "Lets you view everything but will not let you delete or create a storage account or contained resource. It will also allow read/write access to all data contained in a storage account via access to storage account keys." "Owner" is needed to manage permissions, as "User Access Administrator" is not offered as an option.

   Source: Adapted from community discussion — Muffay

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 133 · 570 in bank

   You have an Azure subscription that contains 10 virtual machines, a key vault named Vault1, and a network security group (NSG) named NSG1. All the resources are deployed to the East US Azure region. The virtual machines are protected by using NSG1. NSG1 is configured to block all outbound traffic to the internet. You need to ensure that the virtual machines can access Vault1. The solution must use the principle of least privilege and minimize administrative effort What should you configure as the destination of the outbound security rule for NSG1?

   • Aan application security group
   • Ba service tag
   • Can IP address range

   Show answer

   Answer: B

   Explanation

   The correct answer is B. a service tag. In order to ensure that the virtual machines can access Vault1 while also using the principle of least privilege and minimizing administrative effort, you should configure a service tag as the destination of the outbound security rule for NSG1. Service tags represent a group of IP addresses associated with Azure PaaS and SaaS services. By specifying a service tag as the destination of the outbound security rule, you can allow the virtual machines to access Vault1 without having to manually specify the IP addresses of Vault1. This reduces administrative effort and ensures that the virtual machines are only able to access Vault1, rather than any other internet destination.

   Source: Adapted from community discussion — Iszy

   References

   • Microsoft Learn

   Next question

4. Question 134 · 570 in bank

   You have an Azure AD tenant named adatum.com that contains the groups shown in the following table.

   

   Adatum.com contains the users shown in the following table.

   

   You assign the Azure Active Directory Premium Plan 2 license to Group1 and User4. Which users are assigned the Azure Active Directory Premium Plan 2 license?

   • AUser4 only
   • BUser1 and User4 only
   • CUser1, User2, and User4 only
   • DUser1, User2, User3, and User4

   Show answer

   Answer: B

   Explanation

   Nevermind, the answer is B https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/licensing-group-advanced Under Limitations and known issues: "Group-based licensing currently does not support groups that contain other groups (nested groups). If you apply a license to a nested group, only the immediate first-level user members of the group have the licenses applied."

   Source: Adapted from community discussion — sandorh

   References

   • Microsoft Learn

   Next question

5. Question 135 · 570 in bank

   HOTSPOT - You have an Azure subscription that contains the resources shown in the following table:

   

   You assign a policy to RG6 as shown in the following table:

   

   To RG6, you apply the tag: RGroup: RG6. You deploy a virtual network named VNET2 to RG6. Which tags apply to VNET1 and VNET2? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   VNET1: Department: D1, and Label:Value1 only. Tags applied to the resource group or subscription are not inherited by the resources. Note: Azure Policy allows you to use either built-in or custom-defined policy definitions and assign them to either a specific resource group or across a whole Azure subscription. VNET2: Label:Value1 only. Incorrect Answers: RGROUP: RG6 - Tags applied to the resource group or subscription are not inherited by the resources. Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies

   Source: Adapted from community discussion — shash_ank

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

6. Question 136 · 570 in bank

   HOTSPOT - You have an Azure AD tenant named contoso.com. You have two external partner organizations named fabrikam.com and litwareinc.com. Fabrikam.com is configured as a connected organization. You create an access package as shown in the Access package exhibit. (Click the Access package tab.)

   

   You configure the external user lifecycle settings as shown in the Lifecycle exhibit. (Click the Lifecycle tab.)

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   N - Because not Connected Y - Because when it expires it is removed from the group. Proof to follow Y - Because..math https://learn.microsoft.com/en-us/azure/active-directory/governance/entitlement-management-access-package-resources When a user's access package assignment expires, they are removed from the group or team, unless they currently have an assignment to another access package that includes that same group or team.

   Source: Adapted from community discussion — PlaceboC6

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 137 · 570 in bank

   You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1. Subscription1 has a user named User1. User1 has the following roles: • Reader • Security Admin • Security Reader You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do?

   • AAssign User1 the Network Contributor role for VNet1.
   • BRemove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.
   • CAssign User1 the Owner role for VNet1.
   • DAssign User1 the Network Contributor role for RG1.

   Show answer

   Answer: C

   Explanation

   There is only two choices for that puspose; - Assign User1 the Owner role for VNet1. - Assign User1 the User Access Administrator role for VNet1.

   Source: Adapted from community discussion — myarali

   References

   • Microsoft Learn

   Next question

8. Question 138 · 570 in bank

   HOTSPOT - You have an Azure subscription that contains the users shown in the following table.

   

   The groups are configured as shown in the following table.

   

   You have a resource group named RG1 as shown in the following exhibit.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Just tested in my Azure test environment. Answer is: 1. No 2. No 3. Yes Don't know where rpalanivel83 got his answers from

   Source: Adapted from community discussion — HenriksDisciple

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 139 · 570 in bank

   Your on-premises network contains a VPN gateway. You have an Azure subscription that contains the resources shown in the following table.

   

   You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network. What should you configure?

   • AAzure Application Gateway
   • Bprivate endpoints
   • Ca network security group (NSG)
   • DAzure Virtual WAN

   Show answer

   Answer: B

   Explanation

   Per the MS documentation, private endpoint seems to be the proper choice: "You can use private endpoints for your Azure Storage accounts to allow clients on a virtual network (VNet) to securely access data over a Private Link. The private endpoint uses a separate IP address from the VNet address space for each storage account service. Network traffic between the clients on the VNet and the storage account traverses over the VNet and a private link on the Microsoft backbone network, eliminating exposure from the public internet." Link: https://learn.microsoft.com/en-us/azure/storage/common/storage-private-endpoints

   Source: Adapted from community discussion — hevfe01

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 140 · 570 in bank

    HOTSPOT - You have an Azure subscription that contains a user named User1 and the resources shown in the following table.

    

    NSG1 is associated to networkinterface1. User1 has role assignments for NSG1 as shown in the following table.

    

    For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Correct Answers. YES, No, Yes (YES)User1 can create a storage account in RG1, since User1 has Storage Account Contribute Role inherited from Resource Group. (NO) User1 can modify the DNS settings of networkinterface1, since it requires Network Contribute role referring to the following link. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface?tabs=network-interface-portal#permissions (YES) User1 can create an inbound security rule to filter inbound traffic to networkinterface1, since User1 has Contributor role for NSG1

    Source: Adapted from community discussion — skydivex

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-104 practice, question 131. 570 questions available.