AZ-104 practice questions 141–150

1. Question 141 · 570 in bank

   HOTSPOT - You have three Azure subscriptions named Sub1, Sub2, and Sub3 that are linked to an Azure AD tenant. The tenant contains a user named User1, a security group named Group1, and a management group named MG1. User is a member of Group1. Sub1 and Sub2 are members of MG1. Sub1 contains a resource group named RG1. RG1 contains five Azure functions. You create the following role assignments for MG1: • Group1: Reader • User1: User Access Administrator You assign User the Virtual Machine Contributor role for Sub1 and Sub2.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Personally I think its YYN. 1) GROUP1 Reader access, provides access to view all items, except secrets https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#reader 2) To Assign OWNER role, you need to either Owner role or User Administrator Access Role https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal-subscription-admin#prerequisites 3) Neither User Access Admin Role nor the Reader Role allows to create new resources. https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-steps

   Source: Adapted from community discussion — Shadowner

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 142 · 570 in bank

   You have an Azure subscription that contains the resources shown in the following table.

   

   You need to assign User1 the Storage File Data SMB Share Contributor role for share1. What should you do first?

   • AEnable identity-based data access for the file shares in storage1.
   • BModify the security profile for the file shares in storage1.
   • CSelect Default to Azure Active Directory authorization in the Azure portal for storage1.
   • DConfigure Access control (IAM) for share1.

   Show answer

   Answer: D

   Explanation

   It should be A, I just created a storage account, then created a file share, went to IAM, and it says : To give individual accounts access to the file share (Kerberos), enable identity-based authentication for the storage account.

   Source: Adapted from community discussion — macrawat

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 143 · 570 in bank

   You have an Azure subscription named AZPT1 that contains the resources shown in the following table:

   

   You create a new Azure subscription named AZPT2. You need to identify which resources can be moved to AZPT2. Which resources should you identify?

   • AVM1, storage1, VNET1, and VM1Managed only
   • BVM1 and VM1Managed only
   • CVM1, storage1, VNET1, VM1Managed, and RVAULT1
   • DRVAULT1 only

   Show answer

   Answer: C

   Explanation

   Correct Answer: C All of them. Moving a resource only moves it to a new Resource Group or Subscription. It doesn't change the location of the resource. Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources#microsoftcompute https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources#microsoftnetwork https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources#microsoftstorage https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources#microsoftrecoveryservices

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • azure.microsoft.com documentation
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 144 · 570 in bank

   HOTSPOT - You have an Azure AD tenant named adatum.com that contains the groups shown in the following table.

   

   Adatum.com contains the users shown in the following table.

   

   You assign an Azure Active Directory Premium P2 license to Group1 as shown in the following exhibit.

   

   Group2 is NOT directly assigned a license. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   YNN 1) Y, You can assign users MS Defender for Cloud Apps on a per user basis. 2) N, You cannot remove the P2 license as User1 is in Group1. 3) N, nested group assignments don't work

   Source: Adapted from community discussion — ExamHelp22

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 145 · 570 in bank

   HOTSPOT - You have a hybrid deployment of Azure Active Directory (Azure AD) that contains the users shown in the following table.

   

   You need to modify the JobTitle and UsageLocation attributes for the users. For which users can you modify the attributes from Azure AD? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Users syncing from an On Prem AD to AAD cannot have the job title altered in AAD. it would need to be done in local AD , as AADC by default synchronizes the jobTitle property. Usage location is set only on the cloud side for all users, and Guest users can have their job titles set as well as cloud native (AAD) users. Source - I've been the AD and AAD admin for years at several organizations.

   Source: Adapted from community discussion — JeremyChainsaw

   References

   • Microsoft Learn

   

   Next question

6. Question 146 · 570 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Active Directory (Azure AD) tenant named contoso.com. You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: You create a PowerShell script that runs the New-MgUser cmdlet for each external user. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   The `New-MgUser` cmdlet is part of the Microsoft Graph PowerShell module, and it's used for creating new users in Azure AD. However, when creating guest users (or B2B users), you typically would invite them rather than create them like regular members. The cmdlet you'd want to use for inviting external guest users is `New-AzureADMSInvitation` if you're using the AzureAD module or a related command in the Microsoft Graph module. Given the provided solution, the answer is: B. No

   Source: Adapted from community discussion — iamchoy

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 147 · 570 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Active Directory (Azure AD) tenant named contoso.com. You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: You create a PowerShell script that runs the New-MgInvitation cmdlet for each external user. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   Explanation

   The New-MgInvitation cmdlet is part of the Microsoft Graph PowerShell module. It's used to create an invitation to an external user. When the invited user redeems their invitation, a guest user is created in the directory. If you use a PowerShell script that loops through each external user in the CSV file and runs the New-MgInvitation cmdlet for each of them, it will send out invitation emails to each of those external users. Once an external user accepts the invitation, they'll be added to the Azure AD tenant as a guest user. So, using the New-MgInvitation cmdlet in a PowerShell script for each external user does meet the goal of creating a guest user account in contoso.com for each of the 500 external users. The answer is: A. Yes

   Source: Adapted from community discussion — iamchoy

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 148 · 570 in bank

   You have an Azure subscription named Subscription1 that contains virtual network named VNet1. VNet1 is in a resource group named RG1. A user named User1 has the following roles for Subscription1: • Reader • Security Admin • Security Reader You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do?

   • AAssign User1 the Contributor role for VNet1.
   • BAssign User1 the Network Contributor role for VNet1.
   • CAssign User1 the User Access Administrator role for VNet1.
   • DRemove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1.

   Show answer

   Answer: C

   Explanation

   Network Contributor - Lets you manage networks, but not access to them. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#network-contributor User Access Administrator - Lets you manage user access to Azure resources. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator Contributor - Grants full access to manage all resources, but does not allow you to assign roles in Azure RBAC, manage assignments in Azure Blueprints, or share image galleries. T2Q71 - similar question with another possible solution - Assign User1 the Owner role for VNet1.

   Source: Adapted from community discussion — AntaninaD

   References

   • Microsoft Learn

   Next question

9. Question 149 · 570 in bank

   You have an Azure subscription named Subscription1 that contains virtual network named VNet1. VNet1 is in a resource group named RG1. User named User1 has the following roles for Subscription1: • Reader • Security Admin • Security Reader You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do?

   • ARemove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1.
   • BRemove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.
   • CAssign User1 the Network Contributor role for VNet1.
   • DAssign User1 the User Access Administrator role for VNet1.

   Show answer

   Answer: D

   Explanation

   To allow User1 to assign the Reader role for VNet1 to other users, User1 needs to have permissions related to Azure RBAC (Role-Based Access Control). Among the listed options: A. Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1. - The Contributor role allows a user to manage everything except access. B. Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1. - Again, the Contributor role doesn't grant User1 the ability to assign roles to others. C. Assign User1 the Network Contributor role for VNet1. - This role provides permissions to manage networking resources, not role assignments. D. Assign User1 the User Access Administrator role for VNet1. - This role provides permissions to manage user access to Azure resources, which means User1 can assign roles to other users for VNet1. The correct action to meet the requirement is: D. Assign User1 the User Access Administrator role for VNet1.

   Source: Adapted from community discussion — iamchoy

   References

   • Microsoft Learn

   Next question

10. Question 150 · 570 in bank

    HOTSPOT - You have an Azure Storage account named storage1 that uses Azure Blob storage and Azure File storage. You need to use AzCopy to copy data to the blob storage and file storage in storage1. Which authentication method should you use for each type of storage? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    The link you provided states: "You can provide authorization credentials by using Microsoft Entra ID, or by using a Shared Access Signature (SAS) token". So it should be Azure AD & SAS for both Questions. Am I getting it wrong?

    Source: Adapted from community discussion — hank00r

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-104 practice, question 141. 570 questions available.