AZ-104 practice questions 151–160

1. Question 151 · 570 in bank

   HOTSPOT - You have an Azure AD tenant that contains a user named External User. External User authenticates to the tenant by using external195@gmail.com. You need to ensure that External User authenticates to the tenant by using contractor@gmail.com. Which two settings should you configure from the Overview blade? To answer, select the appropriate settings in the answer area. NOTE: Each correct answer is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   If the user wants to sign in using a different email: - Select the Edit properties icon. - Scroll to Email and type the new email. - Next to Other emails, select Add email. Select Add, type the new email, and select Save. - Select the Save button at the bottom of the page to save all changes On the Overview tab, under My Feed, select the "Reset redemption" status link in the B2B collaboration tile. https://learn.microsoft.com/en-us/azure/active-directory/external-identities/reset-redemption-status#use-the-microsoft-entra-admin-center-to-reset-redemption-status

   Source: Adapted from community discussion — Vestibal

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 152 · 570 in bank

   You have an Azure subscription that contains the resources shown in the following table.

   

   You need to assign Workspace1 a role to allow read, write, and delete operations for the data stored in the containers of storage1. Which role should you assign?

   • AStorage Account Contributor
   • BContributor
   • CStorage Blob Data Contributor
   • DReader and Data Access

   Show answer

   Answer: C

   Explanation

   ChatGPT and AI in general cannot be trusted to be truthful. Use them if you want but you need to personally verify everything they say. Just mentioning that you used ChatGPT or any AI does not add any validity to your statements and in fact it calls into question the very info provided

   Source: Adapted from community discussion — maxsteele

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 153 · 570 in bank

   You recently created a new Azure subscription that contains a user named Admin1. Admin1 attempts to deploy an Azure Marketplace resource by using an Azure Resource Manager template. Admin1 deploys the template by using Azure PowerShell and receives the following error message: `User failed validation to purchase resources. Error message: `Legal terms have not been accepted for this item on this subscription. To accept legal terms, please go to the Azure portal (http://go.microsoft.com/fwlink/?LinkId=534873) and configure programmatic deployment for the Marketplace item or create it there for the first time.` You need to ensure that Admin1 can deploy the Marketplace resource successfully. What should you do?

   • AFrom Azure PowerShell, run the Set-AzApiManagementSubscription cmdlet
   • BFrom the Azure portal, register the Microsoft.Marketplace resource provider
   • CFrom Azure PowerShell, run the Set-AzMarketplaceTerms cmdlet
   • DFrom the Azure portal, assign the Billing administrator role to Admin1

   Show answer

   Answer: C

   Explanation

   For anyone wondering how we are supposed to know this while studying for 104, it's hiding here under VM docs: https://learn.microsoft.com/en-us/azure/virtual-machines/windows/cli-ps-findimage

   Source: Adapted from community discussion — Techfall

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 154 · 570 in bank

   You have an Azure AD tenant that contains the groups shown in the following table.

   

   You purchase Azure Active Directory Premium P2 licenses. To which groups can you assign a license?

   • AGroup1 only
   • BGroup1 and Group3 only
   • CGroup3 and Group4 only
   • DGroup1, Group2, and Group3 only
   • EGroup1, Group2, Group3, and Group4

   Show answer

   Answer: B

   Explanation

   Azure AD licenses can be assigned to user accounts. When you want to assign licenses to a group, the intention is to assign those licenses to the members of the group. You can assign licenses to Microsoft 365 groups and security groups, but not to mail-enabled security groups. Furthermore, the group should be security-enabled to get the licenses assigned. From the given list: Group1: Security group (Security Enabled) - You can assign licenses. Group2: Mail-enabled security group (Security Enabled) - You cannot assign licenses to mail-enabled security groups. Group3: Microsoft 365 group (Security Enabled) - You can assign licenses. Group4: Microsoft 365 group (Security Disabled) - You cannot assign licenses to security-disabled groups. The correct answer is: B. Group1 and Group3 only.

   Source: Adapted from community discussion — iamchoy

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 155 · 570 in bank

   HOTSPOT - You have an Azure AD tenant. You need to create a Microsoft 365 group that contains only members of a marketing department in France. How should you complete the dynamic membership rule? To answer, select the appropriate options in the answer area. NOTE: Each correct answer is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   (user.department -eq "Marketing") and (user.country -eq "France") - user.department -eq "Marketing": This part checks if the user's department attribute in Azure AD is equal to "Marketing". - and: This operator combines the two conditions. - user.country -eq "France": This part checks if the user's country attribute in Azure AD is equal to "France". Therefore, the rule will only add users to the group who meet both conditions: they must be in the "Marketing" department and have their country set to "France".

   Source: Adapted from community discussion — tfdestroy

   References

   • Microsoft Learn

   

   Next question

6. Question 156 · 570 in bank

   HOTSPOT - You have an Azure AD tenant. You need to modify the Default user role permissions settings for the tenant. The solution must meet the following requirements: • Standard users must be prevented from creating new service principals. • Standard users must only be able to use PowerShell or Microsoft Graph to manage their own Azure resources. Which two settings should you modify? To answer, select the appropriate settings in the answer area. NOTE: Each correct answer is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Register applications: Setting this option to No prevents users from creating application registrations. Restrict access to Azure AD administration portal: What does this switch do? No: lets non-administrators browse the Azure AD administration portal. Yes: Restricts non-administrators from browsing the Azure AD administration portal. Non-administrators who are owners of groups or applications are unable to use the Azure portal to manage their owned resources. What does it not do? It doesn't restrict access to Azure AD data using PowerShell, Microsoft GraphAPI, or other clients such as Visual Studio. It doesn't restrict access as long as a user is assigned a custom role (or any role). https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/users-default-permissions

   Source: Adapted from community discussion — AntaninaD

   References

   • Microsoft Learn

   

   Next question

7. Question 157 · 570 in bank

   HOTSPOT - You have an Azure subscription named Sub1 that contains the blob containers shown in the following table.

   

   Sub1 contains two users named User1 and User2. Both users are assigned the Reader role at the Sub1 scope. You have a condition named Condition1 as shown in the following exhibit.

   

   You have a condition named Condition2 as shown in the following exhibit.

   

   You assign roles to User1 and User2 as shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Answer is NNY The conditions are difficult to read, but they mean (according to reference 1): a. If the user performs a reading operation, then he may only read from “cont1” b. If the user performs a writing operation, then he may only write to blobs like “*2*” Given that, then: 1- User 1 can read Blob2 - No, because he is reading, then the condition a. applies, and he is not reading cont1 2- User 1 can read Blob3 - No, because he is reading, then the condition a. applies, and he is not reading cont1 3- User 2 can read blob 1 - Yes. He is not writing, so the condition b. does not apply. He has permissions granted by the role on the scope he is reading - Storage Blob Data Owner on storage1, which contains blob1 References: 1. https://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-format 2. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

   Source: Adapted from community discussion — sugarbubbles

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 158 · 570 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Active Directory (Azure AD) tenant named contoso.com. You have a CSV file that contains the names and email addresses of 500 external users. You need to create a guest user account in contoso.com for each of the 500 external users. Solution: You create a PowerShell script that runs the New-MgUser cmdlet for each user. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Instead use the New-AzureADMSInvitation cmdlet which is used to invite a new external user to your directory. Reference: https://docs.microsoft.com/en-us/powershell/module/azuread/new-azureadmsinvitation New-MgUser —> https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.users/new-mguser?view=graph-powershell-1.0

   Source: Adapted from community discussion — Vestibal

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 159 · 570 in bank

   HOTSPOT - You purchase a new Azure subscription. You create an Azure Resource Manager (ARM) template named deploy.json as shown in the following exhibit.

   

   You connect to the subscription and run the following command. New-AzDeployment –Location westus –TemplateFile “deploy.json” For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   NNY - I run the ARM template in a lab environment. Before go to the explanation, it's valid to say that there are some errors in the script format and I have to fix it to run successfully. 1- It's N, because it creates 4 Resource Groups and not 3 Resource Groups (RGS0, RGS1, RGroup4 and ResGrp8); 1.1: The Resource Group named with "[concat('RGS', copyIndex())]", creates RGS0 and RGS1; 1.2: The Resource Group named with "[concat('ResGrp', '8')]", creates ResGrp8; 1.3: The Resource Group named with "[concat('RGroup', length(parameters('obj1')))]", creates RGroup4 (As we can see, obj1 parameter has a length of 4 'propA', 'propB', 'propC' and 'propD'); 2 - It's N, because it doesn't create a resourcer group named RGroup5; 3 - It's Y, because all resource groups were created in the East US Azure Region.

   Source: Adapted from community discussion — trferreiraBR

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 160 · 570 in bank

    Your on-premises network contains a VPN gateway. You have an Azure subscription that contains the resources shown in the following table.

    

    You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network. What should you configure?

    • AAzure AD Application Proxy
    • Bprivate endpoints
    • Ca network security group (NSG)
    • DAzure Peering Service

    Show answer

    Answer: B

    Explanation

    Correct, that's what private endpoints are for. "A private endpoint is a network interface that uses a private IP address from your virtual network. This network interface connects you privately and securely to a service that's powered by Azure Private Link. By enabling a private endpoint, you're bringing the service into your virtual network." https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview

    Source: Adapted from community discussion — Batiste2023

    References

    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-104 practice, question 151. 570 questions available.