AZ-104 practice questions 221–230

1. Question 221 · 570 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Storage account named storage1. You need to enable a user named User1 to list and regenerate storage account keys for storage1. Solution: You assign the Storage Account Encryption Scope Contributor Role to User1. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   The Storage Account Encryption Scope Contributor role allows a user to manage encryption scopes in a storage account but does not grant the ability to list and regenerate storage account keys. To meet the goal, you would need to assign the Storage Account Key Operator Service Role or a role with broader access such as the Storage Account Contributor role, which includes permissions to list and regenerate keys.

   Source: Adapted from community discussion — Dankho

   Next question

2. Question 222 · 570 in bank

   HOTSPOT - You have an Azure subscription that has offices in the East US and West US Azure regions. You plan to create the storage account shown in the following exhibit.

   

   Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Correct answers: Minimize network cost - Default routing tier to Internet Routing After creation you can modify - Encryption type

   Source: Adapted from community discussion — MichaelMelb

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 223 · 570 in bank

   HOTSPOT - You have an Azure subscription. You plan to deploy a new storage account. You need to configure encryption for the account. The solution must meet the following requirements: • Use a customer-managed key stored in a key vault. • Use the maximum supported bit length. Which type of key and which bit length should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Correct answer as per article. "Azure storage encryption supports RSA and RSA-HSM keys of sizes 2048, 3072 and 4096." https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-overview#key-vault-requirements

   Source: Adapted from community discussion — AnonFox

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 224 · 570 in bank

   You have an Azure Storage account that contains 5,000 blobs accessed by multiple users. You need to ensure that the users can view only specific blobs based on blob index tags. What should you include in the solution?

   • Aa role assignment condition
   • Ba stored access policy
   • Cjust-in-time (JIT) VM access
   • Da shared access signature (SAS)

   Show answer

   Answer: A

   Explanation

   Anser is A: An Azure role assignment condition is an optional check that you can add to your role assignment to provide more fine-grained access control. For example, you can add a condition that requires an object to have a specific tag to read the object. https://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-role-assignments-portal

   Source: Adapted from community discussion — Siraf

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 225 · 570 in bank

   You have an Azure Storage account named storage1. For storage1, you create an encryption scope named Scope1. Which storage types can you encrypt by using Scope?

   • Afile shares only
   • Bcontainers only
   • Cfile shares and containers only
   • Dcontainers and tables only
   • Efile shares, containers, and tables only
   • Ffile shares, containers, tables, and queues

   Show answer

   Answer: B

   Explanation

   Answer is B: Encryption scopes enable you to manage encryption with a key that is scoped to a container or an individual blob. There is no blob in the answer choices. https://learn.microsoft.com/en-us/azure/storage/blobs/encryption-scope-overview#how-encryption-scopes-work

   Source: Adapted from community discussion — Siraf

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 226 · 570 in bank

   HOTSPOT - You have an Azure subscription. You plan to create a role definition to meet the following requirements: • Users must be able to view the configuration data of a storage account. • Users must be able to perform all actions on a virtual network. • The solution must use the principle of least privilege. What should you include in the role definition for each requirement? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Finished the exam today with 837 points and this question was asked. About 70% of the questions were from here brothers - keep studying and you will make it!

   Source: Adapted from community discussion — DH333

   References

   • Microsoft Learn

   

   Next question

7. Question 227 · 570 in bank

   HOTSPOT - You have an Azure subscription that contains a virtual machine named VM1. To VM1, you plan to add a 1-TB data disk that meets the following requirements: • Provides data resiliency in the event of a datacenter outage. • Provides the lowest latency and the highest performance. • Ensures that no data loss occurs if a host fails. You need to recommend which type of storage and host caching to configure for the new data disk.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Answer: Storage type: Premium SDD that uses zone-redundant storage (ZRS) Host-caching: Read-only Rationale ZRS replicates to different locations Host caching: Write cache stores information in memory, no host, no memory, no data Redundancy options for Azure managed disks - Azure Virtual Machines | Microsoft Learn Enable and configure Azure VM disk cache with the Azure portal - Training | Microsoft Learn

   Source: Adapted from community discussion — ducklaorange

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 228 · 570 in bank

   Select 2

   You have an Azure virtual machine named VM1 and an Azure key vault named Vault1. On VM1, you plan to configure Azure Disk Encryption to use a key encryption key (KEK). You need to prepare Vault1 for Azure Disk Encryption. Which two actions should you perform on Vault1? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • ASelect Azure Virtual machines for deployment.
   • BCreate a new key.
   • CCreate a new secret.
   • DConfigure a key rotation policy.
   • ESelect Azure Disk Encryption for volume encryption.

   Show answer

   Answer: BE

   Explanation

   To prepare Vault1 for Azure Disk Encryption with a key encryption key (KEK): 1. **You need to have a key in the Key Vault.** This will be the KEK. Azure Disk Encryption uses BitLocker for Windows VMs, which requires a key for encrypting the data disk. If you're using a KEK, the BEK (BitLocker Encryption Key) will be wrapped by this KEK. So, you should: B. Create a new key. 2. **The key vault itself should be configured for Azure Disk Encryption.** This ensures the vault is set up to work with Azure VMs and their disks. Therefore: E. Select Azure Disk Encryption for volume encryption. So, the correct actions are B and E.

   Source: Adapted from community discussion — iamchoy

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 229 · 570 in bank

   You have an Azure subscription that contains a virtual machine named VM1 and an Azure key vault named KV1. You need to configure encryption for VM1. The solution must meet the following requirements: • Store and use the encryption key in KV1. • Maintain encryption if VM1 is downloaded from Azure. • Encrypt both the operating system disk and the data disks. Which encryption method should you use?

   • Acustomer-managed keys
   • BConfidential disk encryption
   • CAzure Disk Encryption
   • Dencryption at host

   Show answer

   Answer: C

   Explanation

   "You can protect your managed disks by using Azure Disk Encryption for Linux VMs, which uses DM-Crypt, or Azure Disk Encryption for Windows VMs, which uses Windows BitLocker, to protect both operating system disks and data disks with full volume encryption. Encryption keys and secrets are safeguarded in your Azure Key Vault subscription. By using the Azure Backup service, you can back up and restore encrypted virtual machines (VMs) that use Key Encryption Key (KEK) configuration." https://learn.microsoft.com/en-us/azure/security/fundamentals/encryption-overview

   Source: Adapted from community discussion — vitodobra

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 230 · 570 in bank

    DRAG DROP - You have an Azure subscription that contains a storage account. You have an on-premises server named Server1 that runs Windows Server 2016. Server1 has 2 TB of data. You need to transfer the data to the storage account by using the Azure Import/Export service. In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order. NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select. Select and Place:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    At a high level, an import job involves the following steps: Step 1: Attach an external disk to Server1 and then run waimportexport.exe Determine data to be imported, number of drives you need, destination blob location for your data in Azure storage. Use the WAImportExport tool to copy data to disk drives. Encrypt the disk drives with BitLocker. Step 2: From the Azure portal, create an import job. Create an import job in your target storage account in Azure portal. Upload the drive journal files. Step 3: Detach the external disks from Server1 and ship the disks to an Azure data center. Provide the return address and carrier account number for shipping the drives back to you. Ship the disk drives to the shipping address provided during job creation. Step 4: From the Azure portal, update the import job Update the delivery tracking number in the import job details and submit the import job. The drives are received and processed at the Azure data center. The drives are shipped using your carrier account to the return address provided in the import job. Reference: https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-service

    Source: Adapted from community discussion — mlantonis

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-104 practice, question 221. 570 questions available.