AZ-104 practice questions 371–380

1. Question 371 · 570 in bank

   HOTSPOT - You have an Azure subscription. The subscription contains virtual machines that run Windows Server 2016 and are configured as shown in the following table.

   

   You create a public Azure DNS zone named adatum.com and a private Azure DNS zone named contoso.com. You create a virtual network link for contoso.com as shown in the following exhibit.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances https://docs.microsoft.com/en-us/azure/dns/private-dns-autoregistration

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 372 · 570 in bank

   You have an Azure subscription that contains a storage account named storage1. You need to allow access to storage1 from selected networks and your home office. The solution must minimize administrative effort. What should you do first for storage1?

   • AAdd a private endpoint.
   • BModify the Public network access settings.
   • CSelect Internet routing.
   • DModify the Access Control (IAM) settings.

   Show answer

   Answer: B

   Explanation

   To allow access to the storage account storage1 from selected networks and your home office while minimizing administrative effort, the first step is to modify the Public network access settings. This option allows you to specify which networks can access the storage account, including enabling access from specific IP addresses or virtual networks.

   Source: Adapted from community discussion — Elite4Life

   Next question

3. Question 373 · 570 in bank

   You plan to deploy route-based Site-to-Site VPN connections between several on-premises locations and an Azure virtual network. Which tunneling protocol should you use?

   • AIKEv1
   • BPPTP
   • CIKEv2
   • DL2TP

   Show answer

   Answer: C

   References

   • Microsoft Learn

   Next question

4. Question 374 · 570 in bank

   You have an Azure subscription that contains the resources shown in the following table.

   

   You configure Azure Site Recovery to replicate VM1 between the US East and West US regions. You perform a test failover of VM1 and specify VNET2 as the target virtual network. When the test version of VM1 is created, to which subnet will the virtual machine be connected?

   • ATestSubnet1
   • BDemoSubnet1
   • CRecoverySubnetA
   • DRecoverySubnetB

   Show answer

   Answer: B

   Explanation

   B is the answer. https://learn.microsoft.com/en-us/azure/site-recovery/azure-to-azure-network-mapping The subnet of the target VM is selected based on the name of the subnet of the source VM. - If a subnet with the same name as the source VM subnet is available in the target network, that subnet is set for the target VM. - If a subnet with the same name doesn't exist in the target network, the first subnet in the alphabetical order is set as the target subnet.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 375 · 570 in bank

   You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers. You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines. You need to ensure that visitors are serviced by the same web server for each request. What should you configure?

   • AProtocol to UDP
   • BSession persistence to None
   • CFloating IP (direct server return) to Disabled
   • DSession persistence to Client IP

   Show answer

   Answer: D

   Explanation

   D is the answer. https://learn.microsoft.com/en-us/azure/load-balancer/distribution-mode-concepts Session persistence: Client IP - Traffic from the same client IP is routed to the same backend instance

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn

   Next question

6. Question 376 · 570 in bank

   HOTSPOT - You have an Azure subscription that contains the virtual networks shown in the following table.

   

   You have the peering options shown in the following exhibit.

   

   You need to design a communication strategy for the resources on the virtual networks. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Given answer is right. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-faq Global virtual network peering enables you to peer virtual networks in different regions. Global virtual network peering is available in all Azure public regions, China cloud regions, and government cloud regions. You can't globally peer from Azure public regions to national cloud regions. This means global peering between azure government to public is not possible. Global peering between Azure Government to Azure China ( China Government) is possible, It is a government to government peering. Global peering between Azure China ( China Government) to Public is not possible.

   Source: Adapted from community discussion — arunyadav09

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 377 · 570 in bank

   You have an Azure subscription that contains 20 virtual machines, a network security group (NSG) named NSG1, and two virtual networks named VNET1 and VNET2 that are peered. You plan to deploy an Azure Bastion Basic SKU host named Bastion1 to VNET1. You need to configure NSG1 to allow inbound access to the virtual machines via Bastion1. Which port should you configure for the inbound security rule?

   • A22
   • B443
   • C389
   • D8080

   Show answer

   Answer: B

   Explanation

   Correct Answer B. 443 Using Bastion your RDP/SSH session is over TLS on port 443. https://learn.microsoft.com/en-us/azure/bastion/bastion-overview If you say port 22 then what about windows VM as it is not mentioned that the VM is windows or Linux? You will have to allow port 443 in NSG.

   Source: Adapted from community discussion — Ashfaque_9x

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • azure.microsoft.com documentation
   • Microsoft Learn

   Next question

8. Question 378 · 570 in bank

   HOTSPOT - Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the servers shown in the following table.

   

   You plan to migrate contoso.com to Azure. You create an Azure virtual network named VNET1 that has the following settings: • Address space: 10.0.0.0/16 • Subnet: o Name: Subnet1 o IPv4: 10.0.1.0/24 You need to move DC1 to VNET1. The solution must ensure that the member servers in contoso.com can resolve AD DS DNS names. How should you configure DC1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I think the answers should be: 1) Obtain an IP address automatically The first 4 IP addresses within a subnet space are getting reserved for Azure automatically. Thus, 10.0.1.3 can't be the right answer. 10.0.2.1 is in the VNET space but falls out of the subnet space. 192.168.2.1 is just out of the VNET. 2) Configure VNET1 to use a custom DNS server This VNET1 should use our pre-created DNS server as its DNS server so tahat the member servers in contoso.com can resolve AD DS DNS names. Pls do not hesitate to correct me if I am wrong :)

   Source: Adapted from community discussion — tunaparker

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 379 · 570 in bank

   You have an Azure subscription that contains the virtual networks shown in the following table.

   

   You need to deploy an Azure firewall named AF1 to RG1 in the West US Azure region. To which virtual networks can you deploy AF1?

   • AVNET1, VNET2, VNET3, and VNET4
   • BVNET1 and VNET2 only
   • CVNET1 only
   • DVNET1, VNET2, and VNET4 only
   • EVNET1 and VNET4 only

   Show answer

   Answer: C

   Explanation

   C. VNET1 only No idea why people are saying option E as the question clearly states that "You need to deploy an Azure firewall named AF1 to RG1 in the West US", so RG1 in the West US region means the correct answer is C(VNET1).

   Source: Adapted from community discussion — Ashfaque_9x

   References

   • Microsoft Learn

   Next question

10. Question 380 · 570 in bank

    You have an Azure subscription that contains the resources in the following table.

    

    To which subnets can you apply NSG1?

    • Athe subnets on VNet1 only
    • Bthe subnets on VNet2 and VNet3 only
    • Cthe subnets on VNet2 only
    • Dthe subnets on VNet3 only
    • Ethe subnets on VNet1, VNet2, and VNet3

    Show answer

    Answer: D

    Explanation

    Correct Answer: D You can assign NSG to the Subnet of the VNet in the same region where NSG is. NSG1 is in East US and only VNet3 Subnets are in East US.

    Source: Adapted from community discussion — mlantonis

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-104 practice, question 371. 570 questions available.