AZ-104 practice questions 381–390

1. Question 381 · 570 in bank

   You have an on-premises network. You have an Azure subscription that contains three virtual networks named VNET1. VNET2. and VNET3. The virtual networks are peered and connected to the on-premises network. The subscription contains the virtual machines shown in the following table.

   

   You need to monitor connectivity between the virtual machines and the on-premises network by using Connection Monitor. What is the minimum number of connection monitors you should deploy?

   • A1
   • B2
   • C3
   • D4

   Show answer

   Answer: B

   Explanation

   So you came back, scrolled through all of the ~450 questions until you found the ones which where in your exam and posted this because of altruism? I dont think so.

   Source: Adapted from community discussion — werdy92

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 382 · 570 in bank

   HOTSPOT - You plan to deploy the following Azure Resource Manager (ARM) template.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   I would say that the correct answer is NO NO NO. Box 1: instead of "netname" there should be the value of netname variable Box 2: I don't see Resource Group mentioned anywhere in the template Box 3: I don't see parameters being referred anywhere in the template, only variables are referred, e.g. "sku" variable.

   Source: Adapted from community discussion — FabrityDev

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 383 · 570 in bank

   You have an Azure subscription that contains a storage account. The account stores website data. You need to ensure that inbound user traffic uses the Microsoft point-of-presence (POP) closest to the user's location. What should you configure?

   • Aprivate endpoints
   • BAzure Firewall rules
   • CRouting preference
   • Dload balancing

   Show answer

   Answer: C

   Explanation

   The correct option to configure for ensuring inbound user traffic uses the Microsoft point-of-presence (POP) closest to the user's location is option C, Routing preference. Routing preference in Azure Traffic Manager allows you to specify how to route traffic to your Azure service endpoints based on various criteria, such as the geographic location of the client or the endpoint, the performance of the endpoint, or the priority of the endpoint. By configuring routing preference, you can direct incoming user traffic to the Microsoft point-of-presence (POP) closest to the user's location, ensuring the best possible user experience. This can be achieved by selecting the "Performance" routing method in Azure Traffic Manager, which uses DNS-based traffic routing to direct users to the endpoint that offers the best performance from the user's location.

   Source: Adapted from community discussion — [Removed]

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

4. Question 384 · 570 in bank

   You have two Azure virtual machines named VM1 and VM2 that run Windows Server. The virtual machines are in a subnet named Subnet1. Subnet1 is in a virtual network named VNet1. You need to prevent VM1 from accessing VM2 on port 3389. What should you do?

   • ACreate a network security group (NSG) that has an outbound security rule to deny destination port 3389 and apply the NSG to the network interface of VM1.
   • BConfigure Azure Bastion in VNet1.
   • CCreate a network security group (NSG) that has an outbound security rule to deny source port 3389 and apply the NSG to Subnet1.
   • DCreate a network security group (NSG) that has an inbound security rule to deny source port 3389 and apply the NSG to Subnet1.

   Show answer

   Answer: A

   Explanation

   A: The rule works although it will prevent VM1 from connecting to anything on 3389 they way it is described in the question (no limit to the destination IP detailed). Configuring a Bastion will do nothing to prevent VM1 from accessing VM2 in anyway. C & D are wrong as they are SOURCE port Deny not destination port Deny. A connection to remote port of 3389 is not going to be from a source port of 3389 (especially if RDP is already listening on these VMs as that port will be unavailable as a source port), it could be any port in 1024-65535.

   Source: Adapted from community discussion — GBAU

   References

   • Microsoft Learn

   Next question

5. Question 385 · 570 in bank

   You have an Azure subscription that contains the resources shown in the following table.

   

   You need to manage outbound traffic from VNET1 by using Firewall1. What should you do first?

   • AConfigure the Hybrid Connection Manager.
   • BUpgrade ASP1 to the Premium SKU.
   • CCreate a route table.
   • DCreate an Azure Network Watcher.

   Show answer

   Answer: C

   Explanation

   Route all traffic to the firewall When you create a virtual network, Azure automatically creates a default route table for each of its subnets and adds system default routes to the table. In this step, you create a user-defined route table that routes all traffic to the firewall, and then associate it with the App Service subnet in the integrated virtual network. Section3 in document. https://learn.microsoft.com/en-us/azure/app-service/network-secure-outbound-traffic-azure-firewall

   Source: Adapted from community discussion — fatihaxi

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 386 · 570 in bank

   You have an Azure subscription that contains the resources shown in the following table.

   

   All the resources connect to a virtual network named VNet1. You plan to deploy an Azure Bastion host named Bastion1 to VNet1. Which resources can be protected by using Bastion1?

   • AVM1 only
   • Bcontoso.com only
   • CApp1 and contoso.com only
   • DVM1 and contoso.com only
   • EVM1, App1, and contoso.com

   Show answer

   Answer: A

   Explanation

   Be aware when checking CyberKelev comments - I think he is a troll as most of the time he posts wrong answers. Always verify with other comments

   Source: Adapted from community discussion — martin_k1

   References

   • Microsoft Learn

   Next question

7. Question 387 · 570 in bank

   You have an Azure subscription that contains 10 virtual machines and the resources shown in the following table.

   

   You need to ensure that Bastion1 can support 100 concurrent SSH users. The solution must minimize administrative effort. What should you do first?

   • AResize the subnet of Bastion1
   • BConfigure host scaling.
   • CCreate a network security group (NSG)
   • DUpgrade Bastion1 to the Standard SKU

   Show answer

   Answer: D

   Explanation

   D is the answer. https://learn.microsoft.com/en-us/azure/bastion/configuration-settings#instance When you configure Azure Bastion using the Basic SKU, two instances are created. If you use the Standard SKU, you can specify the number of instances. This is called host scaling. Each instance can support 20 concurrent RDP connections and 40 concurrent SSH connections for medium workloads. Once the concurrent sessions are exceeded, an additional scale unit (instance) is required.

   Source: Adapted from community discussion — zellck

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 388 · 570 in bank

   DRAG DROP - You have an Azure subscription that contains two virtual networks named VNet1 and VNet2. Virtual machines connect to the virtual networks. The virtual networks have the address spaces and the subnets configured as shown in the following table.

   

   You need to add the address space of 10.33.0.0/16 to VNet1. The solution must ensure that the hosts on VNet1 and VNet2 can communicate. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Step 1: Remove peering between Vnet1 and VNet2. You can't add address ranges to, or delete address ranges from a virtual network's address space once a virtual network is peered with another virtual network. To add or remove address ranges, delete the peering, add or remove the address ranges, then re-create the peering. Step 2: Add the 10.44.0.0/16 address space to VNet1. Step 3: Recreate peering between VNet1 and VNet2 Reference: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • azure.microsoft.com documentation
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 389 · 570 in bank

   DRAG DROP - You have a Windows 11 device named Device and an Azure subscription that contains the resources shown in the following table.

   

   Device1 has Azure PowerShell and Azure Command-Line Interface (CLI) installed. From Device1, you need to establish a Remote Desktop connection to VM1. Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Explanation: Azure Bastion is a service you deploy that lets you connect to a virtual machine using your browser and the Azure portal, or via the native SSH or RDP client already installed on your local computer. The native client feature lets you connect to your target VMs via Bastion using Azure CLI, and expands your sign-in options to include local SSH key pair and Azure Active Directory (Azure AD). Using the native client requires the Standard SKU tier for Azure Bastion. First, we need to upgrade the SKU of our Azure Bastion instance. Second, we need to enable the native client support from the configuration settings of Bastion1 in the Azure Portal. Third, we need to sign in to our Azure account and select the subscription containing the Bastion resource as shown below:

   Source: Adapted from community discussion — Teroristo

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 390 · 570 in bank

    You have an Azure subscription that has the public IP addresses shown in the following table.

    

    You plan to deploy an Azure Bastion Basic SKU host named Bastion1. Which IP addresses can you use?

    • AIP1 only
    • BIP1 and IP2 only
    • CIP3, IP4, and IP5 only
    • DIP1, IP2, IP4, and IP5 only
    • EIP1, IP2, IP3, IP4, and IP5

    Show answer

    Answer: A

    Explanation

    Tested in sandbox - IPv4 - Static - Standard - Global: Error during the selection in the interface - A Global Tier PublicIPAddress cannot be attached to Bastions. - IPv4 - Static - Standard - Regional: OK - IPv4 - Static - Basic - Regional Error during the selection in the interface - Static public IP addresses cannot be associated. - IPv4 - Dynamic - Basic - Regional Error during the selection in the interface - The SKU type for the public IP address does not match the SKU type of the load balancer (?? I don't know why this message). - IPv6 - Static - Standard - Regional: Error during deployment (The selected IPv6 public IP address is not supported for Azure Bastion. To fix this, please recreate your Azure Bastion with an IPv4 public IP address. (Code: PublicIpAddressVersionNotSupported))

    Source: Adapted from community discussion — eliasalg

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-104 practice, question 381. 570 questions available.