AZ-104 practice questions 391–400

1. Question 391 · 570 in bank

   You have two Azure subscriptions named Sub1 and Sub2. Sub1 contains a virtual machine named VM1 and a storage account named storage1. VM1 is associated to the resources shown in the following table.

   

   You need to move VM1 to Sub2. Which resources should you move to Sub2?

   • AVM1, Disk1, and NetInt1 only
   • BVM1, Disk1, and VNet1 only
   • CVM1, Disk1, and storage1 only
   • DVM1, Disk1, NetInt1, and VNet1

   Show answer

   Answer: D

   Explanation

   When you move a virtual machine from one subscription to another, you need to ensure that all the dependent resources are also moved along with it. In the given scenario, VM1 is associated with the resources Disk1 (OS Disk), NetInt1 (Network Interface), and VNet1 (Virtual Network), and the storage account named storage1 is not associated with VM1. Therefore, to move VM1 to Sub2, you need to move the following resources: VM1: This is the virtual machine that you want to move to Sub2. Disk1: This is the OS disk for VM1, and it contains the operating system and boot files. NetInt1: This is the network interface that is attached to VM1 and provides connectivity to the virtual network. VNet1: This is the virtual network that is associated with VM1, and it provides the network connectivity to the virtual machine.

   Source: Adapted from community discussion — _fkucuk

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 392 · 570 in bank

   You have an Azure subscription. You create a routing table named RT1. You need to add a route to RT1 that specifies the next hop IP address. Which next hop type should you select?

   • AInternet
   • BVirtual network gateway
   • CVirtual network
   • DVirtual appliance

   Show answer

   Answer: D

   Explanation

   chatgpt D. Virtual appliance Explanation: If you need to specify a next hop IP address, you would select Virtual appliance as the next hop type. This is typically used for scenarios where traffic needs to be routed to a specific network virtual appliance (NVA), such as a firewall or load balancer, which requires a specified IP address. A. Internet: This sends traffic directly to the internet and does not require a next hop IP address. B. Virtual network gateway: This is used for traffic going through a VPN gateway or an ExpressRoute gateway, not for specifying a next hop IP address. C. Virtual network: This refers to routing within the virtual network (VNet), where no next hop IP is needed. Since you're specifying a next hop IP address, Virtual appliance is the appropriate choice.

   Source: Adapted from community discussion — 117b84e

   Next question

3. Question 393 · 570 in bank

   HOTSPOT - You have an Azure subscription that contains the resource groups shown in the following table.

   

   RG1 contains the resources shown in the following table.

   

   VM1 is running and connects to NIC1 and Disk1. NIC1 connects to VNET1. RG2 contains a public IP address named IP2 that is in the East US location. IP2 is not assigned to a virtual machine. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Yes - You can move storage - Box 2: No - You can't move to a new resource group a NIC that is attached to a virtual machine. Box 3: No - Azure Public IPs are region specific and can't be moved from one region to another. Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources https://docs.microsoft.com/en-us/azure/virtual-network/move-across-regions-publicip-powershell

   Source: Adapted from community discussion — NickyDee

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 394 · 570 in bank

   You have two Azure subscriptions named Sub1 and Sub2 that are linked to separate Microsoft Entra tenants.

   

   You have the virtual networks shown in the following table. Which virtual networks can you peer with VNet1?

   • AVNet2 only
   • BVNet2 and VNet3 only
   • CVNet2 and VNet4 only
   • DVNet2, VNet3, and VNet4 only
   • EVNet2, VNet3, VNet4, and VNet5

   Show answer

   Answer: E

   References

   • Microsoft Learn

   Next question

5. Question 395 · 570 in bank

   You have an Azure subscription that contains a Recovery Services vault named Vault1. You need to enable multi-user authorization (MAU) for Vault1. Which resource should you create first?

   • Aan administrative unit
   • Ba managed identity
   • Ca resource guard
   • Da custom Azure role

   Show answer

   Answer: C

   Explanation

   Given answer looks correct, see; https://learn.microsoft.com/en-us/azure/backup/multi-user-authorization?tabs=azure-portal&pivots=vaults-recovery-services-vault Before you start Testing scenarios Create a Resource Guard Enable MUA on a Recovery Services vault Protected operations on a vault using MUA Authorize critical operations on a vault Disable MUA on a Recovery Services vault

   Source: Adapted from community discussion — RandomNickname

   References

   • Microsoft Learn

   Next question

6. Question 396 · 570 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer. The effective network security configurations for VM2 are shown in the following exhibit.

   

   You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail. You verify that the Load Balancer rules are configured correctly. You need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port 443. Solution: You create an inbound security rule that allows any traffic from the AzureLoadBalancer source and has a priority of 150. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: A

   Explanation

   Answer is 'NO' B, there is rule in place to allow 131.107.100.50 over TCP port 443 with higher priority of 100. Adding a new rule of priority of 150 will not made any difference.

   Source: Adapted from community discussion — yettie79

   References

   • Microsoft Learn

   Next question

7. Question 397 · 570 in bank

   You have an Azure subscription that contains the resources shown in the following table.

   

   You create a route table named RT1 in the East US Azure region. To which resources can you associate RT1?

   • AVNet1 only
   • BSubnet1 only
   • CVNet1 and NIC1 only
   • DSubnet1 and NIC1 only
   • EVNet1, Subnet1, and NIC1

   Show answer

   Answer: B

   Explanation

   answer is correct You cannot directly associate a route table with a virtual network (VNet) or a network interface card (NIC). Route tables are applied at the subnet level, and all resources within that subnet will follow the routes defined in the associated route table

   Source: Adapted from community discussion — Henrytml

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 398 · 570 in bank

   You create an Azure VM named VM1 that runs Windows Server 2019. VM1 is configured as shown in the exhibit. (Click the Exhibit tab.)

   

   You need to enable Desired State Configuration for VM1. What should you do first?

   • AConnect to VM1.
   • BStart VM1.
   • CCapture a snapshot of VM1.
   • DConfigure a DNS name for VM1.

   Show answer

   Answer: B

   Explanation

   Given answer is correct, see; https://learn.microsoft.com/en-us/azure/virtual-machines/extensions/dsc-windows "The DSC extension for Windows requires that the target virtual machine is able to communicate with Azure and the location of the configuration package (.zip file) if it is stored in a location outside of Azure."

   Source: Adapted from community discussion — RandomNickname

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 399 · 570 in bank

   HOTSPOT - You have an Azure subscription that contains the virtual networks shown in the following table.

   

   The subnets have the IP address spaces shown in the following table.

   

   You plan to create a container app named contapp1 in the East US Azure region. You need to create a container app environment named con-env1 that meets the following requirements: • Uses its own virtual network. • Uses its own subnet. • Is connected to the smallest possible subnet. To which virtual networks can you connect con-env1, and which subnet mask should you use? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Its VNET 3 only and /23 So we need a /23 mask, this means 512 IPs I am a total newbie with this so i tried to find out what the possible IP Ranges are: - VNET 1 10.1.128.0/23 = 10.1.128.0 - 10.1.129.255 (512 IPs) - Sub 1 10.1.128.0/24 = 10.1.128.0 - 10.1.128.255 (256) -> Not enough IPs available - VNET 2 192.168.0.0/16 = 192.168.0.0-192.168.255.255 - Sub21 192.168.0.0 /17 = 192.168.0.0 - 192.168.127.255 - Sub22 192.168.128.0/17 = 192.168.128.0 - 192.168.255.255 -> The subnets take out the whole range of VNET 2 - VNET 3 172.16.0.0/16 = 172.16.0.0 - 172.16.255.255 - Sub3 172.16.1.0/24 = 172.16.1.0 - 172.16.1.255 -> VNET 3 still has most of the range for a /23 available. For example we could make the following /23 subnet: 172.16.2.0/23 = 172.16.2.0 - 172.16.3.255 Please correct me if i am wrong!

   Source: Adapted from community discussion — Kuikz

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 400 · 570 in bank

    You have an Azure subscription that contains the virtual networks shown in the following table.

    

    All the virtual networks are peered. Each virtual network contains nine virtual machines. You need to configure secure RDP connections to the virtual machines by using Azure Bastion. What is the minimum number of Bastion hosts required?

    • A1
    • B3
    • C9
    • D10

    Show answer

    Answer: A

    Explanation

    Azure Bastion and VNet peering can be used together. When VNet peering is configured, you don't have to deploy Azure Bastion in each peered VNet. This means if you have an Azure Bastion host configured in one virtual network (VNet), it can be used to connect to VMs deployed in a peered VNet without deploying an additional bastion host. For more information about VNet peering, see About virtual network peering. Azure Bastion works with the following types of peering: Virtual network peering: Connect virtual networks within the same Azure region. Global virtual network peering: Connecting virtual networks across Azure regions. Answer is A

    Source: Adapted from community discussion — [Removed]

    References

    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-104 practice, question 391. 570 questions available.