AZ-104 practice questions 421–430

1. Question 421 · 570 in bank

   HOTSPOT - You have a virtual network named VNet1 that has the configuration shown in the following exhibit.

   

   Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: add an address space - Your IaaS virtual machines (VMs) and PaaS role instances in a virtual network automatically receive a private IP address from a range that you specify, based on the address space of the subnet they are connected to. We need to add the 192.168.1.0/24 address space. Box 2: add a network interface - The 10.2.1.0/24 network exists. We need to add a network interface. Reference: https://docs.microsoft.com/en-us/office365/enterprise/designing-networking-for-microsoft-azure-iaas

   Source: Adapted from community discussion — Throwitawaynow

   References

   • Microsoft Learn

   

   Next question

2. Question 422 · 570 in bank

   You have an Azure subscription that contains a virtual network named VNET1. VNET1 contains the subnets shown in the following table.

   

   Each virtual machine uses a static IP address. You need to create network security groups (NSGs) to meet following requirements: ✑ Allow web requests from the internet to VM3, VM4, VM5, and VM6. ✑ Allow all connections between VM1 and VM2. ✑ Allow Remote Desktop connections to VM1. ✑ Prevent all other network traffic to VNET1. What is the minimum number of NSGs you should create?

   • A1
   • B3
   • C4
   • D12

   Show answer

   Answer: A

   Explanation

   Correct Answer: A NSGs can be associated to subnets, individual VMs (classic), or individual network interfaces (NIC) attached to VMs (Resource Manager). You can associate zero, or one, NSG(s) to each VNet subnet and NIC in a virtual machine. The same NSG can be associated to as many subnets and NICs as you choose. So, you can create 1 NSG and associate it with all 3 Subnets. - Allow web requests from internet to VM3, VM4, VM5 and VM 6: You need to add an inbound rule to allow Internet TCP 80 to VM3, VM4, VM5 and VM6 static IP addresses. - Allow all connections between VM1 & VM2: You do not need an NSG as communication in the same VNet is allowed by default, without even configuring NSG. - Allow remote desktop to VM1: You need to add an inbound rule to allow RDP 3389 in VM1’s static IP address . - Prevent all other network traffic to VNET1: You do not need to configure any NSG as the there is explicit deny rule (DenyAllInbound) in every NSG.

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 423 · 570 in bank

   You have an Azure subscription that contains the resources shown in the following table.

   

   The Not allowed resource types Azure policy that has policy enforcement enabled is assigned to RG1 and uses the following parameters: Microsoft.Network/virtualNetworks Microsoft.Compute/virtualMachines In RG1, you need to create a new virtual machine named VM2, and then connect VM2 to VNET1. What should you do first?

   • ARemove Microsoft.Compute/virtualMachines from the policy.
   • BCreate an Azure Resource Manager template
   • CAdd a subnet to VNET1.
   • DRemove Microsoft.Network/virtualNetworks from the policy.

   Show answer

   Answer: A

   Explanation

   Answer is A because we already have the VNET in place, so the only thing that would get blocked by this policy would be the NEW vm we are creating

   Source: Adapted from community discussion — yoelalan14

   References

   • Microsoft Learn

   Next question

4. Question 424 · 570 in bank

   Your company has an Azure subscription named Subscription1. The company also has two on-premises servers named Server1 and Server2 that run Windows Server 2016. Server1 is configured as a DNS server that has a primary DNS zone named adatum.com. Adatum.com contains 1,000 DNS records. You manage Server1 and Subscription1 from Server2. Server2 has the following tools installed: ✑ The DNS Manager console ✑ Azure PowerShell ✑ Azure CLI 2.0 You need to move the adatum.com zone to an Azure DNS zone in Subscription1. The solution must minimize administrative effort. What should you use?

   • AAzure CLI
   • BAzure PowerShell
   • Cthe Azure portal
   • Dthe DNS Manager console

   Show answer

   Answer: A

   Explanation

   Answer is incorrect, it should be A - Azure CLI. https://docs.microsoft.com/en-us/azure/dns/dns-import-export - Azure DNS supports importing and exporting zone files by using the Azure command-line interface (CLI). Zone file import is not currently supported via Azure PowerShell or the Azure portal. PrivateDNSMigrationScript is for migrating legacy Azure DNS private zones to the new Azure DNS private zone resource.

   Source: Adapted from community discussion — asdf12345a

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 425 · 570 in bank

   You have a public load balancer that balances ports 80 and 443 across three virtual machines named VM1, VM2, and VM3. You need to direct all the Remote Desktop Protocol (RDP) connections to VM3 only. What should you configure?

   • Aan inbound NAT rule
   • Ba new public load balancer for VM3
   • Ca frontend IP configuration
   • Da load balancing rule

   Show answer

   Answer: A

   Explanation

   An inbound NAT rule forwards incoming traffic to a specific virtual machine Service: RDP Protocol: TCP Port: 3389 Target VM =VM3

   Source: Adapted from community discussion — [Removed]

   References

   • Microsoft Learn

   Next question

6. Question 426 · 570 in bank

   HOTSPOT - You have an Azure subscription named Subscription1 that contains the virtual networks in the following table.

   

   Subscription1 contains the virtual machines in the following table.

   

   In Subscription1, you create a load balancer that has the following configurations: ✑ Name: LB1 ✑ SKU: Basic ✑ Type: Internal ✑ Subnet: Subnet12 ✑ Virtual network: VNET1 For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/load-balancer/load-balancer-standard-overview

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

7. Question 427 · 570 in bank

   HOTSPOT - You have an Azure virtual machine that runs Windows Server 2019 and has the following configurations: ✑ Name: VM1 ✑ Location: West US ✑ Connected to: VNET1 ✑ Private IP address: 10.1.0.4 ✑ Public IP addresses: 52.186.85.63 ✑ DNS suffix in Windows Server: Adatum.com You create the Azure DNS zones shown in the following table.

   

   You need to identify which DNS zones you can link to VNET1 and the DNS zones to which VM1 can automatically register. Which zones should you identify? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Reference: https://docs.microsoft.com/en-us/azure/dns/private-dns-overview

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

8. Question 428 · 570 in bank

   DRAG DROP - You have an on-premises network that you plan to connect to Azure by using a site-so-site VPN. In Azure, you have an Azure virtual network named VNet1 that uses an address space of 10.0.0.0/16 VNet1 contains a subnet named Subnet1 that uses an address space of 10.0.0.0/24. You need to create a site-to-site VPN to Azure. Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order. NOTE: More than one order of answer choice is correct. You will receive credit for any of the correct orders you select. Select and Place:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   The answers are in order and are correct. Always work from the Azure side first, it's a dependency. Dependency is the key to all order obviously... 1 - Start with a Gateway subnet. You need the subnet in place first before you can associate a VPN gateway with it, which is what is created next. 2 - Create a VPN gateway. Associate the VPN gateway with the gateway subnet you created (there are other steps but for the sake of what is available for answers, the prem side is now configured) Now for the premice side. 3. Create a local gateway. You need the local gateway in order to complete the tunnel, then you can create a VPN connection

   Source: Adapted from community discussion — ZUMY

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 429 · 570 in bank

   You have an Azure subscription that contains the resources in the following table.

   

   VM1 and VM2 are deployed from the same template and host line-of-business applications. You configure the network security group (NSG) shown in the exhibit. (Click the Exhibit tab.)

   

   You need to prevent users of VM1 and VM2 from accessing websites on the Internet over TCP port 80. What should you do?

   • ADisassociate the NSG from a network interface
   • BChange the Port_80 inbound security rule.
   • CAssociate the NSG to Subnet1.
   • DChange the DenyWebSites outbound security rule.

   Show answer

   Answer: C

   Explanation

   Correct Answer: C Outbound rule “DenyWebSites” is setup correctly to block outbound internet traffic over port 80. In the screenshot it states, "Associated with: 0 subnets, 0 NIC's", so you need to associate the NSG to Subnet1.You can associate or dissociate a network security group from a NIC or Subnet. Reference: https://docs.microsoft.com/en-us/azure/virtual-network/manage-network-security-group

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn

   Next question

10. Question 430 · 570 in bank

    You have two subscriptions named Subscription1 and Subscription2. Each subscription is associated to a different Azure AD tenant. Subscription1 contains a virtual network named VNet1. VNet1 contains an Azure virtual machine named VM1 and has an IP address space of 10.0.0.0/16. Subscription2 contains a virtual network named VNet2. VNet2 contains an Azure virtual machine named VM2 and has an IP address space of 10.10.0.0/24. You need to connect VNet1 to VNet2. What should you do first?

    • AMove VM1 to Subscription2.
    • BMove VNet1 to Subscription2.
    • CModify the IP address space of VNet2.
    • DProvision virtual network gateways.

    Show answer

    Answer: D

    Explanation

    Correct Answer: D There is no overlap between the VNets: VNet1: 10.0.0.0/16 - CIDR IP Range 10.0.0.0 - 10.0.255.255 VNet2: 10.10.0.0/24 - CIDR IP Range 10.10.0.0 - 10.0.0.255 Note: If a virtual network has address ranges that overlap with another virtual network or on-premises network, the two networks can't be connected. You can connect virtual networks (VNets) by using the VNet-to-VNet connection type. Virtual networks can be in different regions and from different subscriptions. When you connect VNets from different subscriptions, the subscriptions don't need to be associated with the same Active Directory tenant. Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-vnet-vnet-resource-manager-portal https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpngateways

    Source: Adapted from community discussion — mlantonis

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-104 practice, question 421. 570 questions available.