AZ-104 practice questions 431–440

1. Question 431 · 570 in bank

   HOTSPOT - You plan to deploy five virtual machines to a virtual network subnet. Each virtual machine will have a public IP address and a private IP address. Each virtual machine requires the same inbound and outbound security rules. What is the minimum number of network interfaces and network security groups that you require? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: 5 - A public and a private IP address can be assigned to a single network interface. Box 2: 1 - You can associate zero, or one, network security group to each virtual network subnet and network interface in a virtual machine. The same network security group can be associated to as many subnets and network interfaces as you choose. Reference: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface-addresses

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn

   

   Next question

2. Question 432 · 570 in bank

   Select 2

   You plan to create an Azure virtual machine named VM1 that will be configured as shown in the following exhibit.

   

   The planned disk configurations for VM1 are shown in the following exhibit.

   

   You need to ensure that VM1 can be created in an Availability Zone. Which two settings should you modify? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • AUse managed disks
   • BOS disk type
   • CAvailability options
   • DSize
   • EImage

   Show answer

   Answer: AC

   Explanation

   Correct Answer: A and C A: Your VMs should use managed disks if you want to move them to an Availability Zone by using Site Recovery. C: When you create a VM for an Availability Zone, Under Settings > High availability, select one of the numbered zones from the Availability zone dropdown. Reference: https://docs.microsoft.com/en-us/azure/site-recovery/move-azure-vms-avset-azone https://docs.microsoft.com/en-us/azure/virtual-machines/windows/create-portal-availability-zone https://docs.microsoft.com/en-us/azure/virtual-machines/manage-availability https://docs.microsoft.com/en-us/azure/availability-zones/az-overview#availability-zones

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

3. Question 433 · 570 in bank

   HOTSPOT - You have an Azure subscription that contains the resources shown in the following table.

   

   VMSS1 is set to VM (virtual machines) orchestration mode. You need to deploy a new Azure virtual machine named VM1, and then add VM1 to VMSS1. Which resource group and location should you use to deploy VM1? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: RG1, RG2, or RG3 - The resource group stores metadata about the resources. When you specify a location for the resource group, you're specifying where that metadata is stored. Box 2: West US only - Note: Virtual machine scale sets will support 2 distinct orchestration modes: ScaleSetVM ג€" Virtual machine instances added to the scale set are based on the scale set configuration model. The virtual machine instance lifecycle - creation, update, deletion - is managed by the scale set. VM (virtual machines) ג€" Virtual machines created outside of the scale set can be explicitly added to the scaleset. Reference: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 434 · 570 in bank

   HOTSPOT - You have an Azure subscription that contains three virtual networks named VNET1, VNET2, and VNET3. Peering for VNET1 is configured as shown in the following exhibit.

   

   Peering for VNET2 is configured as shown in the following exhibit.

   

   Peering for VNET3 is configured as shown in the following exhibit.

   

   How can packets be routed between the virtual networks? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1. VNET2 and VNET3 - Box 2: VNET1 - Gateway transit is disabled. Reference: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

5. Question 435 · 570 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site connection uses a self-signed certificate. From Azure, you download and install the VPN client configuration package on a computer named Computer2. You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2. Solution: You modify the Azure Active Directory (Azure AD) authentication policies. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Correct Answer: B Instead export the client certificate from Computer1 and install the certificate on Computer2. A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer. A P2S connection is established by starting it from the client computer. This solution is useful for telecommuters who want to connect to Azure VNets from a remote location, such as from home or a conference. P2S VPN is also a useful solution to use instead of S2S VPN when you have only a few clients that need to connect to a VNet. This article applies to the Resource Manager deployment model.

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 436 · 570 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site connection uses a self-signed certificate. From Azure, you download and install the VPN client configuration package on a computer named Computer2. You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2. Solution: You join Computer2 to Azure Active Directory (Azure AD). Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Correct Answer: B A client computer that connects to a VNet using Point-to-Site must have a client certificate installed. Instead export the client certificate from Computer1 and install the certificate on Computer2. A Point-to-Site (P2S) VPN gateway connection lets you create a secure connection to your virtual network from an individual client computer. A P2S connection is established by starting it from the client computer. This solution is useful for telecommuters who want to connect to Azure VNets from a remote location, such as from home or a conference. P2S VPN is also a useful solution to use instead of S2S VPN when you have only a few clients that need to connect to a VNet. This article applies to the Resource Manager deployment model.

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

7. Question 437 · 570 in bank

   Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups. Another administrator plans to create several network security groups (NSGs) in the subscription. You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks. Solution: You create a resource lock, and then you assign the lock to the subscription. Does this meet the goal?

   • AYes
   • BNo

   Show answer

   Answer: B

   Explanation

   Correct Answer: B - No You need to use a custom policy definition, because there is not a built-in policy and Resource Lock is an irrelevant solution. Reference: https://docs.microsoft.com/en-us/azure/azure-policy/policy-definition https://docs.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources?tabs=json

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 438 · 570 in bank

   You have an Azure subscription named Subscription1. Subscription1 contains a virtual machine named VM1. You have a computer named Computer1 that runs Windows 10. Computer1 is connected to the Internet. You add a network interface named vm1173 to VM1 as shown in the exhibit. (Click the Exhibit tab.)

   

   From Computer1, you attempt to connect to VM1 by using Remote Desktop, but the connection fails. You need to establish a Remote Desktop connection to VM1. What should you do first?

   • AChange the priority of the RDP rule
   • BAttach a network interface
   • CDelete the DenyAllInBound rule
   • DStart VM1

   Show answer

   Answer: D

   Explanation

   Correct Answer: D Αny resource with a dynamically assigned public IP address will display the 'name' you gave it when the resource it is assigned to is offline. A static address will be shown regardless of the resource state. This means that we need to start the VM1. A: RDP rule has the highest priority. priority. B: The network interface has already been added to VM1. C: DenyAllInBound has really low priority. Reference: https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

9. Question 439 · 570 in bank

   You have the Azure virtual machines shown in the following table.

   

   A DNS service is installed on VM1. You configure the DNS servers settings for each virtual network as shown in the following exhibit.

   

   You need to ensure that all the virtual machines can resolve DNS names by using the DNS service on VM1. What should you do?

   • AConfigure a conditional forwarder on VM1
   • BAdd service endpoints on VNET1
   • CAdd service endpoints on VNET2 and VNET3
   • DConfigure peering between VNET1, VNET2, and VNET3

   Show answer

   Answer: D

   Explanation

   Correct Answer: D Use Virtual network peering to connect virtual networks to be able to connect to other VMs in different VNETs. Virtual network peering enables you to seamlessly connect networks in Azure Virtual Network. The virtual networks appear as one for connectivity purposes. The traffic between virtual machines uses the Microsoft backbone infrastructure. B, C: Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over an optimized route over the Azure backbone network. Endpoints allow you to secure your critical Azure service resources to only your virtual networks. Service Endpoints enables private IP addresses in the VNet to reach the endpoint of an Azure service without needing a public IP address on the VNet.

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 440 · 570 in bank

    HOTSPOT - You have an Azure subscription that contains the Azure virtual machines shown in the following table.

    

    You add inbound security rules to a network security group (NSG) named NSG1 as shown in the following table.

    

    You run Azure Network Watcher as shown in the following exhibit.

    

    You run Network Watcher again as shown in the following exhibit.

    

    For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

    

    This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

    Show the answer figure

    Answer: See figure below

    Explanation

    Box 1: No - It limits traffic to VM2, but not VM1 traffic. Box 2: Yes - Yes, the destination is VM2. Box 3: No - Reference: https://docs.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works

    Source: Adapted from community discussion — mlantonis

    References

    • Microsoft Learn
    • Microsoft Learn

    

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-104 practice, question 431. 570 questions available.