AZ-104 practice questions 501–510

1. Question 501 · 570 in bank

   You have an on-premises datacenter and an Azure subscription. You plan to connect the datacenter to Azure by using ExpressRoute. You need to deploy an ExpressRoute gateway. The solution must meet the following requirements: ✑ Support up to 10 Gbps of traffic. ✑ Support availability zones. ✑ Support FastPath. ✑ Minimize costs. Which SKU should you deploy?

   • AERGw1AZ
   • BERGw2
   • CErGw3
   • DErGw3AZ

   Show answer

   Answer: D

   Explanation

   Questions like these are what make me hate Azure certifications so much. They ask super specific questions that you have to learn by heart, when you shouldn't, and nobody in real life does. Also, they don't allow brain dumps. Instead, they want you to rely on their terrible documentation and only use tests officially supported by Microsoft. Try passing the exam using only that. Yes, you can do it, but seriously, good luck... Perhaps the reason people resort to brain dumps has to do with all that nonsense? I understand they ask complex questions to test your knowledge, but questions like this one are not complex, they are just pure evil.

   Source: Adapted from community discussion — ivan0590

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

2. Question 502 · 570 in bank

   HOTSPOT - You have a virtual network named VNET1 that contains the subnets shown in the following table:

   

   You have Azure virtual machines that have the network configurations shown in the following table:

   

   For NSG1, you create the inbound security rule shown in the following table:

   

   For NSG2, you create the inbound security rule shown in the following table:

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: Yes - The inbound security rule for NSG1 allows TCP port 1433 from 10.10.2.0/24 (or Subnet2 where VM2 and VM3 are located) to 10.10.1.0/24 (or Subnet1 where VM1 is located) while the inbound security rule for NSG2 blocks TCP port 1433 from 10.10.2.5 (or VM2) to 10.10.1.5 (or VM1). However, the NSG1 rule has a higher priority (or lower value) than the NSG2 rule. Box 2: Yes - No rule explicitly blocks communication from VM1. The default rules, which allow communication, are thus applied. Box 3: Yes - No rule explicitly blocks communication between VM2 and VM3 which are both on Subnet2. The default rules, which allow communication, are thus applied. Reference: https://docs.microsoft.com/en-us/azure/virtual-network/security-overview

   Source: Adapted from community discussion — JohnAvlakiotis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

3. Question 503 · 570 in bank

   HOTSPOT - You have an Azure subscription named Subscription1. Subscription1 contains the virtual machines in the following table:

   

   Subscription1 contains a virtual network named VNet1 that has the subnets in the following table:

   

   VM3 has multiple network adapters, including a network adapter named NIC3. IP forwarding is enabled on NIC3. Routing is enabled on VM3. You create a route table named RT1 that contains the routes in the following table:

   

   You apply RT1 to Subnet1 and Subnet2. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   IP forwarding enables the virtual machine a network interface is attached to: ✑ Receive network traffic not destined for one of the IP addresses assigned to any of the IP configurations assigned to the network interface. Send network traffic with a different source IP address than the one assigned to one of a network interface's IP configurations. The setting must be enabled for every network interface that is attached to the virtual machine that receives traffic that the virtual machine needs to forward. A virtual machine can forward traffic whether it has multiple network interfaces or a single network interface attached to it. Box 1: Yes - The routing table allows connections from VM3 to VM1 and VM2. And as IP forwarding is enabled on VM3, VM3 can connect to VM1. Box 2: No - VM3, which has IP forwarding, must be turned on, in order for VM2 to connect to VM1. Box 3: Yes - The routing table allows connections from VM1 and VM2 to VM3. IP forwarding on VM3 allows VM1 to connect to VM2 via VM3. Reference: https://docs.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview https://www.quora.com/What-is-IP-forwarding

   Source: Adapted from community discussion — klexams

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

4. Question 504 · 570 in bank

   Your on-premises network contains an SMB share named Share1. You have an Azure subscription that contains the following resources: ✑ A web app named webapp1 ✑ A virtual network named VNET1 You need to ensure that webapp1 can connect to Share1. What should you deploy?

   • Aan Azure Application Gateway
   • Ban Azure Active Directory (Azure AD) Application Proxy
   • Can Azure Virtual Network Gateway

   Show answer

   Answer: C

   Explanation

   Correct Answer: C A Site-to-Site VPN gateway connection can be used to connect your on-premises network to an Azure virtual network over an IPsec/IKE (IKEv1 or IKEv2) VPN tunnel. This type of connection requires a VPN device, a VPN gateway, located on-premises that has an externally facing public IP address assigned to it. A: Application Gateway is for http, https and Websocket - Not SMB B: Application Proxy is also for accessing web applications on-prem - Not SMB. Application Proxy is a feature of Azure AD that enables users to access on-premises web applications from a remote client. Reference: https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-howto-site-to-site-resource-manager-portal

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   Next question

5. Question 505 · 570 in bank

   Select 2

   You have an Azure subscription that contains the resources shown in the following table.

   

   You create a public IP address named IP1. Which two resources can you associate to IP1? Each correct answer presents a complete solution. NOTE: Each correct selection is worth one point.

   • AVM1
   • BLB1
   • CNIC1
   • DVPN1
   • EVNet1

   Show answer

   Answer: BC

   Explanation

   A public IP address can be associated with resources that require direct internet access, such as virtual machines (via NICs) and load balancers. However, a VPN gateway typically uses its own dedicated public IP address for establishing secure connections between on-premises networks and Azure. VPN1: Uses its own public IP address for secure connections and does not typically share or use a public IP address assigned to other resources. Therefore, the correct resources to associate with IP1 are LB1 and NIC1.

   Source: Adapted from community discussion — Josh219

   References

   • Microsoft Learn

   Next question

6. Question 506 · 570 in bank

   You have an Azure subscription that has a Recovery Services vault named Vault1. The subscription contains the virtual machines shown in the following table:

   

   You plan to schedule backups to occur every night at 23:00. Which virtual machines can you back up by using Azure Backup?

   • AVM1 and VM3 only
   • BVM1, VM2, VM3 and VM4
   • CVM1 and VM2 only
   • DVM1 only

   Show answer

   Answer: B

   Explanation

   Correct Answer: B Azure Backup supports backup of 64-bit Windows server operating system from Windows Server 2008. Azure Backup supports backup of 64-bit Windows 10 operating system. Azure Backup supports backup of 64-bit Ubuntu Server operating system from Ubuntu 12.04. Azure Backup supports backup of VM that are shutdown or offline. The Backup service installs the backup extension whether or not the VM is running.

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn

   Next question

7. Question 507 · 570 in bank

   Your company has a main office in London that contains 100 client computers. Three years ago, you migrated to Azure Active Directory (Azure AD). The company's security policy states that all personal devices and corporate-owned devices must be registered or joined to Azure AD. A remote user named User1 is unable to join a personal device to Azure AD from a home network. You verify that User1 was able to join devices to Azure AD in the past. You need to ensure that User1 can join the device to Azure AD. What should you do?

   • AAssign the User administrator role to User1.
   • BFrom the Device settings blade, modify the Maximum number of devices per user setting.
   • CCreate a point-to-site VPN from the home network of User1 to Azure.
   • DFrom the Device settings blade, modify the Users may join devices to Azure AD setting.

   Show answer

   Answer: B

   Explanation

   Correct Answer: B Keyword: "user was able to connect the device in the past". The Maximum number of devices setting enables you to select the maximum number of devices that a user can have in Azure AD. If a user reaches this quota, they will not be able to add additional devices until one or more of the existing devices are removed. By default, the maximum number of devices per user is 50. Azure portal -> Azure Active Directory -> Devices Azure portal -> Azure Active Directory -> Users > Select a user > Devices

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

8. Question 508 · 570 in bank

   HOTSPOT - You have two Azure App Service app named App1 and App2. Each app has a production deployment slot and a test deployment slot. The Backup Configuration settings for the production slots are shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   NNY On January 15th you will have 9 backups as 0 day retention is defined as indefinite. [How many days to keep a backup before automatically deleting it. Set to 0 for indefinite retention.] https://docs.microsoft.com/en-us/cli/azure/webapp/config/backup?view=azure-cli-latest The DevOps / Web apps backup in the questions only includes the production slot. One cannot restore a test slot from a production slot backup. [If a slot is not specified, the API will create a backup for the production slot.] https://docs.microsoft.com/en-us/rest/api/appservice/web-apps/backup-slot January 6th backup will still be within the 30 days retention as of January 15th.

   Source: Adapted from community discussion — Mozbius_

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 509 · 570 in bank

   HOTSPOT - You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com. The tenant is synced to the on-premises Active Directory domain. The domain contains the users shown in the following table.

   

   You enable self-service password reset (SSPR) for all users and configure SSPR to have the following authentication methods: ✑ Number of methods required to reset: 2 ✑ Methods available to users: Mobile phone, Security questions ✑ Number of questions required to register: 3 ✑ Number of questions required to reset: 3 You select the following security questions: ✑ What is your favorite food? ✑ In what city was your first job? ✑ What was the name of your first pet? For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point. Hot Area:

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   Box 1: No - Administrator accounts are special accounts with elevated permissions. To secure them, the following restrictions apply to changing passwords of administrators: On-premises enterprise administrators or domain administrators cannot reset their password through Self-service password reset (SSPR). They can only change their password in their on-premises environment. Thus, we recommend not syncing on-prem AD admin accounts to Azure AD. An administrator cannot use secret Questions & Answers as a method to reset password. Box 2: Yes - Self-service password reset (SSPR) is an Azure Active Directory feature that enables employees to reset their passwords without needing to contact IT staff. Box 3: Yes - Reference: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-sspr-deployment

   Source: Adapted from community discussion — Mozbius_

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

10. Question 510 · 570 in bank

    Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:

    

    User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com. You need to create new user accounts in external.contoso.onmicrosoft.com. Solution: You instruct User1 to create the user accounts. Does that meet the goal?

    • AYes
    • BNo

    Show answer

    Answer: A

    Explanation

    ARE YOU GUYS HIGH?? IT SAYS User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com." SO IF USER 1 has created the new tenant then obv it can create users within it as well and it is GA.

    Source: Adapted from community discussion — awssecuritynewbie

    References

    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn
    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-104 practice, question 501. 570 questions available.