AZ-104 practice questions 61–70

1. Question 61 · 570 in bank

   HOTSPOT - You have a Microsoft Entra tenant that is linked to the subscriptions shown in the following table.

   

   You have the resource groups shown in the following table.

   

   You assign roles to users as shown in the following table.

   

   For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   YNY 1. User 1 is a contributor of MG2, which cointains sub 3 and VM1. 2. User 2 is a SA Cont on storage 1 only. Can only modify tht. 3. User 3 is a UA Admin at tenant group level. Can assign roles to anything below.

   Source: Adapted from community discussion — alsmk2

   

   Next question

2. Question 62 · 570 in bank

   Your on-premises network contains a VPN gateway. You have an Azure subscription that contains the resources shown in the following table.

   

   You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network. What should you configure?

   • Aa network security group (NSG)
   • Bprivate endpoints
   • CMicrosoft Entra Application Proxy
   • DAzure Virtual WAN

   Show answer

   Answer: B

   Next question

3. Question 63 · 570 in bank

   Select 2

   You have a Microsoft Entra tenant. You plan to perform a bulk import of users. You need to ensure that imported user objects are added automatically as the members of a specific group based on each user's department. The solution must minimize administrative effort. Which two actions should you perform? Each correct answer presents part of the solution. NOTE: Each correct selection is worth one point.

   • ACreate groups that use the Assigned membership type.
   • BCreate an Azure Resource Manager (ARM) template.
   • CCreate groups that use the Dynamic User membership type.
   • DWrite a PowerShell script that parses an import file.
   • ECreate an XML file that contains user information and the appropriate attributes.
   • FCreate a CSV file that contains user information and the appropriate attributes.

   Show answer

   Answer: CF

   Explanation

   Solution Analysis: Dynamic User Membership Type: Azure AD offers dynamic group membership, which automatically adds users to groups based on attributes such as department, job title, etc. By using the Dynamic User membership type, you can create rules (e.g., department equals 'Sales') that automatically manage group membership. This minimizes ongoing administrative effort as users are automatically added/removed from groups based on attribute changes. This solution directly aligns with the requirement to minimize administrative effort and automatically handle group membership. Importing User Information: When performing a bulk import of users, you need a structured format to provide user details such as names, departments, etc. A CSV file is a common format for importing user data into Azure AD. Azure AD supports bulk importing users using a CSV file, which can include attributes necessary for dynamic membership rules (e.g., department).

   Source: Adapted from community discussion — ELearn

   Next question

4. Question 64 · 570 in bank

   You have an Azure subscription that contains a storage account named storage1. You need to ensure that the access keys for storage1 rotate automatically. What should you configure?

   • Aa backup vault
   • Bredundancy for storage1
   • Clifecycle management for storage1
   • Dan Azure key vault
   • Ea Recovery Services vault

   Show answer

   Answer: D

   Explanation

   D: Use Azure Key Vault for Key Management Azure Key Vault is a service that helps manage secrets, keys, and certificates. You can store and manage your storage account keys securely in Key Vault and use its features to automate key rotation.

   Source: Adapted from community discussion — exa104az

   Next question

5. Question 65 · 570 in bank

   You have an Azure subscription that contains the Microsoft Entra identities shown in the following table.

   

   You need to enable self-service password reset (SSPR). For which identities can you enable SSPR in the Azure portal?

   • AUser1 only
   • BGroup1 only
   • CUser1 and Group1 only
   • DGroup1 and Group2 only
   • EUser1, Group1, and Group2

   Show answer

   Answer: D

   Explanation

   The correct answer is D, you can not assign SSPR to individual users it has to be a group. It can be a Security Group or a M365 Group.

   Source: Adapted from community discussion — hnk

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

6. Question 66 · 570 in bank

   DRAG DROP - You have a Microsoft Entra tenant. You need to ensure that when a new Microsoft 365 group is created, the group name is automatically formatted as follows:

   

   Which three actions should you perform in sequence in the Microsoft Entra admin center? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   To ensure that when a new Microsoft 365 group is created, the group name is automatically formatted as , you need to configure a group naming policy in Microsoft Entra (formerly Azure AD). This can be achieved by setting a prefix based on the department attribute. 1- Create a group naming policy: This is the first step to establish the framework for naming groups. 2- Set Add prefix to Attribute: This step specifies that the prefix will be an attribute rather than a static string. 3- Set Select type to Department: Finally, you specify that the 'Department' attribute will be used as the prefix.

   Source: Adapted from community discussion — ELearn

   References

   • Microsoft Learn

   

   Next question

7. Question 67 · 570 in bank

   HOTSPOT - You have a Microsoft Entra tenant that contains the users shown in the following table.

   

   The tenant contains the groups shown in the following table.

   

   Which users and groups can be deleted? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   the given answers are correct: 1st box: you can delete all users (user1,2,3&4) whether a license is assigned directly or via inheritance from a group membership 2nd box: Groups with active license assignments cannot be deleted. so only group 1 & 3 can be deleted

   Source: Adapted from community discussion — ELearn

   

   Next question

8. Question 68 · 570 in bank

   HOTSPOT - You have an Azure subscription that contains the resources shown in the following table.

   

   You plan to use an Azure key vault to provide a secret to app1. What should you create for app1 to access the key vault, and from which key vault can the secret be used? To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

   

   This is an interactive task on the real exam — a drag-and-drop, hotspot or ordering question. There is nothing to select here, so the answer is shown below for reference.

   Show the answer figure

   Answer: See figure below

   Explanation

   You can use a Key Vault in a different resource group and region to provide secrets to your web application in a different resource group and region. Azure allows cross-resource group and cross-region access to Key Vaults, as long as you have the necessary access policies configured. And the answers: Create a: Managed Identity Use the secret from: Vault1, Vault2, or Vault3

   Source: Adapted from community discussion — Chuong0810

   References

   • Microsoft Learn
   • Microsoft Learn
   • Microsoft Learn

   

   Next question

9. Question 69 · 570 in bank

   You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com that contains 100 user accounts. You purchase 10 Azure AD Premium P2 licenses for the tenant. You need to ensure that 10 users can use all the Azure AD Premium features. What should you do?

   • AFrom the Licenses blade of Azure AD, assign a license
   • BFrom the Groups blade of each user, invite the users to a group
   • CFrom the Azure AD domain, add an enterprise application
   • DFrom the Directory role blade of each user, modify the directory role

   Show answer

   Answer: A

   Explanation

   Correct Answer: A Active Directory-> Manage Section > Choose Licenses -> All Products -> Select Azure Active Directory Premium P2 -> Then assign a user to it.

   Source: Adapted from community discussion — mlantonis

   References

   • Microsoft Learn
   • Microsoft Learn

   Next question

10. Question 70 · 570 in bank

    You have a Microsoft Entra tenant named contoso.com. You collaborate with an external partner named fabrikam.com. You plan to invite users in fabrikam.com to the contoso.com tenant. You need to ensure that invitations can be sent only to fabrikam.com users. What should you do in the Microsoft Entra admin center?

    • AFrom Cross-tenant access settings, configure the Tenant restrictions settings.
    • BFrom Cross-tenant access settings, configure the Microsoft cloud settings.
    • CFrom External collaboration settings, configure the Guest user access restrictions settings.
    • DFrom External collaboration settings, configure the Collaboration restrictions settings.

    Show answer

    Answer: D

    Explanation

    Collaboration restrictions settings in Microsoft Entra (formerly Azure AD) are specifically designed to control which external domains can be invited as guests.

    Source: Adapted from community discussion — KAM2023

    References

    • Microsoft Learn

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

AZ-104 practice, question 61. 570 questions available.