AZ 104 Exam
Updated
Questions & Answers
A+ Grade Guaranteed
,You need to define a custom domain name for Azure AD to Answer: D
support the planned infrastructure. Which domain name
should you use? Every Azure AD directory comes with an initial domain name in the form of
domainname.onmicrosoft.com.
A. ad.humongousinsurance.com The initial domain name cannot be changed of deleted, but you can add your
B. humongousinsurance.onmicrosoft.com corporate domain name to AAD as well. Adding custom domain names to Azure AD
C. humongousinsurance.local allows you to assign user names in the directory that are familiar to your users, such
D. humongousinsurance.com as '.' instead of 'alice@domain name.onmicrosoft.com'.
You need to prepare the environment to meet the Answer: BE
authentication requirements. Which two actions should you
perform? Each correct answer presents part of the B: You can gradually roll out Seamless SSO to your users. You start by adding the
solution. NOTE: Each correct selection is worth one point. following Azure AD URL to all or selected users' Intranet zone settings by using
Group Policy in Active Directory: https://autologon.microsoftazuread-sso.com
A. Allow inbound TCP port 8080 to the domain controllers
in the Miami office. E: Seamless SSO works with any method of cloud authentication - Password Hash
Synchronization or Pass-through Authentication, and can be enabled via Azure AD
B. Add http://autogon.microsoftazuread-sso.com to the Connect.
intranet zone of each client computer in the Miami office.
C. Join the client computers in the Miami office to Azure
AD.
D. Install the Active Directory Federation Services (AD FS)
role on a domain controller in the Miami Questions &
Answers PDF P-16 www.dumpskey.com office.
E. Install Azure AD Connect on a server in the Miami office
and enable Pass-through Authentication.
Scenario: Licensing Issue Answer: B
1. You attempt to assign a license in Azure to several
users and receive the following error message: "Licenses Explanation: Some Microsoft services aren't available in all locations because of
not assigned. License agreement failed for one user." local laws and regulations. Before you can assign a license to a user, you must
2. You verify that the Azure subscription has the available specify the Usage location property for the user. You can specify the location under
licenses. the User > Profile > Settings section in the Azure portal.
You need to resolve the licensing issue before you attempt
to assign the license again. What should you do?
A. From the Groups blade, invite the user accounts to a
new group.
B. From the Profile blade, modify the usage location.
C. From the Directory role blade, modify the directory role.
You have an azure subscription named Subscription that Answer: AC
contains the resource groups shown in the following table.
A network interface can exist in the same, or different resource group, than the
RG1 - East Asia virtual machine you attach it to, or the virtual network you connect it to. The virtual
RG2 - East US machine you attach a network interface to and the virtual network you connect it to
must exist in the same location, also referred to as a region. Note, Resource groups
In RG1, you create a virtual machine named VM1 in the can span multiple Regions, but VNets only can hold resources (VMs, Network
East Asia location. You plan to create a virtual network Adapters) that exists in the same region. So in this scenario, you need to create
named VNET1. You need to create VNET, and then VNET1 in any RG and set location as East Asia.
connect VM1 to VNET1. What are two possible ways to
achieve this goal? Each correct answer presents a
complete a solution. NOTE: Each correct selection is worth
one point.
A. Create VNET1 in RG2, and then set East Asia as the
location.
B. Create VNET1 in a new resource group in the West US
location, and then set West US as the location.
C. Create VNET1 in RG1, and then set East Asia as the
location
D. Create VNET1 in RG1, and then set East US as the
location.
E. Create VNET1 in RG2, and then set East US as the
location.
,You have an Azure subscription that contains a storage Answer: AB
account named account1. You plan to upload the disk files
of a virtual machine to account1 from your on-premises By default, storage accounts accept connections from clients on any network. To
network. The on-premises network uses a public IP limit access to selected networks, you must first change the default action. Azure
address space of 131.107.1.0/24. You plan to use the disk portal
files to provision an Azure virtual machine named VM1. 1. Navigate to the storage account you want to secure. 2. Click on the settings
VM1 will be attached to a virtual network named VNet1. menu called Firewalls and virtual networks.
VNet1 uses an IP address space of 192.168.0.0/24. You 3. To deny access by default, choose to allow access from 'Selected networks'. To
need to configure account1 to meet the following allow traffic from all networks, choose to allow access from 'All networks'.
requirements: Ensure that you can upload the disk files to 4. Click Save to apply your changes. Grant access from a Virtual Network Storage
account1. Ensure that you can attach the disks to VM1. accounts can be configured to allow access only from specific Azure Virtual
Prevent all other access to account1. Which two actions Networks. By enabling a Service Endpoint for Azure Storage within the Virtual
should you perform? Each correct selection presents part Network, traffic is ensured an optimal route to the Azure Storage service. The
of the solution. NOTE: Each correct selection is worth one identities of the virtual network and the subnet are also transmitted with each
point. request.
A. From the Firewalls and virtual networks blade of
account1, add the 131.107.1.0/24 IP address range.
B. From the Firewalls and virtual networks blade of
account1, select Selected networks.
C. From the Firewalls and virtual networks blade of
acount1, add VNet1.
D. From the Firewalls and virtual networks blade of
account1, select Allow trusted Microsoft services to access
this storage account.
E. From the Service endpoints blade of VNet1, add a
service endpoint.
You have an Azure Active Directory (Azure AD) tenant Answer: B
named contosocloud.onmicrosoft.com. Your company has
a public DNS zone for contoso.com. You add contoso.com TXT or MX : Correct You can use either a TXT or MX record to verify the custom
as a custom domain name to Azure AD. You need to domain in the Azure AD. MX records can serve the purpose of TXT records
ensure that Azure can verify the domain name. Which type Questions & Answers PDF P-56 www.dumpskey.com
of DNS record should you create?
SRV : Incorrect SRV records are used by various services to specify server
A. PTR locations. When specifying an SRV record in Azure DNS
B. MX DNSKEY : Incorrect Choice This will verify that the records are originating from an
C. NSEC3 authorized sender. NSEC : Incorrect Choice This is Part of DNSSEC. This is used
D. RRSIG for explicit denial-of-existence of a DNS record. It is used to prove a name does not
exist.
You have an Azure virtual machine named VM1. Azure Answer: B
collects events from VM1. You are creating an alert rule in
Azure Monitor to notify an administrator when an error is Explanation: Azure Monitor can collect data directly from your Azure virtual
logged in the System event log of VM1. You need to machines into a Log Analytics workspace for analysis of details and correlations.
specify which resource type to monitor. What should you Installing the Log Analytics VM extension for Windows and Linux allows Azure
specify? Monitor to collect data from your Azure VMs. Azure Log Analytics workspace is also
used for on-premises computers monitored by System Center Operations Manager.
A. metric alert
B. Azure Log Analytics workspace
C. virtual machine
D. virtual machine extension
You have two Azure virtual machines named VM1 and Answer: D
VM2. You have two Recovery Services vaults named
RSV1 and RSV2. VM2 is protected by RSV1. You need to The Azure Site Recovery service contributes to your disaster recovery strategy by
use RSV2 to protect VM2. What should you do first? managing and orchestrating replication, failover, and failback of on-premises
machines and Azure virtual machines (VMs).
A. From the RSV1 blade, click Backup items and stop the
VM2 backup.
B. From the RSV1 blade, click Backup Jobs and export the
VM2 backup.
C. From the RSV1 blade, click Backup. From the Backup
blade, select the backup for the virtual machine, and then
click Backup.
D. From the VM2 blade, click Disaster recovery, click
Replication settings, and then select RSV2 as the
Recovery Services vault
, You have an Azure subscription that contains a web app Answer: B
named webapp1. You need to add a custom domain
named www.contoso.com to webapp1. What should you
do first?
A. Upload a certificate.
B. Add a connection string.
C. Stop webapp1.
D. Create a DNS record.
You create an App Service plan named App1 and an Azure Answer: C
web app named webapp1. You discover that the option to
create a staging slot is unavailable. You need to create a Scale up: Get more CPU, memory, disk space, and extra features like dedicated
staging slot for App1. What should you do first? virtual machines (VMs), custom domains and certificates, staging slots, autoscaling,
and more. You scale up by changing the pricing tier of the App Service plan that
A. From webapp1, modify the Application settings. your app belongs to.
B. From webapp1, add a custom domain.
C. From App1, scale up the App Service plan.
D. From App1, scale out the App Service plan.
You download an Azure Resource Manager template Answer: C
based on an existing virtual machine. The template will be
used to deploy 100 virtual machines. You need to modify Explanation: You can use a template that allows you to deploy a simple Windows
the template to reference an administrative password. You VM by retrieving the password that is stored in a Key Vault. Therefore the password
must prevent the password from being stored in plain text. is never put in plain text in the template parameter file
What should you create to store the password? Questions
& Answers PDF P-73 www.dumpskey.com
A. Azure Active Directory (AD) Identity Protection and an
Azure policy
B. a Recovery Services vault and a backup policy
C. an Azure Key Vault and an access policy
D. an Azure Storage account and an access policy
You plan to use the Azure Import/Export service to copy Answer: BC
files to a storage account. Which two files should you
create before you prepare the drives for the import job? Explanation: B: Modify the driveset.csv file in the root folder where the tool resides.
Each correct answer presents part of the solution. NOTE: C: Modify the dataset.csv file in the root folder where the tool resides. Depending on
Each correct selection is worth one point. A. an XML whether you want to import a file or folder or both, add entries in the dataset.csv file
manifest file
B. a driveset CSV file
C. a dataset CSV file
D. a PowerShell PS1 file
E. a JSON configuration file
You have an Azure subscription named Subscription1. You Answer: D
have 5 TB of data that you need to transfer to
Subscription1. You plan to use an Azure Import/Export job. Explanation: Azure Import/Export service is used to securely import large amounts
What can you use as the destination of the imported data? of data to Azure Blob storage and Azure Files by shipping disk drives to an Azure
A. Azure Data Lake Store datacenter. The maximum size of an Azure Files Resource of a file share is 5 TB.
B. a virtual machine
C. the Azure File Sync Storage Sync Service
D. Azure Blob storage
You have an Azure subscription that contains the following Answer: C
resources: 100 Azure virtual machines 20 Azure SQL
databases 50 Azure file shares You need to create a daily Explanation: There is a limit of 100 VMs that can be associated to the same backup
backup of all the resources by using Azure Backup. What policy from portal. We recommend that for more than 100 VMs, create multiple
is the minimum number of backup policies that you must backup policies with same schedule or different schedule. One policy for VMS, one
create? for SQL databases, and one for the file shares.
A. 1
B. 2
C. 3
D. 150
E. 170
Updated
Questions & Answers
A+ Grade Guaranteed
,You need to define a custom domain name for Azure AD to Answer: D
support the planned infrastructure. Which domain name
should you use? Every Azure AD directory comes with an initial domain name in the form of
domainname.onmicrosoft.com.
A. ad.humongousinsurance.com The initial domain name cannot be changed of deleted, but you can add your
B. humongousinsurance.onmicrosoft.com corporate domain name to AAD as well. Adding custom domain names to Azure AD
C. humongousinsurance.local allows you to assign user names in the directory that are familiar to your users, such
D. humongousinsurance.com as '.' instead of 'alice@domain name.onmicrosoft.com'.
You need to prepare the environment to meet the Answer: BE
authentication requirements. Which two actions should you
perform? Each correct answer presents part of the B: You can gradually roll out Seamless SSO to your users. You start by adding the
solution. NOTE: Each correct selection is worth one point. following Azure AD URL to all or selected users' Intranet zone settings by using
Group Policy in Active Directory: https://autologon.microsoftazuread-sso.com
A. Allow inbound TCP port 8080 to the domain controllers
in the Miami office. E: Seamless SSO works with any method of cloud authentication - Password Hash
Synchronization or Pass-through Authentication, and can be enabled via Azure AD
B. Add http://autogon.microsoftazuread-sso.com to the Connect.
intranet zone of each client computer in the Miami office.
C. Join the client computers in the Miami office to Azure
AD.
D. Install the Active Directory Federation Services (AD FS)
role on a domain controller in the Miami Questions &
Answers PDF P-16 www.dumpskey.com office.
E. Install Azure AD Connect on a server in the Miami office
and enable Pass-through Authentication.
Scenario: Licensing Issue Answer: B
1. You attempt to assign a license in Azure to several
users and receive the following error message: "Licenses Explanation: Some Microsoft services aren't available in all locations because of
not assigned. License agreement failed for one user." local laws and regulations. Before you can assign a license to a user, you must
2. You verify that the Azure subscription has the available specify the Usage location property for the user. You can specify the location under
licenses. the User > Profile > Settings section in the Azure portal.
You need to resolve the licensing issue before you attempt
to assign the license again. What should you do?
A. From the Groups blade, invite the user accounts to a
new group.
B. From the Profile blade, modify the usage location.
C. From the Directory role blade, modify the directory role.
You have an azure subscription named Subscription that Answer: AC
contains the resource groups shown in the following table.
A network interface can exist in the same, or different resource group, than the
RG1 - East Asia virtual machine you attach it to, or the virtual network you connect it to. The virtual
RG2 - East US machine you attach a network interface to and the virtual network you connect it to
must exist in the same location, also referred to as a region. Note, Resource groups
In RG1, you create a virtual machine named VM1 in the can span multiple Regions, but VNets only can hold resources (VMs, Network
East Asia location. You plan to create a virtual network Adapters) that exists in the same region. So in this scenario, you need to create
named VNET1. You need to create VNET, and then VNET1 in any RG and set location as East Asia.
connect VM1 to VNET1. What are two possible ways to
achieve this goal? Each correct answer presents a
complete a solution. NOTE: Each correct selection is worth
one point.
A. Create VNET1 in RG2, and then set East Asia as the
location.
B. Create VNET1 in a new resource group in the West US
location, and then set West US as the location.
C. Create VNET1 in RG1, and then set East Asia as the
location
D. Create VNET1 in RG1, and then set East US as the
location.
E. Create VNET1 in RG2, and then set East US as the
location.
,You have an Azure subscription that contains a storage Answer: AB
account named account1. You plan to upload the disk files
of a virtual machine to account1 from your on-premises By default, storage accounts accept connections from clients on any network. To
network. The on-premises network uses a public IP limit access to selected networks, you must first change the default action. Azure
address space of 131.107.1.0/24. You plan to use the disk portal
files to provision an Azure virtual machine named VM1. 1. Navigate to the storage account you want to secure. 2. Click on the settings
VM1 will be attached to a virtual network named VNet1. menu called Firewalls and virtual networks.
VNet1 uses an IP address space of 192.168.0.0/24. You 3. To deny access by default, choose to allow access from 'Selected networks'. To
need to configure account1 to meet the following allow traffic from all networks, choose to allow access from 'All networks'.
requirements: Ensure that you can upload the disk files to 4. Click Save to apply your changes. Grant access from a Virtual Network Storage
account1. Ensure that you can attach the disks to VM1. accounts can be configured to allow access only from specific Azure Virtual
Prevent all other access to account1. Which two actions Networks. By enabling a Service Endpoint for Azure Storage within the Virtual
should you perform? Each correct selection presents part Network, traffic is ensured an optimal route to the Azure Storage service. The
of the solution. NOTE: Each correct selection is worth one identities of the virtual network and the subnet are also transmitted with each
point. request.
A. From the Firewalls and virtual networks blade of
account1, add the 131.107.1.0/24 IP address range.
B. From the Firewalls and virtual networks blade of
account1, select Selected networks.
C. From the Firewalls and virtual networks blade of
acount1, add VNet1.
D. From the Firewalls and virtual networks blade of
account1, select Allow trusted Microsoft services to access
this storage account.
E. From the Service endpoints blade of VNet1, add a
service endpoint.
You have an Azure Active Directory (Azure AD) tenant Answer: B
named contosocloud.onmicrosoft.com. Your company has
a public DNS zone for contoso.com. You add contoso.com TXT or MX : Correct You can use either a TXT or MX record to verify the custom
as a custom domain name to Azure AD. You need to domain in the Azure AD. MX records can serve the purpose of TXT records
ensure that Azure can verify the domain name. Which type Questions & Answers PDF P-56 www.dumpskey.com
of DNS record should you create?
SRV : Incorrect SRV records are used by various services to specify server
A. PTR locations. When specifying an SRV record in Azure DNS
B. MX DNSKEY : Incorrect Choice This will verify that the records are originating from an
C. NSEC3 authorized sender. NSEC : Incorrect Choice This is Part of DNSSEC. This is used
D. RRSIG for explicit denial-of-existence of a DNS record. It is used to prove a name does not
exist.
You have an Azure virtual machine named VM1. Azure Answer: B
collects events from VM1. You are creating an alert rule in
Azure Monitor to notify an administrator when an error is Explanation: Azure Monitor can collect data directly from your Azure virtual
logged in the System event log of VM1. You need to machines into a Log Analytics workspace for analysis of details and correlations.
specify which resource type to monitor. What should you Installing the Log Analytics VM extension for Windows and Linux allows Azure
specify? Monitor to collect data from your Azure VMs. Azure Log Analytics workspace is also
used for on-premises computers monitored by System Center Operations Manager.
A. metric alert
B. Azure Log Analytics workspace
C. virtual machine
D. virtual machine extension
You have two Azure virtual machines named VM1 and Answer: D
VM2. You have two Recovery Services vaults named
RSV1 and RSV2. VM2 is protected by RSV1. You need to The Azure Site Recovery service contributes to your disaster recovery strategy by
use RSV2 to protect VM2. What should you do first? managing and orchestrating replication, failover, and failback of on-premises
machines and Azure virtual machines (VMs).
A. From the RSV1 blade, click Backup items and stop the
VM2 backup.
B. From the RSV1 blade, click Backup Jobs and export the
VM2 backup.
C. From the RSV1 blade, click Backup. From the Backup
blade, select the backup for the virtual machine, and then
click Backup.
D. From the VM2 blade, click Disaster recovery, click
Replication settings, and then select RSV2 as the
Recovery Services vault
, You have an Azure subscription that contains a web app Answer: B
named webapp1. You need to add a custom domain
named www.contoso.com to webapp1. What should you
do first?
A. Upload a certificate.
B. Add a connection string.
C. Stop webapp1.
D. Create a DNS record.
You create an App Service plan named App1 and an Azure Answer: C
web app named webapp1. You discover that the option to
create a staging slot is unavailable. You need to create a Scale up: Get more CPU, memory, disk space, and extra features like dedicated
staging slot for App1. What should you do first? virtual machines (VMs), custom domains and certificates, staging slots, autoscaling,
and more. You scale up by changing the pricing tier of the App Service plan that
A. From webapp1, modify the Application settings. your app belongs to.
B. From webapp1, add a custom domain.
C. From App1, scale up the App Service plan.
D. From App1, scale out the App Service plan.
You download an Azure Resource Manager template Answer: C
based on an existing virtual machine. The template will be
used to deploy 100 virtual machines. You need to modify Explanation: You can use a template that allows you to deploy a simple Windows
the template to reference an administrative password. You VM by retrieving the password that is stored in a Key Vault. Therefore the password
must prevent the password from being stored in plain text. is never put in plain text in the template parameter file
What should you create to store the password? Questions
& Answers PDF P-73 www.dumpskey.com
A. Azure Active Directory (AD) Identity Protection and an
Azure policy
B. a Recovery Services vault and a backup policy
C. an Azure Key Vault and an access policy
D. an Azure Storage account and an access policy
You plan to use the Azure Import/Export service to copy Answer: BC
files to a storage account. Which two files should you
create before you prepare the drives for the import job? Explanation: B: Modify the driveset.csv file in the root folder where the tool resides.
Each correct answer presents part of the solution. NOTE: C: Modify the dataset.csv file in the root folder where the tool resides. Depending on
Each correct selection is worth one point. A. an XML whether you want to import a file or folder or both, add entries in the dataset.csv file
manifest file
B. a driveset CSV file
C. a dataset CSV file
D. a PowerShell PS1 file
E. a JSON configuration file
You have an Azure subscription named Subscription1. You Answer: D
have 5 TB of data that you need to transfer to
Subscription1. You plan to use an Azure Import/Export job. Explanation: Azure Import/Export service is used to securely import large amounts
What can you use as the destination of the imported data? of data to Azure Blob storage and Azure Files by shipping disk drives to an Azure
A. Azure Data Lake Store datacenter. The maximum size of an Azure Files Resource of a file share is 5 TB.
B. a virtual machine
C. the Azure File Sync Storage Sync Service
D. Azure Blob storage
You have an Azure subscription that contains the following Answer: C
resources: 100 Azure virtual machines 20 Azure SQL
databases 50 Azure file shares You need to create a daily Explanation: There is a limit of 100 VMs that can be associated to the same backup
backup of all the resources by using Azure Backup. What policy from portal. We recommend that for more than 100 VMs, create multiple
is the minimum number of backup policies that you must backup policies with same schedule or different schedule. One policy for VMS, one
create? for SQL databases, and one for the file shares.
A. 1
B. 2
C. 3
D. 150
E. 170
