AZ 104 AZURE NETWORKING RENEWAL
EXAM 2024 QUESTIONS AND ACTUAL
ANSWERS
You -need -to -define -a -custom -domain -name -for -Azure -AD -to -support -the -planned -
infrastructure. -Which -domain -name -should -you -use? -
A. -ad.humongousinsurance.com -
B. -humongousinsurance.onmicrosoft.com -
C. -humongousinsurance.local -
D. -humongousinsurance.com -- -CORRECT -ANSWER-Answer: -D
Every -Azure -AD -directory -comes -with -an -initial -domain -name -in -the -form -of -
domainname.onmicrosoft.com.
The -initial -domain -name -cannot -be -changed -of -deleted, -but -you -can -add -your -corporate -
domain -name -to -AAD -as -well. -Adding -custom -domain -names -to -Azure -AD -allows -you -to -
assign -user -names -in -the -directory -that -are -familiar -to -your -users, -such -as -
'.' -instead -of -'alice@domain -name.onmicrosoft.com'.
You -need -to -prepare -the -environment -to -meet -the -authentication -requirements. -Which -two -
actions -should -you -perform? -Each -correct -answer -presents -part -of -the -solution. -NOTE: -Each -
correct -selection -is -worth -one -point. -
A. -Allow -inbound -TCP -port -8080 -to -the -domain -controllers -in -the -Miami -office. -
B. -Add -http://autogon.microsoftazuread-sso.com -to -the -intranet -zone -of -each -client -computer -in
-the -Miami -office. -
C. -Join -the -client -computers -in -the -Miami -office -to -Azure -AD. -
D. -Install -the -Active -Di -- -CORRECT -ANSWER-Answer: -BE
,B: -You -can -gradually -roll -out -Seamless -SSO -to -your -users. -You -start -by -adding -the -following -
Azure -AD -URL -to -all -or -selected -users' -Intranet -zone -settings -by -using -Group -Policy -in -Active -
Directory: -https://autologon.microsoftazuread-sso.com -
E: -Seamless -SSO -works -with -any -method -of -cloud -authentication -- -Password -Hash -
Synchronization -or -Pass-through -Authentication, -and -can -be -enabled -via -Azure -AD -Connect.
Scenario: -Licensing -Issue -
1. -You -attempt -to -assign -a -license -in -Azure -to -several -users -and -receive -the -following -error -
message: -"Licenses -not -assigned. -License -agreement -failed -for -one -user." -
2. -You -verify -that -the -Azure -subscription -has -the -available -licenses.
You -need -to -resolve -the -licensing -issue -before -you -attempt -to -assign -the -license -again. -What -
should -you -do? -
A. -From -the -Groups -blade, -invite -the -user -accounts -to -a -new -group. -
B. -From -the -Profile -blade, -modify -the -usage -location. -
C. -- -CORRECT -ANSWER-Answer: -B
Explanation: -Some -Microsoft -services -aren't -available -in -all -locations -because -of -local -laws -and
-regulations. -Before -you -can -assign -a -license -to -a -user, -you -must -specify -the -Usage -location -
property -for -the -user. -You -can -specify -the -location -under -the -User -> -Profile -> -Settings -section
-in -the -Azure -portal.
You -have -an -azure -subscription -named -Subscription -that -contains -the -resource -groups -shown -in
-the -following -table. -
RG1 -- -East -Asia
RG2 -- -East -US
In -RG1, -you -create -a -virtual -machine -named -VM1 -in -the -East -Asia -location. -You -plan -to -
create -a -virtual -network -named -VNET1. -You -need -to -create -VNET, -and -then -connect -VM1 -to -
,VNET1. -What -are -two -possible -ways -to -achieve -this -goal? -Each -correct -answer -presents -a -
complete -a -solution. -NOTE: -Each -correct -selection -is -worth -one -point. -
A. -Create -VNET1 -in -RG -- -CORRECT -ANSWER-Answer: -AC
A -network -interface -can -exist -in -the -same, -or -different -resource -group, -than -the -virtual -
machine -you -attach -it -to, -or -the -virtual -network -you -connect -it -to. -The -virtual -machine -you -
attach -a -network -interface -to -and -the -virtual -network -you -connect -it -to -must -exist -in -the -
same -location, -also -referred -to -as -a -region. -Note, -Resource -groups -can -span -multiple -Regions, -
but -VNets -only -can -hold -resources -(VMs, -Network -Adapters) -that -exists -in -the -same -region. -So
-in -this -scenario, -you -need -to -create -VNET1 -in -any -RG -and -set -location -as -East -Asia.
You -have -an -Azure -subscription -that -contains -a -storage -account -named -account1. -You -plan -to -
upload -the -disk -files -of -a -virtual -machine -to -account1 -from -your -on-premises -network. -The -
on-premises -network -uses -a -public -IP -address -space -of -131.107.1.0/24. -You -plan -to -use -the -
disk -files -to -provision -an -Azure -virtual -machine -named -VM1. -VM1 -will -be -attached -to -a -
virtual -network -named -VNet1. -VNet1 -uses -an -IP -address -space -of -192.168.0.0/24. -You -need -to
-configure -account1 -to -meet -the -following -requirement -- -CORRECT -ANSWER-Answer: -AB
By -default, -storage -accounts -accept -connections -from -clients -on -any -network. -To -limit -access -
to -selected -networks, -you -must -first -change -the -default -action. -Azure -portal -
1. -Navigate -to -the -storage -account -you -want -to -secure. -2. -Click -on -the -settings -menu -called -
Firewalls -and -virtual -networks. -
3. -To -deny -access -by -default, -choose -to -allow -access -from -'Selected -networks'. -To -allow -traffic
-from -all -networks, -choose -to -allow -access -from -'All -networks'. -
4. -Click -Save -to -apply -your -changes. -Grant -access -from -a -Virtual -Network -Storage -accounts -
can -be -configured -to -allow -access -only -from -specific -Azure -Virtual -Networks. -By -enabling -a -
Service -Endpoint -for -Azure -Storage -within -the -Virtual -Network, -traffic -is -ensured -an -optimal -
route -to -the -Azure -Storage -service. -The -identities -of -the -virtual -network -and -the -subnet -are -
also -transmitted -with -each -request.
You -have -an -Azure -Active -Directory -(Azure -AD) -tenant -named -contosocloud.onmicrosoft.com. -
Your -company -has -a -public -DNS -zone -for -contoso.com. -You -add -contoso.com -as -a -custom -
domain -name -to -Azure -AD. -You -need -to -ensure -that -Azure -can -verify -the -domain -name. -
Which -type -of -DNS -record -should -you -create? -
, A. -PTR -
B. -MX -
C. -NSEC3 -
D. -RRSIG -- -CORRECT -ANSWER-Answer: -B
TXT -or -MX -: -Correct -You -can -use -either -a -TXT -or -MX -record -to -verify -the -custom -domain -in
-the -Azure -AD. -MX -records -can -serve -the -purpose -of -TXT -records -Questions -& -Answers -PDF -
P-56 -www.dumpskey.com -
SRV -: -Incorrect -SRV -records -are -used -by -various -services -to -specify -server -locations. -When -
specifying -an -SRV -record -in -Azure -DNS -
DNSKEY -: -Incorrect -Choice -This -will -verify -that -the -records -are -originating -from -an -authorized -
sender. -NSEC -: -Incorrect -Choice -This -is -Part -of -DNSSEC. -This -is -used -for -explicit -denial-of-
existence -of -a -DNS -record. -It -is -used -to -prove -a -name -does -not -exist.
You -have -an -Azure -virtual -machine -named -VM1. -Azure -collects -events -from -VM1. -You -are -
creating -an -alert -rule -in -Azure -Monitor -to -notify -an -administrator -when -an -error -is -logged -in -
the -System -event -log -of -VM1. -You -need -to -specify -which -resource -type -to -monitor. -What -
should -you -specify?
A. -metric -alert -
B. -Azure -Log -Analytics -workspace -
C. -virtual -machine -
D. -virtual -machine -extension -- -CORRECT -ANSWER-Answer: -B
Explanation: -Azure -Monitor -can -collect -data -directly -from -your -Azure -virtual -machines -into -a -
Log -Analytics -workspace -for -analysis -of -details -and -correlations. -Installing -the -Log -Analytics -VM
-extension -for -Windows -and -Linux -allows -Azure -Monitor -to -collect -data -from -your -Azure -VMs.
-Azure -Log -Analytics -workspace -is -also -used -for -on-premises -computers -monitored -by -System -
Center -Operations -Manager.
You -have -two -Azure -virtual -machines -named -VM1 -and -VM2. -You -have -two -Recovery -Services -
vaults -named -RSV1 -and -RSV2. -VM2 -is -protected -by -RSV1. -You -need -to -use -RSV2 -to -protect -
VM2. -What -should -you -do -first? -
EXAM 2024 QUESTIONS AND ACTUAL
ANSWERS
You -need -to -define -a -custom -domain -name -for -Azure -AD -to -support -the -planned -
infrastructure. -Which -domain -name -should -you -use? -
A. -ad.humongousinsurance.com -
B. -humongousinsurance.onmicrosoft.com -
C. -humongousinsurance.local -
D. -humongousinsurance.com -- -CORRECT -ANSWER-Answer: -D
Every -Azure -AD -directory -comes -with -an -initial -domain -name -in -the -form -of -
domainname.onmicrosoft.com.
The -initial -domain -name -cannot -be -changed -of -deleted, -but -you -can -add -your -corporate -
domain -name -to -AAD -as -well. -Adding -custom -domain -names -to -Azure -AD -allows -you -to -
assign -user -names -in -the -directory -that -are -familiar -to -your -users, -such -as -
'.' -instead -of -'alice@domain -name.onmicrosoft.com'.
You -need -to -prepare -the -environment -to -meet -the -authentication -requirements. -Which -two -
actions -should -you -perform? -Each -correct -answer -presents -part -of -the -solution. -NOTE: -Each -
correct -selection -is -worth -one -point. -
A. -Allow -inbound -TCP -port -8080 -to -the -domain -controllers -in -the -Miami -office. -
B. -Add -http://autogon.microsoftazuread-sso.com -to -the -intranet -zone -of -each -client -computer -in
-the -Miami -office. -
C. -Join -the -client -computers -in -the -Miami -office -to -Azure -AD. -
D. -Install -the -Active -Di -- -CORRECT -ANSWER-Answer: -BE
,B: -You -can -gradually -roll -out -Seamless -SSO -to -your -users. -You -start -by -adding -the -following -
Azure -AD -URL -to -all -or -selected -users' -Intranet -zone -settings -by -using -Group -Policy -in -Active -
Directory: -https://autologon.microsoftazuread-sso.com -
E: -Seamless -SSO -works -with -any -method -of -cloud -authentication -- -Password -Hash -
Synchronization -or -Pass-through -Authentication, -and -can -be -enabled -via -Azure -AD -Connect.
Scenario: -Licensing -Issue -
1. -You -attempt -to -assign -a -license -in -Azure -to -several -users -and -receive -the -following -error -
message: -"Licenses -not -assigned. -License -agreement -failed -for -one -user." -
2. -You -verify -that -the -Azure -subscription -has -the -available -licenses.
You -need -to -resolve -the -licensing -issue -before -you -attempt -to -assign -the -license -again. -What -
should -you -do? -
A. -From -the -Groups -blade, -invite -the -user -accounts -to -a -new -group. -
B. -From -the -Profile -blade, -modify -the -usage -location. -
C. -- -CORRECT -ANSWER-Answer: -B
Explanation: -Some -Microsoft -services -aren't -available -in -all -locations -because -of -local -laws -and
-regulations. -Before -you -can -assign -a -license -to -a -user, -you -must -specify -the -Usage -location -
property -for -the -user. -You -can -specify -the -location -under -the -User -> -Profile -> -Settings -section
-in -the -Azure -portal.
You -have -an -azure -subscription -named -Subscription -that -contains -the -resource -groups -shown -in
-the -following -table. -
RG1 -- -East -Asia
RG2 -- -East -US
In -RG1, -you -create -a -virtual -machine -named -VM1 -in -the -East -Asia -location. -You -plan -to -
create -a -virtual -network -named -VNET1. -You -need -to -create -VNET, -and -then -connect -VM1 -to -
,VNET1. -What -are -two -possible -ways -to -achieve -this -goal? -Each -correct -answer -presents -a -
complete -a -solution. -NOTE: -Each -correct -selection -is -worth -one -point. -
A. -Create -VNET1 -in -RG -- -CORRECT -ANSWER-Answer: -AC
A -network -interface -can -exist -in -the -same, -or -different -resource -group, -than -the -virtual -
machine -you -attach -it -to, -or -the -virtual -network -you -connect -it -to. -The -virtual -machine -you -
attach -a -network -interface -to -and -the -virtual -network -you -connect -it -to -must -exist -in -the -
same -location, -also -referred -to -as -a -region. -Note, -Resource -groups -can -span -multiple -Regions, -
but -VNets -only -can -hold -resources -(VMs, -Network -Adapters) -that -exists -in -the -same -region. -So
-in -this -scenario, -you -need -to -create -VNET1 -in -any -RG -and -set -location -as -East -Asia.
You -have -an -Azure -subscription -that -contains -a -storage -account -named -account1. -You -plan -to -
upload -the -disk -files -of -a -virtual -machine -to -account1 -from -your -on-premises -network. -The -
on-premises -network -uses -a -public -IP -address -space -of -131.107.1.0/24. -You -plan -to -use -the -
disk -files -to -provision -an -Azure -virtual -machine -named -VM1. -VM1 -will -be -attached -to -a -
virtual -network -named -VNet1. -VNet1 -uses -an -IP -address -space -of -192.168.0.0/24. -You -need -to
-configure -account1 -to -meet -the -following -requirement -- -CORRECT -ANSWER-Answer: -AB
By -default, -storage -accounts -accept -connections -from -clients -on -any -network. -To -limit -access -
to -selected -networks, -you -must -first -change -the -default -action. -Azure -portal -
1. -Navigate -to -the -storage -account -you -want -to -secure. -2. -Click -on -the -settings -menu -called -
Firewalls -and -virtual -networks. -
3. -To -deny -access -by -default, -choose -to -allow -access -from -'Selected -networks'. -To -allow -traffic
-from -all -networks, -choose -to -allow -access -from -'All -networks'. -
4. -Click -Save -to -apply -your -changes. -Grant -access -from -a -Virtual -Network -Storage -accounts -
can -be -configured -to -allow -access -only -from -specific -Azure -Virtual -Networks. -By -enabling -a -
Service -Endpoint -for -Azure -Storage -within -the -Virtual -Network, -traffic -is -ensured -an -optimal -
route -to -the -Azure -Storage -service. -The -identities -of -the -virtual -network -and -the -subnet -are -
also -transmitted -with -each -request.
You -have -an -Azure -Active -Directory -(Azure -AD) -tenant -named -contosocloud.onmicrosoft.com. -
Your -company -has -a -public -DNS -zone -for -contoso.com. -You -add -contoso.com -as -a -custom -
domain -name -to -Azure -AD. -You -need -to -ensure -that -Azure -can -verify -the -domain -name. -
Which -type -of -DNS -record -should -you -create? -
, A. -PTR -
B. -MX -
C. -NSEC3 -
D. -RRSIG -- -CORRECT -ANSWER-Answer: -B
TXT -or -MX -: -Correct -You -can -use -either -a -TXT -or -MX -record -to -verify -the -custom -domain -in
-the -Azure -AD. -MX -records -can -serve -the -purpose -of -TXT -records -Questions -& -Answers -PDF -
P-56 -www.dumpskey.com -
SRV -: -Incorrect -SRV -records -are -used -by -various -services -to -specify -server -locations. -When -
specifying -an -SRV -record -in -Azure -DNS -
DNSKEY -: -Incorrect -Choice -This -will -verify -that -the -records -are -originating -from -an -authorized -
sender. -NSEC -: -Incorrect -Choice -This -is -Part -of -DNSSEC. -This -is -used -for -explicit -denial-of-
existence -of -a -DNS -record. -It -is -used -to -prove -a -name -does -not -exist.
You -have -an -Azure -virtual -machine -named -VM1. -Azure -collects -events -from -VM1. -You -are -
creating -an -alert -rule -in -Azure -Monitor -to -notify -an -administrator -when -an -error -is -logged -in -
the -System -event -log -of -VM1. -You -need -to -specify -which -resource -type -to -monitor. -What -
should -you -specify?
A. -metric -alert -
B. -Azure -Log -Analytics -workspace -
C. -virtual -machine -
D. -virtual -machine -extension -- -CORRECT -ANSWER-Answer: -B
Explanation: -Azure -Monitor -can -collect -data -directly -from -your -Azure -virtual -machines -into -a -
Log -Analytics -workspace -for -analysis -of -details -and -correlations. -Installing -the -Log -Analytics -VM
-extension -for -Windows -and -Linux -allows -Azure -Monitor -to -collect -data -from -your -Azure -VMs.
-Azure -Log -Analytics -workspace -is -also -used -for -on-premises -computers -monitored -by -System -
Center -Operations -Manager.
You -have -two -Azure -virtual -machines -named -VM1 -and -VM2. -You -have -two -Recovery -Services -
vaults -named -RSV1 -and -RSV2. -VM2 -is -protected -by -RSV1. -You -need -to -use -RSV2 -to -protect -
VM2. -What -should -you -do -first? -
