Az-104

Multiple choice
Another IT administrator creates an Azure virtual machine scale set with 5 VMs. Later, you notice
that the VMs are all running at max capacity with the CPU being fully consumed. However,
additional VMs are not deploying in the scale set. You need to ensure that additional VMs are
deployed when the CPU is 75% consumed. What should you do?
Select one.
■ Enable the autoscale option.
† Increase the instance count.
† Add the scale set automation script to the library

Multiple choice
Your organization has an app that is used across the business. The performance of this app is
critical
to day-to-day operations. Because the app is so important, four IT administrators have been
identified to address any issues. You have configured an alert and need to ensure the
administrators
are notified if there is a problem. In which area of the portal will you provide the administrator
email
addresses?
Select one.
† Activity log
† Performance group
■ Action Group

Multiple choice
You are using blob storage. Which of the following is true? Select one.
† The cool access tier is for frequent access of objects in the storage account.
† The hot access tier is for storing large amounts of data that is infrequently accessed.
■ You can switch between hot and cool performance tiers at any time.

Multiple choice
You are configuring VNet Peering across two Azure two virtual networks, VNET1 and VNET2. You
are
configuring the VPN Gateways. You want VNET2 to be able to use to VNET1's gateway to get to
resources outside the peering. What should you do?
Select one.
■ Select allow gateway transit on VNET1 and use remote gateways on VNET2.
† Select allow gateway transit on VNET2 and use remote gateways on VNET1.
† Select allow gateway transit and use remote gateways on both VNET1 and VNET2.

Multiple choice
Your users want to sign-in to devices, apps, and services from anywhere. They want to sign-in using
an organizational work or school account instead of a personal account. You must ensure corporate
assets are protected and that devices meet standards for security and compliance. Specifically, you
need to be able to enable or disable a device. What should you do?
Select one.
† Enable the device in Azure AD.
■ Join the device to Azure AD.
† Register the device with Azure AD.

Multiple choice
Identify three differences from the following list between Azure Active Directory (AD) and Active
Directory Domain Services (AD DS). Select three.
■ Azure AD uses HTTP and HTTPS communications
† Azure AD uses Kerberos authentication
■ There are no Organizational Units (OUs) or Group Policy Objects (GPOs) in Azure AD
■ Azure AD includes Federation Services
† Azure AD can be queried through LDAP

Multiple choice
Your company is preparing to move some services andVMs to Microsoft Azure. The company has
opted to use Azure DNS to provide name resolution. A project begins to configure the name
resolution. The project identifies the following requirements:
● A new domain will be used.
● The domain will have DNS records for internal and external resources.
● Minimize ongoing administrative overhead.

Multiple choice
You need to prepare and configure the environment with a new domain name and a test hostname
of [Link] of the following steps should you perform? (Each answer presents part of the
solution. Choose three.)
■ Register a domain name with a domain registrar.
†Register a domain name with MicrosoftAzure.
■ Delegate the new domain name to Azure DNS.
†Add an Address (A) record for Azure name servers in the zone.
†Add DNS glue records to point to the Azure name servers.
■ Add a record for WWW.

Multiple choice
You are administering a production web app. The app requires scaling to five instances, 40GB of
storage, and a custom domain name. Which App Service Plan should you select? Select one.
† Basic
■ Standard
† Premium

Multiple choice
You want to connect different VNets in the same region as well as different regions and decide to
use VNet peering to accomplish this. Which of the following statements are true benefits of VNet
peering?
Select two.
†The virtual networks can exist in any Azure cloud region.
■ Network traffic between peered virtual networks is private.
■ Peering is easy to configure and manage, requiring little to no downtime.
†Gateway transit can be configured regionally or globally.

Multiple choice
Your company is preparing to implement persistent connectivity to Microsoft Azure. The company
has a single site, headquarters, which has an on-premises data centre. The company requires the
connectivity be persistent. Connectivity must provide for the entire on-premises site. You need to
implement a connectivity solution to meet the requirements. What should you do?
Select one.
■ Implement a Site-to-Site VPN.
† Implement a Virtual Private Cloud (VPC).
† Implement a VNet-to-VNet VPN.
Multiple choice
You need to provide a contingent staff employee temporary read-only access to the contents of an
Azure storage account container named media. It is important that you grant access while adhering
to the security principle of least-privilege. What should you do? Select one.
† Set the public access level to Container.
■ Generate a shared access signature (SAS) token for the container.
† Configure a Cross-Origin Resource Sharing (CORS) rule for the storage account.

Multiple choice
You are reviewing the Alerts page and notice an alert has been Acknowledged. What does this
mean?
Select one.
■ An administrator has reviewed the alert and started working on it.
† The issue has been resolved.
† The issue has been closed

Multiple choice
You decide to move all your services to Azure Kubernetes service. Which of the following
components will contribute to your monthly Azure charge?
Select one.
† Azure managed node
† Pods
■ Customer node virtual machines

Multiple choice
Your company provides cloud software to audit administrative access in Microsoft Azure resources.
The software logs all administrative actions (including all clicks and text input) to log files. The
software is about to be released from beta and the company is concerned about storage
performance. You need to deploy a storage solution for the log files to maximize performance. What
should you do?
Select one.
† Deploy Azure Files using SMB 3.0.
† Deploy blob storage using block blobs.
■ Deploy blob storage using append blobs

Multiple choice
You are researching Microsoft Azure for your company. The company is considering deploying
Windows-based VMs in Azure. However, before moving forward, the management team has asked
you to research the costs associated with Azure VMs. You need to document the configuration
options that are likely to save the company money on their Azure VMs. Which options should you
document? (Each answer presents part of the solution.
Select four.
■ Use HDD instead of SSD for VM storage.
†Use unmanaged premium storage instead of managed standard storage.
†Bring your own Windows custom images.
■ Use different Azure regions.
■ Use the least powerful VMs that meet your requirements.
†Place all VMs in the same resource group.
■ Bring your own Windows license for each VM.
Multiple choice
You deploy a new domain named [Link] to domain controllers in Azure. You have the
following domain-joined VMs in Azure: You need to add DNS records so that the hostnames resolve
to their respective IP addresses. Additionally, you need to add a DNS record so that
[Link] resolves to VM99. What should you do?
(Each answer presents part of the solution. Choose two.)
†Add AAAA records for each VM.
■ Add A records for each VM.
†Add a TXT record for [Link] with the text of [Link].
†Add an SRV record for [Link] with the target pointing at [Link]
■ Add a CNAME record for [Link] with a value of [Link].

Multiple choice
You host a service with two Azure virtual machines. You discover that occasional outages cause
your
service to fail. What two actions can you do to minimize the impact of the outages?
Select two.
■ Add a load balancer.
■ Put the virtual machines in an availability set.
†Put the virtual machines in a scale set.
†Add a network gateway.
†Add a third instance of the virtual machine.

Multiple choice
You are backing up your App Service. Which of the following is included in the backup? Select two.
■ App configuration
■ Azure database for MySQL
†Files and database content totalling 15GB
†Firewall enabled-storage account
†SSL enabled Azure Database for MySQL

†         
Pre
Question 1

You manage a virtual network named VNet1 that is hosted in the West US Azure region.VNet1
hosts two virtual machines named VM1 and VM2 that run Windows Server. You need to inspect
all the network traffic from VM1 to VM2 for three hours. Solution: From Performance Monitor,
you create a Data Collector Set (DCS). Does this meet the goal?

Correct Answer : No

Question 2

How many records can you create in One Recordset in Azure DNS?

Correct Answer : 20

Question 3

By default, the health probe will check the endpoint after________.

Correct Answer : 15 seconds

Question 4

What is the minimum number of App Service plans you should create for the web apps?

Correct Answer : 1

Question 5

You have an Azure virtual machine named demovm that runs Windows Server 2019. You save
demovm as a template named Template1 to the Azure Resource Manager library. You plan to
deploy a virtual machine named demovm2 from Template1. What can you configure during the
deployment of demovm2?

Correct Answer : Resource group

Question 6

You need to recommend a solution to automate the configuration for the finance department
users. The solution must meet the technical requirements. What should you include in the
recommended?

Correct Answer : Dynamic groups and conditional access policies

Question 7

You have an Azure subscription named Subscription1 and an on-premises deployment of

Microsoft System Center Service Manager. Subscription1 contains a virtual machine named
VM1. You need to ensure that an alert is set in Service Manager when the amount of available
memory on VM1 is below 10 percent. What should you do first?

Correct Answer : Deploy the IT Service Management Connector (ITSM)

Question 8

You have an Azure subscription that contains the following resources: 100 Azure virtual
machines 20 Azure SQL databases 50 Azure file shares You need to create a daily backup of all
the resources by using Azure Backup. What is the minimum number of backup policies that you
must create?

Correct Answer : 3

Question 9

Which of the following is not true of the App Service plan?

Correct Answer : The App Service plan hosts a single App Service web app.

Your Answer : The App Service plan is a set of virtual server resources that run App Service
apps.

Question 10

You plan to automate the deployment of a virtual machine scale set that uses the Windows
Server 2016 Datacenter image. You need to ensure that when the scale set virtual machines are
provisioned, they have web server components installed. Which two actions should you
perform? Each correct answer presents part of the solution.

Correct Answer : Modify the extensionProf ile section of the Azure Resource Manager
template,Upload a configuration script.

Mod 1
Question 1

You attempt to assign a license in Azure to several users and receive the following error
message: "Licenses not assigned. License agreement failed for one user. " You verify that the
Azure subscription has the available licenses. You need to resolve the Active Directory issue.
What should you do?

Correct Answer : Run the IdFix tool then use the Update actions

Question 2

Which port is used for synchronizing ads to azure ads?

Correct Answer : 80 443

Question 3

A company is Deploying a New On-Premise Desktop Application. App and it must be able to
Access Azure Active Directory ( Azure AD) in addition to the on-premises Active Directory. You
Need to Configure the application. Which two actions should you perform?
Correct Answer : Install and run Azure AD Connect,In the Azure Management portal, register the
application

Question 4

You have an Azure Active Directory tenant named [Link] that

contains 100 user accounts. You purchase 10 Azure AD Premium P2 licenses for the tenant.
You need to ensure that 10 users can use all the Azure AD Premium features. Which of the
following must you implement for this requirement?

Correct Answer : From the licenses blade, assign a new license

Question 5

You have an Azure Active Directory (Azure AD) tenant named [Link]. The
User administrator role is assigned to a user named demo admin. An external partner has a
Microsoft account that uses the externalusr1@[Link] sign in. demo admin attempts to
invite the external partner to sign in to the Azure AD tenant and receives the following error
message: “Unable to invite user externalusr1@[Link] – Generic authorization exception.”
You need to ensure that the demo admin can invite the external partner to sign in to the Azure
AD tenant. What should you do about this requirement?

Correct Answer : From the User settings blade, modify the External collaboration settings

Question 6

You need to recommend a solution to automate the configuration for the finance department
users. The solution must meet the technical requirements. What should you include in the
recommended?

Correct Answer : Dynamic groups and conditional access policies

Question 7

A dedicated and trusted instance of Azure AD is referred to as________.

Correct Answer : An Azure tenant

Question 8

You are configuring Self-service Password Reset. Which of the following is not a validation
method?

Correct Answer : A paging service

Question 9

You sign up for Azure Active Directory (Azure AD) Premium. You need to add a user named
admin1@[Link] as an administrator on all the computers that will be joined to the Azure
AD domain. What should you configure in Azure AD?

Correct Answer : Device settings from the Devices blade

Question 10

In Azure Active Directory (Azure AD) the tenant is named [Link] which
contains 100 user accounts. You purchase 10 Azure AD Premium P2 licenses for the tenant.
You need to ensure that 10 users can use all the Azure AD Premium features. What should you
do?

Correct Answer : From the Licenses blade of Azure AD, assign a license

Mod 2

Question 1

To manage multiple subscriptions, what should you create?

Correct Answer : Management Group

Question 2

A group of policy definitions in azure is called________.

Correct Answer : Intiative Definition

Question 3

Can we transfer a resource from One Subscription to another Subscription in different Azure
Accounts?

Correct Answer : No

Question 4

You have an Azure subscription that contains a user named demousr1. You need to ensure that
demousr1 can deploy virtual machines and manage virtual networks. The solution must use the
principle of least privilege. Which Role-Based Access Control (RBAC) role should you assign to
demousr1?

Correct Answer : Contributor

Question 5

You have an Azure subscription linked to an Azure Active Directory tenant. The tenant includes
a user account named User1. You need to ensure that User1 can assign a policy to the tenant
root management group. What should you do?

Correct Answer : Assign the Owner role for the Azure subscription to User1, and then instruct
User1 to configure access management for Azure resources.

Question 6

You have an Azure subscription named Subscription1 that contains a virtual network named
VNet1. VNet1 is in a resource group named RG1. Subscription1 has a user named User1. User1
has the following roles: i. Reader ii. Security Admin iii. Security Reader You need to ensure that
User1 can assign the Reader role for VNet1 to other users. What should you do?

Correct Answer : Assign User1 the User Access Administrator role for VNet1.

Question 7

You are assigning Azure AD roles. Which role will allow the user to manage all the groups in
your Team’s tenants and be able to assign other administrator roles?

Correct Answer : Global Administrator

Question 8

You would like to categorize resources and billing for different departments like IT and HR. The
billing needs to be consolidated across multiple resource groups, and you need to ensure
everyone complies with the solution. What should you do? {Choose two to complete a solution}.

Correct Answer : Create tags for each department,Create an Azure policy

Question 9

You need to move the blueprint files to Azure. What should you do?

Correct Answer : Use Azure Storage Explorer to copy the files.

Question 10

Your company financial comptroller wants to be notified whenever the company is halfway to
spending the money allocated for cloud services. What should you do?

Correct Answer : Create a budget and a spending threshold.

Mod 3

Question 1

You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure
Resource Manager template named [Link] receive a notification that VM1 will be
affected by maintenance. You need to move VM1 to a different host immediately. Solution:
From the Redeploy blade, you click Redeploy. Does this meet the goal?

Correct Answer : Yes

Question 2

You recently created a new Azure subscription that contains a user named Admin1. Admin1
attempts to deploy an Azure Marketplace resource by using an Azure Resource Manager
template. Admin1 deploys the template by using Azure PowerShell and receives the following
error message: User failed validation to purchase resources. Error message: Legal terms have
not been accepted for this item on this subscription. To accept legal terms, please go to the
Azure portal ([Link] and configure programmatic
deployment for the Marketplace item or create it there for the first time. You need to ensure that
Admin1 can deploy the Marketplace resource successfully. What should you do?

Correct Answer : From Azure PowerShell, run the Set-AzMarketplaceTerms cmdlet

Question 3

Which of the following best describes the format of an Azure Resource Manager template?

Correct Answer : A JSON document with key-value pairs

Question 4

Which of the following is not true about Cloud Shell?

Correct Answer : Cloud Shell is assigned multiple machines per user account

Question 5

You are managing Azure locally using PowerShell. You have launched the app as an
Administrator. Which of the following commands would you do first?

Correct Answer : Connect-AzAccount

Question 6

Which parameter can you add to most CLI commands to get concise, formatted output?

Correct Answer : Table

Question 7

What needs to be installed on your machine to let you execute Azure PowerShell cmdlets
locally?

Correct Answer : The base PowerShell product and the AZ module

Question 8

What do you need to install on your machine so you can execute Azure CLI commands locally?

Correct Answer : Only the Azure CLI

Question 9

Suppose you are building a video-editing application that will offer online storage for user-
generated video content. You will store the videos in Azure Blobs, so you need to create an
Azure storage account to contain the blobs. Once the storage account is in place, it is unlikely
you would remove and recreate it because this would delete all the user videos. Which tool is
likely to offer the quickest and easiest way to create the storage account?

Correct Answer : Azure portal

Mod 4

Question 1

An azure firewall is applied at_______.

Correct Answer : Virtual Network

Question 2

How many NSG's can be attached with One Subnet?

Correct Answer : 1

Question 3

How many records can you create in One Recordset in Azure DNS?

Correct Answer : 20

Question 4

Which of them is a service endpoint for the Azure virtual network?

Correct Answer : Azure AD

Question 5

You need to create an Azure virtual machine named demovm1 that requires a static private IP
address configured inside the IP address space for the VNet in which the VM resides. How do
you configure a static IP address for this Azure VM?

Correct Answer : After the VM has been created, go to the network interface attached to the VM
and change the IP configuration to static assignment

Question 6

You have an Azure Active Directory (Azure AD) tenant that has the
[Link] domain name. You have a domain name of
[Link] registered at a third-party registrar. You need to ensure that you can create
Azure AD users that have names containing a suffix of @[Link]. Which of the
following steps would you carry out to fulfill this requirement? Choose 3 answers from the
options given below.

Correct Answer : Verify the domain,Add a custom domain name,Add a record to the publick
[Link] DNS zone

Question 7

Which among the following is the correct Azure CLI cmdlet to create a Network Security Group
(NSG)?

Correct Answer : az network nsg create

Question 8

Your company has an existing Azure tenant named [Link]. The

company wants to start using [Link] for its Azure resources. You add a custom
domain to Azure. Now, you need to add a DNS record to prepare for verifying the custom
domain. Which two of the following record types could you create?

Correct Answer : Add a TXT record to the DNS zone,Add an MX record to the DNS zone

Question 9

You are planning your Azure network implementation to support your company's migration to
Azure. Your first task is to prepare for the deployment of the first set of VMs. For these
machines, consumers on the internet must be able to communicate directly with the web
application on the VMs. Also, the IP configuration must be zone redundant. You should
minimize costs, whenever possible, while still meeting the requirements. What should you do?

Correct Answer : Create a standard public IP address. During the creation of the first VM,
associate the public IP address with the VM's NIC.

Question 10

You have a VM with two NICs named NIC1 and NIC2. NIC1 is connected to the [Link]/24
subnet. NIC2 is connected to the [Link]/24 subnet. You plan to enable direct communication
from the internet to TCP port 443. You would like to maintain existing communication across
the [Link]/24 and [Link]/24 subnets. To support the new functionality and keep things
simple. What should you do?

Correct Answer : Associate a public IP address to NIC2 and create an inbound security rule.

Mod 5

Question 1

What type of gateway can be created using Virtual Network Gateway?

Correct Answer : 2 and 3

Question 2
Vnet peering can be used to connect________.

Correct Answer : Two Vnets

Question 3
You have two subscriptions named staging and testing. Each subscription is linked to a
different Azure AD tenant. The staging subscription contains a virtual network named vnet1 that
has an IP address space of [Link]/16. The virtual network has a virtual machine named
demovm. The testing subscription contains a virtual network named vnet2 that has an IP
address space of [Link]/24. The virtual network has a virtual machine named testvm. You
need to connect vnet1 to vnet2. Which of the following would you first implement for this
requirement?

Correct Answer : Create virtual network gateways

Question 4

You have an Azure subscription named staging that contains two Azure virtual networks named
vnet1 and vnet2. Vnet1 contains a VPN gateway that uses static routing. There is a Site-to-Site
VPN connection between the on-premises network and vnet1. You configure a Point-to-Site VPN
connection from a computer that runs Windows 10 to vnet1. You then configure virtual network
peering between vnet1 and vnet2. You verify that you can connect to vnet2 from the on-
premises network. The client is unable to connect to vnet2. You have to ensure the client can
connect to vnet2. Which of the following would you implement for this requirement?

Correct Answer : Download and re-install the VPN client configuration package on the Windows
10 client machine

Question 5

The traffic between virtual machines in peered virtual networks is routed_______.

Correct Answer : directly through the Microsoft backbone infrastructure

Question 6

You want to connect different VNets in the same region as well as different regions and decide
to use VNet peering to accomplish this. Which of the following statements is not true about
VNet peering?

Correct Answer : The virtual networks can only exist in the same azure cloud region.

Question 7

Your company has an Azure subscription which has a line-of-business application that runs on
several Azure virtual machines. These machines run Windows Server 2016. From home, the
users connect via Point-to-Site VPN connections. And from the customer sites, the users
connect via Site-to-Site VPN connections. You have to ensure that the connections are spread
across all of the virtual machines. Which of the following can be implemented for this
requirement? Choose any 2 answers from the options given below.

Correct Answer : An Internal Load Balancer,An Azure Application Gateway

Mod 6

Question 1

Azure Application Gateway works at which layer?

Correct Answer : layer7

Question 2

What is the default TTL for CDN?

Correct Answer : 7 Days

Question 3

By default, the health probe will check the endpoint after________.

Correct Answer : 15 seconds

Question 4

How many Routes can be created inside a route table?

Correct Answer : Unlimited

Question 5

Your company has a Microsoft SQL Server Always On availability group defined on a set of
Azure virtual machines. You have to configure an Azure internal load balancer as a listener for
the availability group. Which of the following do you need to implement for this requirement?

Correct Answer : Enable Floating IP

Question 6

You have to create and configure an Azure load balancer. The Azure Load balancer would listen
on port 443 and redirect traffic to a backend pool of virtual machines. You have to ensure that
users are serviced by the same virtual machine for the requests they make. Which of the
following should you configure for this request?

Correct Answer : Session Persistence to Client IP

Question 7

Your company has a load balancer named “apploadbalancer” defined as part of their Azure
subscription. You have to ensure that a user named “appusr” can manage the configuration of
the load balancer. You need to assign the right role ensuring the principle of least privilege is
used. Which of the following could you assign as a role to ensure the user could add a health
probe to the load balancer resource?

Correct Answer : Network Contributor role on the resource group that contains the load
balancer and other related resources

Question 8

You have an Azure subscription that contains three virtual networks named demonetwork1,
demonetwork2, and demonetwork3. demonetwork2 contains a virtual appliance named
demovm2 that operates as a router. You are configuring the virtual networks in a hub and spoke
topology that uses demonetwork2 as the hub network. You plan to configure peering between
demonetwork1 and demonetwork2 and between demonetwork2 and demonetwork3. You need
to provide connectivity between demonetwork1 and demonetwork3 through demonetwork2.
Which two configurations should you perform for this requirement? Each correct answer
presents part of the solution.

Correct Answer : On the peering connections, allow forwarded traffic,Create route tables and
assign the table to subnets
Question 9

When creating user-defined routes, you can specify any of these next-hop types, except________.

Correct Answer : Load balancer

Question 10

What is the main benefit of using a network virtual appliance?

Correct Answer : To control incoming traffic from the perimeter network and allow only traffic
that meets security requirements to pass through.

Mod 7

Question 1

Which tool should be used to transfer 600TB of data to Azure storage?

Correct Answer : Data Box Heavy

Question 2

Which tool can be used to sync on-premises file servers to Azure storage?

Correct Answer : Azure File Sync

Question 3

Your company has an Azure subscription. You have to transfer 35 TB of data from an on-
premises Windows 2016 Server to an Azure storage account. You have to ensure that the data
transfer has zero impact on the network. You have to ensure that your existing drives are
preserved, and the transfer is the fastest and most secure method. Which of the following can
be taken as the first step for this process?

Correct Answer : Order an Azure Databox via the Azure Portal

Question 4

You have a resource group named demogrp. demogrp contains an Azure Storage account
named appstore1000 and a virtual machine named demovm1 that runs Windows Server 2016.
appstore1000 contains the disk files for demovm1. You apply a ReadOnly lock to demogrp.
What can you do from the Azure portal?

Correct Answer : View the keys of appstore1000

Question 5

You have an Azure storage account named store1000. You are going to use the AzCopy tool to
copy data to the storage account. You are going to be copying data to the blob storage and file
storage in the storage account. Which authentication method can be used for accessing Blob
storage?
Correct Answer : Azure Active Directory and Shared Access Signatures only

Question 6

Your team is developing an application that needs to have a data store defined in Azure. Below
are the key requirements for the datastore: a) Can configure the retention period for the data
itself b) Ability to archive data c) Ability to read archive data d) The Archive data should not be
modified or deleted Your team decides to create an Azure storage account – General Purpose
v2. Which of the following service should be used for the underlying data?

Correct Answer : Blob

Question 7

You have a set of Windows Servers in your on-premise environment. You need to sync files
across the servers. You decide to use the Azure File Sync service. You deploy an Azure File Sync
Storage Sync Service, and you create a sync group in your Azure subscription. You need to
synchronize files from the servers to Azure. Which of the following steps would you need to
implement for this requirement. Choose 3 answers from the options given below.

Correct Answer : Install the Azure File Sync agent on the servers,Register the servers,Add the
server endpoint to the sync group

Question 8

You have an on-premises server that contains a folder named D:\data. You need to copy the
contents of D:\data to a local container in an Azure Storage account named store1000. Which
of the following would you run for this requirement?

Correct Answer : azcopy copy D:\data [Link] --

recursive

Question 9

You have an Azure subscription that contains an Azure storage account named
stagingstore1000. You are planning on uploading disk files of a virtual machine to the storage
account from an on-premises network. The on-premises network uses a public IP address
space of [Link]/24. You will be using the disks files in the storage account to create an
Azure virtual machine named stagingvm. The virtual machine will be connected to a virtual
network named vnet1. The virtual network uses an IP address range of [Link]/24. You
have to configure the storage account to meet the following requirements: a) Ensure that you
can upload disks files to the storage account b) Ensure that you can attach disks to the virtual
machine c) Prevent all other access to the storage account Which of the following actions can
be performed for this requirement? Choose 2 answers from the options given below.

Correct Answer : From the Firewalls and virtual networks blade of the storage account, select
Allow trusted Microsoft services to access this storage account,From the Firewalls and virtual
netwoks blade of the storage account, add the [Link]/24 address range

Question 10
In a typical project, when would you create your storage account(s)?

Correct Answer : At the beginning, during project setup.

Mod 8

Question 1

You have an availability set named AS1 that contains three virtual machines named VM1, VM2,
and VM3. You attempt to reconfigure VM1 to use a larger size. The operation fails, and you
receive an allocation failure message. You need to ensure that the resize operation succeeds.
What should you do?

Correct Answer : Stop VM1, VM2 VM3,Start VM1, VM2 VM3,Resize VM1

Question 2

Which of them is not in Azure VM Family?

Correct Answer : Network Optimized

Question 3

You need to deploy an Azure virtual machine scale set that contains five instances as quickly as
possible. What should you do?

Correct Answer : Deploy one virtual machine scale set that is set to ScaleSetVM

Question 4

You have an app named App1 that runs on two Azure virtual machines named VM1 and VM2.
You plan to implement an Azure Availability Set for App1. The solution must ensure that App1 is
available during planned maintenance of the hardware hostingVM1 and VM2. What should you
include in the Availability Set?

Correct Answer : Two update domains

Question 5

You download an Azure Resource Manager template based on an existing virtual machine. The
template will be used to deploy 100 virtual machines. You need to modify the template to
reference an administrative password. You must prevent the password from being stored in
plain text. What should you create to store the password?

Correct Answer : An Azure Key Vault and an access policy

Question 6

You plan to move a distributed on-premises app named App1 to an Azure subscription. After
the planned move, App1 will be hosted on several Azure virtual machines. You need to ensure
that App1 always runs on at least eight virtual machines during planned Azure maintenance.
What should you create?

Correct Answer : One Availability Set that has 10 update domains and one fault domain
Question 7

You have an Azure virtual machine named demovm that runs Windows Server 2019. You save
demovm as a template named Template1 to the Azure Resource Manager library. You plan to
deploy a virtual machine named demovm2 from Template1. What can you configure during the
deployment of demovm2?

Correct Answer : Resource group

Question 8

What is the effect of the default network security settings for a new virtual machine?

Correct Answer : Outbound request is allowed. Inbound traffic is only allowed from within the
virtual network.

Question 9

You have several Linux virtual machines hosted in Azure. You will administer these VMs
remotely over SSH from three dedicated machines in your corporate headquarters. Which of the
following authentication methods would typically be considered best practice for this situation?

Correct Answer : Private key with passphrase

Question 10

You plan to automate the deployment of a virtual machine scale set that uses the Windows
Server 2016 Datacenter image. You need to ensure that when the scale set virtual machines are
provisioned, they have web server components installed. Which two actions should you
perform? Each correct answer presents part of the solution.

Correct Answer : Modify the extensionProf ile section of the Azure Resource Manager
template,Upload a configuration script.

Mod 9

Question 1

You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant
named [Link] and an Azure Kubernetes Service (AKS) cluster named AKS1. An
administrator reports that she is unable to grant access to AKS1 to the users in [Link].
You need to ensure that access to AKS1 can be granted to the [Link] users. What should
you do first?

Correct Answer : From [Link], create an OAuth 2.0 authorization endpoint.

Question 2

What is the minimum number of App Service plans you should create for the web apps?

Correct Answer : 1
Question 3

You have an Azure subscription that contains an Azure Storage account. You are going to be
creating an Azure Container instance named staging-container that will be using an existing
Docker image. The docker image contains a Microsoft SQL Server instance that requires
persistent storage. Which of the following can be used to configure a storage service for the
container?

Correct Answer : Azure Files

Question 4

You currently have the following resources as part of your subscription a) An Azure Container
registry instance named appregistry1000 b) An Azure Kubernetes cluster named appcluster You
have a container image on your local workstation. This image contains an application that
needs to be deployed to the cluster. Which of the following must you do first for this
requirement?

Correct Answer : Upload the image to the registry

Question 5

You have a Basic App Service plan named stagingplan that hosts an Azure App Service named
stagingapp. You need to configure a custom domain and enable backups for stagingapp. What
should you do first?

Correct Answer : Scale up stagingplan

Question 6

You have to deploy two Azure Web Apps named stagingApp1 and stagingApp2. The web
applications have the following requirements: a) stagingApp1 must be able to use staging slots
b) stagingApp2 must be able to access the resources located on an Azure virtual network You
have to use the least costly plan for the deployment of each web app. Which of the following
should you use for stagingApp2?

Correct Answer : S1-Production

Question 7

You have a service deployed to a Kubernetes cluster. Another application needs to access the
service via the private IP address of the pod. Which of the following would you define as the
networking type for the cluster to meet this requirement?

Correct Answer : Azure container network plugin

Question 8
You have an Azure resource manager template that will be used to deploy 10 Azure Web Apps.
You have to ensure to deploy the pre-requisites before the deployment of the template. You
have to minimize the costs associated with the implementation. Which of the following would
you deploy as pre-requisites?

Correct Answer : A single App Service Plan

Question 9

A web developer creates a web application that you plan to deploy as an Azure web app. Users
must enter credentials to access the web application. You create a new web app named staging
app and then deploy the web application to Azure Web App. You need to disable anonymous
access to the web application. Which of the following must you configure for this requirement?

Correct Answer : Authentication/Authorization

Question 10

To configure an autoscale trigger based on average response time, you should select________.

Correct Answer : Metric-based

Mod 10

Question 1

You manage a virtual network named VNet1 that is hosted in the West US Azure region.VNet1
hosts two virtual machines named VM1 and VM2 that run Windows Server. You need to inspect
all the network traffic from VM1 to VM2 for three hours. Solution: From Performance Monitor,
you create a Data Collector Set (DCS). Does this meet the goal?

Correct Answer : No

Question 2

You manage a virtual network named VNet1 that is hosted in the West US Azure region.VNet1
hosts two virtual machines named VM1 and VM2 that run Windows Server. You need to inspect
all the network traffic from VM1 to VM2 for three hours. Solution: From Azure Network Watcher,
you create a packet capture. Does this meet the goal?

Correct Answer : No

Question 3

You need to implement a backup solution for Appl after the application is moved. What should
you create first?

Correct Answer : A Recovery Services vault

Question 4

Your company has an on-premises network that contains a Hyper-V host named
productionhost. The host runs Windows Server 2016 and hosts 10 virtual machines that run
Windows Server 2016. You plan to replicate the virtual machines to Azure by using Azure Site
Recovery. You create a Recovery Services vault named productionvault1000 and a Hyper-V site
named productionsite. You need to add the host to the Azure Site Recovery Services vault.
Which of the following would you implement for this requirement?
Correct Answer : Download the installation file for the Azure Site Recovery Provider. Download
the vault registration key. Install the Azure Site Recovery Provider on the host and register the
server.

Question 5

You have an Azure subscription and an on-premises deployment of Microsoft System Center
Service Manager. The Azure subscription contains a virtual machine named demovm You need
to ensure that an alert is set in Service Manager when the amount of available memory on
demovm is below 15 percent. Which of the following must you do first for this requirement?

Correct Answer : Deploy the IT Service Management Connector (ITSM)

Question 6

You have an Azure virtual machine named demovm1. You go ahead and create a backup using
the Azure Backup service. After creating a backup, you perform the following changes on the
virtual machine: a) Modify the size of the virtual machine b) You copy a file named [Link]
to a folder named Data c) You reset the password for the built-in administrator account d) You
add a data disk to the virtual machine You now perform a Restore option using the earlier
backup taken and use the Replace existing option when performing the restore option. Which of
the following would need to be done again to ensure the previous changes carried out on the
virtual machine are still intact?

Correct Answer : Copy the [Link] to a folder named Data

Question 7

You need to backup files and folders to Azure. Which of these steps would you do first?

Correct Answer : Create a recovery services vault

Question 8

You have created the Recovery Vault service. Now you decide to change the storage replication
type to locally redundant. In which situations can Larissa change the storage replication type?

Correct Answer : You can change this setting, but only before a Recovery Vault service starts
providing protection for items.

Question 9
What data does Azure Monitor collect?

Correct Answer : Data from a variety of sources, such as the application event log, the operating
system (Windows and Linux), Azure resources, and custom data sources

Question 10
You have two Azure virtual machines named VM1 and VM2. You have two Recovery Services
vaults named RSV1 and RSV2. VM2 is protected by RSV1. You need to use RSV2 to protect
VM2. What should you do first?

Correct Answer : From the Backup blade, select the backup for the virtual machine, and then
click Backup
Post

Question 1

Which of them is not the Replication option in azure-storage?

Correct Answer : LRS,GRS,ZRS,RA-GRS

Question 2

You have an Azure subscription named Subscription1. You deploy a Linux virtual machine
named VM1 to Subscription1. You need to monitor the metrics and the logs of VM1. What
should you use?

Correct Answer : The AzurePerformanceDiagnostics extension

Question 3

You have an Azure virtual machine named VM1. Azure collects events from VM1. You are
creating an alert rule in Azure Monitor to notify an administrator when an error is logged in the
System event log of VM1. You need to specify which resource type to monitor. What should you
specify?

Correct Answer : Virtual machine extension

Question 4

You have an Azure subscription that contains a virtual machine named VM1. VM1 hosts a line-
of-business application that is available 24 hours a day. VM1 has one network interface and one
managed disk. VM1 uses the D4s v3 size. You plan to make the following changes to VM1: a)
Change the size to D8s v3 b) Add a 500-GB managed disk c) Add the Puppet Agent extension d)
Attach an additional network interface Which change will cause downtime for VM1?

Correct Answer : Change the size to D8s v3

Question 5

Your company registers a domain name of [Link]. You create an Azure DNS zone named
[Link], and then you add an A record to the zone for a host named www that has an IP
address of [Link]. You discover that Internet hosts are unable to
resolve [Link] to the [Link] IP address. You need to resolve the name
resolution issue. Solution: You create a PTR record for www in the [Link] zone. Does this
meet the goal?

Correct Answer : No

Question 6
You manage a virtual network named VNet1 that is hosted in the West US Azure region.VNet1
hosts two virtual machines named VM1 and VM2 that run Windows Server. You need to inspect
all the network traffic from VM1 to VM2 for three hours. Solution: From Performance Monitor,
you create a Data Collector Set (DCS). Does this meet the goal?

Correct Answer : No
Question 7

You have an Azure subscription named Subscriptionl that contains an Azure Log Analytics
workspace named Workspace. You need to view the error events from a table named Event.
Which query should you run in Workspace?

Correct Answer : Search in (Event) "error "

Question 8

You have the Azure virtual machines. VM1 and VM2 are in East US and VM3, and VM4 are in
Weston. You have a Recovery Services vault that protects VM1 and VM2. You need to protect
VM3 and VM4 by using Recovery Services. What should you do first?

Correct Answer : Create a new Recovery Services vault

Question 9

You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure
Resource Manager template named [Link] receive a notification that VM1 will be
affected by maintenance. You need to move VM1 to a different host immediately. Solution:
From the Overview blade, you move the virtual machine to a different subscription. Does this
meet the goal?

Correct Answer : No

Question 10

If under one Azure account there are 5 Subscriptions, then how many Service Administrators
will be there?

Correct Answer : 5

Question 11

You need to create an Azure virtual machine named demovm1 that requires a static private IP
address configured inside the IP address space for the VNet in which the VM resides. How do
you configure a static IP address for this Azure VM?

Correct Answer : After the VM has been created, go to the network interface attached to the VM
and change the IP configuration to static assignment

Question 12

Your company has an Azure subscription. You have to transfer 35 TB of data from an on-
premises Windows 2016 Server to an Azure storage account. You have to ensure that the data
transfer has zero impact on the network. You have to ensure that your existing drives are
preserved, and the transfer is the fastest and most secure method. Which of the following can
be taken as the first step for this process?

Correct Answer : Order an Azure Databox via the Azure Portal

Question 13

You have an Azure subscription that contains an Azure Storage account. You are going to be
creating an Azure Container instance named staging-container that will be using an existing
Docker image. The docker image contains a Microsoft SQL Server instance that requires
persistent storage. Which of the following can be used to configure a storage service for the
container?

Correct Answer : Azure Files

Question 14

You have to deploy two Azure Web Apps named stagingApp1 and stagingApp2. The web
applications have the following requirements: a) stagingApp1 must be able to use staging slots
b) stagingApp2 must be able to access the resources located on an Azure virtual network You
have to use the least costly plan for the deployment of each web app. Which of the following
should you use for stagingApp2?

Correct Answer : S1-Production

Question 15

Your company has implemented Firewall rules to deny traffic based on IP address ranges. In
this situation, what should you do?

Correct Answer : Use statically assigned IP addresses.

Question 16

You sign up for Azure Active Directory (Azure AD) Premium. You need to add a user named
admin1@[Link] as an administrator on all the computers that will be joined to the Azure
AD domain. What should you configure in Azure AD?

Correct Answer : Device settings from the Devices blade

Your answer was correct

Question 17

You are responsible for implementing server workload backups. You need to implement on-
premises backups to an Azure Recovery Vault service. What should you do?

Correct Answer : Download and install the MARS agent, and then register the server by installing
the vault credentials.

Question 18
Your company has an Azure subscription which has a line-of-business application that runs on
several Azure virtual machines. These machines run Windows Server 2016. From home, the
users connect via Point-to-Site VPN connections. And from the customer sites, the users
connect via Site-to-Site VPN connections. You have to ensure that the connections are spread
across all of the virtual machines. Which of the following can be implemented for this
requirement? Choose any 2 answers from the options given below.

Correct Answer : An Internal Load Balancer,An Azure Application Gateway

Question 19

You have an Azure subscription that contains a virtual network named staging-network. The
virtual network is in a resource group named staging-grp. The associated Azure AD tenant has a
user named UserA. UserA has the following roles: a) Reader b) Security Admin c) Security
Reader You need to ensure that the user can assign the Reader role for the virtual network to
other users. What should you do to implement this requirement?

Correct Answer : Assign to user the User Access Administrator role for the network

Question 20

You have two Azure virtual machines named VM1 and VM2. You have two Recovery Services
vaults named RSV1 and RSV2. VM2 is protected by RSV1. You need to use RSV2 to protect
VM2. What should you do first?

Correct Answer : From the Backup blade, select the backup for the virtual machine, and then
click Backup