Online Access Free AZ-104 Exam Questions

You have two Azure subscriptions named Sub1 and Sub2 that are linked to separate Microsoft Entra tenants.
You have the virtual networks shown in the following table.

You have two Azure subscriptions named Sub1 and Sub2 that are linked to separate Microsoft Entra tenants.
You have the virtual networks shown in the following table.
Which virtual networks can you peer with VNet1?

• A.VNet2, VNet3, and VNet4 only
• B.VNet2, VNet3, VNet4, and VNet5
• C.VNet2 and VNet4 only
• D.VNet2only
• E.VNet2 and VNet3 only

You have an Azure Storage account named storage1 that uses Azure Blob storage and Azure File storage.
You need to use AzCopy to copy data to the blob storage and file storage in storage1.
Which authentication method should you use for each type of storage? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:

You can provide authorization credentials by using Azure Active Directory (AD), or by using a Shared Access Signature (SAS) token.
Box 1:
Both Azure Active Directory (AD) and Shared Access Signature (SAS) token are supported for Blob storage.
Box 2:
Only Shared Access Signature (SAS) token is supported for File storage.
Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10

You have an Azure subscription that contains a virtual network named VNet1. VNet1 uses an IP address space of 10.0.0.0/16 and contains the subnets in the following table.

Subnet1 contains a virtual appliance named VM1 that operates as a router.
You create a routing table named RT1.
You need to route all inbound traffic to VNet1 through VM1.
How should you configure RT1? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:

Box1 : 10.0.0.0/16
Address prefix in networking refer to the destination IP address range. In this scenario, destination is Vnet1 , hence Address prefix will be the address space of Vnet1.
Box 2 : Virtual appliance
Next hop gets the next hop type and IP address of a packet from a specific VM and NIC. Knowing the next hop helps you determine if traffic is being directed to the intended destination, or whether the traffic is being sent nowhere Next Hop -- > VM1 -- > Virtual Appliance (You can specify IP address of VM 1 when configuring next hop as virtual appliance) Box 3 : GatewaySubnet In the scenario it is asked for all the inbound traffic to Vnet1. Inbound traffic is flowing through SubnetGW.
You need to route all inbound traffic from the VPN gateway to VNet1 through VM1.So its traffic from Gateway subnet only.
Reference:
https://docs.microsoft.com/en-us/azure/virtual-network/manage-route-table#create-a-route-table
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-next-hop-overview

You have an Azure subscription that contains the resources shown in the following table.

You plan to create a data collection rule named DCRI in Azure Monitor.
Which resources can you set as data sources in DCRI, and which resources can you set as destinations in DCRI? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:
Data Sources: VM1 only
Destination: Workspace1 Only

You have an Azure subscription that contains a storage account named contoso2023. The storage account contains:
* cont1: Blob container
* share1: File share



You have a Microsoft Entra tenant that contains the users shown in the following table.
Name
Shared access signature (SAS) token for contoso2023
User1
User delegation SAS with the maximum available permissions
User2
Service SAS with the maximum available permissions
User3
Account SAS with the maximum available permissions
For each of the following statements, select Yes if the statement is true. Otherwise, select No.

Correct Answer:

Explanation:
Yes, No, No
Comprehensive and Detailed 150 to 250 words of Explanation From [Microsoft Azure Administrator/Course Guide/topics]:
The decisive setting is Allow storage account key access = Disabled , which disallows Shared Key authorization for the storage account. Microsoft states that when Shared Key access is disallowed, Azure Storage rejects requests authorized with account access keys, and only requests authorized with Microsoft Entra ID succeed. Microsoft's SAS behavior table is explicit: a User delegation SAS uses Microsoft Entra ID and is permitted, while a Service SAS and an Account SAS use Shared Key and are denied when AllowSharedKeyAccess is false.
Therefore, User1 can access cont1 because a user delegation SAS is Microsoft Entra-authorized and is valid for Blob Storage access. User2 cannot access cont1 because a service SAS is secured by the storage account key, which is blocked. User3 cannot access share1 because an account SAS is also secured by the storage account key and is denied for all Azure Storage services when Shared Key access is disabled.
The anonymous blob access, TLS, and portal authorization settings do not override SAS authorization behavior here. Study Guide reference: AZ-104 Implement and manage storage > configure storage security, shared access signatures, access keys, Azure Blob Storage, and Azure Files.