Online Access Free AZ-104 Exam Questions

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You manage a virtual network named VNet1 that is hosted in the West US Azure region.
VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.
You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.
Solution: From Azure Monitor, you create a metric on Network in and Network Out.
Does this meet the goal?

• A.No
• B.Yes

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json.
You receive a notification that VM1 will be affected by maintenance.
You need to move VM1 to a different host immediately.
Solution: From the Redeploy blade, you click Redeploy.
Does this meet the goal?

• A.No
• B.Yes

You create an Azure Storage account.
You plan to add 10 blob containers to the storage account.
For one of the containers, you need to use a different key to encrypt data at rest.
What should you do before you create the container?

• A.Create an encryption scope.
• B.Modify the minimum TLS version.
• C.Generate a shared access signature (SAS).
• D.Rotate the access keys.

You have an Azure subscription that contains a virtual machine name VM1.
VM1 has an operating system disk named Disk1 and a data disk named Disk2.
You need to back up Disk2 by using Azure Backup.
Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

Exhibit

Correct Answer:

Explanation:
CORRECTED ANSWER: Step 1: Create an Azure Backup vault. Step 2: Delegate permissions for the vault.
Step 3: Create a backup policy and configure the backup.
Detailed Explanation
To back up an individual managed disk (rather than the whole VM through the VM backup extension), Azure Disk Backup is used, and Azure Disk Backup stores its data in a Backup vault - a distinct vault type from a Recovery Services vault, which is used for VM/SQL/file-share backups. A Backup vault is provisioned with a system-assigned managed identity that must be explicitly granted the Disk Backup Reader role on the source disk and the Disk Snapshot Contributor role on the snapshot resource group before backups can run; this is the
' delegate permissions for the vault ' step, and the portal ' s Configure Backup flow can grant these roles automatically. Only after the vault exists and its identity has the required roles can you create/select a disk backup policy and configure protection for Disk2. ' Create a Recovery Services vault ' and ' Configure a managed identity ' are distractors - the vault gets its managed identity automatically at creation; you only need to delegate permissions to it.
Official Reference
Back up Azure Managed Disks - https://learn.microsoft.com/en-us/azure/backup/backup-managed-disks

You have an Azure Active Directory (Azure AD) tenant that contains three global administrators named Admin1, Admin2, and Admin3.
The tenant is associated to an Azure subscription. Access control for the subscription is configured as shown in the Access control exhibit. (Click the Exhibit tab.) You sign in to the Azure portal as Admin1 and configure the tenant as shown in the Tenant exhibit. (Click the Exhibit tab.) For each of the following statements, select Yes if the statement is true. Otherwise, select No.
NOTE: Each correct selection is worth one point.

Exhibit

Exhibit

Exhibit

Correct Answer:

Explanation:
CORRECTED ANSWER: Admin1 can add Admin2 as an owner of the subscription: No. Admin3 can add Admin2 as an owner of the subscription: Yes. Admin2 can create a resource group in the subscription: No.
Detailed Explanation
The ' Global admin can manage Azure Subscriptions and Management Groups ' toggle is per-user, not tenant- wide: when a Global Administrator switches it to Yes, only that individual is granted the User Access Administrator role at root scope ( ' / ' ); switching it to No removes that grant for that user. With the toggle left at No and no other Azure RBAC role visible for Admin1 in the Access control exhibit, Admin1 has no permission to assign roles and cannot add Admin2 as Owner -- the source document ' s original ' Yes ' is corrected to No here. Admin3, however, already holds Owner directly on the subscription (via the classic Service Administrator link shown in the exhibit), and Owner includes Microsoft.Authorization
/roleAssignments/write, so Admin3 can add Admin2 as Owner (Yes, unchanged). Admin2 has no assigned role and Global Administrator status alone grants no Azure resource permissions, so Admin2 cannot create a resource group (No, unchanged).
Official Reference
Elevate access to manage all Azure subscriptions and management groups - https://learn.microsoft.com/en-us
/azure/role-based-access-control/elevate-access-global-admin