Microsoft - AZ-104: Microsoft Azure Administrator
Sample Questions
Question: 839
Measured Skill: Manage Azure identities and governance (20–25%)
You have a Microsoft Entra tenant named contoso.com that contains the users shown in the following table.
You create a dynamic user group named Group1 that has the following membership rule.
(user.department -eq "HR") -and (user.jobTitle -eq "Manager") -or (user.JobTitle -eq "Support")
Which users will be members of Group1?| A | User1 only |
| B | User1 and User2 only |
| C | User1 and User3 only |
| D | User1 and User4 only |
| E | User1, User2, and User4 |
Correct answer: CExplanation:
To match the rule, a user must match either the first part of the membership rule, which is (user.department -eq "HR") -and (user.jobTitle -eq "Manager") or the second part of the membership rule, which is (user.JobTitle -eq "Support").
Question: 840
Measured Skill: Implement and manage storage (15–20%)
You have an Azure subscription that contains the storage accounts shown in the following table.
The cont1 container is configured as shown in the following exhibit.
You plan to perform the following tasks:
- Upload a blob named Blob1 to cont1.
- Upload a blob named Blob2 to cont1.
- Create a file share named share2 in storage2.
For each of the following statements, select Yes if the statement is true. Otherwise, select No.
(NOTE: Each correct selection is worth one point.)
| A | You can use Scope1, Scope2, or Scope3 for Blob1: Yes
You can use Scope2 for Blob2: Yes
You can use Scope3 for share2: Yes |
| B | You can use Scope1, Scope2, or Scope3 for Blob1: Yes
You can use Scope2 for Blob2: Yes
You can use Scope3 for share2: No |
| C | You can use Scope1, Scope2, or Scope3 for Blob1: Yes
You can use Scope2 for Blob2: No
You can use Scope3 for share2: Yes |
| D | You can use Scope1, Scope2, or Scope3 for Blob1: No
You can use Scope2 for Blob2: Yes
You can use Scope3 for share2: No |
| E | You can use Scope1, Scope2, or Scope3 for Blob1: No
You can use Scope2 for Blob2: No
You can use Scope3 for share2: Yes |
| F | You can use Scope1, Scope2, or Scope3 for Blob1: No
You can use Scope2 for Blob2: No
You can use Scope3 for share2: No |
Correct answer: DExplanation:
Encryption scopes enable you to manage encryption with a key that is scoped to a container or an individual blob. You can use encryption scopes to create secure boundaries between data that resides in the same storage account but belongs to different customers.
By default, a storage account is encrypted with a key that is scoped to the entire storage account. When you define an encryption scope, you specify a key that may be scoped to a container or an individual blob. When the encryption scope is applied to a blob, the blob is encrypted with that key. When the encryption scope is applied to a container, it serves as the default scope for blobs in that container, so that all blobs that are uploaded to that container may be encrypted with the same key. The container can be configured to enforce the default encryption scope for all blobs in the container, or to permit an individual blob to be uploaded to the container with an encryption scope other than the default.
Azure storage encryption scopes are strictly bound to the specific storage account in which they are created.
Azure Files does not currently support custom encryption scopes.
Reference: Encryption scopes for Blob storage
Question: 841
Measured Skill: Deploy and manage Azure compute resources (20–25%)
You have two Azure Resource Manager (ARM) templates named Template1 and Template2.
Deployments of Template1 currently fail because a virtual machine extension in Template1 depends on a resource referenced in Template2.
You need to ensure that Template1 and Template2 deploy together as a single transaction, and that if either deployment fails, the overall deployment fails. Both templates must remain separate and reusable.
What should you do?| A | In Template1, set the dependsOn property of the virtual machine extension. |
| B | Create a parent template that references Template1 and Template2 as linked templates. |
| C | In Template1, configure the provisionAfterExtensions property of the virtual machine extension. |
| D | Add the resources from Template2 to Template1. |
Correct answer: BExplanation:
To deploy complex solutions, you can break your Azure Resource Manager template (ARM template) into many related templates, and then deploy them together through a main template. The related templates can be separate files or template syntax that's embedded within the main template.
The parent template orchestrates the deployment and can define dependencies between the linked templates. If one linked template deployment fails, the overall deployment is reported as failed. Microsoft recommends linked templates for breaking complex deployments into reusable components.
Reference: Use linked and nested templates to deploy Azure resources
Question: 842
Measured Skill: Implement and manage virtual networking (15–20%)
You have an Azure subscription named Sub1 that contains a virtual network named VNet1. VNet1 contains the subnets shown in the following table.
Sub1 contains the following storage accounts:
- storage1: Located in the West US Azure region
- storage2: Located in the East US Azure region
You create a network security group (NSG) named NSG1 and associate NSG1 to the subnets on VNet1.
You need to ensure that storage1 and storage2 can only be accessed by the virtual machines on Subnet1 and Subnet4 through the Microsoft backbone network. The solution must block access from all other subnets or external locations.
What should you do?
(To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.)
| A | To configure network connectivity: Create a private endpoint on each subnet.
To configure storage access: For each storage account, add a virtual network for Subnet1 and Subnet4. |
| B | To configure network connectivity: Configure virtual network peering.
To configure storage access: For each storage account, add a virtual network for Subnet1 and Subnet4. |
| C | To configure network connectivity: Create a private endpoint on each subnet.
To configure storage access: For each storage account, disable public network access. |
| D | To configure network connectivity: Create an NSG rule.
To configure storage access: For each storage account, disable public network access. |
| E | To configure network connectivity: Create a route table.
To configure storage access: Modify NSG1 to allow only outbound HTTPS traffic. |
| F | To configure network connectivity: Create an NSG rule.
To configure storage access: Modify NSG1 to allow only outbound HTTPS traffic. |
Correct answer: CExplanation:
We should integrate the storage accounts into Subnet1 and Subnet4 by using private endpoints.
A private endpoint is a network interface that uses a private IP address from your virtual network. This network interface connects you privately and securely to a service that's powered by Azure Private Link. By enabling a private endpoint, you're bringing the service into your virtual network.
The service could be an Azure service such as:
- Azure Storage
- Azure Cosmos DB
- Azure SQL Database
- Your own service, using Private Link service.
To configure storage access, we should limit access to selected networks or prevent traffic from all networks and permit access only through a private endpoint.
References:
What is a private endpoint?
Set the default public network access rule for an Azure Storage account
Question: 843
Measured Skill: Implement and manage virtual networking (15–20%)
You have an Azure subscription that has the public IPv4 addresses shown in the following table.
You need to create a virtual machine named VM1 that has the following settings:
- Region: East US
- Availability options: Availability zone
- Availability zone: Zone 1
Which public IPv4 addresses can you assign to VM1?| A | IP1 only |
| B | IP1 or IP2 only |
| C | IP1 or IP3 only |
| D | IP1, IP2, or IP3 |
Correct answer: BExplanation:
When a VM is deployed in an Availability Zone, any attached Standard Public IP address must be compatible with that zone:
- IP1 is assigned to Zone 1 and can be attached to a VM in Zone 1
- IP2 is Zone-redundant and can be used by resources in any availability zone within the region
- IP3 is assigned to Zone 2 and cannot be attached to a VM in Zone 1
A zone-redundant public IP address is a public IP that is not tied to a single Availability Zone. Instead, Azure automatically makes the IP resilient across multiple zones within the region.
- IP1 can be attached to resources in Zone 1.
- IP3 can be attached to resources in Zone 2.
- IP2 can be used by resources in any zone in the East US region because Azure distributes the IP across multiple zones.
Reference: Azure services that support availability zones