Microsoft Azure Administrator AZ-104 Exam Questions

Page: 1 / 14
Total 479 questions
Question 1

You have an Azure container registry in the Standard tier.

You need to enable the admin user account and retrieve the password for the account Which settings should you use?



Answer : D, D

In Azure Container Registry (ACR), the admin user account provides a simple authentication mechanism using a username and password. Enabling the admin account and retrieving its credentials is done exclusively through the Access keys blade.

According to Azure Container Registry documentation:

The admin user is enabled/disabled from Access keys

The passwords (primary and secondary) are displayed and regenerated there

Other blades such as Networking, Properties, or Identity do not manage admin credentials

Final Answer:


Question 2

You have a Microsoft Entra tenant named contoso.com.

You collaborate with an external partner named fabrikam.com.

You plan to invite users in fabrikam.com to the contoso.com tenant.

You need to ensure that invitations can be sent only to fabrikam.com users.

What should you do in the Microsoft Entra admin center?



Answer : C

Microsoft Entra ID provides External collaboration settings to control which external domains users can invite as guests. To restrict invitations so that only users from fabrikam.com can be invited, you must configure Collaboration restrictions.

Within the External collaboration settings, administrators can:

Allow invitations only to users from specific domains

Block invitations to all other external domains

Microsoft Entra documentation specifies that Collaboration restrictions are the control used to define allowed or blocked external domains for B2B guest invitations.

The other options do not meet the requirement:

Guest user access restrictions control what guests can do after they are invited.

Cross-tenant access -- Tenant restrictions control inbound/outbound access behavior, not invitation eligibility.

Microsoft cloud settings apply to cloud instances, not domain-based invitations.

Final Verified Answe r: C. From External collaboration settings, configure the Collaboration restrictions settings.


Question 3

You have an Azure subscription that contains the resources shown in the following table.

You need to configure a proximity placement group for VMSS1.

Which proximity placement groups should you use?



Answer : A

Placement Groups is a capability to achieve co-location of your Azure Infrastructure as a Service (IaaS) resources and low network latency among them, for improved application performance.

Azure proximity placement groups represent a new logical grouping capability for your Azure Virtual Machines, which in turn is used as a deployment constraint when selecting where to place your virtual machines. In fact, when you assign your virtual machines to a proximity placement group, the virtual machines are placed in the same data center, resulting in lower and deterministic latency for your applications.

The VMSS should share the same region, even it should be the same zone as proximity groups are located in the same data center. Accordingly, it should be proximity 2 only.


https://azure.microsoft.com/en-us/blog/introducing-proximity-placement-groups

Question 4

You have an Azure subscription that contains the resources shown in the following table.

The Not allowed resource types Azure policy that has policy enforcement enabled is assigned to RG1 and uses the following parameters:

Microsoft.Network/virtualNetworks

Microsoft.Compute/virtualMachines

In RG1, you need to create a new virtual machine named VM2 which is connected toVNET1. What should you do first?



Answer : D

Option A (Create an Azure Resource Manager template): This wouldn't circumvent the policy enforcement. Even with a template, you cannot create resources that the policy explicitly denies.

Option B (Add a subnet to VNET1): Adding a subnet does not address the policy restriction on creating virtual machines. Also, the existing VNET1 can already have multiple subnets.

Option C (Remove Microsoft.Network/virtualNetworks from the policy): This isn't necessary because you're not trying to create a new virtual network; you are connecting to an existing one, VNET1.

Option D (Remove Microsoft.Compute/virtualMachines from the policy): This is the correct action because it directly addresses the restriction that is preventing you from creating a new virtual machine in RG1. Removing the virtual machine resource type from the not allowed list in the policy will enable you to create VM2.

Remember, changes to policies might take a few minutes to propagate. After updating the policy, you should be able to create the new virtual machine VM2 and connect it to VNET1.


Question 5

You have an Azure subscription that contains two Log Analytics workspaces named Workspace 1 and Workspace? and 100 virtual machines that run Windows Server.

You need to collect performance data and events from the virtual machines. The solution must meet the following requirements:

* Logs must be sent to Workspace! and Workspace?

* All Windows events must be captured

* All security events must be captured.

What should you install and configure on each virtual machine?



Answer : A

https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview Azure Monitor Agent (AMA) collects monitoring data from the guest operating system of Azure and hybrid virtual machines and delivers it to Azure Monitor for use by features, insights, and other services, such as Microsoft Sentinel and Microsoft Defender for Cloud. Azure Monitor Agent replaces all of Azure Monitor's legacy monitoring agents.


Question 6

You have an Azure subscription that contains an Azure Storage account.

You plan to create an Azure container instance named container1 that will use a Docker image namedImage1. Image1 contains a Microsoft SQL Server instance that requires persistent storage.

You need to configure a storage service for Container1.

What should you use?



Answer : A

When using Azure Container Instances (ACI) that require persistent storage, the recommended and supported storage solution is Azure Files. Azure Files provides a fully managed Server Message Block (SMB) or Network File System (NFS) file share that can be mounted by container instances at runtime.

According to Microsoft Azure Administrator documentation, Azure Files is designed for workloads that require shared, durable storage accessible by multiple compute nodes, including containers. It supports read/write persistence and maintains data durability across restarts of containers.

In this question, since the Docker image contains a Microsoft SQL Server instance, persistent and shared storage is necessary to store the database files (.mdf, .ldf). Blob, Queue, or Table storage cannot provide this functionality because:

Blob storage is for object storage (no file system mount capability).

Queue storage is for message-based communication.

Table storage is for NoSQL key-value structured data.

Azure Files allows containerized SQL Server instances to store their database files securely and persistently between container restarts or failures.


Question 7

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

You have a Microsoft Entra tenant named Adatum.com and an Azure Subscription named Subscription1. Adatum.com contains a group named Developers. Subscription1 contains a resource group named Dev.

You need to provide the Developers group with the ability to create Azure Logic Apps in the Dev resource group.

Solution: On Subscription1, you assign the DevTest Labs User role to the Developers group.

Does this meet the goal?



Answer : B

The DevTest Labs User role is a built-in Azure role designed specifically to support operations within Azure DevTest Labs. According to the Microsoft Azure Administrator documentation on built-in roles, this role permits users to connect to, start, stop, restart, and use virtual machines inside a DevTest Lab, but it does not grant permissions to create or manage Azure resources outside of DevTest Labs, such as Azure Logic Apps.

In this scenario, the requirement is to allow the Developers group to create Azure Logic Apps in the Dev resource group. Azure Logic Apps are managed through the Microsoft.Logic resource provider and require permissions such as Microsoft.Logic/workflows/write. These permissions are included in roles like Logic App Contributor or the more general Contributor role at the resource group scope.

The DevTest Labs User role does not include permissions to deploy or manage Logic Apps, even when assigned at the subscription level. Therefore, assigning this role does not meet the stated goal. Microsoft documentation explicitly states that DevTest Labs User is limited to DevTest Lab resources and cannot be used as a general deployment role.

Final Answer: B. No


Page:    1 / 14   
Total 479 questions