Microsoft AZ-104 Practice Test - Questions Answers, Page 20

The following chart shows the list of roles and the supported actions on management groups.

Note:

Each directory is given a single top-level management group called the "Root" management group.

This root management group is built into the hierarchy to have all management groups and subscriptions fold up to it. This root management group allows for global policies and Azure role assignments to be applied at the directory level. The Azure AD Global Administrator needs to elevate themselves to the User Access Administrator role of this root group initially. After elevating access, the administrator can assign any Azure role to other directory users or groups to manage the hierarchy. As administrator, you can assign your own account as owner of the root management group.

Reference:

https://docs.microsoft.com/en-us/azure/governance/management-groups/overview

Box 1: "tag1": "value1" only

Box 2: "tag2": "value2" and "tag3": "value3"

Tags applied to the resource group are not inherited by the resources in that resource group.

Reference:

https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-group-using-tags

The Not allowed resource types Azure policy prohibits the deployment of specified resource types.

You specify an array of the resource types to block.

Virtual Networks and Virtual Machines are prohibited.

Reference:

https://docs.microsoft.com/en-us/azure/governance/policy/samples/not-allowed-resource-types

Azure Virtual WAN is a networking service that brings many networking, security, and routing functionalities together to provide a single operational interface.

The Virtual WAN architecture is a hub and spoke architecture with scale and performance built in for branches (VPN/SD-WAN devices), users (Azure VPN/OpenVPN/IKEv2 clients), ExpressRoute circuits, and virtual networks.

Azure regions serve as hubs that you can choose to connect to. All hubs are connected in full mesh in a Standard Virtual WAN making it easy for the user to use the Microsoft backbone for any-to-any (any spoke) connectivity.

Virtual WAN offers the following advantages:

Integrated connectivity solutions in hub and spoke: Automate site-to-site configuration and connectivity between on-premises sites and an Azure hub.

Automated spoke setup and configuration: Connect your virtual networks and workloads to the Azure hub seamlessly.

Intuitive troubleshooting: You can see the end-to-end flow within Azure, and then use this information to take required actions.

Reference:

https://docs.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about

You can't delete a Recovery Services vault if it is registered to a server and holds backup data. If you try to delete a vault, but can't, the vault is still configured to receive backup data.

Remove vault dependencies and delete vault

In the vault dashboard menu, scroll down to the Protected Items section, and click Backup Items. In this menu, you can stop and delete Azure File Servers, SQL Servers in Azure VM, and Azure virtual machines.

Reference: https://docs.microsoft.com/en-us/azure/backup/backup-azure-delete-vault

Box 1: 60

One alert per minute will trigger one email per minute.

Box 2: 12

No more than 1 SMS every 5 minutes can be send, which equals 12 per hour.

Note: Rate limiting is a suspension of notifications that occurs when too many are sent to a particular phone number, email address or device. Rate limiting ensures that alerts are manageable and actionable.

The rate limit thresholds are:

SMS: No more than 1 SMS every 5 minutes.

Voice: No more than 1 Voice call every 5 minutes.

Email: No more than 100 emails in an hour.

Other actions are not rate limited.

Reference:

https://github.com/MicrosoftDocs/azure-docs/blob/master/articles/monitoring-anddiagnostics/ monitoring-overview-alerts.md

You can validate web app changes in a staging deployment slot before swapping it with the production slot. Deploying an app to a slot first and swapping it into production makes sure that all instances of the slot are warmed up before being swapped into production. This eliminates downtime when you deploy your app. The traffic redirection is seamless, and no requests are dropped because of swap operations. You can automate this entire workflow by configuring auto swap when pre-swap validation isn't needed.

After the swap you can deploy the App1 update to webapp1-test, and then test the update. If the changes swapped into the production slot aren't as per your expectation then you can perform the same swap immediately to get your "last known good site" back.

Reference:

https://docs.microsoft.com/en-us/azure/app-service/deploy-staging-slots

Note: Rules are processed in priority order, with lower numbers processed before higher numbers, because lower numbers have higher priority. Once traffic matches a rule, processing stops. As a result, any rules that exist with lower priorities (higher numbers) that have the same attributes as rules with higher priorities are not processed.

Reference: https://docs.microsoft.com/en-us/azure/virtual-network/security-overview