Microsoft AZ-104 Practice Test - Questions Answers, Page 35

To prepare for VMware VM assessment, you need to:

Verify VMware settings. Make sure that the vCenter Server and VMs you want to migrate meet requirements.

Set up permissions for assessment. Azure Migrate uses a vCenter account to access the vCenter

Server, to discover and assess VMs.

Verify appliance requirements. Verify deployment requirements for the Azure Migrate appliance, before you deploy it in the next tutorial.

Reference:

https://docs.microsoft.com/en-us/azure/migrate/tutorial-prepare-vmware

Box 1: No

Two methods are required.

Box 2: No

Self-service password reset is only enabled for Group2, and User1 is not a member of Group2.

Box 3: Yes

As a User Administrator User3 can add security questions to the reset process.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/authentication/quickstart-sspr

https://docs.microsoft.com/en-us/azure/active-directory/authentication/active-directorypasswords-faq

the multi-factor authentication service settings - Correct choice

There are two criterias mentioned in the question.

1. MFA required

2. Access from only a specific geographic region/IP range.

To satisfy both the requirements you need MFA with location conditional access. Please note to achieve this configuration you need to have AD Premium account for Conditional Access policy.

Navigate to Active Directory --> Security --> Conditional Access --> Named Location. Here you can create a policy with location (on-premise IP range) and enable MFA. This will satisfy the requirements.

an Azure AD Identity Protection user risk policy - Incorrect choice

In the Identity Protection, there are three (3) protection policies- User Risk, Sign-In Risk & MFA

Registration. None of those in which you can enable a location (on-prem IP Range) requirement in any blade.

the default for all the roles in Azure AD Privileged Identity Management - Incorrect choice

This option will not help you to restrict the users to access only form on prem.

an Azure AD Identity Protection sign-in risk policy - Incorrect choice

In the Identity Protection, there are three (3) protection policies- User Risk, Sign-In Risk & MFA

Registration. None of those in which you can enable a location (on-prem IP Range) requirement in any blade.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/location-condition

If you're enabled for multi-factor authentication, make sure that you have set up app passwords.

Note: During your initial two-factor verification registration process, you're provided with a single app password. If you require more than one, you'll have to create them yourself.

Go to the Additional security verification page.

Reference:

https://docs.microsoft.com/en-us/office365/troubleshoot/sign-in/sign-in-to-office-365-azure-intune

https://docs.microsoft.com/sv-se/azure/active-directory/user-help/multi-factor-authentication-enduser-app-passwords

User3 requires a user account in Azure AD.

Note: Your Azure AD password is considered an authentication method. It is the one method that cannot be disabled.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-authenticationmethods

When you create a web app from a Docker image, you configure the following properties:

. The registry that contains the image. The registry can be Docker Hub, Azure Container

Registry (ACR), or some other private registry.

. The image :This item is the name of the repository.

. The tag : This item indicates which version of the image to use from the repository. By convention, the most recent version is given the tag latest when it's built.

. Startup File :This item is the name of an executable file or a command to be run when the image is loaded. It's equivalent to the command that you can supply to Docker when running an image from the command line by using docker run. If you're deploying a ready-to-run, containerized app that already has the ENTRYPOINT and/or COMMAND values configured, you don't need to fill this in.

Reference:

https://docs.microsoft.com/en-us/learn/modules/deploy-run-container-app-service/4-deploy-webapp

A web app can time out after 20 minutes of inactivity. Only requests to the actual web app reset the timer. Viewing the app's configuration in the Azure portal or making requests to the advanced tools site (https://<app_name>.scm.azurewebsites.net) don't reset the timer. If your app runs continuous or scheduled (Timer trigger) WebJobs, enable Always On to ensure that the WebJobs run reliably.

This feature is available only in the Basic, Standard, and Premium pricing tiers.

The app service plan mentioned in the question is associated to the free tier , so addition of a continuous WebJob to App1 is not possible. So the proposed solution won't meet the goal.

Reference :

https://docs.microsoft.com/en-us/azure/app-service/webjobs-create

Box 1: a computer joined in the Active Directory domain

The Active Directory domain service stores passwords in the form of a hash value representation, of the actual user password.

Box 2: Stored in both Azure AD and in the Active Director domain

The Active Directory domain service stores passwords in the form of a hash value representation, of the actual user password.

To synchronize your password, Azure AD Connect sync extracts your password hash from the onpremises Active Directory instance.

Reference:

https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-password-hashsynchronization

Staging mode must be disabled. If the Azure AD Connect server is in staging mode, password hash synchronization is temporarily disabled.

Reference: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directoryaadconnectsync-troubleshoot-password-hash-synchronization#no-passwords-are-synchronizedtroubleshoot-by-using-the-troubleshooting-task