Microsoft AZ-104 Practice Test - Questions Answers, Page 36
List of questions
Question 351

You sign up for Azure Active Directory (Azure AD) Premium.
You need to add a user named [email protected] as an administrator on all the computers that will be joined to the Azure AD domain.
What should you configure in Azure AD?
Explanation:
When you connect a Windows device with Azure AD using an Azure AD join, Azure AD adds the following security principles to the local administrators group on the device:
The Azure AD global administrator role
The Azure AD device administrator role
The user performing the Azure AD join
In the Azure portal, you can manage the device administrator role on the Devices page. To open the Devices page:
1. Sign in to your Azure portal as a global administrator or device administrator.
2. On the left navbar, click Azure Active Directory.
3. In the Manage section, click Devices.
4. On the Devices page, click Device settings.
5. To modify the device administrator role, configure Additional local administrators on Azure AD joined devices.
Reference: https://docs.microsoft.com/en-us/azure/active-directory/devices/assign-local-admin
Question 352

HOTSPOT
Your network contains an Active Directory domain named adatum.com and an Azure Active Directory (Azure AD) tenant named adatum.onmicrosoft.com.
Adatum.com contains the user accounts in the following table.
Adatum.onmicrosoft.com contains the user accounts in the following table.
You need to implement Azure AD Connect. The solution must follow the principle of least privilege.
Which user accounts should you use? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.
Explanation:
Box 1: User5
In Express settings, the installation wizard asks for the following:
AD DS Enterprise Administrator credentials
Azure AD Global Administrator credentials
The AD DS Enterprise Admin account is used to configure your on-premises Active Directory. These credentials are only used during the installation and are not used after the installation has completed. The Enterprise Admin, not the Domain Admin should make sure the permissions in
Active Directory can be set in all domains.
Box 2: UserA
Azure AD Global Admin credentials credentials are only used during the installation and are not used after the installation has completed. It is used to create the Azure AD Connector account used for synchronizing changes to Azure AD. The account also enables sync as a feature in Azure AD.
Reference: https://docs.microsoft.com/en-us/azure/active-directory/connect/active-directoryaadconnect-accounts-permissions
Question 353

You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com.
You hire a temporary vendor. The vendor uses a Microsoft account that has a sign-in of [email protected].
You need to ensure that the vendor can authenticate to the tenant by using [email protected].
What should you do?
Explanation:
UserPrincipalName - contains the UserPrincipalName (UPN) of this user. The UPN is what the user will use when they sign in into Azure AD. The common structure is @, so for Abby Brown in Contoso.com, the UPN would be [email protected]
Example:
To create the user, call the New-AzureADUser cmdlet with the parameter values:
powershell New-AzureADUser -AccountEnabled rue -DisplayName "Abby Brown" -
PasswordProfile$PasswordProfile -MailNickName "AbbyB" -UserPrincipalName
Reference:
https://docs.microsoft.com/bs-cyrl-ba/powershell/azure/active-directory/new-usersample?view=azureadps-2.0
Question 354

DRAG DROP
You have an Azure Active Directory (Azure AD) tenant that has the initial domain name.
You have a domain name of contoso.com registered at a third-party registrar.
You need to ensure that you can create Azure AD users that have names containing a suffix of @contoso.com.
Which three actions should you perform in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.
Explanation:
The process is simple:
Add the custom domain name to your directory
Add a DNS entry for the domain name at the domain name registrar
Verify the custom domain name in Azure AD
Reference: https://docs.microsoft.com/en-us/azure/dns/dns-web-sites-custom-domain
Question 355

You have an Azure resource manager template that will be used to deploy 10 Azure Web Apps.
You have to ensure to deploy the pre-requisites before the deployment of the template.
You have to minimize the costs associated with the implementation.
Which of the following would you deploy as pre-requisites?
Explanation:
In App Service (Web Apps, API Apps, or Mobile Apps), an app always runs in an App Service plan. an App Service plan defines a set of compute resources for a web app to run.
One App Service Plan : Correct Choice
For an Azure Web App, you need to have an Azure App Service Plan in place. You can associate multiple Azure Web Apps with the same App Service Plan. Hence to save on costs, you can just have one Azure App Service Plan in place.
An Azure Load Balancer : Incorrect Choice
An Azure load balancer is a Layer-4 (TCP, UDP) load balancer that provides high availability by distributing incoming traffic among healthy VMs. A load balancer health probe monitors a given port on each VM and only distributes traffic to an operational VM
An Application Gateway : Incorrect Choice
Azure Application Gateway is a web traffic load balancer that enables you to manage traffic to your web applications. Traditional load balancers operate at the transport layer (OSI layer 4 - TCP and UDP) and route traffic based on source IP address and port, to a destination IP address and port.
10 Azure App Service Plans : Incorrect Choice
For an Azure Web App, you need to have an Azure App Service Plan in place. You can associate multiple Azure Web Apps with the same App Service Plan. Hence to save on costs, you can just have one Azure App Service Plan in place. So there is no need for 10 App Service Plans.
Reference:
https://docs.microsoft.com/en-us/azure/app-service/overview-hosting-plans
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/tutorial-load-balancer
https://docs.microsoft.com/en-us/azure/application-gateway/overview
Question 356

You configure Azure AD Connect for Azure Active Directory Seamless Single Sign-On (Azure AD Seamless SSO) for an on-premises network. Users report that when they attempt to access myapps.microsoft.com, they are prompted multiple times to sign in and are forced to use an account name that ends with onmicrosoft.com.
You discover that there is a UPN mismatch between Azure AD and the on-premises Active Directory.
You need to ensure that the users can use single-sign on (SSO) to access Azure resources.
What should you do first?
Explanation:
Azure AD Connect lists the UPN suffixes that are defined for the domains and tries to match them with a custom domain in Azure AD. Then it helps you with the appropriate action that needs to be taken.
The Azure
AD sign-in page lists the UPN suffixes that are defined for on-premises Active Directory and displays the corresponding status against each suffix. The status values can be one of the following:
State: Verified
Azure AD Connect found a matching verified domain in Azure AD. All users for this domain can sign in by using their on-premises credentials.
State: Not verified
Azure AD Connect found a matching custom domain in Azure AD, but it isn't verified. The UPN suffix of the users of this domain will be changed to the default .onmicrosoft.com suffix after synchronization if the domain isn't verified.
Action Required: Verify the custom domain in Azure AD.
Reference: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/plan-connect-usersignin
Question 357

You have an Azure subscription that contains the following storage account:
You need 10 create a request to Microsoft Support to perform a live migration of storage1 to Zone
Redundant Storage (ZRS) replication. How should you modify storage1 before the Live migration?
Explanation:
If you want to live migration from RA-GRS to ZRS, at first you have to Switch the storage tier to LRS and then only you can request a live migration.
Reference:
https://docs.microsoft.com/en-us/azure/storage/common/redundancymigration?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&tabs=portal
Question 358

You have an Azure Kubernetes cluster in place.
You have to deploy an application using an Azure Container registry image.
Which of the following command can be used for this requirement?
Explanation:
kubectl apply : Correct Choice
The kubectl command can be used to deploy applications to a Kubernetes cluster.
az kubernetes deploy : Incorrect Choice
This command is used to manage Azure Kubernetes Services. This is not used to deploy applications to a Kubernetes cluster.
New-AzKubernetes set : Incorrect Choice
This command is used to create a new managed Kubernetes cluster. This is not used to deploy applications to a Kubernetes cluster.
docker run : Incorrect Choice
This is run command in a new container. This is not used to deploy applications to a Kubernetes cluster.
Reference:
https://kubernetes.io/docs/reference/generated/kubectl/kubectl-commands#apply
https://docs.microsoft.com/en-us/cli/azure/aks?view=azure-cli-latest
https://docs.microsoft.com/en-us/powershell/module/az.aks/New-AzAks?view=azps-3.8.0&viewFallbackFrom=azps-4.3.0
https://docs.docker.com/engine/reference/commandline/run/
Question 359

HOTSPOT
You have an Azure Storage account named storage1.
You have an Azure App Service app named app1 and an app named App2 that runs in an Azure container instance. Each app uses a managed identity.
You need to ensure that App1 and App2 can read blobs from storage1 for the next 30 days.
What should you configure in storage1 for each app?
Explanation:
With Shared access signature you can limit the resources for access and at the same time can control the duration of the access.
A shared access signature (SAS) provides secure delegated access to resources in your storage account without compromising the security of your dat a. With a SAS, you have granular control over how a client can access your data. You can control what resources the client may access, what permissions they have on those resources, and how long the SAS is valid, among other parameters.
Reference:
https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview
Question 360

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription.
Solution: You assign the Traffic Manager Contributor role at the subscription level to Admin1.
Explanation:
With Traffic Manager Contributor role you can manage Traffic Manager profiles, do traffic analysis but does not let you control who has access to them.
Reference:
https://docs.microsoft.com/en-us/azure/network-watcher/traffic-analytics
https://docs.microsoft.com/en-us/azure/role-based-access-control/built-in-roles
Question