Spring Sale Limited Time 75% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = simple75

Pass the Microsoft Azure Administrator Associate AZ-104 Questions and answers with Dumpstech

Exam AZ-104 Premium Access

View all detail and faqs for the AZ-104 exam

Go to Exam

Practice at least 50% of the questions to maximize your chances of passing.

Viewing page 4 out of 13 pages

Viewing questions 31-40 out of questions

Questions # 31:

You need to configure the alerts for VM1 and VM2 to meet the technical requirements.

Which three actions should you perform in sequence? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.

Question # 31

Options:

Answer

Answer:

Explanation

1️⃣ Create a Log Analytics workspace.

2️⃣ Collect Windows performance counters from the Log Analytics agents.

3️⃣ Create an alert rule.

The question states:

“You need to configure the alerts for VM1 and VM2 to meet the technical requirements.”

The technical requirement from the case study specifies:

“Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.”

This requirement involves monitoring performance metrics (disk space) and generating alerts based on those metrics. According to Microsoft Azure monitoring and management documentation, the process to configure such alerts involves using Azure Monitor and Log Analytics.

Step-by-Step Verified Solution:

Step 1: Create a Log Analytics workspace

A Log Analytics workspace is required to store and analyze logs and performance data collected from virtual machines.

Azure Monitor uses this workspace as the central repository for performance counters, events, and logs from connected agents.

From the Microsoft Documentation:

“Before you can collect and query data from virtual machines, you must create a Log Analytics workspace in your subscription.”

(Source: Azure Monitor and Log Analytics Guide)

Step 2: Collect Windows performance counters from the Log Analytics agents

After creating the workspace, you must connect VM1 and VM2 to the workspace and configure the Windows performance counters that you want to monitor.

In this case, you would collect the LogicalDisk(%) Free Space counter for C: drive.

Azure Monitor agent or Log Analytics agent collects these metrics and sends them to the workspace for analysis.

“To monitor system performance, configure the agent to collect performance counters such as available memory or free disk space.”

(Source: Azure Monitor Performance Counters Documentation)

Step 3: Create an alert rule

Once performance data is being collected, you can create an alert rule in Azure Monitor based on a Kusto query or metric threshold.

You would define a condition such as:

LogicalDisk | where FreeSpaceMB < 20480

and configure it to trigger an alert when free space on volume C drops below 20 GB.

This alert can notify via email, action group, or automation runbook.

“Alerts in Azure Monitor proactively notify you when important conditions are found in your monitoring data. Alerts can trigger automated actions or notifications.”

(Source: Azure Monitor Alerts Overview)

Incorrect Options (Eliminated):

Configure the Diagnostic settings:

Used for collecting activity logs or resource logs, not performance counters from VMs.

Create an Azure SQL database:

Not relevant to the scenario of monitoring disk space.

Questions # 32:

You need to ensure that User1 can create initiative definitions, and User4 can assign initiatives to RG2. The solution must meet the technical requirements.

Which role should you assign to each user? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Question # 32

Options:

Answer

Answer:

Explanation

To meet the technical requirement that User1 can create initiative definitions and User4 can assign initiatives to RG2, we must understand how Azure Policy roles operate according to Microsoft Azure documentation and AZ-104 study guides.

Azure Policy uses role-based access control (RBAC) to determine who can create, manage, and assign policies or initiatives (policy sets). The key roles relevant to this task are:

Resource Policy Contributor – Allows users to create, edit, and delete policy definitions and initiative definitions, but does not allow assignment of policies or initiatives. This role is required for users who will design or build the policy logic (definitions).

Therefore, User1, who needs to create initiative definitions, must have the Resource Policy Contributor role.

Scope: Subscription (Sub1) – because initiatives are created at subscription or management group level.

Contributor – Provides full access to manage resources, except granting permissions. Contributors can assign existing policies or initiatives to resource groups or subscriptions if they have sufficient permissions.

Therefore, User4, who needs to assign initiatives to RG2, must be assigned the Contributor role at the RG2 scope.

Other roles:

Security Admin is related to Microsoft Defender for Cloud security settings, not policy creation.

Resource Policy Contributor for RG2 would not meet the requirement because creating definitions typically requires subscription-level access.

According to Microsoft Docs (“Azure built-in roles for Policy”):

“The Resource Policy Contributor role allows users to create, edit, and delete Azure policy and initiative definitions. To assign policies or initiatives, users need the Contributor or Owner role at the appropriate scope.”

Hence, the configuration should be:

User1: Resource Policy Contributor for Sub1

User4: Contributor for RG2

Questions # 33:

You need to ensure that you can grant Group4 Azure RBAC read-only permissions to all the A2ure file shares. What should you do?

Options:

On storagel and storage4, change the Account kind type to StorageV2 (general purpose v2).

Recreate storage2 and set Hierarchical namespace to Enabled.

On storage2, enable identity-based access for the file shares.

Create a shared access signature (SAS) for storagel, storage2, and storage4.

Answer

Questions # 34:

You need to configure Azure Backup to back up the file shares and virtual machines.

What is the minimum number of Recovery Services vaults and backup policies you should create? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Question # 34

Options:

Questions # 35:

You implement the planned changes for NSG1 and NSG2.

For each of the following statements, select Yes if the statement is true. Otherwise, select No.

NOTE: Each correct selection is worth one point.

Question # 35

Options:

Questions # 36:

You need to identify which storage account to use for the flow logging of IP traffic from VM5. The solution must meet the retention requirements.

Which storage account should you identify?

Options:

storage4

storage1

storage2

storage3

Questions # 37:

You need to create storage5. The solution must support the planned changes.

Which type of storage account should you use, and which account should you configure as the destination storage account? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Question # 37

Options:

Answer

Answer:

Explanation

The question asks which storage account type should be created for storage5 and which existing storage account should be configured as the destination for replication — while supporting the planned changes.

Step 1: Planned Change Requirement

From the case study:

“Create a storage account named storage5 and configure storage replication for the Blob service.”

This indicates that storage5 will act as a secondary (destination) account to receive geo-replicated blobs (as part of RA-GRS or GRS replication configuration).

Therefore, the new storage5 must support Blob service replication features.

Step 2: Determining Correct Account Type

According to Microsoft Azure Administrator Documentation (Microsoft Learn: “Types of storage accounts”):

Account Type

Blob Support

File Share Support

Recommended Use

Storage (general purpose v1)

✅ Basic blob

Limited

Legacy use, lacks advanced features

StorageV2 (general purpose v2)

✅ Full blob, file, queue, table support

✅

Supports replication (GRS, RA-GRS, ZRS) and access tiers

BlobStorage

✅ Blob only

❌ No file shares

Used only for block and append blobs

BlockBlobStorage

✅ Blob only (premium tier)

❌ No file shares

High-performance workloads only

Therefore, the correct type for storage5 must be StorageV2, as it supports both:

Blob service replication (GRS, RA-GRS, ZRS, LRS)

All tiers (Hot, Cool, Archive)

This meets the planned change and ensures the account supports replication for Blob service.

Step 3: Determining the Correct Destination Storage Account

The question also requires identifying which existing storage account should act as the destination for replication configuration.

In Azure, Blob service replication (for example, geo-redundant replication or object replication) requires:

Both storage accounts to be StorageV2.

Both to be in the same region pair and have object replication enabled.

Looking at the table:

Storage Account

Kind

Location

File Share

Identity-based Access

storage1

Storage (general purpose v1)

West US

sharea

Azure AD DS

storage2

StorageV2 (general purpose v2)

East US

shareb, sharec

Disabled

storage3

BlobStorage

East US 2

N/A

storage4

FileStorage

Central US

shared

Azure AD DS

Only storage2 meets all of the following conditions:

✅ Type: StorageV2

✅ Region: East US (a valid replication pair for East US 2 or secondary region)

✅ Blob Service supported

Hence, storage2 is the correct destination storage account to configure for replication from storage5.

Step 4: Supporting Microsoft Azure Documentation Extracts

From Microsoft Learn – Azure Storage account overview:

“General-purpose v2 accounts support all Azure Storage features, including blob, file, queue, and table storage. They are recommended for most scenarios.”

“Object replication requires both source and destination accounts to be of the same type (StorageV2) and in regions that are geo-paired.”

“Blob and StorageV2 accounts support replication options such as LRS, ZRS, GRS, and RA-GRS.”

Questions # 38:

You need to add VM1 and VM2 to the backend poo! of LB1. What should you do first?

Options:

Create a new NSG and associate the NSG to VNET1/Subnet1.

Connect VM2 to VNET1/Subnet1.

Redeploy VM1 and VM2 to the same availability zone.

Redeploy VM1 and VM2 to the same availability set.

Answer

Explanation

In Azure, Load Balancers distribute network traffic across multiple virtual machines (VMs) to ensure high availability and reliability. To add virtual machines to the backend pool of an Azure Load Balancer, the following key conditions must be met according to the Microsoft Azure Administrator documentation:

All VMs in the backend pool must be connected to the same virtual network (VNet) as the Load Balancer.

The Load Balancer (in this case, LB1) is configured for internal load balancing on VNET1/Subnet1 as per the technical requirements of the case study.

The backend pool can include network interfaces (NICs) from VMs within the same region and VNet.

Step-by-step analysis:

From the case study data:

Location

Connected to

IP Address

VM1

West US

VNET1/Subnet1

10.0.1.4

VM2

West US

VNET1/Subnet2

10.0.2.4

LB1

Internal Basic Load Balancer

Connected to VNET1/Subnet1

—

Observation:

VM1 is already connected to VNET1/Subnet1, where the internal Load Balancer LB1 is also deployed.

VM2, however, is connected to VNET1/Subnet2, which is a different subnet within the same virtual network.

According to Microsoft Learn (“Configure backend pools in Azure Load Balancer”):

“All network interfaces in the backend pool must be within the same virtual network as the load balancer. You cannot add VMs connected to different VNets or subnets not associated with the load balancer’s front-end configuration.”

Therefore, before you can add VM2 to the backend pool, you must ensure that its network interface is attached to VNET1/Subnet1, the same subnet used by LB1.

Only after this step will both VMs (VM1 and VM2) be eligible for inclusion in LB1’s backend pool.

Incorrect Option Analysis:

A. Create a new NSG and associate the NSG to VNET1/Subnet1.

❌ Not required. Network Security Groups control traffic filtering, not backend pool configuration.

C. Redeploy VM1 and VM2 to the same availability zone.

❌ Availability Zones only matter for redundancy and failover, not for backend pool eligibility in a basic internal load balancer.

D. Redeploy VM1 and VM2 to the same availability set.

❌ Basic Load Balancers can distribute traffic across VMs in the same availability set, but both VMs must already reside in the same VNet/Subnet first.

Final Verified Answer:

✅ B. Connect VM2 to VNET1/Subnet1

Reference (Microsoft Official Documentation):

Microsoft Learn: Configure the backend pool for Azure Load Balancer

Microsoft Learn: Azure Load Balancer overview

Microsoft Learn: Create and configure an internal load balancer

Microsoft Learn: Virtual network and subnet requirements for load balancing

Questions # 39:

You need to the appropriate sizes for the Azure virtual for Server2.

What should you do? To answer, select the appropriate options in the answer area.

NOTE: Each correct selection is worth one point.

Question # 39

Options:

Questions # 40:

You need to ensure that VM1 can communicate with VM4. The solution must minimize administrative effort.

What should you do?

Options:

Create a user-defined route from VNET1 to VNET3.

Assign VM4 an IP address of 10.0.1.5/24.

Establish peering between VNET1 and VNET3.

Create an NSG and associate the NSG to VMI and VM4.

Answer

Explanation

To enable communication between virtual machines (VMs) located in different virtual networks (VNets) in Azure, the most efficient and recommended approach—according to Microsoft Azure Administrator documentation—is to use VNet peering.

1. Background and Scenario Analysis

From the case study:

VM1 and VM4 are located in different VNets (VNET1 and VNET3).

The requirement is to ensure that VM1 can communicate with VM4.

The solution must minimize administrative effort and cost.

2. Microsoft Documentation Insight: VNet Peering

According to Microsoft Learn: “Virtual network peering”:

“Virtual network peering seamlessly connects two Azure virtual networks. The virtual networks appear as one for connectivity purposes. Traffic between peered virtual networks uses private IP addresses, as if they were part of the same network, and the traffic stays entirely on the Microsoft backbone network.”

Key characteristics of VNet peering:

Enables private IP connectivity between resources across peered VNets.

No need to deploy or maintain gateways (unlike VPN gateways).

Provides low latency and high bandwidth.

Supports transitive routing through additional configurations.

Minimal administrative overhead — peering can be created with just a few clicks or PowerShell/CLI commands.

3. Why the Other Options Are Incorrect

A. Create a user-defined route (UDR) from VNET1 to VNET3.

❌ A UDR alone cannot enable connectivity between VNets unless a gateway or peering already exists. Without a connection path, a route has no effect.

B. Assign VM4 an IP address of 10.0.1.5/24.

❌ This would attempt to place VM4 in the same subnet as VM1, but cross-VNet subnet IP assignment is not possible in Azure. Each VNet has its own isolated address space.

D. Create an NSG and associate it with VM1 and VM4.

❌ Network Security Groups control traffic filtering within or between existing network connections. They do not create connectivity between isolated VNets.

4. Why Peering Is the Correct and Simplest Solution

Establishing VNet peering between VNET1 and VNET3 will:

Instantly enable bidirectional private IP communication between VM1 and VM4.

Minimize administrative effort (no gateways, routing tables, or IP reconfiguration).

Maintain security and performance through Microsoft’s internal backbone.

Avoid additional costs compared to deploying VPN gateways.

5. Implementation Summary

Steps to configure:

In the Azure Portal, go to VNET1 → Peerings → Add.

Choose VNET3 as the peer virtual network.

Enable Allow virtual network access in both directions.

Once completed, both VMs (VM1 and VM4) will communicate using their private IPs.

Final Verified Answer: ✅ C. Establish peering between VNET1 and VNET3

References (Microsoft Official Documentation):

Microsoft Learn — Virtual network peering overview

Microsoft Learn — Create, change, or delete a virtual network peering

Microsoft Learn — Azure virtual network connectivity options and recommendations

Viewing page 4 out of 13 pages

Viewing questions 31-40 out of questions