AZ-104

You plan to con􀂬gure Azure Monitor for VM Insights.

You need to ensure that all the virtual machines only communicate with Azure Monitor through VNet1.

What should you create 􀂬rst?

You need to monitor input events for Job1 to identify the number of events that were NOT processed.

Which metric should you use?

You plan to use Azure Monitor to monitor the performance of DB1. You must be able to run queries to analyze log data.

Which destination should you con􀂬gure in the Diagnostic settings of DB1?

You have a data collection rule (DCR) named Rule1.

You plan to use the Azure Monitor Agent to collect events from Windows System event logs.

You only need to collect system events that have an ID of 1001.

Which type of query should you use for the data source in Rule1?

You have an on-premises datacenter that contains a domain controller named DC1. ExpressRoute is used to connect the on-premises

datacenter to Azure.

You need to use Connection Monitor to identify network latency between VM1 and DC1.

What should you install on DC1?

You deploy a new virtual machine named VM1 that has the following settings:

• Region: East US

• Virtual network: VNet1

• NIC network security group: NSG1

You need to monitor VM1 tra􀂮c by using Tra􀂮c Analytics.

Which settings should you con􀂬gure?

Contoso identi􀂬es the following requirements for users:

Ensure that only users who are part of a group named Pilot can join devices to Azure AD.

Designate a new user named Admin1 as the service admin for the Azure subscription.

Admin1 must receive email alerts regarding service outages.

Ensure that a new user named User3 can create network objects for the Azure subscription.

Question

You need to meet the user requirement for Admin1.

What should you do?

Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an onpremises

Active

Directory domain that syncs to the Azure AD tenant.

The Azure AD tenant contains the users shown in the following table.

（含图）

Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table.

（含图）

User1 manages the resources in RG1. User4 manages the resources in RG2.

Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table

（含图）

No network security groups (NSGs) are associated to the network interfaces or the subnets.

Sub1 contains the storage accounts shown in the following table.

（含图）

Requirements -

Planned Changes -

Contoso plans to implement the following changes:

Create a blob container named container1 and a 􀂬le share named share1 that will use the Cool storage tier.

Create a storage account named storage5 and con􀂬gure storage replication for the Blob service.

Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.

（含图）

Associate NSG1 to the network interface of VM1.

Create an NSG named NSG2 that will have the custom outbound security rules shown in the following table.

（含图）

Associate NSG2 to VNET1/Subnet2.

Technical Requirements -

Contoso must meet the following technical requirements:

Create container1 and share1.

Use the principle of least privilege.

Create an Azure AD security group named Group4.

Back up the Azure 􀂬le shares and virtual machines by using Azure Backup.

Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.

Enable User1 to create Azure policy de􀂬nitions and User2 to assign Azure policies to RG1.

Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1

Enable 􀂭ow logging for IP tra􀂮c from VM5 and retain the 􀂭ow logs for a period of eight months.

Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure

You need to ensure that you can grant Group4 Azure RBAC read only permissions to all the Azure 􀂬le shares.

What should you do?

Contoso, Ltd. is a manufacturing company that has o􀂮ces worldwide. Contoso works with partner organizations to bring products to market.

Contoso products are manufactured by using blueprint 􀂬les that the company authors and maintains.

Existing Environment -

Currently, Contoso uses multiple types of servers for business operations, including the following:

File servers

Domain controllers

Microsoft SQL Server servers

Your network contains an Active Directory forest named contoso.com. All servers and client computers are joined to Active Directory.

You have a public-facing application named App1. App1 is comprised of the following three tiers:

A SQL database

A web front end

A processing middle tier -

Each tier is comprised of 􀂬ve virtual machines. Users access the web front end by using HTTPS only.

Requirements -

Planned Changes -

Contoso plans to implement the following changes to the infrastructure:

Move all the tiers of App1 to Azure.

Move the existing product blueprint 􀂬les to Azure Blob storage.

Create a hybrid directory to support an upcoming Microsoft 365 migration project.

Technical Requirements -

Contoso must meet the following technical requirements:

Move all the virtual machines for App1 to Azure.

Minimize the number of open ports between the App1 tiers.

Ensure that all the virtual machines for App1 are protected by backups.

Copy the blueprint 􀂬les to Azure over the Internet.

Ensure that the blueprint 􀂬les are stored in the archive storage tier.

Ensure that partner access to the blueprint 􀂬les is secured and temporary.

Prevent user passwords or hashes of passwords from being stored in Azure.

Use unmanaged standard storage for the hard disks of the virtual machines.

Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.

Minimize administrative effort whenever possible.

店铺；IT认证考试服务

店铺；IT认证考试服务

店铺；IT认证考试服务

店铺；IT认证考试服务

淘宝店铺：https://shop100800896.taobao.com/

User Requirements -

Contoso identi􀂬es the following requirements for users:

Ensure that only users who are part of a group named Pilot can join devices to Azure AD.

Designate a new user named Admin1 as the service admin for the Azure subscription.

Admin1 must receive email alerts regarding service outages.

Ensure that a new user named User3 can create network objects for the Azure subscription.

Question

You need to implement a backup solution for App1 after the application is moved.

What should you create 􀂬rst?

Currently, Contoso uses multiple types of servers for business operations, including the following:

File servers

Domain controllers

Microsoft SQL Server servers

Your network contains an Active Directory forest named contoso.com. All servers and client computers are joined to Active Directory.

You have a public-facing application named App1. App1 is comprised of the following three tiers:

A SQL database

A web front end

A processing middle tier -

Each tier is comprised of 􀂬ve virtual machines. Users access the web front end by using HTTPS only.

Requirements -

Planned Changes -

Contoso plans to implement the following changes to the infrastructure:

Move all the tiers of App1 to Azure.

Move the existing product blueprint 􀂬les to Azure Blob storage.

Create a hybrid directory to support an upcoming Microsoft 365 migration project.

Technical Requirements -

Contoso must meet the following technical requirements:

Move all the virtual machines for App1 to Azure.

Minimize the number of open ports between the App1 tiers.

Ensure that all the virtual machines for App1 are protected by backups.

Copy the blueprint 􀂬les to Azure over the Internet.

Ensure that the blueprint 􀂬les are stored in the archive storage tier.

Ensure that partner access to the blueprint 􀂬les is secured and temporary.

Prevent user passwords or hashes of passwords from being stored in Azure.

Use unmanaged standard storage for the hard disks of the virtual machines.

Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.

Minimize administrative effort whenever possible.

店铺；IT认证考试服务

店铺；IT认证考试服务

店铺；IT认证考试服务

店铺；IT认证考试服务

淘宝店铺：https://shop100800896.taobao.com/

User Requirements -

Contoso identi􀂬es the following requirements for users:

Ensure that only users who are part of a group named Pilot can join devices to Azure AD.

Designate a new user named Admin1 as the service admin for the Azure subscription.

Admin1 must receive email alerts regarding service outages.

Ensure that a new user named User3 can create network objects for the Azure subscription.

Question

You need to move the blueprint 􀂬les to Azure.

What should you do?

Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an onpremises

Active

Directory domain that syncs to the Azure AD tenant.

The Azure AD tenant contains the users shown in the following table.

（含图）

Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table.

（含图）

User1 manages the resources in RG1. User4 manages the resources in RG2.

Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table

（含图）

No network security groups (NSGs) are associated to the network interfaces or the subnets.

Sub1 contains the storage accounts shown in the following table.

（含图）

Requirements -

Planned Changes -

Contoso plans to implement the following changes:

Create a blob container named container1 and a 􀂬le share named share1 that will use the Cool storage tier.

Create a storage account named storage5 and con􀂬gure storage replication for the Blob service.

Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.

（含图）

Associate NSG1 to the network interface of VM1.

Create an NSG named NSG2 that will have the custom outbound security rules shown inthe following table.

（含图）

Associate NSG2 to VNET1/Subnet2.

Technical Requirements -

Contoso must meet the following technical requirements:

Create container1 and share1.

Use the principle of least privilege.

Create an Azure AD security group named Group4.

Back up the Azure 􀂬le shares and virtual machines by using Azure Backup.

Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.

Enable User1 to create Azure policy de􀂬nitions and User2 to assign Azure policies to RG1.

Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1

Enable 􀂭ow logging for IP tra􀂮c from VM5 and retain the 􀂭ow logs for a period of eight months.

Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure 􀂬le shares.

Question

You need to identify which storage account to use for the 􀂭ow logging of IP tra􀂮c from VM5. The solution must meet the retention

requirements.

Which storage account should you identify?

Litware, Inc. is a consulting company that has a main o􀂮ce in Montreal and two branch o􀂮ces in Seattle and New York.

The Montreal o􀂮ce has 2,000 employees. The Seattle o􀂮ce has 1,000 employees. The New York o􀂮ce has 200 employees.

All the resources used by Litware are hosted on-premises.

Litware creates a new Azure subscription. The Azure Active Directory (Azure AD) tenant uses a domain named litware.onmicrosoft.com. The

tenant uses the

Premium P1 pricing tier.

Existing Environment -

The network contains an Active Directory forest named litware.com. All domain controllers are con􀂬gured as DNS servers and host the

litware.com DNS zone.

Litware has 􀂬nance, human resources, sales, research, and information technology departments. Each department has an organizational unit

(OU) that contains all the accounts of that respective department. All the user accounts have the department attribute set to their respective

department. New users are added frequently.

Litware.com contains a user named User1.

All the o􀂮ces connect by using private connections.

Litware has data centers in the Montreal and Seattle o􀂮ces. Each o􀂮ce has a 􀂬rewall that can be con􀂬gured as a VPN device.

All infrastructure servers are virtualized. The virtualization environment contains the servers in the following table.

（含图）

Litware uses two web applications named App1 and App2. Each instance on each web application requires 1 GB of memory.

The Azure subscription contains the resources in the following table.

（含图）

The network security team implements several network security groups (NSGs)

Requirements -

Planned Changes -

Litware plans to implement the following changes:

Deploy Azure ExpressRoute to the Montreal o􀂮ce.

Migrate the virtual machines hosted on Server1 and Server2 to Azure.

Synchronize on-premises Active Directory to Azure Active Directory (Azure AD).

Migrate App1 and App2 to two Azure web apps named WebApp1 and WebApp2.

Technical Requirements -

Litware must meet the following technical requirements:

Ensure that WebApp1 can adjust the number of instances automatically based on the load and can scale up to 􀂬ve instances.

Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in the Montreal o􀂮ce.

Ensure that routing information is exchanged automatically between Azure and the routers in the Montreal o􀂮ce.

Enable Azure Multi-Factor Authentication (MFA) for the users in the 􀂬nance department only.

Ensure that webapp2.azurewebsites.net can be accessed by using the name app2.litware.com.

Connect the New York o􀂮ce to VNet1 over the Internet by using an encrypted connection.

Create a work􀂭ow to send an email message when the settings of VM4 are modi􀂬ed.

Create a custom Azure role named Role1 that is based on the Reader role.

Minimize costs whenever possible.

Question

You discover that VM3 does NOT meet the technical requirements.

You need to verify whether the issue relates to the NSGs.

What should you use?

Litware, Inc. is a consulting company that has a main o􀂮ce in Montreal and two branch o􀂮ces in Seattle and New York.

The Montreal o􀂮ce has 2,000 employees. The Seattle o􀂮ce has 1,000 employees. The New York o􀂮ce has 200 employees.

All the resources used by Litware are hosted on-premises.

Litware creates a new Azure subscription. The Azure Active Directory (Azure AD) tenant uses a domain named litware.onmicrosoft.com. The

tenant uses the

Premium P1 pricing tier.

Existing Environment -

The network contains an Active Directory forest named litware.com. All domain controllers are con􀂬gured as DNS servers and host the

litware.com DNS zone.

Litware has 􀂬nance, human resources, sales, research, and information technology departments. Each department has an organizational unit

(OU) that contains all the accounts of that respective department. All the user accounts have the department attribute set to their respective

department. New users are added frequently.

Litware.com contains a user named User1.

All the o􀂮ces connect by using private connections.

Litware has data centers in the Montreal and Seattle o􀂮ces. Each o􀂮ce has a 􀂬rewall that can be con􀂬gured as a VPN device.

All infrastructure servers are virtualized. The virtualization environment contains the servers in the following table.

（含图）

Litware uses two web applications named App1 and App2. Each instance on each web application requires 1 GB of memory.

The Azure subscription contains the resources in the following table.

（含图）

The network security team implements several network security groups (NSGs)

Requirements -

Planned Changes -

Litware plans to implement the following changes:

Deploy Azure ExpressRoute to the Montreal o􀂮ce.

Migrate the virtual machines hosted on Server1 and Server2 to Azure.

Synchronize on-premises Active Directory to Azure Active Directory (Azure AD).

Migrate App1 and App2 to two Azure web apps named WebApp1 and WebApp2.

Technical Requirements -

Litware must meet the following technical requirements:

Ensure that WebApp1 can adjust the number of instances automatically based on the load and can scale up to 􀂬ve instances.

Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in the Montreal o􀂮ce.

Ensure that routing information is exchanged automatically between Azure and the routers in the Montreal o􀂮ce.

Enable Azure Multi-Factor Authentication (MFA) for the users in the 􀂬nance department only.

Ensure that webapp2.azurewebsites.net can be accessed by using the name app2.litware.com.

Connect the New York o􀂮ce to VNet1 over the Internet by using an encrypted connection.

Create a work􀂭ow to send an email message when the settings of VM4 are modi􀂬ed.

Create a custom Azure role named Role1 that is based on the Reader role.

Minimize costs whenever possible.

Question

You need to ensure that VM1 can communicate with VM4. The solution must minimize the administrative effort.

What should you do?

Contoso, Ltd. is a manufacturing company that has o􀂮ces worldwide. Contoso works with partner organizations to bring products to market.

Contoso products are manufactured by using blueprint 􀂬les that the company authors and maintains.

Existing Environment -

Currently, Contoso uses multiple types of servers for business operations, including the following:

File servers

Domain controllers

Microsoft SQL Server servers

Your network contains an Active Directory forest named contoso.com. All servers and client computers are joined to Active Directory.

You have a public-facing application named App1. App1 is comprised of the following three tiers:

A SQL database

A web front end

A processing middle tier -

Each tier is comprised of 􀂬ve virtual machines. Users access the web front end by using HTTPS only.

Requirements -

Planned Changes -

Contoso plans to implement the following changes to the infrastructure:

Move all the tiers of App1 to Azure.

Move the existing product blueprint 􀂬les to Azure Blob storage.

Create a hybrid directory to support an upcoming Microsoft 365 migration project.

Technical Requirements -

Contoso must meet the following technical requirements:

Move all the virtual machines for App1 to Azure.

Minimize the number of open ports between the App1 tiers.

Ensure that all the virtual machines for App1 are protected by backups.

Copy the blueprint 􀂬les to Azure over the Internet.

Ensure that the blueprint 􀂬les are stored in the archive storage tier.

Ensure that partner access to the blueprint 􀂬les is secured and temporary.

Prevent user passwords or hashes of passwords from being stored in Azure.

Use unmanaged standard storage for the hard disks of the virtual machines.

Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.

Minimize administrative effort whenever possible.

User Requirements -

Contoso identi􀂬es the following requirements for users:

Ensure that only users who are part of a group named Pilot can join devices to Azure AD.

Designate a new user named Admin1 as the service admin for the Azure subscription.

Admin1 must receive email alerts regarding service outages.

Ensure that a new user named User3 can create network objects for the Azure subscription.

Question

You are planning the move of App1 to Azure.

You create a network security group (NSG).

You need to recommend a solution to provide users with access to App1.

What should you recommend?

Contoso has an Azure subscription named Sub1 that is linked to an Azure Active Directory (Azure AD) tenant. The network contains an onpremises

Active

Directory domain that syncs to the Azure AD tenant.

The Azure AD tenant contains the users shown in the following table.

（含图）

Sub1 contains two resource groups named RG1 and RG2 and the virtual networks shown in the following table.

（含图）

User1 manages the resources in RG1. User4 manages the resources in RG2.

Sub1 contains virtual machines that run Windows Server 2019 as shown in the following table

（含图）

No network security groups (NSGs) are associated to the network interfaces or the subnets.

Sub1 contains the storage accounts shown in the following table.

（含图）

Requirements -

Planned Changes -

Contoso plans to implement the following changes:

Create a blob container named container1 and a 􀂬le share named share1 that will use the Cool storage tier.

Create a storage account named storage5 and con􀂬gure storage replication for the Blob service.

Create an NSG named NSG1 that will have the custom inbound security rules shown in the following table.

（含图）

Associate NSG1 to the network interface of VM1.

Create an NSG named NSG2 that will have the custom outbound security rules shown inthe following table.

（含图）

Associate NSG2 to VNET1/Subnet2.

Technical Requirements -

Contoso must meet the following technical requirements:

Create container1 and share1.

Use the principle of least privilege.

Create an Azure AD security group named Group4.

Back up the Azure 􀂬le shares and virtual machines by using Azure Backup.

Trigger an alert if VM1 or VM2 has less than 20 GB of free space on volume C.

Enable User1 to create Azure policy de􀂬nitions and User2 to assign Azure policies to RG1.

Create an internal Basic Azure Load Balancer named LB1 and connect the load balancer to VNET1/Subnet1

Enable 􀂭ow logging for IP tra􀂮c from VM5 and retain the 􀂭ow logs for a period of eight months.

Whenever possible, grant Group4 Azure role-based access control (Azure RBAC) read-only permissions to the Azure 􀂬le shares.

Question

You need to add VM1 and VM2 to the backend pool of LB1.

What should you do 􀂬rst?

What should you do?

Litware, Inc. is a consulting company that has a main o􀂮ce in Montreal and two branch o􀂮ces in Seattle and New York.

The Montreal o􀂮ce has 2,000 employees. The Seattle o􀂮ce has 1,000 employees. The New York o􀂮ce has 200 employees.

All the resources used by Litware are hosted on-premises.

Litware creates a new Azure subscription. The Azure Active Directory (Azure AD) tenant uses a domain named litware.onmicrosoft.com. The

tenant uses the

Premium P1 pricing tier.

Existing Environment -

The network contains an Active Directory forest named litware.com. All domain controllers are con􀂬gured as DNS servers and host the

litware.com DNS zone.

Litware has 􀂬nance, human resources, sales, research, and information technology departments. Each department has an organizational unit

(OU) that contains all the accounts of that respective department. All the user accounts have the department attribute set to their respective

department. New users are added frequently.

Litware.com contains a user named User1.

All the o􀂮ces connect by using private connections.

Litware has data centers in the Montreal and Seattle o􀂮ces. Each o􀂮ce has a 􀂬rewall that can be con􀂬gured as a VPN device.

All infrastructure servers are virtualized. The virtualization environment contains the servers in the following table.

（含图）

Litware uses two web applications named App1 and App2. Each instance on each web application requires 1 GB of memory.

The Azure subscription contains the resources in the following table.

（含图）

The network security team implements several network security groups (NSGs)

Requirements -

Planned Changes -

Litware plans to implement the following changes:

Deploy Azure ExpressRoute to the Montreal o􀂮ce.

Migrate the virtual machines hosted on Server1 and Server2 to Azure.

Synchronize on-premises Active Directory to Azure Active Directory (Azure AD).

Migrate App1 and App2 to two Azure web apps named WebApp1 and WebApp2.

Technical Requirements -

Litware must meet the following technical requirements:

Ensure that WebApp1 can adjust the number of instances automatically based on the load and can scale up to 􀂬ve instances.

Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in the Montreal o􀂮ce.

Ensure that routing information is exchanged automatically between Azure and the routers in the Montreal o􀂮ce.

Enable Azure Multi-Factor Authentication (MFA) for the users in the 􀂬nance department only.

Ensure that webapp2.azurewebsites.net can be accessed by using the name app2.litware.com.

Connect the New York o􀂮ce to VNet1 over the Internet by using an encrypted connection.

Create a work􀂭ow to send an email message when the settings of VM4 are modi􀂬ed.

Create a custom Azure role named Role1 that is based on the Reader role.

Minimize costs whenever possible.

Question

You need to recommend a solution to automate the con􀂬guration for the 􀂬nance department users. The solution must meet the technical

requirements.

What should you include in the recommendation?

and Production.

The NVA subnet contains two network virtual appliances (NVAs) that will perform network tra􀂮c inspection between the Perimeter subnet and

the Production subnet.

You need to implement an Azure load balancer for the NVAs. The solution must meet the following requirements:

✑ The NVAs must run in an active-active con􀂬guration that uses automatic failover.

✑ The load balancer must load balance tra􀂮c to two services on the Production subnet. The services have different IP addresses.

Which three actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

（含图）

The planned disk con􀂬gurations for VM1 are shown in the following exhibit.

（含图）

You need to ensure that VM1 can be created in an Availability Zone.

Which two settings should you modify? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.

network by using

Azure ExpressRoute.

You plan to prepare the environment for automatic failover in case of ExpressRoute failure.

You need to connect VNet1 to the on-premises network by using a site-to-site VPN. The solution must minimize cost.

Which three actions should you perform? Each correct answer presents part of the solution.

NOTE: Each correct selection is worth one point.