Get Microsoft AZ-104 Exam Practice Questions - Real and Updated

Answer : C

IT Service Management Connector (ITSMC) allows you to connect Azure to a supported IT Service Management (ITSM) product or service. Azure services like Azure Log Analytics and Azure Monitor provide tools to detect, analyze, and troubleshoot problems with your Azure and non-Azure resources. But the work items related to an issue typically reside in an ITSM product or service. ITSMC provides a bi-directional connection between Azure and ITSM tools to help you resolve issues faster. ITSMC supports connections with the following ITSM tools: ServiceNow, System Center Service Manager, Provance, Cherwell.

https://docs.microsoft.com/en-us/azure/azure-monitor/alerts/itsmc-overview

Answer : C

In Microsoft Azure, Network Security Groups (NSGs) are used to filter network traffic to and from Azure resources in an Azure Virtual Network (VNet). NSGs can be associated with subnets or network interfaces (NICs) but are scoped by region --- meaning that an NSG can only be applied to resources within the same Azure region.

From the scenario:

NSG1 is located in the East US region.

VNet1 and VNet2 are located in the West US region.

VNet3 is located in the East US region.

Therefore, based on Microsoft Azure's network management rules, NSG1 can only be applied to subnets or network interfaces in VNets located in the same region (East US). This means NSG1 can only be assigned to VNet3, since both reside in the East US region.

As stated in Microsoft Learn (Azure Networking documentation):

''A network security group (NSG) must exist in the same region as the virtual network or subnet to which it is associated. You cannot link or associate an NSG across regions.''

This regional boundary ensures proper security control enforcement and routing consistency within Azure's networking infrastructure.

Answer : B

The New-MgUser cmdlet is part of the Microsoft Graph PowerShell SDK, which is a module that allows you to interact with the Microsoft Graph API.The Microsoft Graph API is a service that provides access to data and insights across Microsoft 365, such as users, groups, mail, calendar, contacts, files, and more1.

The New-MgUser cmdlet can be used to create new users in your Azure AD tenant, but it has some limitations and requirements.For example, you need to have the Global Administrator or User Administrator role in your tenant, you need to authenticate with the Microsoft Graph API using a certificate or a client secret, and you need to specify the required parameters for the new user, such as userPrincipalName, accountEnabled, displayName, mailNickname, and passwordProfile2.

However, the New-MgUser cmdlet does not support creating guest user accounts in your Azure AD tenant. Guest user accounts are accounts that belong to external users from other organizations or domains.Guest user accounts have limited access and permissions in your tenant, and they are typically used for collaboration or sharing purposes3.

To create guest user accounts in your Azure AD tenant, you need to use a different cmdlet: New-AzureADMSInvitation. This cmdlet is part of the Azure AD PowerShell module, which is a module that allows you to manage your Azure AD resources and objects. The New-AzureADMSInvitation cmdlet can be used to create and send an invitation email to an external user, which contains a link to join your Azure AD tenant as a guest user. You can also specify some optional parameters for the invitation, such as the invited user display name, message info, redirect URL, or send invitation message.

Therefore, to meet the goal of creating guest user accounts for 500 external users from a CSV file, you need to use a PowerShell script that runs the New-AzureADMSInvitation cmdlet for each user, not the New-MgUser cmdlet.

Answer : C

The requirement is for Group1 to manage role assignments (Azure RBAC) across existing subscriptions and future subscriptions, while applying least privilege and minimizing ongoing administration. In Azure RBAC, the permission to create, update, and delete role assignments is governed by management-plane actions under Microsoft.Authorization/roleAssignments. Microsoft's Azure Administrator documentation identifies two common roles that can manage access: Owner and User Access Administrator. Of these, User Access Administrator is the least-privileged role intended specifically to manage user access without granting full resource management permissions like Owner does.

To minimize administrative effort for both current and newly purchased subscriptions, you should assign the role at the highest scope that will automatically cover all subscriptions through inheritance. The root management group is the top of the management group hierarchy; all management groups and subscriptions roll up to it. Assigning User Access Administrator to Group1 at the root management group ensures Group1 can manage role assignments across the entire hierarchy, including subscriptions added later, without repeatedly applying role assignments per subscription or per management group. This meets both requirements: least privilege (User Access Administrator instead of Owner) and minimal administrative effort (one assignment at the root scope).

Answer : B

In Microsoft Azure, Azure Resource Manager (ARM) templates are JSON-based files used to define and automate the deployment of Azure resources in a consistent and repeatable manner. To deploy an ARM template, the PowerShell cmdlet you use depends on the deployment scope --- whether the template targets a tenant, management group, subscription, or resource group.

According to the Microsoft Azure Administrator documentation (AZ-104 Study Guide, ''Deploy and Manage Azure Resource Manager Templates''):

New-AzTenantDeployment Used for tenant-level deployments, typically involving management group creation or tenant-wide policies.

New-AzSubscriptionDeployment Used for subscription-level deployments, when resources are created directly under the subscription rather than within a resource group.

New-AzResourceGroupDeployment Used for resource group-level deployments, which is the most common scenario for creating and managing resources such as virtual machines, storage accounts, and virtual networks.

New-AzDeployment An older alias that may refer to subscription-level deployments in older Az modules but is not the standard for resource group deployments.

In this question, the ARM template defines both a resource group and a storage account that will be deployed within that resource group. Therefore, the correct PowerShell cmdlet to use is:

New-AzResourceGroupDeployment `

-ResourceGroupName <RGName> `

-TemplateFile <PathToTemplateFile>

This cmdlet processes the specified ARM template file, validates the schema, and provisions all the resources defined in the template inside the target resource group.

Hence, based on the Azure Resource Manager official documentation and exam objectives, the correct answer is: