Get Microsoft AZ-104 Exam Practice Questions - Real and Updated

Answer : B

In this scenario, you need to inspect all network traffic between VM1 and VM2 in VNet1 for a period of time. The proposed solution uses Azure Network Watcher -- Connection Monitor. However, this solution does not meet the goal, because Connection Monitor is designed to test connectivity and monitor latency, packet loss, and reachability between two endpoints---not to capture or inspect the actual contents or packets of the traffic.

According to Microsoft Azure Administrator Study Guide and Azure Network Watcher official documentation, Azure provides different tools for different purposes:

Connection Monitor: Verifies that a connection exists between two VMs or endpoints and monitors metrics such as latency, availability, and packet loss. It does not capture network packets or provide detailed traffic inspection.

Network Watcher Packet Capture: Captures actual network packets entering or leaving a virtual machine. It is the correct tool to use when you need to inspect all network traffic between VMs. Packet capture can be configured to run for a specific time (for example, three hours) and stored in Azure Storage for later analysis.

From the Microsoft Learn: 'Implement and Manage Network Watcher' documentation, the correct approach is:

''Use Network Watcher Packet Capture to capture network traffic to and from a virtual machine. Packet capture helps in diagnostics by collecting network traffic over a specified time frame or under certain conditions.''

Therefore, to meet the goal of inspecting all traffic between VM1 and VM2, you must use Packet Capture, not Connection Monitor.

Answer : A

In Azure, Network Security Groups (NSGs) control inbound and outbound traffic to network interfaces, subnets, and virtual machines. When NSGs block all outbound traffic, VMs cannot reach Azure services such as Azure Key Vault, Storage, or Azure SQL Database, unless exceptions are explicitly configured.

To allow virtual machines to access Vault1 (Azure Key Vault), the correct and most efficient configuration is to use an Azure service tag as the destination in the outbound rule.

Service tags are predefined identifiers that represent a group of IP address prefixes for specific Azure services.

Microsoft automatically manages the address prefixes included in each tag, reducing administrative overhead and maintenance.

The service tag for Azure Key Vault is:

AzureKeyVault

You can create an outbound rule in NSG1 with:

Destination: Service tag AzureKeyVault

Port: 443 (HTTPS)

Action: Allow

This allows only secure traffic to Azure Key Vault, satisfying the principle of least privilege (since it limits access to only the necessary service) while also minimizing administrative effort (since the service tag updates automatically as Azure changes).

Using an application security group or IP address range would require additional configuration and maintenance, making them less efficient.

Final Verified Answe r: A. a service tag

Answer : B

Moving a virtual machine (VM) to a different host immediately in Azure is related to host-level maintenance mitigation, not to resource organization.

In this scenario, VM1 is affected by planned maintenance, and the goal is to move VM1 to a different host immediately.

According to Microsoft Azure Administrator documentation:

Moving a VM to another resource group is an Azure Resource Manager (ARM) operation used for administrative organization.

A resource group move does not change:

The physical host

The datacenter

The availability zone

The underlying hardware

Therefore, moving VM1 to another resource group does not relocate the VM to a different host and does not avoid maintenance.

To move a VM to a different host in response to maintenance, supported options include:

Redeploying the VM (which moves it to a new node)

Using Availability Sets or Availability Zones

Using Azure Scheduled Events to prepare workloads

Microsoft documentation explicitly states:

''Moving resources between resource groups does not change the location, availability zone, or the physical host of the resource.''

Because the proposed solution does not move the VM to a new host, it does not meet the goal.

Answer : B

https://learn.microsoft.com/en-us/azure/storage/common/redundancy-migration?tabs=portal

Answer : B

IdFix is used to perform discovery and remediation of identity objects and their attributes in an on-premises Active Directory environment in preparation for migration to Azure Active Directory. IdFix is intended for the Active Directory administrators responsible for directory synchronization with Azure Active Directory.

Scenario: Active Directory Issue

Several users in humongousinsurance.com have UPNs that contain special characters.

You suspect that some of the characters are unsupported in Azure AD.