Free Microsoft Azure Administrator AZ-104 MCQ Questions and Answers — Questions and Answers
Question 1: Azure Active Directory (Azure AD) and Microsoft 365 tenants for your business go by contoso.com. The business uses multiple Azure Files shares. Each share of the corporation is allocated to a distinct division. All users have data in the department property in Azure AD. The departmental file sharing must be accessible to the users. Which two categories of groups ought you employ?
- a Microsoft 365 group that uses the assigned membership type
- a security group that uses the dynamic membership type (Correct answer)
- a Microsoft 365 group that uses the dynamic membership type (Correct answer)
- a distribution group that uses the dynamic membership type
- a security group that uses the assigned membership type
Correct answer: a security group that uses the dynamic membership type
Access to the Azure Files shares is controlled with a security group (Microsoft 365 and distribution groups are for collaboration and email, not resource permissions), and dynamic membership automatically adds users based on a rule against their department property in Azure AD. Assigned membership would require manually maintaining each group, defeating the goal of automatic department-based access.
Question 2: You have a tenant called contoso.com in your production Azure Active Directory (Azure AD). You deploy a development Azure Active Directory (AD) tenant and provide the development tenant with several unique administrative roles. The roles must be copied to the production tenant. What ought you start with?
- From the production tenant, create an administrative unit.
- From the development tenant, export the custom roles to JSON. (Correct answer)
- From the production tenant, create a new custom role.
- From the development tenant, perform a backup.
Correct answer: From the development tenant, export the custom roles to JSON.
To copy the custom administrative roles from the development Azure AD tenant to the production Azure AD tenant, you should first export the custom roles to JSON from the development tenant. This will create a JSON representation of the roles and their configurations.
Question 3: Several Azure runbooks are included with your Azure subscription. The runbooks provide reports each night while they run. Authentication credentials are kept in the runbooks as variables. You must swap out the current authentication method with a more secure one. What ought you use?
- Azure Key Vault (Correct answer)
- Azure Active Directory (Azure AD) Identity Protection
- An administrative unit
- An access policy
Correct answer: Azure Key Vault
To replace the authentication solution for storing credentials in Azure runbooks with a more secure option, you should use Azure Key Vault.
Question 4: You have a virtual machine called VM1 in your Azure subscription. Volume encryption is necessary for VM1's operating system and data drives. You create vault1 as the name of an Azure key vault. You must set up vault1 for volume encryption to enable Azure Disk Encryption. Which setting for vault1 should you change?
- Keys
- Security
- Secrets
- Access policies (Correct answer)
Correct answer: Access policies
To configure vault1 to support Azure Disk Encryption for volume encryption on VM1, you need to modify the access policies for vault1.
Question 5: You have a tenant called contoso.com in Azure Active Directory (Azure AD). It would help if you ensured that User1 has access to the tenant's set of settings. It must be impossible for User1 to alter any settings. Which role ought should you provide User1?
- Global reader (Correct answer)
- Directory reader
- Security reader
- Reports reader
Correct answer: Global reader
To ensure that User1 can review all the settings of the Azure Active Directory (Azure AD) tenant but is prevented from changing any settings, you should assign the "Global reader" role to User1.
Question 6: You have VM1, a virtual computer in Azure. The identical parameters as VM1 must be used to generate five more virtual machines. The answer must guarantee that VM1 is always accessible. You open the blade for VM1 from the Azure portal. What ought you to do now?
- Select Export template (Correct answer)
- Select Capture
- Select Availability and scaling
- Select Redeploy + reapply
Correct answer: Select Export template
To create five additional virtual machines with the same configurations as VM1 while ensuring VM1 remains available, you should select "Export template" from the Azure portal blade for VM1.
Question 7: After moving the application to Azure, you must make sure to establish the backup solution. For this need, which of the following would you develop first?
- Create an Azure Backup Server
- Create a recovery plan
- Create a recovery services vault (Correct answer)
- Create a backup policy
Correct answer: Create a recovery services vault
To implement a backup solution for an application after it is moved to Azure, the first step would be to create a Recovery Services vault.
Free Microsoft Azure Administrator AZ-104 MCQ Questions and Answers
Azure Active Directory (Azure AD) and Microsoft 365 tenants for your business go by contoso.com.
The business uses multiple Azure Files shares.
Each share of the corporation is allocated to a distinct division.
All users have data in the department property in Azure AD.
The departmental file sharing must be accessible to the users.
Which two categories of groups ought you employ?