AZ-104 Flashcards
You manage the Azure network for your company. The company on-premises network configuration consists of multiple subnets. Each branch office has a dedicated IP subnet.
A new branch office was recently added. The network devices in this office were assigned to a 192.168.22.0/24 subnet.
You need to reconfigure the existing Azure VPN Gateway to ensure that all network devices in the new branch office can be accessed from the Azure virtual network.
Which PowerShell cmdlet should you use?
You should use the Set-AzLocalNetworkGateway PowerShell cmdlet. To change the list of network prefixes that are routed to the on-premises location, you need to reconfigure the local network gateway. This list can be configured upon the creation of the local network gateway or later, using the Set-AzLocalNetworkGateway cmdlet.
You have two Azure virtual machines (VMs) running Windows as shown in the first exhibit.
You create a virtual network (VNet) peering by executing the following PowerShell commands:
$vnet1 = Get-AzVirtualNetwork -Name ‘VNet1’ -ResourceGroupName ‘RG1’
$vnet2 = Get-AzVirtualNetwork -Name ‘VNet2’ -ResourceGroupName ‘RG2’
Add-AzVirtualNetworkPeering `
-Name ‘VNet1-VNet2’ `
-VirtualNetwork $vnet1 `
-RemoteVirtualNetworkId $vnet2.Id
The peering overview of VNet1 is shown in the second exhibit.
You open the local Windows firewalls by running the following PowerShell command on both VMs:
New-NetFirewallRule -DisplayName ‘Enable ping’ -Protocol ‘ICMPv4’
A ping from VM1 to the private IP address of VM2 fails.
You need to make sure that VM1 can connect to VM2.
What should you do?
You should add a VNet peering from VNet2 to VNet1. When peering two VNets, peering connections are required in both directions. The peering from VNet1 to VNet2 is already created, so now you need to create the reverse peering. As shown in the second exhibit, the peering status is Initiated. The peering status should be Connected. This will be the case when 2-way peering is created.
Your company has an Azure subscription. You have a virtual network (VNet) hosted in the East US Azure region. The VNet includes a virtual machine (VM) named VM1 that runs Windows Server 2016.
You need to capture all network packets into and out of VM1 over a two-hour period. Captured packets should be stored in VM1’s storage.
What should you use?
You should use Azure Network Watcher. Network Watcher lets you monitor and view performance metrics and diagnose performance issues for an Azure network. Functionality includes the ability to capture packets into or out of a VM. You can store the captured packets in Azure Storage on a local disk on the VM.
You have an Azure network, as shown in the exhibit. Your network consists of two virtual networks (VNets) and several servers. Server 2 has the Network Watcher Agent installed.
You have peered both VNets together, but Server 1 cannot communicate with Server 2 over HTTPS.
You need to find the fault that is preventing the servers from communicating.
What should you do first?
You should use the Network Watcher service to test the connection. The IP flow verify tool in Network Watcher can be used to discover network issues, such as misconfigured network security groups.
Your company has an Azure subscription that includes a virtual machine (VM) named VM1. VM1 is backed up through Azure Backup using a custom backup policy that runs backups twice daily. You plan to create a new VM based on VM1. You plan to restore from the Azure portal and choose to Create a new VM as the restore type.
Can you specify the destination virtual network for the new VM?
Yes
Your company has an Azure subscription that includes a virtual machine (VM) named VM1. VM1 is backed up through Azure Backup using a custom backup policy that runs backups twice daily. You plan to create a new VM based on VM1. You plan to restore from the Azure portal and choose to Create a new VM as the restore type.
Can you create a new VM in the same resource group as the source VM or specify a different resource group?
Yes
Your company has an Azure subscription that includes a virtual machine (VM) named VM1. VM1 is backed up through Azure Backup using a custom backup policy that runs backups twice daily. You plan to create a new VM based on VM1. You plan to restore from the Azure portal and choose to Create a new VM as the restore type.
Can you create the new VM in a different region?
No
Vilken enhet sätter man TTL för DNS i?
Sekunder
You are asked to configure Azure DNS records for the root domain company1.com and add two records to that zone for independently hosted websites on different servers but using the same alias of “www”. These servers will round-robin the DNS requests for high availability of the service. The time to live for the records must also be set to 1 hour.
You need to configure Azure DNS to support the requirements.
You should complete the script as follows:
New-AzDnsRecordSet -Name “@” -RecordType A -ZoneName “company1.com” -ResourceGroupName “MyResourceGroup” -Ttl 3600 -DnsRecords `
(New-AzDnsRecordConfig -IPv4Address “1.2.3.4”)
$aRecords = @()
$aRecords += New-AzDnsRecordConfig -IPv4Address “2.3.4.5”
$aRecords += New-AzDnsRecordConfig -IPv4Address “3.4.5.6”
New-AzDnsRecordSet -Name “www” -ZoneName “company1.com” -ResourceGroupName MyResourceGroup -Ttl 3600 -RecordType A -DnsRecords $aRecords
When configuring the root of a new DNS zone, you first have to configure the root element at the apex of the zone. This is done by using the New-AzDnsRecordSet cmdlet with the name “@”. This completes the first part of the requirement.
The Time To Live (TTL) should be set to 1 hour in both places. With DNS entries this is configured in seconds, so 3600 seconds is used for this value.
Following the configuration of the zone apex, you need to set two aliases for “www”. These are both set using the New-AzRecordConfig cmdlet and assigning the two IP addresses as elements of an array.
Finally, you create a New-AzRecordSet using the same zone and declare the records in the record set as the array you created earlier.
Your company’s Azure subscription includes the Azure virtual machines (VMs) shown in the exhibit. Your company wants to start using Azure Recovery Services vaults to protect all VMs and store backup data.
You need to create Recovery Services vaults to support Azure VM backups.
What is the minimum number of Recovery Services vaults required?
2
You should create two Recovery Service vaults. You are required to create a Recovery Services vault in each Azure geographic region containing VMs for which you want to configure backups. VMs that are being backed up can include a mix of operating systems and operating system versions.
Your company has an Azure subscription. You create an Azure Log Analytics workspace (Azure Monitor log) to collect data from various data sources. You are configuring monitoring solutions to collect log data and provide queries and views to analyze collected data.
You need to determine if prerequisites are met for the monitoring solutions you plan to employ.
Which monitoring solution requires a connected Operations Manager management group?
Windows Alert Management requires a connected Operations Manager management group to enable the alerts created in System Center Operations Manager (SCOM) to be imported into Log Analytics.
Your company is planning to move a large amount of data from its on-premises storage solution to Azure Blob Storage in an Azure Storage Account.
You decide to use the Azure Import/Export service to migrate the data.
You need to prepare the disks for copying the data that will be migrated to Azure.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of possible actions to the answer area and arrange them in the correct order.
You should perform the following actions in order:
Purchase 2.5-inch SATA hard disk drives.
Connect the disks to a Windows machine.
Create a volume and encrypt it by using BitLocker.
Prepare the import by using the WaImportExportV1 tool.
What version of WaImportExport tool should you use for Blob Storage?
You use V1 when you want to import/export the data into Azure Blob Storage.
What version of WaImportExport tool should you use for Azure FIles?
You need to use the V2 version when you want to import the data into Azure Files.
You are planning to leverage Azure File Sync to create a cloud-based file share for all on-premises files hosted on a server running Windows Server 2019.
You need to set up the synchronization. You open port 443 for outbound traffic in the on-premises server.
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of possible actions to the answer area and arrange them in order.
You should perform the following actions in order:
Create a File Sync service in Azure.
Install the Azure File Sync Agent on the server and register it with the Storage Sync Service.
Create a sync group and a cloud endpoint.
Register the server and create a server endpoint on the share.
You should first create a File Sync service. Next, install the Azure File Sync Agent and configure the endpoints on the server and Azure Storage file share to start the sync process.
Your company has a web application deployed in Azure. This web application is distributed in three different layers with three virtual machines (VMs) in each layer. The web application also has a public IP address to allow customers to access the application.
You are implementing a business continuity and disaster recovery (BCDR) plan for this web application using Azure Site Recovery. You configure replication of the VMs in the Azure region that hosts your web application.
You need to minimize the recovery time objective (RTO).
Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of possible actions to the answer area and arrange them in the correct order.
You should perform the following steps in order:
Configure Network Security Groups (NSGs) in the target region.
Create a recovery plan.
Customize the plan and add a step for attaching the public IP address.
Create a Traffic Manager profile.
First, you should configure NSGs in the target region. When you set up Azure Site Recovery, the service can automatically configure virtual networks and subnets that you have configured in your source site. Unfortunately, the Azure Site Recovery service does not automatically replicate any NSGs that you have set in your source site. You need to re-create in the target region any NSG that you configured in the source region. Once you configure replication of the VMs in the source region and perform the first replication, you can create the target NSG.
Next, you should create a recovery plan. When you design a business continuity and disaster recovery plan, you write the needed tasks for bringing your web application online in case there is a critical failure in the Azure region where you are hosting your application. An Azure Site Recovery plan is a list of tasks that allows you to automate the execution of all jobs in your plan. Before you can create a recovery plan, you need to configure the replication of your VMs.
Next, you should customize the plan and add a step for attaching the public IP address. By default, Azure Site Recovery does not migrate public IP addresses, and these types of addresses cannot be retained during failover. If you need your target site to have a public IP address, you need to add the IP address to the target region. You can do this manually or by adding a step to the recovery plan. You use an Azure Automation runbook to add this public IP address to the target region.
Finally, you should create a Traffic Manager profile. Traffic Manager allows you to monitor the status of the source and target sites. In case of a failure of the source site, Traffic Manager automatically redirects the traffic to the target site while Azure Site Recovery handles the failover to the target region, making your web application available again and minimizing downtime.
You deploy a virtual network (VNet) named VNET01. You deploy several virtual machines (VMs) connected to VNET01.
You configure a new service on VM01, which is one of the VMs connected to VNET01.
You need to allow inbound traffic to TCP port 992 on VM01. You created a network security group named NSG01.
Which PowerShell cmdlet should you use to attach the network security group to VM01?
You should use the Set-AzNetworkInterface cmdlet. This cmdlet modifies the NIC configured for a VM. To make this association, you should use a script similar to the following:
$nic = Get-AzNetworkInterface -ResourceGroupName “RG01” -Name “primary NIC of VM01”
$nsg = Get-AzNetworkSecurityGroup -ResourceGroupName “RG01” -Name “NSG01”
$nic.NetworkSecurityGroup = $nsg
$nic | Set-AzNetworkInterface
You are planning to deploy a Line of Business (LOB) application in Azure. This LOB application needs to be distributed in three different layers: one for the frontend, one for the backend, and the last layer for data persistence. To ensure high availability of each layer, you deploy two virtual machines (VMs) per layer. You also plan to configure an internal load balancer for the backend and persistence layers.
The LOB application must have the following minimum required services running on each layer:
Frontend layer: An IIS listening on TCP port 80 and an internal health endpoint on TCP port 80
Backend layer: An IIS listening on TCP port 443 and an internal health endpoint on TCP port 80
Persistence layer: A SQL Server listening on TCP port 1433
You are configuring the VMs for the backend layer.
You need to configure an internal load balancer for the backend layer. You need to ensure that your solution is resilient to hardware and software failures. Your solution needs to be cost-effective.
Which four actions should you perform? To answer, move the appropriate actions from the list of possible actions to the answer area and arrange them in any order.
You should perform the following steps:
Create a Standard Load Balancer.
Create a backend pool using the availability set.
Create an HTTP health probe using port 80.
Create a load balancing rule using port 443.
You need to create a Standard Load Balancer. This SKU meets all of the scenario requirements.
Can you apply a custom role to a management group?
No
You are asked to configure a subnet named SUBNET1 that is part of a virtual network named VNET1. Hosts on SUBNET1 need to be able to reach resources on a virtual network named VNET2 and also reach a proxy server that scans all outbound internet requests being made by resources hosted on SUBNET1.
The proxy server is hosted on your on-premises network. You have an ExpressRoute circuit named EXP-ROUTE1 configured between VNET2 and your on-premises network.
You want VNET1 to use EXP-ROUTE1 to reach the proxy server. Your solution must not require the creation of additional resources to reduce cost.
Which two actions should you perform? Each correct answer presents part of the solution.
You should configure virtual network peering between VNET1 and VNET2. You should also set VNET1 to use the remote gateway. The peering will provide connectivity between VNET1 and VNET2 by internally sharing routes to the corresponding IP address ranges. For VNET1 to leverage the EXP-ROUTE1 to connect to on-premises, you would have to ensure that the peering connection on VNET1 uses the gateway device attached to VNET2. This gateway is what is used by the ExpressRoute EXP-ROUTE1 circuit.
Your Azure subscription has the following resources:
three App Services one backup vault one Azure event hub a virtual network (VNet) named VNET01 a VPN Gateway You deploy a new storage account named storage1 in a resource group named RG01.
You need to ensure that the App Services, the backup vault, and the event hub can access the new storage account. Access should be enabled from within Azure only, and not via public internet.
You decide to use PowerShell to set up the new storage account.
How should you complete the command string? To answer, select the appropriate options from the drop-down menus.
You should run the following script to ensure that the backup vault and the event hub services have access to the storage account:
Get-AzVirtualNetwork -ResourceGroupName “RG01” -Name “VNET01” |
Set-AzVirtualNetworkSubnetConfig -Name “VSUBNET01”
-AddressPrefix “10.0.0.0/24” -ServiceEndpoint “Microsoft.Storage”
| Set-AzVirtualNetwork
$subnet = Get-AzVirtualNetwork -ResourceGroupName “RG01” -Name “VNET01” |
Get-AzVirtualNetworkSubnetConfig -Name “VSUBNET01”
Add-AzStorageAccountNetworkRule -ResourceGroupName “RG01”
-Name “ storage01” -VirtualNetworkResourceId $subnet.Id
Update-AzStorageAccountNetworkRuleSet -ResourceGroupName “RG01”
-Name “ storage01” -Bypass AzureServices
You should use Microsoft.Storage as the service endpoint. Using the Set-AzVirtualNetworkSubnetConfig cmdlet enables the service endpoint on the subnet VSUBNET01 for a storage account. This will allow connections to the virtual subnet from the storage account. This cmdlet makes modifications only to the memory representation of the virtual network. You need to run Set-AzVirtualNetwork to make the changes persistent.
You should use the Add-AzStorageAccountNetworkRule cmdlet to add a firewall exception on the NetworkRule property in the storage account. This will allow communication from the virtual subnet to the storage account.
You should use the Update-AzStorageAccountNetworkRuleSet cmdlet. This cmdlet also updates the NetworkRule property. This cmdlet allows you to modify the NetworkRule property to allow other Azure services, like Backup or Event Hub, to have access to the storage account.
You should use AzureServices for the -Bypass parameter. This way, you instruct the Update-AzStorageAccountNetworkRuleSet cmdlet to allow connections from other Azure services. Allowed values are AzureServices, Metrics, Logging, and None.
You are asked to evaluate and solve an issue with network and application rules on an Azure Firewall named AZFW1 associated with your Hub virtual network. AZFW1 was configured to not allow outbound traffic to google.com, however, users are able to reach google.com websites.
AZFW1 is configured with the network and applications rules as shown in the exhibit.
You need to resolve the issue by modifying the rules defined for AZFW1.
What should you do?
You should delete the all-web rule and add an application rule with a 400 priority to allow all websites. Network rules on Azure Firewall are evaluated before application rules, no matter if the priority value is smaller at the application rule. Because the all-web network rule allows all requests to port 80 and 443 to succeed, the application rule that denies traffic to google.com does not take effect. You should also another application rule with 400 priority to allow traffic to websites different than google.com.
You plan to deploy a new Azure web app. The deployment must support Autoscale and support up to 20 instances of the web app.
You need to create an App Service Plan that supports the deployment. You want to minimize the cost to deploy and maintain the web app.
Which pricing tier should you choose?
You should choose a Premium service plan. The Premium pricing tier supports Autoscale with up to 30 instances.
You should not choose a Standard service plan. The Standard pricing tier supports Autoscale, but it is limited to no more than 10 instances.
You have an Azure virtual network (VNet) named VNet1. VNet1 contains a subnet named Sub1 that hosts three Windows Server 2019 virtual machines (VMs).
You need to design a network security group (NSG) that blocks inbound Remote Desktop Protocol (RDP) traffic from the Internet into Sub1.
How should you configure the NSG? To answer, drag the appropriate NSG configuration value to each NSG configuration property. A configuration value may be used once, more than once, or not at all.
Source: Service Tag
Source Data: Internet
Destination: Any
Destination Port: 3389
