Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

My AZ-104 > Practice Tests > Flashcards

Practice Tests Flashcards

1
Q

Why does Azure Bastion require a public IP address?

A

Traffic is first routed to the public IP of Bastion. Bastion then routes RDP or SSH connections to the private IP address associated with the virtual machine.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Bastion subnet requirement

A

Azure Bastion requires a dedicated subnet: AzureBastionSubnet. You must create this subnet in the same virtual network that you want to deploy Azure Bastion to.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the three scopes you can assign an Azure policy to?

A

management group
subscription
resource group.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What are the three entities that an administrative unit can contain?

A

users
groups
devices

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

True or false: service endpoints are enabled per service, per subnet.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Network security groups limit access to all resources within a subnet.

A

True. But first the NSG has to be associated with the subnet.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Smallest in size to largest: Account, Subscription, Department

A

Department, Account, Subscription
Departments help to segment costs into logical groupings and set a budget or quota at the department level. The quota isn’t firmly enforced; it’s used for reporting purposes.
Accounts are organizational units in the Azure EA portal. They can be used to manage subscriptions and access reports.
Subscriptions are the smallest units in the Azure EA portal. They’re containers for Azure services that are managed by a Service Administrator. This is where your organization deploys Azure services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

True or false: Azure resources are deployed into Azure management groups.

A

False. Azure subscriptions.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Azure backup and soft delete

A

With soft delete, even if a malicious actor deletes a backup (or backup data is accidentally deleted), the backup data is retained for 14 additional days, allowing the recovery of that backup item with no data loss. The additional 14 days of retention for backup data in the “soft delete” state don’t incur any cost to you.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

Limitations on deleting a recovery services vault

A

You can’t delete a vault that contains protected data sources (for example, IaaS VMs, SQL databases, Azure file shares).
You can’t delete a vault that contains backup data. Once backup data is deleted, it will go into the soft deleted state.
You can’t delete a vault that contains backup data in the soft deleted state.
You can’t delete a vault that has registered storage accounts.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

AAD joined device. Who can administer?

A

When you connect a Windows device with Azure AD using an Azure AD join, Azure AD adds the following security principals to the local administrators group on the device:
The Azure AD global administrator role
The Azure AD joined device local administrator role
The user performing the Azure AD join
By adding Azure AD roles to the local administrators group, you can update the users that can manage a device anytime in Azure AD without modifying anything on the device.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is the effect of moving a web app?

A

Moving the web app does not have an impact an app service plan. The app service plan will remain in its source location or resource group. Since web app is moved to a different resource group, the policies in the target resource group will be applied.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What does Azure Traffic Manager do?

A

Distributes traffic across Azure regions

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Does changing a VM size require restart?

A

Yes. If the virtual machine is currently running, changing its size will cause it to be restarted.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

For load balancing, what is the difference between global vs. regional?

A

Global-These services route end-user traffic to the closest available backend, so to closest region

Regional load-balancing services distribute traffic within virtual networks across virtual machines (VMs) or zonal and zone-redundant service endpoints within a region.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Name the Azure load balancing options in terms of global and regional

A

Global: Azure Traffic Manager, Azure Front Door
Regional: Azure Load Balancer, Application Gateway

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is the difference between Azure roles and Azure AD roles?

A

Separate.
Azure role assignments do not grant access to Azure AD. They grant access to Azure resources. However, global admin role in AAD allows you to get User Access Admin role in Azure at root scope.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Azure Bastion setup

A

The Azure Bastion service is a fully platform-managed PaaS service that you provision inside your virtual network.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

How would you make Azure services available to private IP addresses in your vnet

A

Virtual Network (VNet) service endpoint provides secure and direct connectivity to Azure services over an optimized route over the Azure backbone network. Endpoints allow you to secure your critical Azure service resources to only your virtual networks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

Can a vm in one location connect to a virtual network in another location?

A

No. Everything has to be in the same location and subscription.
Vm—>NIC—>VNet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

Can a vm move to a different subnet within a vnet?

A

Yes. Add a NIC. Multiple NICs allow a VM to connect to different subnets.

22
Q

If you host an app on two vm’s, each in a different availability zone, and one zone has local failures, will you still be able to access the app?

A

Yes, because each vm is in a different zone.

Availability zones are designed so that if one zone is affected, regional services, capacity, and high availability are supported by the remaining two zones. Each Azure region usually consists of three availability zones.

23
Q

How would you identify underutilized resources?

A

Azure Advisor

24
Q

Name the authorization methods available for azcopy.

A

Blob storage: AAD or SAS token

File storage: SAS token is only authorization method that is supported

25
Q

What is the recommended way to enable Azure MFA?

A

The recommended way to enable and use Azure AD Multi-Factor Authentication is with Conditional Access policies. Conditional Access lets you create and define policies that react to sign-in events and that request additional actions before a user is granted access to an application or service.

26
Q

You need to create a conditional access policy that requires all users to use multi-factor authentication when they access the Azure portal.
Which three settings should you configure?

A

Users and groups
Cloud apps
Grant

27
Q

What do the External Collaboration settings do?

A

Determine scope of guest user access
Specify who can invite guests
Enable guest self-service sign-up via user flows
Allow or block domains

28
Q

Can you roll back a slot swap in Azure App Service.

A

If any errors occur in the target slot (for example, the production slot) after a slot swap, restore the slots to their pre-swap states by swapping the same two slots immediately.

29
Q

How can you log network traffic that flows through an NSG with Network Watcher’s NSG flow log capability.

A

Enable Network Watcher and register the Microsoft.Insights provider
Enable a traffic flow log for an NSG, using Network Watcher’s NSG flow log capability. This requires an Azure storage account.

30
Q

True or false: an App Service Plan can have more than one web app?

A

True. However, the app service plan should be either windows or linux based.

31
Q

What are the three types of cost alerts

A

budget alerts, credit alerts, and department spending quota alerts.

32
Q

What is the turnaround time for cost and usage data and how often are budgets evaluated against these costs?

A

Cost and usage data is typically available within 8-24 hours and budgets are evaluated against these costs every 24 hours.

33
Q

Update domains indicate groups of virtual machines and underlying physical hardware that can be…

A

Rebooted at the same time.

34
Q

Fault domains define the group of virtual machines that share a common…

A

Power source and network switch.

35
Q

Can a vnet span regions?

A

No. A VNet is limited to a single region. A virtual network does, however, span availability zones. You can connect virtual networks in different regions with virtual network peering.

36
Q

Name the steps to setup Azure File Sync

A

The steps are as follows.
Install the Azure File Sync agent
Register Windows Server with Storage Sync Service
Create a sync group and a cloud endpoint

37
Q

A network security group (NSG) enables you to filter inbound traffic to, and outbound traffic from, a virtual machine (VM). How can you log network traffic that flows through an NSG? with Network Watcher’s NSG flow log capability.

A

Use Network Watcher’s NSG flow log capability

38
Q

What provider must you register to use Network Watcher’s NSG flow?

A

Microsoft.Insights provider

39
Q

What does Azure Network Watcher allow you to do?

A

Gain insight into your Azure Virtual Network with tools like packet capture and NSG flows logs, to diagnose problems with traffic filtering and routing, and to monitor connections.

40
Q

What does IP flow verify in Azure Network Watcher allow you to do?

A

IP flow verify checks if a packet is allowed or denied to or from a virtual machine. IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to the on-premises environment.

41
Q

What are placement groups?

A

A regional (non-zonal) scale set uses placement groups, which act as an implicit availability set with five fault domains and five update domains. If you have 10 VMs spread across five update domains, the 8 VMs will be available for any given Azure planned maintenance.

42
Q

True or false-Scale sets can be deployed regionally or they can be zonal

A

True

43
Q

What is the difference between an availability set and a scale set?

A

Availability set is for redundancy and for promoting business continuity in the face of an outage.
A scale set is a group of load balanced vms that can scale in response to increase demand or a schedule

44
Q

When changing size (sku) of a vm scale set, what is necessary?

A

Some properties of VM scale sets only be changed to certain values if the VMs in the scale set are deallocated. These properties include:
· SKU Name- If the new VM SKU is not supported on the hardware the scale set is currently on, you need to deallocate the VMs in the scale set before you modify the SKU name.

45
Q

In terms of a user profile in AAD, what does usage location attribute hold?

A

Not all Microsoft services are available in all locations. Before a license can be assigned to a user, you must specify the Usage location. You can set this value in the Azure Active Directory > Users > Profile > Settings area in Azure AD. Any user whose usage location is not specified inherits the location of the Azure AD organization.

46
Q

What are the steps to create a site-to-site vpn connection?

A 
Create a virtual network
Create a VPN gateway
Create a local network gateway (in Azure)
Create a VPN connection
Verify the connection
Connect to a virtual machine
47
Q

Azure Import/Export service

A

Data from external data disk drives can be:
Import from disk to Azure Blob Storage or Azure File Storage
Export fom Azure Blob Storage to disk drive

48
Q

General purpose v1 and v2 storage accounts support what services?

A

The both support blob, file, queue, table, and disk.

v2 supports data lake gen 2 in addition

49
Q

How many cloud endpoints can an Azure File Sync group have?

A

One

50
Q

Describe vCPU quotas for vms.

A

The vCPU quotas for virtual machines and virtual machine scale sets are arranged in two tiers for each subscription, in each region.

The first tier is the Total Regional vCPUs, and the second tier is the various VM size family cores such as the D-series vCPUs. Any time a new VM is deployed the vCPUs for the VM must not exceed the vCPU quota for the VM size family or the total regional vCPU quota

51
Q

What is a local network gateway in terms of Azure site to site vpn?

A

The local network gateway (LNG) typically refers to your on-premises location. It is not the same as a virtual network gateway. You give the site a name by which Azure can refer to it, then specify the IP address of the on-premises VPN device to which you will create a connection

52
Q

What are the two types of locks?

A

Delete lock

Read-only lock

My AZ-104 (1 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions