View Full Microsoft AZ-104 Exam Dumps and Practice Test Dumps.

 

Question 161

You need to create a virtual network with an address space of 10.0.0.0/16. Which Azure resource should you configure?

1. Virtual Network
2. Network Security Group
3. Route Table
4. Public IP Address

Correct Answer: 1

Explanation

An Azure Virtual Network provides the private networking environment for Azure resources. When creating a virtual network, you define an address space such as 10.0.0.0/16 and then create subnets within that address range. Network Security Groups control traffic, Route Tables define custom routes, and Public IP addresses provide internet-facing connectivity. Therefore, the Virtual Network is the correct resource to configure when creating the 10.0.0.0/16 address space.

Question 162

You need to divide a virtual network into separate address ranges for web, application, and database servers. What should you create?

1. Resource Groups
2. Subnets
3. Availability Sets
4. Management Groups

Correct Answer: 2

Explanation

Subnets divide an Azure virtual network’s address space into smaller logical network segments. Separate subnets can be created for web, application, and database workloads, allowing different security and routing configurations to be applied. Resource Groups organize Azure resources, Availability Sets improve VM availability, and Management Groups organize subscriptions. Therefore, subnets are the correct choice when a virtual network needs to be divided into separate address ranges for different workloads.

Question 163

You need to restrict traffic between a subnet and the internet by allowing only specific ports. Which Azure resource should you associate with the subnet?

1. Azure DNS
2. Public IP Address
3. Network Security Group
4. Azure Storage Account

Correct Answer: 3

Explanation

A Network Security Group provides inbound and outbound traffic filtering for Azure resources. An NSG can be associated with a subnet and configured with rules based on source, destination, port, protocol, and direction. This allows administrators to permit required traffic while blocking unnecessary connections. Azure DNS provides name resolution, Public IP addresses provide internet connectivity, and Storage Accounts provide data services. Therefore, a Network Security Group is the correct resource for controlling subnet traffic.

Question 164

You need to connect two Azure virtual networks that belong to the same Azure region. Which networking feature should you use?

1. Azure DNS
2. Azure Bastion
3. Virtual Network Peering
4. Azure Load Balancer

Correct Answer: 3

Explanation

Virtual Network Peering allows two Azure virtual networks to communicate with each other over the Azure backbone network. It provides private connectivity without requiring traffic to pass through the public internet. Peering can be configured between virtual networks in the same region or across regions, depending on the required configuration. Azure DNS provides name resolution, Bastion provides secure VM access, and Load Balancer distributes traffic. Therefore, Virtual Network Peering is the appropriate solution for connecting two Azure virtual networks.

Question 165

You need to connect two Azure virtual networks located in different Azure regions. Which feature should you use?

1. Network Security Group
2. Availability Set
3. Azure Files
4. Global Virtual Network Peering

Correct Answer: 4

Explanation

Global Virtual Network Peering allows virtual networks in different Azure regions to communicate privately over Microsoft’s backbone network. It provides low-latency connectivity between resources in separate regions without requiring a VPN gateway for basic peering connectivity. Network Security Groups control traffic, Availability Sets improve VM availability, and Azure Files provides shared file storage. Therefore, Global Virtual Network Peering is the correct feature for connecting virtual networks located in different Azure regions.

Question 166

You need to prevent resources in one subnet from communicating directly with resources in another subnet unless specific traffic is allowed. Which feature should you configure?

1. Azure Advisor
2. Network Security Group
3. Azure Pricing Calculator
4. Azure Service Health

Correct Answer: 2

Explanation

Network Security Groups can control inbound and outbound traffic for subnets and network interfaces. By creating appropriate security rules, administrators can restrict communication between subnet resources and allow only required protocols or ports. Azure Advisor provides recommendations, Pricing Calculator estimates costs, and Service Health provides information about Azure service issues. Therefore, an NSG is the correct feature for controlling communication between resources in different subnets.

Question 167

You need a dedicated private connection from your on-premises network to Azure that does not traverse the public internet. Which service should you use?

1. Azure ExpressRoute
2. Azure VPN Gateway
3. Azure Traffic Manager
4. Azure Front Door

Correct Answer: 1

Explanation

Azure ExpressRoute provides a private connection between an on-premises environment and Microsoft Azure through a connectivity provider. Traffic does not traverse the public internet, providing predictable connectivity and supporting enterprise networking requirements. VPN Gateway can provide encrypted connectivity over the public internet, but it does not provide the same type of dedicated private connection. Traffic Manager distributes application traffic using DNS, while Front Door provides global application delivery. Therefore, ExpressRoute is the correct choice.

Question 168

You need to create an encrypted site-to-site connection between an Azure virtual network and an on-premises network over the internet. Which service should you use?

1. ExpressRoute
2. Azure DNS
3. Azure Load Balancer
4. VPN Gateway

Correct Answer: 4

Explanation

Azure VPN Gateway provides encrypted connectivity between Azure virtual networks and on-premises networks over the public internet. A site-to-site VPN typically uses IPsec or IKE-based protocols to protect traffic between the two environments. ExpressRoute provides a private dedicated connection instead of an internet-based VPN. Azure DNS handles name resolution, and Load Balancer distributes traffic across backend resources. Therefore, VPN Gateway is the appropriate solution for an encrypted site-to-site connection over the internet.

Question 169

You need to assign a public IP address to an Azure resource that must remain unchanged after the resource is restarted. What should you configure?

1. Static public IP
2. Dynamic public IP
3. Private DNS Zone
4. Network Security Group

Correct Answer: 1

Explanation

A static public IP address remains assigned to the resource until it is explicitly changed or released. This is useful for services that require a consistent internet-facing address, such as firewalls, gateways, or applications with IP-based access rules. A dynamic public IP can change when the associated resource is stopped and deallocated. Private DNS provides name resolution, while an NSG controls traffic. Therefore, a static public IP is the correct choice when the address must remain consistent.

Question 170

You need to create DNS records for a custom domain that will resolve publicly on the internet. Which Azure service should you use?

1. Azure Private DNS
2. Azure Bastion
3. Azure Monitor
4. Azure DNS

Correct Answer: 4

Explanation

Azure DNS is a hosting service for DNS domains that provides name resolution for publicly accessible domain names. Administrators can create records such as A, AAAA, CNAME, MX, and TXT records according to their requirements. Azure Private DNS is intended for private name resolution within virtual networks rather than public internet DNS. Bastion provides secure VM access, while Monitor provides monitoring and telemetry. Therefore, Azure DNS is the appropriate service for hosting public DNS records.

Question 171

You need private DNS name resolution for resources connected to an Azure virtual network. Which service should you configure?

1. Azure Private DNS
2. Azure DNS
3. Azure Traffic Manager
4. Azure Front Door

Correct Answer: 1

Explanation

Azure Private DNS provides DNS name resolution within virtual networks without exposing private records to the public internet. It can be used for internal applications, private endpoints, and other resources that require private name resolution. Azure DNS is primarily used for public DNS zones, while Traffic Manager provides DNS-based traffic distribution and Front Door provides global application delivery. Therefore, Azure Private DNS is the correct service for private name resolution within an Azure virtual network.

Question 172

You need to provide secure RDP and SSH access to Azure virtual machines through the Azure portal without exposing ports 3389 and 22 to the internet. Which service should you use?

1. Azure Load Balancer
2. Azure Bastion
3. Azure Traffic Manager
4. Azure DNS

Correct Answer: 2

Explanation

Azure Bastion provides secure RDP and SSH access to virtual machines through the Azure portal. The VMs do not need public IP addresses, and management ports such as RDP 3389 and SSH 22 do not need to be exposed directly to the public internet. This reduces the attack surface for administrative access. Load Balancer distributes network traffic, Traffic Manager provides DNS-based routing, and Azure DNS manages name resolution. Therefore, Azure Bastion is the correct service.

Question 173

You need to distribute incoming TCP traffic across multiple healthy virtual machines. Which Azure service should you use?

1. Azure Traffic Manager
2. Azure DNS
3. Azure Load Balancer
4. Azure Key Vault

Correct Answer: 3

Explanation

Azure Load Balancer distributes network traffic across multiple backend resources such as virtual machines. It uses health probes to determine whether backend instances are available and can direct traffic only to healthy instances. Traffic Manager works at the DNS level and is commonly used for distributing traffic among endpoints, including across regions. Azure DNS handles DNS hosting, while Key Vault manages secrets and keys. Therefore, Azure Load Balancer is the correct service for distributing TCP traffic across healthy VMs.

Question 174

You need to route users to the Azure region with the lowest network latency. Which Azure service should you use?

1. Azure Load Balancer
2. Azure Bastion
3. Azure Storage
4. Azure Traffic Manager

Correct Answer: 4

Explanation

Azure Traffic Manager supports performance-based routing, which directs users toward the endpoint that provides the lowest network latency from their location. This is useful when an application has deployments in multiple Azure regions and needs to provide responsive access. Azure Load Balancer distributes traffic among backend resources, generally within a regional deployment scenario. Bastion provides VM administration, while Storage provides data services. Therefore, Azure Traffic Manager is the correct choice for directing users based on network performance.

Question 175

You need to protect an Azure web application from common web attacks such as SQL injection and cross-site scripting. Which service should you use with Azure Application Gateway?

1. Web Application Firewall
2. Azure DNS
3. Azure Backup
4. Azure Queue Storage

Correct Answer: 1

Explanation

Web Application Firewall, or WAF, provides protection against common web application attacks such as SQL injection and cross-site scripting. When integrated with Azure Application Gateway, WAF can inspect HTTP and HTTPS requests and apply managed or custom security rules. Azure DNS handles name resolution, Backup protects data, and Queue Storage stores messages. Therefore, Web Application Firewall is the correct choice for protecting web applications from common application-layer attacks.

Question 176

You need to expose an internal Azure service privately to clients in a virtual network using a private IP address. Which feature should you use?

1. Public IP Address
2. Azure Traffic Manager
3. Private Endpoint
4. Azure DNS

Correct Answer: 3

Explanation

An Azure Private Endpoint creates a network interface with a private IP address in a virtual network and connects it to a supported Azure service. This allows clients to access the service privately without relying on a public endpoint. A Public IP provides internet-facing access, Traffic Manager distributes traffic using DNS, and Azure DNS provides name resolution. Therefore, Private Endpoint is the correct feature when an Azure service needs to be accessed privately through a virtual network.

Question 177

You need to create a storage account that provides read access to data from a secondary region if the primary region becomes unavailable. Which redundancy option should you choose?

1. GRS
2. LRS
3. RA-GRS
4. ZRS

Correct Answer: 3

Explanation

Read-access geo-redundant storage, or RA-GRS, replicates data to a secondary Azure region and allows read access to the secondary endpoint. This can provide continued read availability during certain primary-region outages. GRS also replicates data to another region but does not provide normal read access to the secondary endpoint unless a failover occurs. LRS keeps copies locally, while ZRS replicates data across availability zones in the primary region. Therefore, RA-GRS is the correct choice when secondary-region read access is required.

Question 178

You need to monitor Azure resources by collecting platform metrics such as CPU percentage, network traffic, and disk activity. Which Azure service should you use?

1. Azure Monitor
2. Azure Policy
3. Azure Resource Manager
4. Azure Key Vault

Correct Answer: 1

Explanation

Azure Monitor collects and analyzes metrics and other telemetry from Azure resources. Platform metrics such as CPU utilization, network traffic, and disk activity can be monitored to understand resource performance and detect potential issues. Azure Policy is used for governance, Resource Manager manages Azure resources, and Key Vault stores secrets and cryptographic material. Therefore, Azure Monitor is the correct service for collecting and analyzing Azure resource performance metrics.

Question 179

You need to create a centralized workspace for storing logs collected from multiple Azure resources. Which resource should you create?

1. Resource Group
2. Availability Set
3. Network Security Group
4. Log Analytics workspace

Correct Answer: 4

Explanation

A Log Analytics workspace provides a centralized location for storing and analyzing log data collected from Azure resources and other supported sources. Administrators can query the data using a query language to investigate performance, security, and operational issues. A Resource Group organizes Azure resources, Availability Sets improve VM availability, and Network Security Groups control network traffic. Therefore, a Log Analytics workspace is the correct resource when logs from multiple Azure resources need to be centralized and analyzed.

Question 180

You need to configure an alert that triggers when a virtual machine’s CPU usage exceeds 90 percent for a sustained period. Which Azure Monitor component should you configure?

1. Resource lock
2. Metric alert
3. Policy assignment
4. Activity log export

Correct Answer: 2

Explanation

Azure Monitor metric alerts can monitor numerical metrics such as VM CPU utilization and trigger when a defined threshold is reached. The alert can include conditions such as CPU usage exceeding 90 percent for a specified duration, helping administrators detect sustained performance problems. Resource locks protect resources, policy assignments enforce governance, and activity log exports handle administrative event information. Therefore, a metric alert is the correct Azure Monitor component for monitoring CPU utilization against a defined threshold.