Create and configure containers – IT – Engineering – Cloud

Microsoft Certified: Azure Administrator Associate Average Salary — $125,993

Azure Administrator AZ104 Certification Exam Prep
#Azure #AZ104 #AzureAdmnistrator #AzureDevOps #AzureAdmin #AzureTraining #AzureSysAdmin #AzureCloud #LearnAzure
AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Candidates for the Azure Administrator Associate certification should have subject matter expertise implementing, managing, and monitoring an organization’s Microsoft Azure environment.

Responsibilities for this role include implementing, managing, and monitoring identity, governance, storage, compute, and virtual networks in a cloud environment, plus provision, size, monitor, and adjust resources, when needed.

AZ-104 Microsoft Azure Administrator Exam Breakdown:

Manage Azure identities and governance (15-20%),
Manage Azure AD objects,
Manage role-based access control (RBAC),
Manage subscriptions and governance,
Implement and manage storage (10-15%),
Manage storage accounts,
Manage data in Azure Storage,
Configure Azure files and Azure blob storage,
Deploy and manage Azure compute resources (25-30%),
Configure VMs for high availability and scalability,
Automate deployment and configuration of VMs,
Create and configure VMs,
Create and configure containers,
Create and configure Web Apps,
Configure and manage virtual networking (30-35%),
Implement and manage virtual networking,
Configure name resolution,
Secure access to virtual networks,
Configure load balancing,
Monitor and troubleshoot virtual networking,
Integrate an on-premises network with an Azure virtual network,
Monitor and back up Azure resources (10-15%),
Monitor resources by using Azure Monitor,
Implement backup and recovery,

2022 AWS Cloud Practitioner Exam Preparation

Below are the top 50 Microsoft Azure Administrator Certification Questions and Answers Dumps.

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Question 1: In our subscription, we have four different resource groups. They are RG1, RG2, RG3, RG4. RG2 has a Read-only lock at the resource group scope. RG3 has a Delete lock at the resource group scope. RG1 and RG4 do not have locks. We need to determine how we could move resources between resource groups during the lifecycle of these resources. Assuming all resources provisioned support moving between resource groups regardless of region. Which of the following statements are plausible?

A. We can move resources from RG1 to RG4.

B. We can move resources between any of these resource groups.

C. We can move resources from RG2 to RG4.

D. We can move resources from RG4 to RG3.

Save 65% on select product(s) with promo code 65ZDS44X on Amazon.com

E. We can move resources from RG2 to RG3.

ANSWER1:

Notes: We can effectively move resources from RG1 and RG4 because RG1 does not have a lock. We can move resources from RG4 and RG3 because RG4 does not have a lock. Also, while RG3 does have a Delete lock this does not stop resources from being moved into this resource group.

Azure Administrator Exam Prep App #Azure #AZ104 #AzureAdmnistrator #AzureDevOps #AzureAdmin #AzureTraining #AzureSysAdmin #AzureCloud #LearnAzure

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Question 2: Your company has recently added a few new users to your Azure Active Directory. You have already added them to an active directory group, and now you have asked them to add their devices to the domain. When they add their devices, you have to ensure they are prompted to use a mobile phone to verify their identity. How do you configure this?

A. Require multi-factor authentication to join devices

B. Configure a point-to-site VPN

C. Enable Conditional Access

D. You must sign up for Azure AD Premium

ANSWER2:

Notes: This setting in Azure Active directory will require multi-factor authentication for all devices under any conditions.

Question 3: Under your Azure Subscription, you are trying to identify VMs that are underutilized in order to shutdown all VMs with CPU utilization under 5%. Which blade should you use?

A. Customer Insights

B. Advisor recommendations

C. Monitor

D. Metrics

ANSWER3:

Notes: Advisor helps you follow best practices to optimize your Azure deployments. It analyzes your resource configuration and usage telemetry and then recommends solutions that can help you improve the cost-effectiveness, performance, high availability, and security of your Azure resources.

Question4: You have just purchased the domain name arseemagroup.com from a third party registrar. Using your Azure Active Directory domain, you’d like to create new users with the suffix @arseemagroup.com. Which three things must you do?

A. Access the custom domain names blade from Azure AD

B. Create a MX or TXT record from arseemagroup.com DNS

C. Verify that you own the domain name

D. Access the App registrations blade from Azure AD

ANSWER4:

A B and C

Notes: In order to add the domain “arseemagroup.com” to Azure AD, you must add the domain from the custom domain names blade.

When you add your custom domain to Azure AD, you must create an MX or TXT record with a destination address (provided) in order to verify that the domain does indeed belong to you.

When you add your custom domain to Azure AD, you must verify that this domain belongs to you by going through a verification process. Azure AD will provide the verification information.

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Question 5: You have two subscriptions named Subscription1 and Subscription2. You are logged into Azure using Azure PowerShell from Computer1. How can you identify which subscription you are currently viewing and then switch from one subscription to the other for the current session at Computer1.

A. Set-AzContext -SubscriptionName

B. Get-AzContext

C. Select-AzContext

D. AzShow-Context

ANSWER5:

A and B

Notes: In Az PowerShell 3.7.0, Set-AzContext sets the tenant, subscription, and environment for cmdlets to use in the current session.

In Az PowerShell 3.7.0, ‘Get-AzContext’ gets the metadata used to authenticate Azure Resource Manager requests.

Reference: Azure Powershell CLI

Question 6: You have two subscriptions named Subscription1 and Subscription2. You are currently managing resources in Subscription1 from Computer1 that has the Azure CLI installed. You need to switch to Subscription2. Which command should you run?

A. az set account –subscription “Subscription2”

B. az account set –subscription “Subscription2”

C. az subscription set “Subscription2”

D. Select-AzureSubscription -SubscriptionName “Subscription2”

ANSWER6:

Notes: You are accessing Azure from Computer1 with the Azure CLI installed; therefore, this command is the correct command.

Reference: Azure Powershell CLI

Question 7: You work at the IT help desk for Consilium Corporation. You have been getting an influx of calls into the help desk about resetting users’ passwords. They keep reporting that they can’t seem to figure out how to reset their password in order to gain access to their Customer Relationship Management (CRM) software. What do you do?

A. Ensure that the users who are having problems are within the correct AD group

B. Make sure you have Azure Active Directory Free

C. Make sure they have their verification device (mobile app or access to email)

D. Verify that self-service password reset is enabled in Azure Active Directory

ANSWER7:

A C and D

Notes: Self-service password may not apply to those not in a specific Active Directory group. If the user is not in the group, they will not be able to reset their password.

In order to reset their password, the user will have to verify their identity using a mobile phone, mobile app, office phone or email.

Self-service password reset is an optional feature in Azure Active Directory, which may not apply to any and all users in the organization.

Reference: Self Service Password reset in Azure AD

Question 8: In this scenario, we are working for Cloud Chase Support. We our the active administrator, and we have been tasked with determining how to ensure we do not incur costs in either our Prod-Subscription and our Dev-Subscription for virtual machine resources. We have a CloudChase management group where both subscription nested. We decide to use Azure Policy to enforce compliance on Virtual Machines. Our Policy definition states that virtual machines are not an allowed resource type at the scope of our CloudChase management group. There are some existing virtual machines in our Prod-Subscription at the time this policy is created. After the enforcement of our new policy which of the below statements is true?

A. We cannot create virtual machines in any subscription under the scope of our management group and our existing virtual machines will be deallocated.

B. Virtual machines can be created in our Prod-Subscription if they are compliant.

C. Virtual machines can be created in our Dev-Subscription.

D. We cannot create virtual machines in any subscription under the scope of our management group.

ANSWER8:

Notes: We created a policy that has a definition that defines that virtual machines are not a supported resource type at the scope of our management group. Any subscription under the scope of this management group will not support the provisioning of virtual machine resources.

Question 9: You recently signed up for Azure Active Directory Premium and need users to be able to reset their passwords if they are unable to login. What should you configure in Azure Active Directory?

A. Set “block sign-in” to off when creating the user

B. User password reset

C. User password change

D. Add user to sign-in group in Azure AD

ANSWER9:

Notes: With the password reset capability, the user will be able to click “forgot password” when trying to log in to the portal and reset their password on their own.

Question 10: You have an Azure Pay-as-you-go Subscription named Subscription1. You have some concerns about cost for Subscription1, and you would like to spend less than $100.00 US per month on all resources in this subscription. If you spend more than $90.00 US, you would like to get an alert in the form of a text message. What should you do?

A. Shutdown VMs when you are not using them

B. Create an alert in Azure Monitor

C. Create a budget alert condition tied to an action group

D. Create a budget in the subscriptions blade

ANSWER10:

Notes: Creating an alert condition is available when setting your budget, it is not required that you create an action group, however in this case where we want to be notified via SMS (text message), it is required that we tie an action group to our budget alert.

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Question 11: We want to be provide an Azure AD B2B guest user the ability to manage all resources inside of our DevRG resource group. We want to give them these abilities over managing all resources inside of this resource group and nothing more. What role would we assign to the user to accomplish this goal? Assume we are assigning the role to the DevRG scope.

A. User Access Administrator

B. Owner

C. Contributor

D. Global Admin

ANSWER11:

Notes: This role will allow us to give this guest user the ability to manage all resources inside of the DevRG resource group, and nothing more like manage role assignments. This is exactly what we need for our scenario. When assigning permissions we need to think the principle of least privilege.

Question 12: You have just created a General-purpose V2 storage account in Azure. From a VM located in your on-prem environment, you’ve logged into your Azure subscription using the Connect-AzConnect command from the PowerShell command line. Next, you need to retrieve the key, in order to access your storage account. Which PowerShell cmdlet will you use to retrieve the access key?

A. Get-AzStorageAccount

B. Get-AzStorageContainerKey

C. Get-AzStorageContainerStoredAccessPolicy

D. Get-AzStorageAccountKey

ANSWER12:

Notes: The Get-AzStorageAccountKey cmdlet gets the access keys for an Azure Storage account.

Question 13: You have been directed to copy all data from one storage account to another using the AzCopy tool. You need to report which storage services you can copy. Which of those services would it be?

A. Only Azure File Shares

B. Azure Queues and Blobs

C. Azure Blob and File Shares

D. Azure Table and File Shares

ANSWER13:

Notes: AzCopy is a command-line utility that you can use to copy blobs or files to or from a storage account.

Question 14: You have a general purpose v1 storage account named consiliumstore that has a private container named container2. You need to allow read access to the data inside container2, but only within a 14 day window. How do you accomplish this using the Azure Portal?

A. Upgrade the storage account to general purpose v2

B. Create a shared access signatures

C. Create a service SAS

D. Create a stored access policy

ANSWER14:

B and D

Notes: A Shared Access Signature (SAS) allows you to have granular control over your storage account, including access to only certain services (i.e. Azure Blobs) and permitting only read, write, delete, list, add, or create access. A Stored Access Policy allows granular control over a single storage container using a Shared Access Signature (SAS).

Question 15: You have an existing Microsoft Enterprise Agreement (EA) Subscription. You need to ship 34TB of data from an on-premise Windows 2016 server to your Azure storage account. You need to ensure that the data transfer has zero impact on the network, preserves your existing drives and is the fastest and most secure method. What should be your first step to starting the import job?

A. Open a ticket with Microsoft Support

B. Order an Azure Databox via the Azure Portal

C. Start an Import Job via the Azure Portal

D. Prepare your hard drives using the WAImportExport tool

ANSWER15:

Notes: This option would be the best, as Azure Data box supports Windows 2016 servers, and is secure and reliable.

Question 16: You have data in an AWS S3 Bucket named myS3Bucket and you need to copy all of its contents to a container named container1 in an Azure storage account named companydata. Which command would be most efficient use of getting the data from the S3 bucket to the Azure storage container?

A. azcopy copy ‘https://s3.amazonaws.com/myS3Bucket’ ‘https://companydata.blob.core.windows.net/container1’ –recursive=true

B. aws s3 cp s3://mybucket/test.txt https://companydata.blob.core.windows.net/container1

C. azcopy blob copy ‘https://s3.amazonaws.com/myS3Bucket’ ‘https://companydata.blob.core.windows.net/container1’

D. azcopy copy sync ‘https://s3.amazonaws.com/myS3Bucket’ ‘https://companydata.blob.core.windows.net/container1’

ANSWER16:

Notes: The AzCopy tool can copy directly from an AWS S3 bucket to an Azure Storage Account. source

Question 17: You have the following Azure Storage Accounts in your Subscription: stor1 (BlockBlobStorage) stor2 (FileStorage) stor3 (StorageV2) Which of these storage accounts can be converted to Read-Access Geo-Redundant Storage (RA-GRS) based on their storage account kind? Please select the most appropriate answer.

A. stor1 and stor2

B. stor3

C. stor2

D. stor1, stor2, and stor3

ANSWER17:

Notes: StorageV2 does support read-access geo-redundant storage (RA-GRS) and is able to be converted.

Question 18: You create an Azure storage account named companystore with a publicly accessible container named container1. You upload a file to container1 named pic1.png. What will be the URL in order to access this blob?

A. https://companystore.blob.core.windows.net/container1/pic1.png

B. https://portal.azure.com/companystore.blob.core.windows.net/pic1.png

C. https://blob.core.windows.net/companystore/container1/pic.png

D. https://pic1.companystore.blob.core.windows.net

ANSWER18:

Notes: The URL of the blob, by default will be the storage account name, followed by blob.core.windows.net, the container name, then the name of the blob.

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Question 19: You have an Azure subscription named Subscription1. In Subscription1, you have an Azure virtual machine named VM1. Attached to VM1 are two network interface cards. You require a third network interface card with a network bandwidth above 1000 Mbps for your storage area network. What should you do?

A. Create an additional VM in the same subnet and connect to VM1 over the LAN

B. Create a new subnet with a sufficient number of available IP addresses

C. Create a new storage account to store data for VM1

D. Change the VM SKU to Standard_A4 or larger

ANSWER19:

Notes: The larger SKUs for Azure virtual machines allow for an increased number of NICs.

Question 20: You are trying to create a new Azure Kubernetes Service (AKS) cluster from your local workstation. The AKS cluster must contain three nodes and ensure access to the worker nodes in order to troubleshoot the kubelet. You have authenticated to Azure from your local workstation with the Azure CLI. What command will you use to create an AKS cluster named AKS1 with the necessary components inside of the resource group named RG1?

A. az aks create -g RG1 -n AKS1 –generate-ssh-keys –node-count 3

B. az kubernetes create –name AKS1 –group RG1 –nodes 3 –generate-keys

C. az aks create –name AKS1 –resource-group RG1 –nodes 3 –ssh-key-value ~/.ssh/id_rsa.pub

D. az kubernetes create –name AKS1 –resource-group RG1 –nodes 3 –generate-keys

ANSWER20:

Notes: The correct command to use for creating an AKS cluster is az aks create and the -g and -n values are abbreviated syntax for resource group and name respectively. The --generate-ssh-keys flag will create the SSH keys in order to access the worker nodes. The --node-count flag will ensure that there are three worker nodes in the cluster.

Question 21: VM1 is located in the West US region, and the OS disk is Premium SSD. The size of VM1 is currently Standard_D2s_v3, but you need to change the size to Standard_D2. You are able to select the size from the size blade, but you receive an error message. Why can’t you change the VM size?

A. You need to provide the username and password for the OS to upgrade

B. Standard_D2 does not support premium SSD disks

C. The size Standard_D2 is not available in the West US region

D. You did not shut down (deallocated) VM1 before you change the size

ANSWER21:

Notes: Standard_D2 does not support premium disks; therefore, you are unable to change VM1 to this size. A good way to remember which size is available is the s in the size, as the s indicates Premium SSD. See more here: dsv3-series

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Question 22: You have an Azure Kubernetes Service (AKS) cluster named AKS1 within the resource group named RG1. You are trying run the command kubectl get all from the Azure Cloud Shell (https://shell.azure.com) to view your cluster resources. You received the error Error from server (BadRequest): the server rejected our request for an unknown reason. You’ve verified that the resources exist and the command is correct. What do you need to do in order to view your cluster resources from the Azure Cloud Shell?

A. Retrieve the access credentials using the command az aks get-credentials --name AKS1 --resource-group RG1

B. Log into the cluster GUI from the Azure Portal

C. Install the kubectl tool

D. Access the Kubernetes Dashboard using the command az aks browse --name AKS1 --resource-group RG1

ANSWER22:

Notes: AKS does not have a cluster GUI that is accessible from the Azure Portal. You must use a machine with kubectl installed, or the Azure Cloud Shell.

The kubeconfig is required in order to access the Kubernetes API. You can retrieve the kubeconfig using the az aks get-credentials command.

Question 23: You have a subscription named Subscription1. You create a new Azure VM in your subscription named VM5 running Windows 2012 R2. You try to connect and login to VM5, but you get an error that says “We couldn’t connect to the remote PC. Make sure the PC is turned on and connected to the network, and that remote access is enabled.” You have verified that VM5 is running and has been assigned a public IP address. What change do you need to make in order to successfully connect and login to VM5?

A. Add a rule to the Network Security Group that will allow port 3389

B. Select Reset password from the VM blade

C. Use Network Watcher for detailed connection tracing

D. You need to access the VM from a computer that’s in the same subnet

ANSWER23:

Notes: A Network Security Group (NSG) is designed to filter traffic to and from Azure resources, including Azure VMs. Allowing port 3389 from your machine to the Azure VM will address the connection issue. You may reset the password, but being you received the error before attempting to enter your credentials says that it’s a connectivity problem, not a credentials problem.

Question 24: Subscription1 contains an Azure VM named VM1 with the following configuration:VM Size: Standard_D2s_v3

Public IP Address: 52.173.36.55

Resource Group: RG1

Availability Zone: None

Location: Japan East

Disk Type: Standard HDD

What are two things you can do to reduce data loss and achieve a 99.9% SLA?

A. Create a recovery services vault and enable replication for VM1

B. Move VM1 to a paired region

C. Place the VM in an availability zone

D. Change the disk type to Premium SSD

ANSWER24:

A and D

Notes: Creating a recovery services vault will allow you to back up the VM to a different region and location. You will enable replication to ensure that VM data and settings are continually replicated to the backup location for simple recovery.

Virtual machines with Premium SSD disks qualify for the 99.9% connectivity SLA.

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Question 25: You have created an application that is to be run on Linux containers named ContainerApp1. You’ve created an Azure container instance with an FQDN, but you notice that when the container restarts, all application data is lost. What is the best solution to preserve the data associated with your application?

A. Create a public blob storage container and share the URI with the application

B. Create a storage account and share the SAS with the application

C. Mount an Azure file share as a volume in Azure Container Instances

D. Run the container on a VM, and use the managed disk attached to the VM

ANSWER25:

Notes: Azure Container Instances can mount an Azure file share created with Azure Files. Azure Files offers fully managed file shares hosted in Azure Storage that are accessible via Server Message Block (SMB) protocol. Using an Azure file share with Azure Container Instances provides file-sharing features similar to using an Azure file share with Azure virtual machines.

Question 26: You’ve created a Dockerfile that contains the necessary steps to build an image that you plan to use for your application running as a Web App in App Services named APP1. You have created an Azure Container Registry, which is where you plan to store your images to be used for APP1. What should your next step be?

A. Run the az acr build command

B. Create the App Service Plan

C. Run the docker push command

D. Run the docker login command

ANSWER26:

Notes: The az acr build command will build and push your image to an Azure Container Registry all in one command. You should use this if you don’t have docker installed, and/or if you don’t have the compute resources to build images on your local machine.

Question 27: You have an application that runs on instances in a Virtual Machine Scale Set. The number of instances in the VMSS is at three starting Monday. The minimum number of instances is one, and the maximum is 5 instances. There are two scaling rules for this VMSS:

Rule	Condition	Action
Rule1	CPU > 75%	+1 instance
Rule2	CPU < 25%	-1 instance

Based on the rules above and the chart below, on Wednesday how many instances will there be in our VMSS?

|CPU%|Time(UTC)|Day |:—|:—:|:—:|—:| |75|12:01|Tuesday| |20|13:36|Tuesday| |85|12:10|Wednesday| |20|19:07|Thursday|

A. 2 instances

B. 3 instances

C. 4 instances

D. 5 instances

ANSWER27:

Notes: We start with 3 instances on Monday. Based on the chart we will still be at 3 instances on Tuesday at 12:01 because we have not met a condition for any scaling actions to take place, but then at 13:36 on Tuesday we will scale down an instance due to the CPU% being below 25%. Now we have 2 instances. Then on Wednesday at 12:10 we will be scale-out by one instance because our CPU% has gone above 75%. This gives us three instances on Wednesday.

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Question 28: Subscription1 contains an Azure VM named VM1. You have added a data disk to VM1, as well as a new network interface card. You need to create two more Azure VMs just like this one named VM2 and VM3. What is the most efficient way to create VM2 and VM3 that will minimize cost?

A. Backup the VM and recover to a different region

B. Redeploy VM1 with the new disk and NIC and deploy the template to VM2 and VM3

C. Select Export template from VM1 blade, then deploy VM2 and VM3 with that template

D. Create an image from VM1 and use the image to deploy VM2 and VM3

ANSWER28:

Notes: Exporting the template from a VM is a quick and easy way to take the existing VM settings and automate future deployments.

Question 29: You have an Azure subscription named Subscription1. You have created a web app named App1 in Subscription1 that is sourced from a git repository named Git1. You need to ensure that every commit to the master branch in Git1 triggers a deployment to a test version of the application before releasing it to production. What are two changes that you must make to App1 to fulfill this requirement?

A. Create a build server with the master branch of Git1 as the trigger

B. Configure custom domains for test and production versions of App1

C. Add a new deployment slot to App1 to release the test version of App1

D. Create a new web app and configure failover settings from test to production

ANSWER29:

A and C

Notes: You have the option of creating a build server natively in App Services by selecting Deployment Center in the App1 blade. This will trigger a build every time a commit is made to the master branch of Git1.

Deployment Slots allow greater flexibility within app services, providing a built-in staging environment for your app, allowing you access to your application without deploying it to production.

Question 30: You plan to create an Azure Web App in the East US region. You need to ensure that this web app scales out with demand, to prevent downtime. You also need to ensure that the data that resides inside of the application will remain secure and never become exposed to anyone outside of the organization. Which App Service plan SKU will you chose that will meet these requirements and also save on cost?

A. FREE

B. B1

C. SHARED

D. I1

ANSWER30:

Notes: The I1 SKU allows your app to run on dedicated hardware, and also provides network isolation on top of compute isolation to protect your app. It also provides the maximum scale-out capabilities.

Question 31: VM1 is located in the East US region. You have added a premium SSD data disk to VM1, but the IOPS are not satisfying the needs of your application, how can you change the speed of the disk?

A. Select the disk configuration and increase the size

B. Shut down (Deallocate) the VM

C. Export the disk and convert to VHD

D. Create a new disk and migrate the data

ANSWER31:

A and B

Notes: Premium disk performance increases based on the size of the disk, while standard disks have consistent performance for all disk sizes. Disks can be resized only when they are unattached or the owner VM is deallocated. Disks can be resized only when they are unattached or the owner VM is deallocated.

Question 32: The NoName Company has just deployed a number of Azure VMs into a specific subnet in an Azure virtual network. They have also implemented a network security plan which includes the use of Azure Firewall. From those newly deployed VMs, the company wants to deny access to the website https://www.microsoft.com. How can you achieve this using their current Azure resources?

A. A network rule

B. Create a route via Route Table to the firewall (as a virtual appliance hop)

C. Configure an application rule on the Azure Firewall that blocks FQDNS www.microsoft.com

D. An Application Gateway

E. A Subnet named AzureFirewallSubnet

F. A VPN Gateway

ANSWER32:

A B C

Notes: A network rule would allow access to an external public DNS service, to lookup the microsoft.com domain name. Creating a route via Route Table to the firewall is required to direct incoming traffic (from the firewall public IP address) to a specific destination.

An application rule allows or blocks an address by URL. This is necessary in order to block https://www.microsoft.com according to the requirements of the company.

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Question 33: You need to create an Azure virtual machine named VM1 that requires a static private IP address configured inside the IP address space for the VNet in which the VM resides. How do you configure a static IP address for this Azure VM?

A. After the VM has been created, create a new network interface and configure a static IP address for that network interface

B. After the VM has been created, go to the network interface attached to the VM and change the IP configuration to static assignment

C. When creating a VM in the portal, select New next to private ip address and choose static after assigning the correct IP address

D. When creating the VM in the portal, change the setting from dynamic to static on the networking tab under private IP address

ANSWER33:

Notes: Changing the IP configuration on the network interface will achieve this goal.

Question 34: You have an Azure subscription named Subscription1. In Subscription1, you have a web server that has the IP address 10.1.0.83 and a database server that has the IP address 10.1.0.142. Instead of remembering the IP addresses of the servers, you’d like to connect to these servers using a DNS name. With no DNS server currently, and without having to create a new DNS server, how can you access your database server from your web server by the DNS name db.yourcompany.com?

A. Public DNS Zone

B. Promote Server to Domain Controller

C. Access the Domain Controller

D. Private DNS Zone

ANSWER34:

Notes: A private DNS zone is an easy way to register servers with a DNS name versus having to access them by their IP address

Question 35: You have an Azure subscription named Subscription1. In Subscription1 you have two VNets, one named VNet-Hub and one named VNet-Spoke. Within VNet-Hub, there is an Azure Firewall with a public IP address, configured as a Standard SKU. In VNet-Spoke, there is a Windows Server 2016 with no public IP address and no Network Security Group (NSG). Using which three items can you utilize the public IP address of the Azure firewall to connect to the Windows Server, without exposing the server to the public internet directly?

A. NAT Rule for the Firewall

B. Route Table

C. Virtual Network Gateway

D. Virtual Network Peering

E. ExpressRoute Gateway

ANSWER35:

A B D

Notes: You can configure a NAT rule on the firewall to translate and filter inbound Internet traffic to your subnets. You will need a route table to route ingress traffic to the firewall virtual appliance. In order for traffic to flow from the VNet-Spoke to VNet-Hub, you will need a peer connection between the virtual networks (Virtual Network Peering).

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Question 36: You have an on-premises environment as well as your Azure environment with a subscription named Subscription1. Subscription1 has a virtual network named VNET1 and you need to connect to the on-premises network securely using an ExpressRoute link and Site-to-site VPN. What Azure resources do you need in order to establish the connection while minimizing cost?

A. Azure VPN Gateway

B. Network virtual appliance

C. No resources needed, ExpressRoute is encrypted by default

D. A route table

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

ANSWER36:

B and D

Notes: VPN tunnels over Microsoft peering can be terminated either using VPN gateway, or using an appropriate Network Virtual Appliance (NVA) available through Azure Marketplace. We choose to use NVA because it accomplishes our goal, but for a lesser cost than Azure VPN Gateway. A route table is required to specify the next hop for traffic coming and going from the on-premises network.

Question 37: You have a Network Security Group (NSG) that is associated with a network interface that is attached to an Azure virtual machine named VM1 running Windows Server 2019. VM1 is in subnet named subnet1, in a virtual network named VNet1. A different NSG is attached to subnet1, but you notice that there is an inbound rule to allow port 3389. When you try to connect to VM1, you cannot connect. You reviewed the NSG and the source IP address and the protocol are correct. How can you connect to VM1 using best practices for NSGs in Azure?

A. The protocol on the NSG rule is set to UDP

B. The NSG attached to the network interface needs to be removed

C. The source IP address on the NSG rule is incorrect

D. You need to add an inbound rule for the NSG attached to the network interface

ANSWER37:

Notes: Removing the NSG from the network interface would allow the VM to use the NSG associated with the subnet, which is best practice.

Question 38: You have an Azure subscription named Subscription1. In Subscription1 you have an Azure VM named VM1 with Windows Server 2019 as the operating system. VM1 does not have a public IP address assigned to it. VM1 is located in a virtual network named VNet1, in subnet1. Attached to subnet1 is a Network Security Group (NSG) that has port 3389 open inbound. On your local machine, you do not have an RDP client installed, but you need to login into the VM. Without assigning a public IP address to the VM, what three things in combination can we use to log into VM1?

A. HTML5 supported Web Browser

B. Azure VPN Gateway

C. A subnet named AzureBastionSubnet

D. A Gateway Subnet

E. Azure Bastion Host

F. Inbound security rule to open port 443

ANSWER38:

A C E

Notes: The RDP connection to the virtual machine happens via Bastion host using the Azure portal (over HTML5) using port 443 and the Bastion service.

The subnet inside your virtual network to which the Bastion resource will be deployed must have the name AzureBastionSubnet. The name lets Azure know which subnet to deploy the Bastion resource to. This is different than a Gateway Subnet.

The Azure Bastion service is a new fully platform-managed PaaS service that you provision inside your virtual network. It provides secure and seamless RDP/SSH connectivity to your virtual machines directly in the Azure portal over TLS. When you connect via Azure Bastion, your virtual machines do not need a public IP address.

[/bg_collapse]

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Question 39: You have a subscription named Subscription1. Subscription1 has two virtual networks named VNet1 and VNet2 in two different resource groups. VNet1 is located in the West US region and VNet2 is located in the East US region. You need to apply a network security group named NSG1 to a subnet in VNet1. NSG1 is located in the East US region. How do you attach NSG1 to the subnet in VNet1?

A. You can’t. Create a new network security group in the west us region

B. Move VNet1 into a resource group located in the east us region

C. Select the subnet and choose NSG1 from the network security group drop-down

D. Move NSG1 into the VNet1 resource group

ANSWER39:

Notes: In order for you to associate a network security group to a subnet, both the virtual network and the network security group must be in the same region.

Question 40: You have a subscription named Subscription1. Subscription1 has one Azure virtual machine named VM1 which is an Ubuntu server. You can’t seem to login to the server via SSH. What tool should you use to verify if the problem is the network security group?

A. IP flow verify tool in Azure Network Watcher

B. Azure Monitor VM metrics

C. Azure Traffic Manager traffic view

D. Azure Virtual Network logs

ANSWER40:

Notes: The IP Flow Verify tool checks if a packet is allowed or denied to or from a virtual machine. The information consists of direction, protocol, local IP, remote IP, local port, and a remote port. If the packet is denied by a security group, the name of the rule that denied the packet is returned.

Question 41: You have two Azure virtual machines named VM1 and VM2. VM1 is using the Red Hat Enterprise Linux 8.1 (LVM) operating system and is located in VNet1, within subnet1. VM2 is using the Windows Server 2019 operating system, and is located in VNet1, within subnet2. VNet1 has custom DNS configured, pointing to a DNS server with the IP address 172.168.0.6. VM2 has 10.0.1.15 configured as the DNS server on its network interface. Which DNS server will VM2 use for DNS queries?

A. 8.8.8.8

B. 10.0.1.15 for primary, 172.168.0.6 as secondary

C. 10.0.1.15

D. 172.168.0.6

ANSWER41:

Notes: Since the network interface attached to VM2 is assigned to a specific DNS server, it takes precedence over the DNS configured on the VNet.

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Question 42: You have created a new Azure virtual machine in a subnet named Subnet1 with an attached network interface card named NIC1. The NIC1, attached to Subnet1, has the following effective routes:

Source	State	Address Prefix	Next Hop
Default	Active	10.1.0.0/16	Virtual Network
Default	Invalid	0.0.0.0/0	Internet
Default	Active	10.0.0.0/8	None
Default	Active	100.64.0.0/10	None
Default	Active	192.168.0.0/16	None
Default	Active	25.33.80.0/20	None
Default	Active	25.41.3.0/25	None
User	Active	0.0.0.0/0	None

What will happen when the virtual machine tried to communicate with a VM on a different network?

A. Traffic will be sent successfully

B. Traffic will be forced out to the internet

C. Traffic will be forced internally

D. Traffic will be dropped and no connection will be established

ANSWER42:

Notes: The user-defined route in the table will override the default route, causing traffic to be directed to nowhere (next hope type of none).

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Question 43: You have a standard load balancer that directs traffic from port 80 externally to three different virtual machines. You need to direct all incoming TCP traffic on port 5000 to port 22 internally for connecting to Linux VMs. What do you need in order to connect to the VM via SSH?

A. A public IP address for all three VMs

B. A Route Table with at least one rule

C. A Network Security Group (NSG)

D. A Network Address Translation (NAT) Rule

ANSWER43:

C and D

Notes: The NSG rules work alongside the NAT rules to provide a connection to a VM that’s behind a load balancer. NAT rules work alongside NSG rules to provide a connection to a VM that’s behind a load balancer.

Question 44: You have a web application that serves video and images to those visiting the site. You start to notice that your web server is overloaded, and often crashes because the requests have consumed all of its resources. To combat this, you’ve added an additional web server and you plan to load balance these servers by serving images from the first server only and serving video from the second server only. Which Azure resource can you implement that will properly load balance (at OSI layer 7) with URL-based routing and secure with SSL at the lowest cost?

A. Azure Load Balancer

B. Azure Front Door

C. Azure Application Gateway

D. Web Application Firewall

ANSWER44:

Notes: Azure Application Gateway operates at layer 7 (the application layer), and is a web traffic load balancer that enables you to manage traffic to your web applications. Application Gateway can make routing decisions based on URI path and secure with SSL.

Question 45: You manage a virtual network named VNet1 that is hosted in the West US region. Two virtual machines named VM1 and VM2, both running Windows Server, are on VNet1. You need to monitor traffic between VM1 and VM2 for a period of five hours. As a solution, you propose to create a connection monitor in Azure Network Watcher. Does this solution meet the goal?

A. Yes

B. –

C. –

D. No

ANSWER45:

Notes: The connection monitor capability in Azure Network Watcher monitors communication at a regular interval and informs you of reachability, latency, and network topology changes between the VM and the endpoint.

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Question 46: You have an Azure subscription named Subscription1. You would like to connect your on-premises environment to Subscription1. You have to meet three requirements from the business. The first requirement is that the connection from the on-premises office and Azure must be a private connection. No network traffic is allowed to go over the public internet. The second requirement is that all traffic from the on-premises office and Azure must happen at layer 3 (network layer). The third requirement is that this connection from on-premises to Azure must be redundant to minimize the opportunity for failure. What type of connection fulfills these three requirements?

A. ExpressRoute with premium add-on

B. ExpressRoute

C. Site-to-Site VPN

D. Virtual WAN

ANSWER46:

Notes: ExpressRoute lets you extend your on-premises networks into the Microsoft cloud over a private connection facilitated by a connectivity provider. ExpressRoute connections do not go over the public Internet. An ExpressRoute Connection is a layer 3 connection between your on-premises network and Azure through a connectivity provider (e.g. Verizon).

Question 47: You have an Azure subscription as well as an on-premises environment that is connected via ExpressRoute circuit. You have two additional branch offices that you need to connect to the network, as well as ten remote employees that change locations frequently but still need access to Azure resources. What is the solution that will provide the quickest setup at the lowest cost?

A. Site-to-Site VPN

B. Point-to-Site VPN

C. Virtual WAN

D. Hub-and-Spoke Network Topology

ANSWER47:

Notes: The Virtual WAN architecture is a hub and spoke architecture for branches and users. It enables global transit network architecture, where the cloud-hosted network ‘hub’ enables transitive connectivity between endpoints that may be distributed across different types of ‘spokes’. All hubs are connected in full mesh in a Standard Virtual WAN making it easy for the user to use the Microsoft backbone for any-to-any (any spoke) connectivity. This satisfies the requirement to provide the quickest set up at the lowest cost.

Question 48: You have a small number of servers running a microservice, and you want to make sure that all the servers have connectivity to each other. You also need to calculate network performance metrics like packet loss and link latency. Which two Azure resources do you need to meet this requirement?

A. Log Analytics Workspace

B. Network Performance Monitor

C. Azure Monitor

D. Azure Traffic Manager

ANSWER48:

A and B

Notes: A Log Analytics workspace is a data repository for Azure Monitor log data. A pre-requisite in order to use Network Performance Monitor. Network Performance Monitor helps you monitor network performance between various points in your network infrastructure. It also helps you monitor network connectivity to service and application endpoints and monitor the performance of Azure ExpressRoute.

Question 49: You have two virtual networks named VNet1 and VNet2. VNet1 is located in the West US region, whereas VNet2 is located in the East US region. You need to configure a virtual machine that’s located in VNet1 to also communicate with VMs in VNet2. From the choices available how can we enable communication between resources in VNet1 and VNet2

A. Migrate the VNet1 VM to VNet2 and leave the other VM components on VNet1

B. Migrate the network interface card (NIC), the network security group (NSG) and the VM disks to VNet2

C. Just the VM disks will need to be migrated to VNet2

D. Configure a VNet-to-VNet VPN gateway connection to allow communication between VNets in different regions

ANSWER49:

Notes: VNet-to-VNet connections allow communication between virtual networks in different regions and from different subscriptions. Reference: Configure a VNet-to-VNet VPN gateway connection by using the Azure portal.

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Question 50: You have two subscriptions, one named Subscription1 and the other named Subscription2. Both subscriptions are located within the same tenant. You have one Azure virtual machine located within Subscription1 and another Azure virtual machine within Subscription2 and you’d like to view CPU utilization metrics on both virtual machines. How can you achieve this while maintaining the minimum number of Azure resources and minimizing cost?

A. Create a Log Analytics Workspace for both VMs

B.Turn on VM Insights in Azure Monitor

C. Install the Log Analytics (OMS) Agent on the VMs

D. Enable guest-level monitoring on each VM

ANSWER50:

A and B

Notes: You can view metrics data (such as CPU utilization %) over time by sending your metrics data to a log analytics workspace. This workspace can collect metrics data from multiple VMs, no matter if they are located in the same or different subscriptions.

VM integration with Azure Monitor Logs delivers powerful aggregation and filtering, allowing Azure Monitor for VMs to analyze data trends over time. You can view this data in a single VM from the virtual machine directly, or you can use Azure Monitor to deliver an aggregated view of your VMs where the view supports Azure resource-context or workspace-context modes.

Question 51: You have created a new Azure virtual machine named VM1. You plan to use VM1 as a web server, which will require the VM to be accessible using HTTP/S (HTTP and HTTPS) protocol. A Network Security Group (NSG) is attached to the NIC of VM1 with the following rules:

Priority|Name|Port|Protocol|SRC|DEST|Action| |:—|:—:|:—:|:—:|:—:|:—:|—:| |300|Rule2|80|TCP|Any|Any|Deny| |400|Rule1|443|TCP|Any|Any|Deny| |500|Rule4|60-500|TCP|Any|Any|Allow| |600|Rule5|22|TCP|72.166.177.14/32|Any|Deny| |1000|Rule3|22|TCP|Any|Any|Allow|

What changes do you have to make to the NSG in order to meet the requirements for VM1?

A. Change the priority of Rule3 to 200

B. Change the action of Rule1 to Allow

C. Change the priority of Rule4 to 200

D. Change the port of Rule5 to 443

ANSWER51:

Notes: Lower priority rules take precedence over higher ones. Changing Rule4 to a lower number will negate all the other rules of a lesser priority, therefore allowing traffic on ports 60-500, which includes 80 and 443, the ports necessary for allowing traffic over HTTP/S. Remember the lower the priority the priority number the higher the priority in regards to reading the rules.

Question 52: You have an Azure virtual machine running Windows Server 2016. You need to collect OS level metrics on this virtual machine, including Windows event logs and performance counters. Which of the following items do you need in order to collect this metrics data?

A. Enable guest-level monitoring

B. Windows Diagnostics Extension

C. Log Analytics Agent

D. InfluxData Telegraf Agent

E. Storage Account for Diagnostic Data

ANSWER52:

A B E

Notes: In order to install the diagnostics extension on an Azure VM, you must enable guest-level monitoring from the VM settings in the portal. Windows Diagnostic Extension is an agent in Azure Monitor that collects monitoring data from the guest operating system and workloads of Azure virtual machines and other compute resources. In order to enable guest-level monitoring, you need to create a storage account for storing the metrics data.

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Question 53: You have an Azure subscription with a virtual machine named VM1. You are using Recovery Services Vault (RSV) to backup VM1 with soft delete enabled. The backup policy is set to backup daily at 11 PM UTC, retain an instant recovery snapshot for 2 days, and retain the daily backup point for 14 days. After the initial backup of VM1, you are instructed to delete the vault and all of the backup data. What should you do?

A. Turn off soft delete in the vault security settings

B. Wait 14 days

C. Stop the backup of VM1 and delete backup data

D. Delete the backup policy

E. Delete Backup Jobs Workload

F. Wait 15 days

ANSWER53:

A and C

Notes: When you stop the backup and delete the backup data, because you have soft delete enabled, the backup data is still kept. Permanently delete the soft-deleted backup items that would remove the backup data indefinitely. If you stop the backup of VM1 and choose delete backup data from the dropdown menu, this will stop future backups and delete the existing backup data.

Question 54: You have a number of virtual machines and web applications running in your Azure environment. These Azure resources are critical for business operations, so you’ve locked the resources in order to prevent deletion. In addition, how can you alert on these actions in the portal, and notify your team via email and SMS when a user is trying to delete or create a new resource from within your Azure subscription?

A. Pin the activity log to your dashboard

B. Create a new alert rule

C. Query Administrative Events and Copy Link to Query

D. Create a new action group

ANSWER54:

B and D

Notes: Alert rules specify the conditions for which the alert is triggered. Activity log alerts are the alerts that get activated when a new activity log event occurs that matches the conditions specified in the alert. An action group is a collection of notification preferences defined by the owner of an Azure subscription. Azure Monitor and Service Health alerts use action groups to notify users that an alert has been triggered.

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Question 55: You have a .NET Core application running in Azure App Services. You are expecting a huge influx of traffic to your application in the coming days. When your application experiences this spike in traffic, you want to detect any anomalies such as request errors or failed queries immediately. What service can you use to assure that you know about these types of errors related to your .NET application immediately?

A. Client-side monitoring

B. Live Metrics Stream in Application Insights

C. Application Insights Search

D. Log analytics workspace

ANSWER55:

Notes: Live metrics stream includes such information as the number of incoming requests, the duration of those requests, and any failures that occur. You can also inspect critical performance metrics such as processor and memory.

Question 56: You have an Azure subscription named Subscription1. In Subscription1 you have two Azure VMs named VM1 and VM2, both running Windows Server 2016. VM1 is backed up using Recovery Services Vault, with a backup policy of producing a daily backup and keeping that daily backup for seven days. Also, a snapshot is kept for 2 days. VM1 is compromised by a virus that infects the entire system, including the files. You need to restore the files from yesterday’s backup of VM1. Where can you restore the files to in the quickest manner?

A. A new Azure VM

B. Restore the VM1 snapshot

C. VM2

D. In-place

ANSWER56:

Notes: Using snapshots for VM backups, you speed up the recovery time considerably. The snapshots are stored with the disks in Azure, so the transfer speeds are optimal.

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Question 57: You have a subscription named Subscription1. You would like to be alerted upon certain administrative events within Subscription1 to detect unauthorized access. Which of the following is the quickest method to setup these types of alerts?

A. Monitor > Alerts > New Alert Rule

B. Log Analytics Workspace > myWorkdspace > Advanced Settings

C. Policy > Assignments > Assign Policy

D. Subscriptions > mySubscription > Activity Log > New Alert

ANSWER57:

Notes: Alerts can be created from within Azure Monitor

Microsoft Azure Administrator Certification Q&A:

What does az vmss deallocate do?

The az vmss deallocate command will deallocate and remove the VMs within a VMSS. Azure Doc

A company is planning to use Azure for the various services they offer. They want to ensure that they can bill each department for the resources they consume. They decide to use Azure resource tags to separate the bills department wise. Would this fulfill the requirement?

– Yes, you can use resource tags to organize your Azure resources and also apply billing techniques department wise. The Microsoft documentation mentions the following.

– Reference: Azure resource tags

A company is planning to use Azure for the various services they offer. They want to ensure that they can bill each department for the resources they consume. They decide to use Azure rolebased access control to separate the bills department wise. Would this fulfill the requirement?

– No, This is used to control access to resources and can’t be used for billing purposes.

– Reference: Azure Role Based Access Control

A company is planning to use Azure for the various services they offer. They want to ensure that they can bill each department for the resources they consume. They decide to use Azure policies to separate the bills department wise. Would this fulfill the requirement?

– No, Azure policies are used from a governance perspective and can’t be used to create bills department wise.

– Reference: Azure Gov policies

A company is planning to use the Azure Import/Export service to move data out of its Azure Storage account. Which of the following service could be used when defining the Azure Export job?

– Only the BLOB service is supported by the Export job feature. This is also given in the Microsoft documentation.

– Reference: Azure Blob Storage

Suppose you have an application running on a windows virtual machine in azure. what is the best-practice guidance on where the app should store data files?

– Dedicated data disks are generally considered the best place to store application data files. They can be larger than OS disks and you can optimize them for the cost and performance characteristics appropriate for your data.

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

Sources/References:

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

1- Exam AZ-104: Microsoft Azure Administrator

2- Linux Academy

3- Exam AZ-104: Microsoft Azure Administrator – Skills Measured

4- Whizlab

5- Udemy

6- Quora AZ 104

Azure Breaking News – Azure Certifications Testimonials

Error Setting Sqlserver Auditing Logs (Powershell)
by /u/d3fnotarandomnam3 (Microsoft Azure) on May 19, 2022 at 7:43 am
Set-AzContext -Subscription "subscription01" $server = Get-AzSqlServer -ResourceGroupName. "Resourcegroup-01" -ServerName "servername-01"| Select-Object ServerName,ResourceGroupName Set-AzSQLServerAudit -ResourceGroupName $server.ResourceGroupName -ServerName $server.ServerName -AuditActionGroup "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP", "FAILED_DATABASE_AUTHENTICATION_GROUP", "SUCCESSFUL_LOGIN_GROUP", "FAILED_LOGIN_GROUP", "DATABASE_PRINCIPAL_CHANGE_GROUP", "SERVER_PRINCIPAL_CHANGE_GROUP" The error message: Set-AzSqlServerAudit : Cannot bind parameter 'AuditActionGroup'. Cannot convert value "SUCCESSFUL_LOGIN_GROUP" to type "Microsoft.Azure.Commands.Sql.Auditing.Model.AuditActionGroups". Error: "Unable to match the identifier name SUCCESSFUL_LOGIN_GROUP to a valid enumerator name. Specify one of the following enumerator names and try again: BATCH_STARTED_GROUP, BATCH_COMPLETED_GROUP, APPLICATION_ROLE_CHANGE_PASSWORD_GROUP, BACKUP_RESTORE_GROUP, DATABASE_LOGOUT_GROUP, DATABASE_OBJECT_CHANGE_GROUP, DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP, DATABASE_OBJECT_PERMISSION_CHANGE_GROUP, DATABASE_OPERATION_GROUP, DATABASE_PERMISSION_CHANGE_GROUP, DATABASE_PRINCIPAL_CHANGE_GROUP, DATABASE_PRINCIPAL_IMPERSONATION_GROUP, DATABASE_ROLE_MEMBER_CHANGE_GROUP, FAILED_DATABASE_AUTHENTICATION_GROUP, SCHEMA_OBJECT_ACCESS_GROUP, SCHEMA_OBJECT_CHANGE_GROUP, SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP, SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP, SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP, USER_CHANGE_PASSWORD_GROUP, LEDGER_OPERATION_GROUP, DBCC_GROUP, DATABASE_OWNERSHIP_CHANGE_GROUP, DATABASE_CHANGE_GROUP" If you notice the successful login group is part of the allowed values. submitted by /u/d3fnotarandomnam3 [link] [comments]
Quota delays?
by /u/yellowplantain (Microsoft Azure) on May 19, 2022 at 2:30 am
Is anyone else having problems getting quota from Azure? I've been trying for two months now to get a few hundred low priority cores, and I'm making absolutely no progress with the support request, just being bounced around from broken forms to broken process to follow, with two weeks latency between their responses. I first tried to start some instances - no quota, so I go to the Quota page and request it. After following up twice, a month later they respond to tell me to fill out a different ticket template, and link to that template on a dev.azure.com address that it says I don't have permission to view. They escalate it again and now a month later tell me I need to switch to Invoice Billing. I follow the steps for invoice billing, but the button to actually request it is just... not there. Can you just let me give you money Azure? Please? Is this just happening to me or everyone? submitted by /u/yellowplantain [link] [comments]
3rd Party VPNs with Virtual WAN
by /u/pedrotheterror (Microsoft Azure) on May 19, 2022 at 1:51 am
So we have a vWAN deployed, with multiple vHUBs. These are not secured vHUBs, but we do have Azure FWs deployed in VNETs peered to the vHUBs which we use for outbound Internet access. Now we need to provide for a 3rd Party VPN to access some of our resources. I do not want to terminate this into our exiting vHub as then then would have access to all of our resources. So, I want to terminate them into a dedicated VPNG sitting behind an AFW. But, I am running into some snags. I do not see how to advertise routes that the VNET learned from the vHub to the VPN endpoint. We could turn the vHub into a secured vHub, but the issue with that is that I do not see a Terraform provider to do that, and I am not 100% confident we can do that without destroying the existing infrastructure. The other option I guess is to create a separate secured vHub for this, but see the note above about no TF provider for it (though I could use the azAPI provider). Anyone have any insight or pointers they can send my way? submitted by /u/pedrotheterror [link] [comments]
Azure App Service deployment question
by /u/ihorbond (Microsoft Azure) on May 19, 2022 at 12:37 am
I've described everything here https://stackoverflow.com/questions/72297391/azure-app-service-deployment-fails-when-referenced-by-azure-function but I will give a short description: I have a solution that contains 2 projects: functions and web API. Functions project references web API, one way. Functions deploy fine but web API deployment fails. I don't understand why? It doesn't reference functions project. submitted by /u/ihorbond [link] [comments]
Best way to transfer data from an Azure Storage Blob to a Azure File Share
by /u/noscpal (Microsoft Azure) on May 19, 2022 at 12:10 am
Hey All, As the title suggests looking at the best way to make this happen, i have roughly 2.6tb in a blob that i would like to migrate to some Azure file shares. regards submitted by /u/noscpal [link] [comments]
How can I fix this Cisco Anyconnect Azure SAML CSRF Token error?
by /u/TheHungryNetworker (Microsoft Azure) on May 18, 2022 at 11:20 pm
submitted by /u/TheHungryNetworker [link] [comments]
Getting AD groups synced into AAD to use for a few things
by /u/Ok-Examination3168 (Microsoft Azure) on May 18, 2022 at 11:11 pm
Sup team, running into some issues on a current project. Have a work around in place so I'm not at a deadline but would love some insights. We've got an AD sync to AAD, and use Okta as our idp. We have a ton of security groups for license provisioning through okta - all dandy. I've been tasked with making some permission sets in Power BI from Active directory. So the ideal end result would be Active Directory security groups for powerBI license prov, specific sharepoint access, and data set in PowerBI access. There will be a few different groups with different outcomes. Currently I've manually made AAD groups for the PowerBI, SharePoint stuffs. Wondering if I can drive allllll of it from Active Directory for ease of use. Is this possible? Am I an idiot? Ideally yes to both. submitted by /u/Ok-Examination3168 [link] [comments]
Azure AD Security defaults for all users to 2FA at login
by /u/mattzacamber (Microsoft Azure) on May 18, 2022 at 10:53 pm
We have Security defaults enabled on our tenant. I expect all users to register for 2FA. Admins to be forced to 2FA. We find all users are asked to 2FA at login. Audit logs show reason is 'security defaults' Azure does state it will also trigger 'when necessary' 'One common method to improve protection for all users is to require a stronger form of account verification, such as Multi-Factor Authentication, for everyone. After users complete Multi-Factor Authentication registration, they'll be prompted for another authentication whenever necessary. Azure AD decides when a user will be prompted for Multi-Factor Authentication, based on factors such as location, device, role and task. This functionality protects all applications registered with Azure AD including SaaS applications. ' Seems to apply to all users at any portal (portal,devops,office). Didn't expect defaults to enforce 2FA for everyone. Is this expected behaviour now? Is it just enforced for everyone? submitted by /u/mattzacamber [link] [comments]
Increase the expiration period of Graph Api access token
by /u/Pristine-Month-8944 (Microsoft Azure) on May 18, 2022 at 10:29 pm
Using the app only approach of creating access token using msal for Graph API. It expires in about an hour usually. Can I increase it anyway? If not, can I check if the token is valid currently etc. For context I'll be creating and using the token in Python code. I need to make many API calls, so which is the best approach to make sure unnecessary tokens aren't created? Also, looked into refresh token, it's only for user credential flow, I'm using the app only approach. submitted by /u/Pristine-Month-8944 [link] [comments]
Where to get key vault connection key for logic apps?
by /u/prinkpan (Microsoft Azure) on May 18, 2022 at 10:06 pm
When we add a Get secret action in logic app it creates a connection with the key vault in Azure and generates a connection key which is then stored in local.settings.json file shown below. How is it generated? { "IsEncrypted": false, "Values": { "AzureWebJobsStorage": "UseDevelopmentStorage=true", "FUNCTIONS_WORKER_RUNTIME": "node", "WORKFLOWS_TENANT_ID": "<tenant-id>", "WORKFLOWS_SUBSCRIPTION_ID": "<subscription-id>", "WORKFLOWS_RESOURCE_GROUP_NAME": "<resource-group-name>", "WORKFLOWS_LOCATION_NAME": "westus2", "WORKFLOWS_MANAGEMENT_BASE_URI": "https://management.azure.com/", "keyvault-connectionKey": "eyJ0eXAiOiJKV1QiLCJhbGciO..." <-- How is this key generated? } } submitted by /u/prinkpan [link] [comments]
How to initiate VNET peering from one side, complete from the other side later on
by /u/0x4ddd (Microsoft Azure) on May 18, 2022 at 9:50 pm
My case is: dedicated team is managing hub virtual network developer teams can can create their own vnets Most likely developers would like to use ARM/Bicep/Terraform/whatever templates to automate their deployments. What I have thought about is that they could create peering to the hub from their side and then someone from the networking team can complete peering from the Hub side. However, when I did simple test on my subscription, I have been able to initiate peering from application side. It appeared with the "Initiated" state on the peerings list for my VNET with the message above - "At least one peering is in an initiated state. Navigate to the peer virtual network to complete the initiation. " Now I have thought I just would need to go to my hub virtual network and somewhere there I would see there is a peering request pending. However, I do not see any information on the Hub network side. Moreover, using Azure Portal I cannot create "one-way" peering, so in this case I cannot just create peering from Hub to App. Portal requires to create two-way peering while there is already existing Initiated peering from App to Hub. Is there any way to complete peering using Azure Portal from the Hub side, after application side initiated peering? Or maybe there is no other way than completing this using Azure CLI or any IaC tool? submitted by /u/0x4ddd [link] [comments]
azure front door + application gateway
by /u/Tmmcwm (Microsoft Azure) on May 18, 2022 at 9:05 pm
Hi everyone, Playing around with application gateway and front door. So far my config is app gateway with an internal ase ilb (wildcard domain) and this works fine. But I want to put front door in front so I can make things a little more redundant. So I've configured the front door with my app gateways public ip as the backend and re assigned my custom domain to the front door and stuck everything in forward mode. When I hit that custom domain it just immediately hits a not found page. I'm confused as to why this wouldn't work. Anyone configured a similar thing before? submitted by /u/Tmmcwm [link] [comments]
How can I add a IoT Hub in Azure into a VNet
by /u/sjimenez46 (Microsoft Azure) on May 18, 2022 at 8:14 pm
I see that is possible to use a private link to generate a static IP in the same VNet but I cant figure out how to provisioning an IoT Edge using Eflow to connect with the IoT Hub if I disable the public address. In the connection string is possible to change the public hostname with the static IP assigned yo IoT Hub in the VNet? Thanks in advance submitted by /u/sjimenez46 [link] [comments]
HTTP Logic App
by /u/dj_avi (Microsoft Azure) on May 18, 2022 at 8:14 pm
I'm trying to create a logic app with http GET. It can get a site code status of 200 when the site is running fine. If the site is attacked or the web service is down, it can't pull the GET request, so I the actions won't run. Is there way I can make it do that (When site is down). submitted by /u/dj_avi [link] [comments]
Best way to Automate setup for New Employees
by /u/Mortamus978 (Microsoft Azure) on May 18, 2022 at 7:25 pm
Hey Everyone, So we've just moved one of our companies to Azure AD, moving them away from on-premises AD. I want to know what the best way to "automate" setting up new hires for the company. What I've been doing in the past may make you cringe, so bear with me. Get laptop Install Fresh 21H2 on it w/ USB Go through OOBE Add machine to Azure AD Sign into their Azure AD account Have to add their account to my authenticator (We require 2FA) Install all the software and ready the PC for the employee Remove myself from their 2FA in Azure settings, send re-register Ship it to the user, or set it up in the corp office. Now, as you can see it's not the most efficient way of doing things. I'm looking for some advice on a few things. Avoiding adding myself as a 2FA on their account for the setup... is there a way to avoid that for first sign on or something? What would be the best way to prep these new machines for users? I wonder if it's possible to create a "golden image" for all the stuff they need, then apply it to the machine with their Azure AD account linked. Sorry if any of that is poorly explained. I'm mostly helpdesk / network infrastructure... this is my first time taking on a project that I would consider sysadmin-y. Thanks! submitted by /u/Mortamus978 [link] [comments]
Hybrid Azure AD join windows 10 or later
by /u/VirtualCHi (Microsoft Azure) on May 18, 2022 at 7:10 pm
Hi We are planning an pilot for hybrid Azure AD joined windows 10 computers. Do I need to use the Intune connector for active directory? For example in this article, the setup is not using Intune connector. In this other article, is using group policy for auto enrollment. Please shed some light, I am a bit confused, which is the best method. My environment is Hybrid, on-premise AD sycning to Azure AD. submitted by /u/VirtualCHi [link] [comments]
Received an offer from Microsoft. Faced with an interesting choice.
by /u/ThrowAwayTheSys (Microsoft Azure) on May 18, 2022 at 7:06 pm
Greetings, This is a throwaway for obvious reasons, my co-workers may read this, and I'd like some degree of anonymity. I'm currently in a Sysadmin role at a company and I'm doing pretty well for myself there. I make 86k per year with a yearly 10% bonus. I've made great connections and fostered even better relationships since I started here almost 10 months ago. Overall, I'm pretty happy with what I'm doing. I get to focus heavily on Powershell automation and coming up with creative solutions to solve the technical debt in my department. We underwent quite a bit of structural changes within the company & my department effectively was cut in half. We've been playing catch up and are finally rediscovering our footing and bringing on new talent. Now we have some interesting things coming down the pipeline, such as a full lift and shift to Azure, which is fairly exciting as that's the direction I want to take in my career. Got my AZ900 + AZ104. Want to get the AZ305 and work my way up to becoming a Azure Solutions Architect. Queue me recently getting a call out of the blue from a recruiter and I landed an interview for freaking Microsoft for an Azure AD Support Engineering role. I just received my offer letter. $49.00 per hour on a long term contract to hire role with benefits. The FTE conversion is an automatic bump to 115k + stock options, a sign on bonus, and pretty ridiculous benefits, which is needless to say, very attractive. Assuming I can really shine in this role and actually land the FTE position. I received a counter offer from my company for a bump to 95k + a 10k retention bonus + my 10% performance bonus paid up front. It seems like an ok counter offer, I could probably try and peg them for more, but I'm thinking the right move here is to go with Microsoft. I can't seem to find much information out there on what it's like to work in that role on the Azure team, but from the interviews & people I've talked to, the opportunity for growth is unparalleled if you're hungry enough. I'm curious to hear what you fine folks have to say. What would you do in this position? And if there are any Microsoft engineers lurking this sub, would love to hear what your experience working for the giant is like. Much appreciate anyone's feedback! submitted by /u/ThrowAwayTheSys [link] [comments]
Azure Dashboard for pipeline
by /u/Ughdontlookatmyname (Microsoft Azure) on May 18, 2022 at 6:44 pm
Is there any wizard that could give details on the total number of builds/release- filtered for a(/multiple) pipeline. I can achieve this from Analytics View for specific pipeline but I want to get these details on dashboard and for multiple pipelines. submitted by /u/Ughdontlookatmyname [link] [comments]
How Azure Certificate helped you in growing career?
by /u/licedey (Microsoft Azure Certifications) on May 18, 2022 at 6:18 pm
You may know me as an author of Learn Azure project. I am working on this project during last 1.5 years. The idea was born from my own needs. When I prepared for AZ-900, then a lot of time I had to be outside my desk. So, I prepared through phone using Whizzlabs and it was inconvenient that time. I decided to develop mobile app that will close this need. As download statistics says, I am not the only one who has interest in such app. Since release of v1.0 there are 50k downloads of the app for iOS/Android together. And all that time I didn't ask users of how Azure certification are helps them in growing their career. As Microsoft's certification ad says that there may be such benefits compared to peers w/o certificate: Salary increase Receive a raise or promotion Skills and quality of their work improve Is it truth? I raise this discussion to understand of how the specific Azure certificate helped you on job seeking or current job. And then, will focus on what is really needed for IT-specialists that has desire to become Azure certified. submitted by /u/licedey [link] [comments]
Moving Local ML Experiments to Cloud with Terraform Plugin - Tutorial
by /u/thumbsdrivesmecrazy (Microsoft Azure) on May 18, 2022 at 6:00 pm
In this tutorial, you can learn how to move a local machine learning experiment to a remote cloud machine with the help of Terraform Provider Iterative (TPI): Moving Local Experiments to the Cloud with Terraform Provider Iterative (TPI) submitted by /u/thumbsdrivesmecrazy [link] [comments]

AZ104 Exam Prep on ios – AZ104 Exam Prep on android
AZ104 Exam Prep on windows 10/11 – AZ104 Exam Prep on web

A Twitter List by enoumen

Tag: Create and configure containers

Microsoft Azure Administrator Certification Questions and Answers Dumps – AZ 104

Microsoft Certified: Azure Administrator Associate Average Salary — $125,993

AZ-104 Microsoft Azure Administrator Exam Breakdown:

Below are the top 50 Microsoft Azure Administrator Certification Questions and Answers Dumps.

Azure Administrator Exam Prep App #Azure #AZ104 #AzureAdmnistrator #AzureDevOps #AzureAdmin #AzureTraining #AzureSysAdmin #AzureCloud #LearnAzure

Microsoft Azure Administrator Certification Q&A:

What does az vmss deallocate do?

A company is planning to use Azure for the various services they offer. They want to ensure that they can bill each department for the resources they consume. They decide to use Azure resource tags to separate the bills department wise. Would this fulfill the requirement?

A company is planning to use Azure for the various services they offer. They want to ensure that they can bill each department for the resources they consume. They decide to use Azure rolebased access control to separate the bills department wise. Would this fulfill the requirement?

A company is planning to use Azure for the various services they offer. They want to ensure that they can bill each department for the resources they consume. They decide to use Azure policies to separate the bills department wise. Would this fulfill the requirement?

A company is planning to use the Azure Import/Export service to move data out of its Azure Storage account. Which of the following service could be used when defining the Azure Export job?

Suppose you have an application running on a windows virtual machine in azure. what is the best-practice guidance on where the app should store data files?

Sources/References:

Azure Breaking News – Azure Certifications Testimonials