AZ-104 Exam Dumps - Microsoft Azure Administrator Associate Questions and Answers

< ✅ Properties

✅ Authentication methods

Self-service password reset (SSPR) in Microsoft Entra ID (formerly Azure Active Directory) is configured from the Password reset blade in the Azure portal. Microsoft Entra ID P1 includes full support for SSPR for cloud users, including the ability to configure registration and authentication requirements.

To enable SSPR for all users, Microsoft documentation specifies that administrators must configure the Properties setting. From the Password reset → Properties page, you select who can use SSPR. The available options are None, Selected, or All. Setting this option to All enables self-service password reset for every user in the tenant. This setting controls who is allowed to use SSPR, not how they authenticate.

To require users to answer four questions when registering for SSPR, Microsoft Entra ID uses the Authentication methods setting. According to the Azure Administrator study guide, this section allows administrators to define:

Which authentication methods are available (email, mobile app, phone, security questions)

How many methods are required to reset a password

How many security questions users must answer during registration

Under Authentication methods → Security questions, you can configure the number of questions required for registration and number required to reset, including setting the registration requirement to four questions, exactly matching the scenario.

Other options shown in the blade (such as Administrator Policy or Usage & insights) do not control user enablement or question requirements and therefore do not meet the stated goals.

Box 1 = max value

Box 2 = 20

Explanation

Use max for platformFaultDomainCount

2 or 3 is max value, depending on which region you are in.

Use 20 for platformUpdateDomainCount

Increasing the update domain (platformUpdateDomainCount) helps with capacity and availability planning when the platform reboots nodes. A higher number for the pool (20 is max) means that fewer of their nodes in any given availability set would be rebooted at once.

Box 1: N

Because doesn ' t have:

Microsoft.Authorization/*/Write - Create roles, role assignments, policy assignments, policy definitions and policy set definitions

Box 2; Yes

Has been assigned;

Microsoft.Compute/virtualMachines/* - Perform all virtual machine actions including create, update, delete, start, restart, and power off virtual machines. Execute scripts on virtual machines.

Box 3: Y

Has been assigned;

Microsoft.Network/networkInterfaces/* - Create and manage network interfaces

See;

https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

The deployment order must follow Azure Resource Manager dependency requirements. A virtual machine depends on a network interface, because the VM configuration references the NIC as its network profile. Microsoft’s ARM template dependency guidance explains that Resource Manager evaluates dependencies between resources and deploys resources in dependency order; resources without dependencies can deploy in parallel. Microsoft also gives the VM example directly: a virtual machine cannot be created until the network interface exists.

The network interface must be created after the virtual network and public IP address because the NIC IP configuration references a subnet in VNet1 and can reference PIP1 for public connectivity. Microsoft’s VM ARM template documentation states that dependencies can chain through resources and specifically notes that the network interface depends on the public IP address and virtual network resources.

Therefore, VNet1 and PIP1 must come before NIC1 , and NIC1 must come before VM1 . Since VNet1 and PIP1 are independent of each other, either can be deployed first. A valid sequence is VNet1 → PIP1 → NIC1 → VM1 . Study Guide reference: AZ-104 Deploy and manage Azure compute resources , including deploying Azure VMs and automating deployments with ARM templates.

A Recovery Services vault is a logical container that stores the backup data for each protected resource, such as Azure VMs. When the backup job for a protected resource runs, it creates a recovery point inside the Recovery Services vault.

Scenario:

There are three application tiers, each with five virtual machines.

Move all the virtual machines for App1 to Azure.

Ensure that all the virtual machines for App1 are protected by backups.

When collecting Windows Event Logs using the Azure Monitor Agent (AMA) with a Data Collection Rule (DCR), filtering is done at the source using XPath queries. XPath is specifically designed for querying XML-based event log entries, including filtering by Event ID, Event Level, and Event Source.

According to Azure Monitor documentation, Windows Event Log data sources require XPath expressions, not SQL or KQL. KQL is used after ingestion for querying data in Log Analytics, while XPath determines which events are collected in the first place.

Since the requirement is to collect only system events with Event ID 1001, the correct query type for the DCR data source is XPath.

Final Answer: C. XPath

You can provide authorization credentials by using Azure Active Directory (AD), or by using a Shared Access Signature (SAS) token.

Box 1:

Both Azure Active Directory (AD) and Shared Access Signature (SAS) token are supported for Blob storage.

Box 2:

Only Shared Access Signature (SAS) token is supported for File storage.

Line of Business WebAPP works on VMs need internal load balancer. So D is needed. Then deploy WebAPP on VMs, check the link. https://docs.microsoft.com/en-us/azure/application-gateway/quick-create-portal So B is needed as well. The orignal answer is not accomplished.

Active Directory Federation Services is a feature and web service in the Windows Server Operating System that allows sharing of identity information outside a company’s network.

Scenario: Technical Requirements include:

Prevent user passwords or hashes of passwords from being stored in Azure.