Free Microsoft AZ-104 Exam Dumps Questions & Answers

You plan to use Azure Network Watcher to perform the following tasks:
Task1: Identify a security rule that prevents a network packet from reaching an Azure virtual machine Task2: Validate outbound connectivity from an Azure virtual machine to an external host Which feature should you use for each task? To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:
Detailed Explanation
IP flow verify tests a specific 5-tuple (source/destination IP, port, protocol, direction) against the effective NSG rules applied to a VM ' s NIC and returns whether the packet is allowed or denied and, critically, names the exact security rule responsible for that outcome - which is exactly what Task1 requires. Connection troubleshoot performs a one-time, active, end-to-end connectivity test from a VM to a destination (another Azure resource or an arbitrary external host/URI) and reports latency, hop-by-hop path, and any failure point, making it the correct tool to validate outbound connectivity for Task2. Next hop only shows the routing path a packet takes, not whether it is blocked, and does not test outbound reachability. NSG flow logs and Traffic Analytics provide historical allow/deny metadata and trend analysis rather than an active, on-demand connectivity test.
Official Reference
Azure Network Watcher overview - https://learn.microsoft.com/en-us/azure/network-watcher/network- watcher-monitoring-overview

You have an Azure subscription that contains an Azure Storage account.
You plan to create an Azure container instance named container1 that will use a Docker image namedImage1.
Image1 contains a Microsoft SQL Server instance that requires persistent storage.
You need to configure a storage service for Container1.
What should you use?

• A.Azure Queue storage
• B.Azure Table storage
• C.Azure Blob storage
• D.Azure Files

You need to meet the technical requirement for VM4.
What should you create and configure?

• A.an Azure Event Hub
• B.an Azure Logic App
• C.an Azure Notification Hub
• D.an Azure services Bus

You have an Azure subscription named Subscription1. Subscription1 contains a virtual machine named VM1.
You install and configure a web server and a DNS server on VM1.
VM1 has the effective network security rules shown in the following exhibit.
Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.
NOTE: Each correct selection is worth one point.

Exhibit

Exhibit

Correct Answer:

Explanation:
Detailed Explanation
NSG rules are evaluated in ascending priority order and processing stops at the first match. Rule2 (priority
100, deny ports 50-60) is evaluated before Rule1 (priority 400, allow ports 50-500), and DNS (port 53) falls inside the narrower 50-60 range, so DNS traffic is denied by Rule2 before it can ever reach Rule1 ' s broader allow. Web traffic (ports 80 and 443) falls outside the 50-60 deny range but inside Rule1 ' s 50-500 allow range, so it is permitted - meaning Internet users can currently reach only the web server, not the DNS server. If Rule2 is deleted, port 53 traffic no longer hits any deny rule and instead falls through to Rule1 ' s 50-
500 allow range along with the web ports, so after the deletion Internet users could reach both the web server and the DNS server. Both selections match the source document ' s answer key.
Official Reference
Network security group rule processing order - https://learn.microsoft.com/en-us/azure/virtual-network
/network-security-groups-overview

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You manage a virtual network named VNet1 that is hosted in the West US Azure region.
VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.
You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.
Solution: From Azure Monitor, you create a metric on Network in and Network Out.
Does this meet the goal?

• A.Yes
• B.No