You have an Azure subscription named Subscription1.
In Subscription1, you create an Azure file share named share1.
You create a shared access signature (SAS) named SAS1 as shown in the following exhibit.

To answer, select the appropriate options in the answer area.
NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:

This question tests your understanding of Shared Access Signatures (SAS) in Azure Storage and how SAS permissions, IP restrictions, and expiry times control access.
The exhibit shows a Service SAS generated for Azure Storage with the following key parameters:
Allowed services: Blob, File, Queue, Table
Allowed resource types: Service, Container, Object
Allowed permissions: Read, Write, Delete, List, Add, Create
Start time: September 1, 2018, 2:00 PM
Expiry time: September 14, 2018, 2:00 PM
Allowed IP range: 193.77.134.10 - 193.77.134.50
Allowed protocols: HTTPS only
Scenario 1:
Date: September 2, 2018
Client IP: 193.77.134.1
The start and expiry times are valid (the SAS is active on September 2), but the IP address 193.77.134.1 is outside the allowed range (193.77.134.10-193.77.134.50).
Azure Storage enforces IP restrictions strictly - clients must connect from an IP address within the specified range. Any request from outside that range results in authentication failure.
# Correct Result: The client will have no access to the storage account using SAS1.
Scenario 2:
Date: September 10, 2018
Client IP: 193.77.134.50
In this case:
The SAS is still valid (Sept 10 is between the start and expiry dates).
The IP address 193.77.134.50 is within the allowed range.
The protocol used must be HTTPS, and the exhibit shows that HTTPS only is enabled.
Therefore, a client connecting with SAS1 over HTTPS will have the permissions defined in the SAS token:
Read, Write, and List (and other permissions such as Add and Create).
Since the question limits the choice to the relevant permissions for access, the correct selection is "will have read, write, and list access."
# Correct Result: The client will have read, write, and list access.
Microsoft Azure Administrator Documentation Reference:
"Shared Access Signatures (SAS) provide delegated access to storage resources with fine-grained control over permissions, IP address ranges, start/expiry time, and protocols. Requests made outside the specified IP range or time window are denied." (Source: Microsoft Learn - Secure access to Azure Storage with shared access signatures, AZ-104 Exam Guide)
# Final Verified Answers:
Scenario
Date
IP Address
Result
1
Sept 2, 2018
193.77.134.1
Will have no access
2
Sept 10, 2018
193.77.134.50
Will have read, write, and list access

Comment: *

Name: *

Email: *

Verification: *

You have an Azure subscription that contains the resource groups shown in the following table.

RG1 contains the resources shown in the following table.

RG2 contains the resources shown in the following table.

You need to identify which resources you can move from RG1 to RG2, and which resources you can move from RG2 to RG1.
Which resources should you identify? To answer, select the appropriate options in the answer area.

Correct Answer:

Reference:
https://docs.microsoft.com/en-us/azure/governance/blueprints/concepts/resource-locking

Comment: *

Name: *

Email: *

Verification: *

You have an Azure subscription that includes data in following locations:

You plan to export data by using Azure import/export job named Export1.
You need to identify the data that can be exported by using Export1.
Which data should you identify?

• A.DB1
• B.Table1
• C.container1
• D.Share1

Correct Answer: D

Explanation
Azure Import/Export service is used to securely import large amounts of data to Azure Blob storage.
Only the Blob service is supported with the Export job feature

References:
https://docs.microsoft.com/en-us/azure/storage/common/storage-import-export-requirements

Comment: *

Name: *

Email: *

Verification: *

You have an Azure subscription that contains a user account named User1.
You need to ensure that User1 can assign a policy to the tenant root management group.
What should you do?

• A.Assign the Global administrator role to User1, and then modify the default conditional access policies.
• B.Assign the Owner role to User1. and then modify the default conditional access policies.
• C.Assign the Owner role to User1. and then instruct User1 to configure access management for Azure resources.
• D.Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources.

Comment: *

Name: *

Email: *

Verification: *

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups.
Another administrator plans to create several network security groups (NSGs) in the subscription.
You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks.
Solution: From the Resource providers blade, you unregister the Microsoft.ClassicNetwork provider.
Does this meet the goal?

• A.Yes
• B.No

Comment: *

Name: *

Email: *

Verification: *