You have an Azure subscription. The subscription contains a virtual machine that runs Windows 10.
You need to join the virtual machine to an Active Directory domain.
How should you complete the Azure Resource Manager (ARM) template? To answer, select the appropriate options in the answer area.
NOTE Each correct selection is worth one point.

Correct Answer:

Explanation:

In Azure, to automate domain join operations for virtual machines through an Azure Resource Manager (ARM) template, you must configure the JsonADDomainExtension-a VM extension provided by Microsoft.
This extension allows a Windows virtual machine to be automatically joined to an Active Directory domain after deployment.
According to the Microsoft Azure documentation ( " JsonADDomainExtension for Windows " ), the extension must be defined under the Microsoft.Compute/virtualMachines/extensions resource type, because it is a child resource of a specific VM. This structure allows Azure to attach and configure the extension directly to the virtual machine during or after deployment.
The correct syntax within the ARM template must include:
* Type: " Microsoft.Compute/virtualMachines/extensions " # Specifies the extension resource type.
* Publisher: " Microsoft.Compute " # Specifies the vendor of the extension.
* Type: " JsonADDomainExtension " # Specifies the type of extension.
* ProtectedSettings: used to securely store sensitive information like domain passwords (encrypted automatically by Azure).
The ProtectedSettings section ensures credentials such as the domain password remain confidential, while Settings contain non-sensitive configuration parameters (domain name, username, etc.).
This configuration ensures the VM automatically joins the target domain securely upon creation.
# Final Verified Answer:
* Type: " Microsoft.Compute/virtualMachines/extensions "
* ProtectedSettings: " ProtectedSettings "

Comment: *

Name: *

Email: *

Verification: *

You have an Azure subscription linked to a hybrid Microsoft Entra tenant. The tenant contains the users shown in the following table.

You create the Azure Files shares shown in the following table.

You configure identity-based access for contoso2024 as shown in the following exhibit.



For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Correct Answer:

Explanation:

This question examines your understanding of Azure Files identity-based authentication and Active Directory integration for Azure file shares.
Let's analyze it step by step using official Microsoft Azure Administrator (AZ-104) documentation concepts.
1. Azure Files Identity-Based Access Overview
Azure Files supports identity-based authentication and authorization through:
On-premises Active Directory Domain Services (AD DS)
Azure Active Directory Domain Services (Azure AD DS)
Azure AD Kerberos (hybrid identities required)
Important Note (Microsoft Docs):
"Azure Active Directory (Azure AD) is not a domain controller. Azure AD-only accounts are not supported for SMB access to Azure file shares." This means Azure AD cloud-only users (not hybrid) cannot access SMB file shares using identity-based access.
2. Identity Sync (Hybrid Setup)
User
On-premises Sync Enabled
User1
No
User2
Yes
User1 is a cloud-only user (not hybrid).
# Cannot authenticate using SMB to an Azure Files share because only users synchronized from on-premises AD (hybrid users) are supported.
User2 is synchronized from on-premises AD (hybrid).
# Can authenticate using SMB and access identity-based file shares integrated with AD DS.
3. Storage Account Configuration
Share
Storage Account
share1
contoso2024
share2
contoso2024
share3
contoso2025
contoso2024
Configured with Active Directory (AD DS) integration (see exhibit).
Default share-level permissions are enabled for all authenticated users and groups with the Storage File Data SMB Share Contributor role.
# This means any authenticated domain user (hybrid) has access.
contoso2025
No indication of AD DS configuration in the scenario.
Hence, it is not configured for identity-based access.
4. Step-by-Step Validation
# User1 and share1 (contoso2024)
User1 is not hybrid (no on-prem sync).
SMB authentication requires Kerberos via domain-joined identity.
Result: # Cannot access share1.
# User2 and share2 (contoso2024)
User2 is hybrid (on-prem sync enabled).
contoso2024 supports AD DS integration and allows authenticated domain users.
Result: # Can access share2.
# User2 and share3 (contoso2025)
contoso2025 is not configured for AD DS integration.
Without AD DS/AD DS Kerberos setup, SMB access using identity is not possible.
Result: # Cannot access share3.
Official Microsoft Extract (from Azure Files identity-based authentication guide):
"Azure file shares only support SMB access for users and devices that are authenticated by an Active Directory domain controller.
Azure AD-only users are not supported.
You must have hybrid identities synchronized from Active Directory using Azure AD Connect."
"If identity-based access is enabled, all domain-joined and authenticated users with assigned roles (such as Storage File Data SMB Share Contributor) can access file shares."

Comment: *

Name: *

Email: *

Verification: *

You have an on-premises network.
You have an Azure subscription that contains two virtual networks named VNet1 and VNet2. VNet1 uses an IP address space of 192.168.8.0/24. VNet2 uses an IP address space of 192.168.9.0/24.
You need to configure the virtual networks. The solution must meet the following requirements:
* Ensure that the resources on VNet1 can communicate with the resources on VNet2.
* Ensure that the resources on the on-premises network can communicate with Azure resources.
* Minimize costs.

Correct Answer:

Explanation:

To allow VNet1 (192.168.8.0/24) and VNet2 (192.168.9.0/24) to communicate, the lowest-overhead Azure- native option is virtual network peering. Azure documentation describes VNet peering as a way to connect two VNets so that resources can communicate using private IP addresses as if they were on the same network.
Because the address spaces do not overlap, peering is supported and does not require deploying extra appliances. This also minimizes administrative effort compared to routing through gateways or NVAs.
For on-premises to Azure connectivity while minimizing cost, the appropriate service is an Azure VPN Gateway with a site-to-site (S2S) VPN. Azure's guidance for hybrid connectivity positions VPN Gateway as the cost-effective encrypted tunnel over the public internet for connecting on-premises networks to Azure VNets. The alternative shown, ExpressRoute, provides private dedicated connectivity but is designed for higher throughput/enterprise requirements and generally increases cost due to circuit provisioning and associated charges. Therefore, combining VNet peering (VNet-to-VNet) with VPN Gateway (on-prem-to- Azure) satisfies both communication requirements and the cost constraint.

Comment: *

Name: *

Email: *

Verification: *

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.
After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.
You have an Azure virtual machine named VM1 that runs Windows Server 2016.
You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour.
Solution: You create an Azure Log Analytics workspace and configure the Agent configuration settings. You install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source.
Does this meet the goal?

• A.Yes
• B.No

Comment: *

Name: *

Email: *

Verification: *

You have an Azure subscription that contains a virtual machine named VM1. VM1 hosts a line-of- business application that is available 24 hours a day. VM1 has one network interface and one managed disk. VM1 uses the D4s v3 size.
You plan to make the following changes to VM1:
- Change the size to D8s v3.
- Add a 500-GB managed disk.
- Add the Puppet Agent extension.
- Enable Desired State Configuration Management.
Which change will cause downtime for VM1?

• A.Enable Desired State Configuration Management
• B.Add a 500-GB managed disk
• C.Change the size to D8s v3
• D.Add the Puppet Agent extension

Comment: *

Name: *

Email: *

Verification: *