Quiz
AZ-103
Create a free account to finish this quiz
Save your progress and see your final score.
Already have an account? Sign in
Questions in this quiz (100)
1Your team, the cloud administration team, is creating custom Azure roles as part of a role-based access implementation in Microsoft Azure. One of the other administrators is tasked with creating a custom role based on the Contributor built-in role. The only difference will be that the custom role will not be able to create new VMs.
The other administrator creates a role named Role1. During Role1 testing, a new VM could be created under the new role. You use the Get-AzRoleDefinition cmdlet to view details of the role, and you find the following configuration:
Actions : {*}
NotActions : {}
AssignableScopes: {/}
You need to update the configuration, while minimizing administrative overhead, to ensure that it meets the requirements. What should you do?- ARecreate the role
- BUpdate the Actions value
- CUpdate the NotActions value
- DUpdate the AssignableScopes value
2You would like to add a user who has a Microsoft account to your subscription. Which type of user account is this?
- ACloud Identity
- BDirectory-Synchronized
- CProvider Identity
- DGuest User
- EHosted Identity
3You have created a new group called Managers. You would like any user account that has the name Manager in their Job Title to be placed in the new Manager group. Which of the following do you need to implement?
- ADirectly assigned groups
- BDynamically assigned groups
- CRBAC assigned groups
- DTaxonomy assigned groups
- EAzure policy assigned group
4Your organization has a large number of users. The user data is currently in a SQL database. You would like to import the user data into Azure. What format should you use?
- ACSV
- BDBX
- CJSON
- DXML
5You need to target policies and review spend budgets across several subscriptions you manage. What should you do?
- ACreate resource groups
- BCreate management groups
- CCreate billing groups
- DCreate Azure policies
- EConsolidate subscriptions
6You have three virtual machines (VM1, VM2, and VM3) in a resource group. The Helpdesk hires a new employee. The new employee must be able to modify the settings on VM3, but not on VM1 and VM2. Your solution must minimize administrative overhead. What should you do?
- AAssign the user to the Contributor role on the resource group
- BAssign the user to the Contributor role on VM3
- CMove VM3 to a new resource group and assign the user to the Contributor role on VM3
- DAssign the user to the Contributor role on the resource group, then assign the user to the Owner role on VM3
7You would like to categorize resources and billing for different departments like IT and HR. The billing needs to be consolidated across multiple resource groups and you need to ensure everyone complies with the solution. What should you do? {Choose two to complete a solution}.
- ACreate tags for each department
- BCreate a billing group for each department
- CCreate an Azure policy
- DAdd the groups into a single resource group
- ECreate a subscription account rule
8Your organization is considering migrating workloads to Azure. You need to provide a cost estimation for the project. The estimate should include all areas of Azure including compute, networking, storage, web, and databases. You would like the estimate to be in your country's currency. What should you do?
- ACreate a free Azure subscription and use the Billing blade
- BEnter your workloads in the Pricing Calculator
- CReview the pricing page for each workload and create a spreadsheet of estimated costs
- DEnter your workloads in the Total Cost of Ownership Calculator
9Your company hires a new IT administrator. She needs to manage a resource group with first-tier web servers. However, she should not be able to control access to the resource group. Additionally, she should not have access to other resource groups. You need to configure role-based access. What should you do?
- AAssign her as a Subscription Owner
- BAssign her as a Subscription Contributor
- CAssign her as a Resource Group Owner
- DAssign her as a Resource Group Contributor
10Your company financial comptroller wants to be notified whenever you are half-way to spending the money allocated for cloud services. What should you do?
- ACreate a billing alert
- BCreate an Azure reservation
- CCreate a management group
- DCreate a monthly budget
11You work for an open source development company. You use Microsoft Azure for a variety of storage needs. Up to now, all the storage was used for internal purposes only. It is organized in block blobs. Each block blob is in its own container. Each container is set to default settings. In total, you have 50 block blobs. The company has decided to provide read access to the data in the block blobs, as part of releasing more information about their open source development efforts. You need to reconfigure the storage to meet the following requirements:
All block blobs must be readable by anonymous internet users.
You need to configure the storage to meet the requirements. What should you do?- ACreate a new container, move all the blobs to the new container, and then set the public access level to Blob.
- BSet the public access level to Blob on all the existing containers.
- CCreate a new shared access signature for the storage account and then set the allowed permissions to Read, set the allowed resource types to Object, and set the allowed services to Blob.
- DCreate a new access key for the storage account and then provide the connection string in the storage connectivity information to the public.
12Your company is planning to storage log data, crash dump files, and other diagnostic data for Azure VMs in Azure. The company has issued the following requirements for the storage:
Administrators must be able to browse to the data in File Explorer..
Access over SMB 3.0 must be supported.
The storage must support quotas.
You need to choose the storage type to meet the requirements. Which storage type should you use?- AAzure Files
- BTable storage
- CBlob storage
- DQueue storage
13Your company provides cloud software to audit administrative access in Microsoft Azure resources. The software logs all administrative actions (including all clicks and text input) to log files. The software is about to be released from beta and the company is concerned about storage performance. You need to deploy a storage solution for the log files to maximize performance. What should you do?
- ADeploy Azure Files using SMB 3.0.
- BDeploy Azure Table Storage.
- CDeploy Azure Queues Storage.
- DDeploy blob storage using block blobs.
- EDeploy blob storage using append blobs.
14Your company is building an app in Azure. The app has the following storage requirements:
Storage must be reachable programmatically through a REST API.
Storage must be globally redundant.
Storage must be accessible privately within the company's Azure environment.
Storage must be optimal for unstructured data.
Which type of Azure storage should you use for the app?- AAzure Data Lake store
- BAzure Table Storage
- CAzure Blob Storage
- DAzure File Storage
15You use a Microsoft Azure storage account for storing large numbers of video and audio files. You create containers to store each type of file and want to limit access to those files for specific periods. Additionally, the files can only be accessed through shared access signatures (SAS).
You need the ability to revoke access to the files and to change the period for which users can access the files. What should you do in order to accomplish this in the most simple and effective way?- ACreate an SAS for each user and delete the SAS when you want to prevent access.
- BUse Azure Rights Management Services (RMS) to control access to each file.
- CImplement stored access policies for each container to enable revocation of access or change of duration.
- DPeriodically regenerate the account key to control access to the files.
16You need to provide a contingent staff employee temporary read-only access to the contents of an Azure storage account container named media. It is important that you grant access while adhering to the security principle of least-privilege.
What should you do?- ASet the public access level to Container.
- BGenerate a shared access signature (SAS) token for the container.
- CShare the container entity tag (Etag) with the contingent staff member.
- DConfigure a Cross-Origin Resource Sharing (CORS) rule for the storage account.
17When you created a virtual machine you selected standard storage because the data was accessed infrequently. The data is now being used for a Business Intelligence application and you need better performance. What should you do?
- ACreate a new storage account with premium storage and copy the data there.
- BChange the standard storage to premium storage.
- CCreate a general-purpose v2 account and use that for the data.
- DCreate a blob storage account and use that for the data.
18Your company requires all data to be encrypted with 256-bit AES encryption. What should you do?
- AEnable storage service encryption.
- BEnable customer-managed keys.
- CEnable shared access signatures.
- DYou do not need to do anything.
19You are using blob storage. Which of the following is true?
- AThe cool access tier is for frequent access of objects in the storage account.
- BThe hot access tier is for storing large amounts of data that is infrequently accessed.
- CThe performance tier you select does not affect pricing.
- DYou can switch between hot and cool performance tiers at any time.
20You are planning a delegation model for your Azure storage. The company has issued the following requirements for Azure storage access:
• Apps in the non-production environment must have automated time-limited access
• Apps in the production environment must have unrestricted access to storage resources
You need to configure storage access to meet the requirements. What should you do? (Each answer presents part of the solution. Choose two.)- AUse shared access signatures for the non-production apps.
- BUse shared access signatures for the production apps.
- CUse access keys for the non-production apps.
- DUse access keys for the production apps.
- EUse Stored Access Policies for the production apps.
- FUse Cross Origin Resource Sharing for the non-production apps.
21You need to backup files and folders to Azure. Which three steps must you perform?
- ADownload, install and register the backup agent.
- BSynchronize configuration.
- CBack up files and folders.
- DCreate a backup services vault.
- ECreate a recovery services vault.
22You are developing a storage plan that includes Premium storage. Which storage redundancy type is available to use:
- ALocally redundant storage
- BZone-redundant storage
- CGeo-redundant storage
- DRead-access geo-redundant storage
23You are responsible for creating a disaster recovery plan for your data center. You must be able to recreate virtual machines from scratch. This includes the Operating System, its configuration/ settings, and patches. Which of the following will provide a bare metal backup of your machines?
- AAzure Backup (MARS) agent
- BEnable disk snapshots
- CAzure Site Recovery
- DAzure Backup Server
24You have several Azure VMs that are currently running production workloads. You have a mix of Windows Server and Linux servers and you need to implement a backup strategy for your production workloads.
Which option should you use for this use case?- AManaged snapshots.
- BAzure Backup.
- CAzure Site Recovery.
- DAzure Migrate.
25You plan to use Azure Backup to protect your virtual machines and data and are ready to create a backup. What is the first thing you need to do?
- ADefine recovery points.
- BCreate a Recovery Services vault.
- CCreate a Backup policy.
- DInstall the Azure VM Agent.
26Which of the following replicates your data to a secondary region, maintains six copies of your data, and is the default and recommended replication option.
- ALocally-redundant storage
- BGeo-redundant storage
- CRead-access geo-redundant storage
- DZone-redundant storage
27You deploy several virtual machines (VMs) to Azure. You are responsible for backing up all data processed by the VMs. In the event of a failure, you need to restore the data as quickly as possible. Which of these options would you recommend to restore a database used for development on a data disk?
- AVirtual machine backup
- BAzure Site Recovery
- CDisk image backup
- DDisk snapshot
28You deploy several virtual machines (VMs) to Azure. You are responsible for backing up all data processed by the VMs. In the event of a failure, you need to restore the data as quickly as possible. Which of these options would you recommend to restore the entire virtual machine or files on the virtual machine?
- AVirtual machine backup
- BAzure Site Recovery
- CDisk image backup
- DDisk snapshot
29Your organization needs a way to create application aware snapshots, and backup Linux virtual machines and VMware virtual machines. You have files, folders, volumes, and workloads to protect. You recommend which of the following solutions?
- AAzure Backup (MARS) agent
- BAzure Backup Server
- CEnable disk snapshots
- DEnable backup for individual Azure VMs
30Your company has a file server named FS01. The server has a single shared folder that users' access to shared files. The company wants to make the same files available from Microsoft Azure. The company has the following requirements:
-Microsoft Azure should maintain the exact same data as the shared folder on FS01.
-Files deleted on either side (on-premises or cloud) shall be subsequently and automatically deleted from the other side (on-premises or cloud).
You need to implement a solution to meet the requirements. What should you do?- ADeploy DFS Namespaces.
- BInstall and use AZCopy.
- CDeploy Azure File Sync.
- DInstall and use Azure Storage Explorer.
- EDeploy storage tiering.
31Your organization maintains historical images for large media companies. There are thousands of photos requiring over 600 TB of storage. Your datacenter has only limited bandwidth, and you need to quickly move the data to Azure blob storage. Additionally, security of the data including chain of custody logs and 256-bit encryption is required. Which of the following products would you recommend using?
- ACDN
- BData Box
- CData Box Heavy
- DData Box Gateway
- EData Box Edge
- FImport/Export
32You have an existing storage account in Microsoft Azure. It stores unstructured data. You create a new storage account. You need to move half of the data from the existing storage account to the new storage account. What tool should you use?
- AUse the Azure portal
- BUse File Server Resource Manager
- CUse the Robocopy command-line tool
- DUse the AzCopy command-line tool
33You need to improve the content delivery performance of a specific Azure blob using Azure Content Delivery Network (CDN), specifically the time-to-live (TTL) of the blob. What should you configure?
- AThe blob's LeaseDuration property
- BThe cacheControlMaxAge property in the web.config file
- CThe clientCache section in the web.config file
- DThe blob's CacheControl property
34You are planning to use the Import/Export service. Which of the following is not true.
- AWindows Servers must have a 64-bit OS that supports BitLocker Drive Encryption
- BWindows clients must have .NET Framework 4.5.1 and BitLocker
- CGeneral Purpose v2 storage accounts are recommended for most scenarios
- DSolid-state drives are required
35Your organization is using CDN. The content you are delivering changes frequently and you need to ensure the latest content is provided to the user. What should you do?
- AConfigure the Cache Expiration Duration setting
- BConfigure the Caching Behaviour setting
- CConfigure the Query String Caching Behaviour setting
- DConfigure a matching rule with a TTL value
36Your organization wants to ensure frequently accessed files are cached locally on the server while all other files are cached to Azure Files based on policy settings. What should you do?
- AConfigure file synchronization settings
- BConfigure file archiving settings
- CConfigure file time-to-live settings
- DConfigure cloud tiering
37Before using Azure File Sync you decide to use the Azure File Sync evaluation tool. Which of the following is not true about the tool?
- AChecks for unsupported characters
- BChecks for unsupported OS versions
- CChecks for storage space.
- DUses an Azure PowerShell cmdlet.
38You host a service with two Azure virtual machines. You discover that occasional outages cause your service to fail. What two actions can you do to minimize the impact of the outages? (choose 2)
- AAdd a load balancer.
- BPut the virtual machines in an availability set.
- CPut the virtual machines in a scale set.
- DAdd a network gateway.
- EAdd a third instance of the virtual machine.
39You are researching Microsoft Azure for your company. The company is considering deploying Windows-based VMs in Azure. However, before moving forward, the management team has asked you to research the costs associated with Azure VMs. You need to document the configuration options that are likely to save the company money on their Azure VMs. Which options should you document? (Each answer presents part of the solution. Choose four.)
- AUse HDD instead of SSD for VM storage.
- BUse unmanaged premium storage instead of managed standard storage.
- CBring your own Windows custom images.
- DUse different Azure regions.
- EUse the least powerful VMs that meet your requirements.
- FPlace all VMs in the same resource group.
- GBring your own Windows license for each VM.
40You are planning to deploy several Linux VMs in Azure. The security team issues a policy that Linux VMs must use an authentication system other than passwords. You need to deploy an authentication method for the Linux VMs to meet the requirement. Which authentication method should you use?
- ASSH key pair
- BAzure multi-factor authentication
- CAccess keys
- DShared access signature
- ESecurity vault certificate
41You deploy a new VM with default settings to a resource group named RG1. You validate that you can connect to it by using Remote Desktop Connection. However, when you attempt to connect to it through PowerShell remoting, the connection fails. You need to ensure that you can manage the VM by using PowerShell remoting. What should you do?
- ACreate an inbound security rule to allow TCP port 80 and TCP port 443.
- BCreate an inbound security rule to allow TCP port 5985 and TCP port 5986.
- CCreate an inbound security rule to allow TCP port 3389.
- DCreate an inbound security rule to allow TCP port 20 and TCP port 21.
42Your company has Windows Server 2012 R2 VMs and Ubuntu Linux VMs in Microsoft Azure. The company has a new project to standardize the configuration of servers across the Azure environment. The company opts to use Desired State Configuration (DSC) across all VMs. You need to ensure that DSC can be used across all the VMs. What two things should you do?
- AReplace the Ubuntu VMs with Red Hat Enterprise Linux VMs.
- BDeploy the DSC extension for Windows Server VMs.
- CDeploy the DSC extension for Linux VMs.
- DReplace the Windows Server 2012 R2 VMs with Windows Server 2016 VMs.
43Another IT administrator creates an Azure virtual machine scale set with 5 VMs. Later, you notice that the VMs are all running at max capacity with the CPU being fully consumed. However, additional VMs are not deploying in the scale set. You need to ensure that additional VMs are deployed when the CPU is 75% consumed. What should you do?
- AEnable the autoscale option.
- BIncrease the instance count.
- CAdd the scale set automation script to the library.
- DDeploy the scale set automation script.
44Your company is preparing to deploy an application to Microsoft Azure. The app is a self-contained unit that runs independently on several servers. The company is moving the app to the cloud to provide better performance. To get better performance, the team has the following requirements:
-If the CPU across the servers goes above 85%, a new VM should be deployed to provide additional resources.
-If the CPU across the servers drops below 15%, an Azure VM running the app should be decommissioned to reduce costs.
You need to deploy a solution to meet the requirements while minimizing the administrative overhead to implement and manage the solution. What should you do?- ADeploy the app in a virtual machine scale set.
- BDeploy the app in a virtual machine availability set.
- CDeploy the app by using a resource manager template.
- DDeploy the app and use PowerShell Desired State Configuration (DSC).
45Your company is deploying a critical business application to Microsoft Azure. The uptime of the application is of utmost importance. The application has the following components:
2 web servers
2 application servers
2 database servers
You need to design the layout of the VMs to meet the following requirements:
Each VM in a tier must run on different hardware
Uptime for the application must be maximized
You need to deploy the VMs to meet the requirements. What should you do?- ADeploy 1 VM from each tier into one availability set and the remaining VMs into a separate availability set.
- BDeploy the VMs from each tier into a dedicated availability set for the tier.
- CDeploy the application and database VMs in one availability set and the web VMs into a separate availability set.
- DDeploy a load balancer for the web VMs and an availability set to hold the application and database VMs.
46You deploy an Azure VM into an availability set. The VM is the only VM in the availability set. The VM runs an application named App1. The VM has the following characteristics:
• The VM uses Azure standard storage.
• The VM does not have any data disks.
• The VM was built with a custom image.
During an Azure planned maintenance event, the VM experiences downtime. The company issues a new requirement for App1:
• App1 must remain available during Azure planned maintenance events
You need to reconfigure your environment to meet the new requirements. What should you do? (Each answer presents a complete solution. Choose two.)- ADeploy a second Azure VM and add it to the same availability set.
- BDeploy a second Azure VM and add it to the same update domain.
- CDeploy a second Azure VM and add it to the same fault domain.
- DConvert the VM storage to premium storage.
- EConvert the VM to a Standard size or higher.
- FConvert the VM storage to use zone redundant storage.
47You begin a new job at a company. You are exploring the existing Microsoft Azure implementation with a plan to document it. First, you are documenting the virtual machine details. You need to go gather the details of the VM data disks. Which type of storage should you review for the data disks?
- AAzure CDN
- BBlob storage
- CTable storage
- DQueue storage
48Your company has an existing Azure tenant named alpineskihouse.onmicrosoft.com. The company wants to start using alpineskihouse.com for their Azure resources. You add a custom domain to Azure.
Now, you need to add a DNS record to prepare for verifying the custom domain. Which two of the following record types could you create?- AAdd an PTR record to the DNS zone.
- BAdd a TXT record to the DNS zone.
- CAdd an MX record to the DNS zone.
- DAdd an SRV record to the DNS zone.
- EAdd a CNAME record to the DNS zone.
49You are planning to configure networking in Microsoft Azure. Your company has a new Microsoft Azure presence with the following network characteristics:
• 1 Virtual Network.
• 1 subnet using 192.168.0.0/23 (does not have existing resources).
Your on-premises data center has the following network characteristics:
• 10 subnets using 192.168.1.0/24 through 192.168.10.0/24.
The company intends to use 192.168.1.0/24 on-premises and 192.168.0.0/24 in Azure. You need to update your company's environment to enable the needed functionality. What should you do? (Each answer represents part of the solution. Choose two.)- ADelete 192.168.0.0/23 from Azure.
- BDelete 192.168.1.0/24 in the on-premises environment.
- CCreate a matching public subnet in Azure and in the on-premises environment.
- DCreate a subnet for 192.168.0.0/23 in the on-premises environment.
- ECreate a subnet for 192.168.0.0/24 in Azure.
50You are planning your Azure network implementation to support your company's migration to Azure. Your first task is to prepare for the deployment of the first set of VMs. The first set of VMs that you are deploying have the following requirements:
• Consumers on the internet must be able to communicate directly with the web application on the VMs.
• The IP configuration must be zone redundant.
You need to configure the environment to prepare for the first VM. Additionally, you need to minimize costs, whenever possible, while still meeting the requirements. What should you do?- ACreate a standard public IP address. During the creation of the first VM, associate the public IP address with the VM's NIC.
- BCreate a standard public IP address. After the first VM is created, remove the private IP address and assign the public IP address to the NIC.
- CCreate a basic public IP address. During the creation of the first VM, associate the public IP address with the VM.
- DCreate a basic public IP address. After the first VM is created, remove the private IP address and assign the public IP address to the NIC.
51You deploy a new domain named contoso.com to domain controllers in Azure. You have the following domain-joined VMs in Azure:
• VM1 at 10.20.30.10
• VM2 at 10.20.30.11
• VM3 at 10.20.30.12
• VM99 at 10.20.40.101
You need to add DNS records so that the hostnames resolve to their respective IP addresses. Additionally, you need to add a DNS record so that intranet.contoso.com resolves to VM99. What should you do? (Each answer presents part of the solution. Choose two.)- AAdd AAAA records for each VM.
- BAdd A records for each VM.
- CAdd a TXT record for intranet.contoso.com with the text of VM99.contoso.com.
- DAdd an SRV record for intranet.contoso.com with the target pointing at VM99.contoso.com
- EAdd a CNAME record for intranet.contoso.com with a value of VM99.contoso.com.
52Your company is preparing to move some services and VMs to Microsoft Azure. The company has opted to use Azure DNS to provide name resolution. A project begins to configure the name resolution. The project identifies the following requirements:
A new domain will be used.
The domain will have DNS records for internal and external resources.
Minimize ongoing administrative overhead.
You need to prepare and configure the environment with a new domain name and a test hostname of WWW. Which of the following steps should you perform? (Each answer presents part of the solution. Choose three.)- ARegister a domain name with a domain registrar.
- BRegister a domain name with Microsoft Azure.
- CDelegate the new domain name to Azure DNS.
- DAdd an Address (A) record for Azure name servers in the zone.
- EAdd DNS glue records to point to the Azure name servers.
- FAdd a record for WWW.
53You have a VM with two NICs named NIC1 and NIC2. NIC1 is connected to the 10.10.8.0/24 subnet. NIC2 is connected to the 10.20.8.0/24 subnet. You plan to update the VM configuration to provide the following functionality:
Enable direct communication from the internet to TCP port 443.
Maintain existing communication across the 10.10.8.0/24 and 10.20.8.0/24 subnets.
Maintain a simple configuration whenever possible.
You need to update the VM configuration to support the new functionality. What should you do?- ARemove the private IP address from NIC2 and then assign a public IP address to it. Then, create an inbound security rule.
- BAdd a third NIC and associate a public IP address to it. Then, create an inbound security rule.
- CAssociate a public IP address to NIC2 and create an inbound security rule.
- DCreate an inbound security rule for TCP port 443.
54You have several VMs in Microsoft Azure. All the VMs are configured with the default IP addressing solution. A VM named VM1 is assigned the 172.16.10.100 IP address. You stop and deallocate VM1 to perform some disk maintenance activities. During that time, another administrator deploys a new VM named VM25. Later, after VM1 comes back online, you notice that its IP address changed. Now, VM25 is assigned the 172.16.10.100 IP address. You need to ensure that VM1 maintains the IP address of 172.16.10.100. All other VMs should have their IP addresses automatically allocated. What should you do? (Each answer presents part of the solution. Choose two.)
- AStop and deallocate VM1.
- BStart VM1.
- CStop and deallocate VM25.
- DStart VM25.
- EConfigure VM1 with a static IP address of 172.16.10.100.
- FConfigure VM25 with a new static IP address.
55You're currently using network security groups (NSGs) to control how your network traffic flows in and out of your virtual network subnets and network interfaces. You want to customize how your NSGs work. For all incoming traffic, you need to apply your security rules to both the virtual machine and subnet level.
Which of the following options will let you accomplish this? (Choose two)- AConfigure the AllowVNetInBound security rule for all new NSGs.
- BCreate rules for both NICs and subnets with an allow action.
- CDelete the default rules.
- DAdd rules with a higher priority than the default rules.
56You have an Azure virtual machine that has a multi-network interface with private IP addressing. To which IP address in Azure managed DNS is the hostname mapped?
- Aeach interface
- Bthe most recently created network interface
- Cthe primary network interface
- Dthe first created network interface
57You need to ensure that Azure DNS can resolve names for your registered domain. What should you implement?
- Azone delegation
- Ba CNAME record
- Can MX record
- Da secondary zone
- Ea primary zone with a NS record
58When establishing connections between virtual networks with VNet-to-VNet VPN connections, your virtual networks cannot be ____
- Ain different regions.
- Bin Azure.
- Cin the cloud using a dedicated private connection.
- Din the same deployment model.
- Ein different subscriptions.
59Which two statements regarding an Azure VPN gateway are true?
- AYou can only assign a dynamic public IP address to an Azure VPN Gateway.
- BThe gateway connects virtual machines within a VNet.
- CThe gateway connects an Azure VNet to an on-premises network.
- DYou can assign a static public IP address to an Azure VPN Gateway.
60You want to connect different VNets in the same region as well as different regions and decide to use VNet peering to accomplish this.
Which of the following statements are true benefits of VNet peering? (Choose two)- AThe virtual networks can exist in any Azure cloud region.
- BSecurity: Network traffic between peered virtual networks is private.
- CPeering is easy to configure and manage, requiring little to no downtime.
- DGateway transit can be configured regionally or globally.
61Your company is preparing to implement a Site-to-Site VPN to Microsoft Azure. You are selected to plan and implement the VPN. Currently, you have an Azure subscription, an Azure virtual network, and an Azure gateway subnet. You need to prepare the on-premises environment and Microsoft Azure to meet the prerequisites of the Site-to-Site VPN. Later, you will create the VPN connection and test it. What should you do? (Each answer presents part of the solution. Choose three.)
- AObtain a VPN device for the on-premises environment.
- BObtain a VPN device for the Azure environment.
- CCreate a virtual network gateway (VPN) and the local network gateway in Azure.
- DCreate a virtual network gateway (ExpressRoute) in Azure.
- EObtain a public IPv4 IP address without NAT for the VPN device.
- FObtain a public IPv4 IP address behind NAT for the VPN device.
62Your company is preparing to implement persistent connectivity to Microsoft Azure. The company has a single site, headquarters, which has an on-premises data center. The company establishes the following requirements for the connectivity:
• Connectivity must be persistent.
• Connectivity must provide for the entire on-premises site.
You need to implement a connectivity solution to meet the requirements. What should you do?- AImplement a Site-to-Site VPN.
- BImplement a Virtual Private Cloud (VPC).
- CImplement a Virtual Private Gateway (VGW).
- DImplement a VNet-to-VNet VPN.
- EImplement a Point-to-Site VPN.
63You are configuring VNet Peering across two Azure two virtual networks, VNET1 and VNET2. You are configuring the VPN Gateways. You want VNET2 to be able to use to VNET1's gateway to get to resources outside the peering. What should you do?
- ASelect allow gateway transit on VNET1 and use remote gateways on VNET2.
- BSelect allow gateway transit on VNET2 and use remote gateways on VNET1.
- CSelect allow gateway transit and use remote gateways on both VNET1 and VNET2.
- DDo not select allow gateway transit or use remote gateways on either VNET1 or VNET2.
64You are configuring a site-to-site VPN connection between your on-premises network and your Azure network. The on-premises network uses a Cisco ASA VPN device. You have checked to ensure the device is on the validated list of VPN devices. Before you proceed to configure the device what two pieces of information should you ensure you have?
- AThe shared access signature key from the recovery services vault.
- BThe shared key you provided when you created your site-to-site VPN connection.
- CThe gateway routing method provided when you created your site-to-site VPN connection.
- DThe static IP address of your virtual network gateway.
- EThe public IP address of your virtual network gateway.
- FThe user and password for the virtual network gateway.
65The ________________ routes traffic between VMs and PaaS cloud services in a virtual network and computers at the other end of the connection.
- AVPN gateway
- Bserver
- CDNS
- Dload balancer
- Elocal gateway
66You manage a large datacenter that is running out of space. You propose extending the datacenter to Azure using a Multi-Protocol Label Switching virtual private network. Which connectivity option would you select?
- APoint-to-Site
- BVPN Peering
- CMulti-site
- DSite-to-Site
- EExpressRoute
- FVNet-to-VNet
67You are creating a connection between two virtual networks. Performance is a key concern. Which of the following will most influence performance?
- AEnsuring you select a route-based VPN.
- BEnsuring you select a policy-based VPN.
- CEnsuring you specify a DNS server.
- DEnsuring you select an appropriate Gateway SKU.
68Your organization has a very large web farm with more than 100 virtual machines. You would like to use Log Analytics to ensure these machines are responding to requests. You plan to automate the process so you create a search query. You begin the query by identifying the source table. Which source table do you use?
- AEvent
- BSysLog
- CHeartbeat
- DMyLog_CL
- EAlert
69Your organization has a app that is used across the business. The performance of this app is critical to day to day operations. Because the app is so important, four IT administrators have been identified to address any issues. You have configured an alert and need to ensure the administrators are notified if there is a problem. In which area of the portal will you provide the administrator email addresses?
- AActivity log
- BPerformance group
- CSignal Type
- DAction Group
70Your organization has several Linux virtual machines. You would like to use Log Analytics to retrieve error messages for these machines. You plan to automate the process, so you create a search query. You begin the query by identifying the source table. Which source table do you use?
- AEvent
- BSysLog
- CHeartbeat
- DMyLog_CL
- EAlert
71You are analyzing the company virtual network and think it would helpful to get a visual representation of the networking elements. Which feature can you use?
- ANetwork Watcher Auditing
- BNetwork Watcher Connection Troubleshoot
- CNetwork Watcher Flows
- DNetwork Watcher Next Hop
- ENetwork Watcher Views
- FNetwork Watcher Topology
72Your company has a website and users are reporting connectivity errors and timeouts. You suspect that a security rule may be blocking traffic to or from one of the virtual machines. You need to quickly troubleshoot the problem, so you:
- AConfigure IIS logging and review the connection errors.
- BTurn on virtual machine diagnostic logging and use Log Analytics.
- CUse Network Watcher's VPN Diagnostics feature.
- DUse Network Watcher's IP Flow Verify feature.
- EConfigure Windows performance counters and use Performance Monitor.
73You are interested in finding a single tool to help identity high VM CPU utilization, DNS resolution failures, firewall rules that are blocking traffic, and misconfigured routes. Which tool can you use?
- ANetwork Watcher Auditing
- BNetwork Watcher Connection Troubleshoot
- CNetwork Watcher Flows
- DNetwork Watcher Next Hop
- ENetwork Watcher Views
- FNetwork Watcher Topology
74You are reviewing the Alerts page and notice an alert has been Acknowledged. What does this mean?
- AThe issue has just been detected and has not yet been reviewed.
- BAn administrator has reviewed the alert and started working on it.
- CThe issue has been resolved.
- DThe issue has been closed.
75You need to determine who deleted a network security group through Resource Manager. You are viewing the Activity Log when another Azure Administrator says you should use this event category to narrow your search.
- AAdministrative
- BService Health
- CAlert
- DRecommendation
- EPolicy
76Which of the following two features of Azure networking provide the ability to redirect all Internet traffic back to your company's on-premises servers for packet inspection?
- AUser Defined Routes
- BCross-premises network connectivity
- CTraffic Manager
- DForced Tunneling
- ESystem Routes
77You have a virtual machine, VMDev, that hosts a cloud application. You want to ensure users can access the Accounts VM on port 8181. What should you do?
- ACreate a firewall rule.
- BConfigure port redirection.
- CConfigure port affinity.
- DCreate an endpoint.
- EConfigure port forwarding.
78Your company has a website that allows users to customize their experience by downloading an app. Demand for the app has increased so you have added another virtual network with two virtual machines. These machines are dedicated to serving the app downloads. You need to ensure the additional download requests do not affect the website performance. Your solution must route all download requests to the two new servers you have installed. What action will you recommend?
- AConfigure Traffic Manager.
- BAdd a user-defined route.
- CCreate a local network gateway.
- DConfigure a new routing table.
- EAdd an application gateway.
79Your company provides customers a virtual network in the cloud. You have dozens of Linux virtual machines in another virtual network. You need to install an Azure load balancer to direct traffic between the virtual networks. What should you do?
- AInstall a private load balancer.
- BInstall a public load balancer.
- CInstall an external load balancer.
- DInstall an internal load balancer.
- EInstall a network load balancer.
80You have several websites and are using Traffic Manager to distribute the network traffic. You are bringing a new endpoint online but are not sure that it is ready to accept a full load of requests. Which Traffic Manager routing algorithm should you use?
- ARound robin
- BPriority
- CGeographic
- DWeighted
- EPerformance
81A(n) ______________ listens on a public port and forwards traffic to an internal port.
- Agateway
- Bbalancer
- Cendpoint
- Ddestination port
- Eunanswered
82Your company has a popular regional web site. The company plans to move it to Microsoft Azure and host it in the Canada East region. The web team has established the following requirements for managing the web traffic:
• Evenly distribute incoming web requests across a farm of 10 Azure VMs.
• Support many incoming requests, including spikes during peak times.
• Minimize complexity.
• Minimize ongoing costs.
Which of the following would you select for this scenario?- AAzure Traffic Manager
- BAzure Load Balancer
- CAzure Content Delivery Network
- DAzure Cloud Services
83You deploy an internal load balancer between your web tier and app tier servers. You configure a custom HTTP health probe. All of the following are true, except which two:
- AThe load balancer manages the health probe.
- BBy default, the health probe checks the endpoint every 30 seconds.
- CThe instance is healthy if it responds with an HTTP 200 error.
- DYou can change the amount of time between health probe checks.
- EYou can change the number of failures within a time period.
84You have been considering whether to install a Basic or Standard load balancer SKU. Which of the following is true?
- AIf you change your mind, you can switch from the Basic to the Standard SKU.
- BThere is no price difference between the Basic and Standard SKU.
- CA Standard load balancer cannot span two virtual networks.
- DLoad balancer frontends are accessible across global virtual network peering.
85Your users want to sign-in to devices, apps, and services from anywhere. They want to sign-in using an organizational work or school account instead of a personal account. You must ensure corporate assets are protected and that devices meet standards for security and compliance. Specifically, you need to be able to enable or disable a device. What should you do?
- AEnable the device in Azure AD.
- BJoin the device to Azure AD.
- CConnect the device to Azure AD.
- DRegister the device with Azure AD.
86Your network contains an Active Directory Domain Services (AD DS) domain named contoso.com and an Azure Active Directory (Azure AD) domain named contoso.onmicrosoft.com. Azure AD Connect is installed and Active Directory Federation Services (AD FS) is configured. Password-writeback is enabled. You need to monitor synchronization events generated by Azure AD Connect.
- AInstall Azure AD Connect Health.
- BDeploy a domain controller for contoso.com on a virtual machine in the contoso.onmicrosoft.com tenant.
- CConfigure Authentication Caching.
- DLaunch Synchronization Service Manager and edit the properties of the connector.
87Identify three differences from the following list between Azure Active Directory (AD) and Active Directory Domain Services (AD DS).
- AAzure AD uses HTTP and HTTPS communications
- BAzure AD uses Kerberos authentication
- CThere are no Organizational Units (OUs) or Group Policy Objects (GPOs) in Azure AD
- DAzure AD includes Federation Services
- EAzure AD can be queried through LDAP
88Your company recently implemented Azure pass-through authentication. Users are now able to authenticate to Azure using their corporate credentials. The management team wants to enhance the user experience. The team comes up with the following requirements.
• Minimize the number of times that users must manually enter credentials
• Minimize on-premises infrastructure
You need to reconfigure the authentication solution to maintain the existing functionality while adding functionality dictated in the requirements. What should you do?- ARemove Azure pass-through authentication and deploy Active Directory Federation Services (AD FS).
- BDeploy Active Directory Federation Services (AD FS).
- CDeploy Azure single sign-on.
- DRemove Azure pass-through authentication and deploy Azure single sign-on.
89You are planning to deploy Azure AD in a hybrid environment for an organization. You must implement the following features: MFA, SSO, Self-service Password Reset, seamless access to both on-premises and cloud applications, and self-service Bitlocker recovery.
- AAzure Active Directory Free
- BAzure Active Directory Basic
- CAzure Active Directory Premium P1
- DAzure Active Directory Premium P2
90Compliance requires all your Windows 10 devices to be joined to Azure. Your Azure AD Premium subscription will provide all of the following additional benefits, except?
- ASeamless access to cloud resources by leveraging single sign-on
- BAutomatic enrollment in device management solutions like Intune
- CSelf-service BitLocker recovery
- DEnterprise State Roaming
91Your company has an on-premises AD DS domain that is synced with Microsoft Azure. The company recently implemented Azure pass-through authentication. Everything is functional. A few weeks later, the network team performs a change to the company’s firewalls. Thereafter, pass-through authentication stops functioning. You need to put in an emergency change request to open the minimum number of ports so that pass-through authentication functions.
Which ports should you open?- AOnly inbound TCP port 80 and inbound TCP port 443.
- BOnly inbound and outbound TCP port 443.
- COnly outbound TCP port 80 and outbound TCP port 443.
- DOnly outbound TCP port 443 and inbound TCP port 80.
92Your company has a hybrid environment with some applications and services in an on-premises data center and some applications and services in Microsoft Azure.
The company intends to strengthen identity verification and access controls for Azure administrators by using conditional access. The information security team issues the following requirements:
• If Azure calculates that there is a chance that an unauthorized person is using an account, then multi-factor authentication must be required for the sign-in.
• If any administrators attempt to access Microsoft Azure while off the corporate networks, the sign-ins must be blocked.
You need to configure conditional access to support the requirements.
Which conditional access features should you configure? (Each answer presents part of the solution. Choose two.)- ADevice platforms
- BLocations
- CSign-in risk
- DClient apps
- EScore
93A user has reported their cell phone has been stolen. They are unable to receive the MFA text notification. What should you do?
- AAdd the IP address of the user to the trusted IPs list.
- BTurn on fraud reporting and provide the key to the user.
- CTurn off fraud reporting and ask the user to try again.
- DTurn off MFA for the user.
- EEnable a one-time bypass for the user.
94You are a systems administrator for Alpine Ski House. The company has a large on-premises environment spread across multiple locations. The on-premises environment includes the following technologies:
• Active Directory Domain Services (AD DS)
• Third-party multi-factor authentication service
• Windows 10
The company is planning to implement services across a range of Microsoft Azure services, such as SaaS and PaaS. You are tasked with deploying a hybrid identity solution.
The company has established the following requirements for the project:
• All access to Microsoft Azure must use multi-factor authentication.
• All multi-factor authentication must use the existing MFA service.
• Users must be provided with a single sign-on experience when going to the Azure portal.
You need to implement a solution to meet the requirements. You plan to deploy Azure AD Connect.
What else should you do?- AImplement Active Directory Federation Services (AD FS).
- BImplement Azure pass-through authentication and Azure single sign-on.
- CImplement Azure multi-factor authentication.
- DImplement Azure AD Domain Services.
- EImplement Web Application Proxy servers.
95Your company recently implemented Azure conditional access. The company configuration was supposed to include the following elements:
• Multi-factor authentication is required for users when they are not on the company network.
• Only Windows computers are enabled to access Azure.
A user reports that they are getting prompted for MFA when they are on the company network. You check the configuration and notice that an MFA rule is configured for any location.
You need to update the configuration to meet the intended company configuration. What should you do?- AUpdate the Include to “All trusted locations”.
- BUpdate the Include to “Selected locations”.
- CAdd an Exclude for “All trusted locations”.
- DAdd an Exclude for “Selected location”.
96Which of the following is not a feature of Azure AD Identity Protection?
- AA customized list of configuration vulnerabilities.
- BAutomated responses with Conditional Access policies.
- CSelf-Service Password Reset (SSPR).
- DMachine learning algorithms signaling different security vulnerabilities
97You are configuring Self-service Password Reset. All of the following authentication methods are valid, except:
- AAn email notification.
- BA text or code sent to a user's mobile or office phone.
- CA paging service.
- DA set of security questions
98A user signs in from a proxy IP address with the intent to hide their device's IP address. Under which type of Azure AD risk event would this activity be classified?
- ALeaked credentials.
- BSign-in from infected device.
- CSign-in from unfamiliar location.
- DSign-in from anonymous IP address.
99Your company is planning to use Azure and is investigating whether their Azure AD Basic subscription will work for their needs. Which of the features below is not available in the Basic subscription?
- ASelf-Service Password change for cloud users.
- BGroup-based access management/provisioning.
- CCompany Branding (Logon Pages/Access Panel customization).
- DMulti-Factor Authentication (Cloud and On-premises (MFA Server)).
100Azure Traffic Manager is a good solution for load balancing traffic (select three):
- Aat hosted providers.
- Bin the same cloud.
- Cin different Azure regions.
- Din on-premises datacenters.
- Ebased on the HTTP protocol.
Information
- Description
- Quiz on AZ-103, created by Marc Hall on 30/04/2020.
- Author
- Marc Hall
- Language
- English
- Views
- 9
- Tags
- Rating
- No ratings yet Rate this quiz