Microsoft AZ-104 Practice Exam Questions & Answers

No, this does not meet the goal. Assigning a built-in policy definition to the subscription is not enough to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks. This is because there is no built-in policy definition that matches this requirement.The closest built-in policy definition is ''Network security groups should not allow unrestricted inbound traffic on well-known ports'', but this policy only blocks TCP port 80 and 443, not 80801.

To meet the goal, you need to create a custom policy definition that enforces a default security rule for NSGs.A policy definition is a set of rules and actions that Azure performs when evaluating your resources2. You can use a policy definition to specify the required properties and values for NSGs, such as the direction, protocol, source, destination, and port of the security rule. You can then assign the policy definition to the subscription scope, so that it applies to all the resource groups and virtual networks in the subscription.

Cost analysis: Correct Option

In cost analysis blade of Azure, you can see all the detail for custom time span. You can use this to determine expenditure of last few day, weeks, and month. Below options are available in Cost analysis blade for filtering information by time span:last 7 days, last 30 days, and custom date range. Choosing the first option (last 7 days) auditors can view the costs by time span.

Cost analysis shows data for the current month by default. Use the date selector to switch to common date ranges quickly. Examples include the last seven days, the last month, the current year, or a custom date range. Pay-as-you-go subscriptions also include date ranges based on your billing period, which isn't bound to the calendar month, like the current billing period or last invoice. Use the<PREVIOUSandNEXT>links at the top of the menu to jump to the previous or next period, respectively. For example,<PREVIOUSwill switch from theLast 7 daysto8-14 days agoor15-21 days ago.

Invoice: Incorrect Option

Invoices can only be used for past billing periods not for current billing period, i.e. if your requirement is to know the last week's cost then that also not filled by invoices because Azure generates invoice at the end of the month. Even though Invoices have custom timespan, but when you put in dates for a week, the pane would be empty. Below is from Microsoft document:

Resource Provider: Incorrect Option

When deploying resources, you frequently need to retrieve information about the resource providers and types. For example, if you want to store keys and secrets, you work with the Microsoft.KeyVault resource provider. This resource provider offers a resource type called vaults for creating the key vault. This is not useful for reviewing all Azure costs from the past week which is required for audit.

Payment method: Incorrect Option

Payment methods is not useful for reviewing all Azure costs from the past week which is required for audit.

https://docs.microsoft.com/en-us/azure/cost-management-billing/costs/quick-acm-cost-analysis

https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/download-azure-invoice-daily-usage-date

In Microsoft Entra ID (Azure Active Directory), creating guest user accounts for external users involves the B2B collaboration invitation process, not the Bulk create user operation. The Bulk create user feature in the Azure portal is used exclusively for creating member users (internal accounts) within your tenant --- users that belong directly to your organization.

The Microsoft Azure Administrator official study guide and documentation specify that to onboard external users (guests), you must invite them using the B2B invitation mechanism. This process creates user objects with userType = Guest in your directory. The correct method to achieve this in bulk is by using the PowerShell cmdlet New-AzureADMSInvitation or Microsoft Graph API to send invitations automatically to all external users listed in your CSV file.

Bulk create user operation does not support adding guest accounts because it doesn't generate the B2B invitation link or email, which is required for the external user to accept and authenticate using their own identity provider (e.g., Microsoft account, Google, or another Entra tenant).

Therefore, the proposed solution fails to meet the requirement of creating guest accounts for the 500 external users in the contoso.com tenant. The correct solution would be to use PowerShell with the New-AzureADMSInvitation command or the Azure AD portal's ''Invite external users'' bulk import option designed specifically for guest creation.

The Storage Account Contributor role provides the necessary permissions to manage a storage account except for access to data itself. According to Microsoft's Azure RBAC documentation, this role includes the following actions:

Microsoft.Storage/storageAccounts/regenerateKey/action

Microsoft.Storage/storageAccounts/listKeys/action

Microsoft.Storage/storageAccounts/read

Therefore, a user assigned the Storage Account Contributor role can list and regenerate access keys for the assigned storage account.

Reference from Azure documentation (Built-in roles for Azure RBAC):

''Storage Account Contributor -- Manage storage accounts, including access keys. Can't manage access to data.''

Hence, assigning Storage Account Contributor to User1 meets the requirement.

The correct first action is to create a data collection rule (DCR). Azure Monitor can collect host-level platform metrics automatically, but metrics from inside the guest operating system require an agent-based collection path. Microsoft states that Azure Monitor Agent collects monitoring data from the guest operating system of Azure and hybrid VMs, and that it collects data according to data collection rules, which define what data is collected, processed, and sent.

In Azure, a storage account access key provides full access to all data within the account. To reduce risk and follow security best practices, these keys should be rotated (regenerated) periodically.

According to the Microsoft Azure Storage and Security documentation, Azure Key Vault can be used to automate access key rotation for storage accounts.

Azure Key Vault allows you to:

Store and manage secrets, keys, and certificates securely.

Integrate directly with Azure Storage to manage account keys and Shared Access Signatures (SAS).

Enable automated key rotation when using Azure Key Vault managed storage account keys.

Here's how it works:

In Azure Key Vault, add the storage account (storage1) as a managed storage account.

Key Vault periodically regenerates (rotates) the storage access keys automatically.

Applications can retrieve updated keys via Key Vault APIs or managed identities without manual key updates.

This process ensures consistent security and reduces the administrative effort required for key rotation.

Other options such as backup vaults, redundancy, or lifecycle management do not handle access key rotation---they serve data protection or retention purposes, not key management.

Final Verified Answe r: D. an Azure key vault

Unable to provide correction without seeing the answer options. To properly answer what should be identified before deploying Template1 to minimize Azure costs, I would need to see the available choices. However, the most cost-minimizing approach would be to identify the resources and costs BEFORE deployment. This typically means: reviewing the template's resource definitions, calculating estimated costs using Azure pricing calculator or cost estimation features, and identifying whether any resources are redundant or could be consolidated.