AZ-104 Exam Dumps - Microsoft Azure Administrator

In this scenario, the PowerShell output shows the configuration of VNet1 in the West US region under the resource group Production. The AddressSpace for the virtual network is defined as 10.2.0.0/16, with a single existing subnet named default that has an AddressPrefix of 10.2.0.0/24.

According to Microsoft Azure networking documentation, an Azure virtual network (VNet) defines an address space (CIDR block), which represents the range of IP addresses available within that network. Subnets are created within that address space to allocate smaller IP ranges for specific resource groupings, such as VMs or application tiers.

For a VM to receive an IP address from 192.168.1.0/24, that range does not exist within the current VNet’s address space (10.2.0.0/16). Therefore, before a VM can use that IP range, you must add an additional address space (192.168.1.0/24) to VNet1.

For a VM to receive an IP address from 10.2.1.0/24, that range falls within the existing address space (10.2.0.0/16). However, there is no subnet currently defined for 10.2.1.0/24, so you must add a new subnet with that address prefix.

This configuration follows the official Azure documentation guidance:

“Each subnet must represent a subset of the virtual network’s address space. To use a different IP range, you must first expand the VNet’s address space before defining subnets within it.”

✅ Final Verified Answer:

192.168.1.0/24 → Add an address space

10.2.1.0/24 → Add a subnet

https://learn.microsoft.com/en-us/azure/container-instances/container-instances-container-groups Multi-container groups currently support only Linux containers. For Windows containers, Azure Container Instances only supports deployment of a single container instance. While we are working to bring all features to Windows containers, you can find current platform differences in the service

A virtual machine scale set is a group of identical virtual machines that are centrally managed, configured, and updated1. A virtual machine scale set can automatically increase or decrease the number of virtual machine instances in response to demand or a defined schedule2. A virtual machine scale set also provides high availability and fault tolerance by distributing the virtual machine instances across multiple fault domains and update domains3.

A fault domain is a logical group of underlying hardware that share a common power source and network switch. A fault domain can fail due to hardware or software failures, power outages, or network interruptions4. A virtual machine scale set can have up to five fault domains in a region.

An update domain is a logical group of underlying hardware that can undergo maintenance or be rebooted at the same time. An update domain can be affected by planned events, such as OS updates, application updates, or configuration changes4. A virtual machine scale set can have up to 20 update domains in a region.

By creating a virtual machine scale set that has 10 virtual machine instances, you can ensure that App1 always runs on at least eight virtual machines during planned Azure maintenance. This is because the default configuration of a virtual machine scale set is to have five fault domains and five update domains. This means that at any given time, only one fault domain or one update domain can be unavailable due to maintenance or failure. Therefore, at least eight out of 10 virtual machine instances will be available to run App1.

An availability set is another option for providing high availability and fault tolerance for your virtual machines. An availability set is a logical grouping of two or more virtual machines that are deployed across multiple fault domains and update domains. However, an availability set does not provide automatic scaling of resources or load balancing of traffic. You need to manually create and manage the number of virtual machine instances in an availability set.

Therefore, a virtual machine scale set is a better option than an availability set for your scenario. To create a virtual machine scale set, you can follow these steps:

Sign in to the Azure portal.

Select Create a resource > Compute > Virtual machine scale set.

On the Basics tab, enter a name for your scale set, select your subscription and resource group, select Windows Server 2019 as the image type, and enter a username and password for the administrator account.

On the Instance details tab, select the region where you want to deploy your scale set, select the size of the virtual machine instances, and enter 10 as the initial instance count.

On the Scaling tab, configure the scaling policy for your scale set based on metrics or schedule.

On the Load balancing tab, configure the load balancer for your scale set to distribute traffic across the instances.

On the Management tab, configure the diagnostics settings, automatic OS upgrades, extensions, and backup options for your scale set.

On the Advanced tab, configure the availability zone, proximity placement group, accelerated networking, host group, and custom script extension options for your scale set.

On the Tags tab, optionally add tags to your scale set resources.

On the Review + create tab, review your settings and select Create.

Cost analysis: Correct Option

In cost analysis blade of Azure, you can see all the detail for custom time span. You can use this to determine expenditure of last few day, weeks, and month. Below options are available in Cost analysis blade for filtering information by time span:  last 7 days, last 30 days, and custom date range. Choosing the first option (last 7 days) auditors can view the costs by time span.

Cost analysis shows data for the current month by default. Use the date selector to switch to common date ranges quickly. Examples include the last seven days, the last month, the current year, or a custom date range. Pay-as-you-go subscriptions also include date ranges based on your billing period, which isn't bound to the calendar month, like the current billing period or last invoice. Use the  links at the top of the menu to jump to the previous or next period, respectively. For example, 

Invoice: Incorrect Option

Invoices can only be used for past billing periods not for current billing period, i.e. if your requirement is to know the last week's cost then that also not filled by invoices because Azure  generates invoice at the end of the month. Even though Invoices have custom timespan, but when you put in dates for a week, the pane would be empty. Below is from Microsoft document:

Resource Provider: Incorrect Option

When deploying resources, you frequently need to retrieve information about the resource providers and types. For example, if you want to store keys and secrets, you work with the Microsoft.KeyVault resource provider. This resource provider offers a resource type called vaults for creating the key vault. This is not useful for reviewing all Azure costs from the past week which is required for audit.

Payment method: Incorrect Option

Payment methods is not useful for reviewing all Azure costs from the past week which is required for audit.

A Shared Access Signature (SAS) defines how, when, and from where a storage resource can be accessed. The exhibit shows the following important configuration details for SAS1:

Validity period: January 1, 2025 through January 1, 2028 → both access attempts occur within the valid timeframe.

Allowed IP addresses: Not specified → access is allowed from any IP address.

Allowed protocols: HTTPS only

Signing key: key1

Scenario 1 – Azure Storage Explorer

Azure Storage Explorer accesses Azure Storage using the HTTPS REST API. Because:

The access is within the SAS validity period,

No IP restriction is configured,

HTTPS is allowed,

the connection succeeds. However, the SAS configuration shown does not include write or list permissions, meaning access is limited to read-only operations.

✔ Result: Will have read-only access

Scenario 2 – net use to connect to Azure file share

The net use command connects to Azure Files using SMB (port 445). SMB traffic does not use HTTPS.

Because the SAS explicitly restricts access to HTTPS only, SMB-based access is blocked, regardless of IP address or validity period.

Microsoft Azure documentation clearly states:

“When HTTPS only is selected, requests that use HTTP or SMB are denied.”

✔ Result: Will have no access

Final Answer Summary

Scenario

Result

Storage Explorer over HTTPS

Will have read-only access

SMB (net use) connection

Will have no access

✅ Final Verified Answer:

First scenario: Will have read-only access

Second scenario: Will have no access

To create a scheduled runbook to increase the processor performance of VM1 at the end of each month, you need to modify the VM size property of VM1. This will allow you to scale up the VM to a larger size that has more CPU cores and memory. You can use Azure Automation to create a PowerShell runbook that changes the VM size using the Set-AzVM cmdlet. You can then schedule the runbook to run at the end of each month using the Azure portal or Azure PowerShell. For more information, see How to resize a virtual machine in Azure using Azure Automation1.

This question evaluates understanding of Azure Virtual Network (VNet) peering behavior, specifically routing rules, non-transitive connectivity, and gateway transit settings.

From the exhibit, VNET1 has two peerings configured:

Peering1: VNET1 ↔ VNET2 (Connected)

Peering2: VNET1 ↔ VNET3 (Connected)

For both peerings, Gateway transit is Disabled.

Packets from VNET1

According to Microsoft Azure networking documentation:

VNet peering allows direct routing between peered VNets

A VNet can communicate with all VNets it is directly peered with

Since VNET1 is directly peered with both VNET2 and VNET3, traffic originating in VNET1 can be routed to both networks.

✅ Packets from VNET1 can be routed to VNET2 and VNET3

Packets from VNET2

Azure VNet peering is not transitive. This means:

Even though VNET2 is peered with VNET1

And VNET1 is peered with VNET3

VNET2 does NOT automatically gain access to VNET3

Additionally:

Gateway transit is disabled

No user-defined routing or hub-and-spoke gateway configuration is present

Therefore, VNET2 can only route traffic to its directly peered network, which is VNET1.

✅ Packets from VNET2 can be routed to VNET1 only

Key Microsoft Azure Principles Applied

VNet peering enables direct connectivity only

Peering connections are non-transitive

Gateway transit must be explicitly enabled for transitive routing scenarios

Without gateway transit or NVA routing, VNets cannot route through each other

Final Verified Answer:

Packets from VNET1: ✅ VNET2 and VNET3

Packets from VNET2: ✅ VNET1 only

You can opt in and configure additional recipients to receive your Azure invoice in an email. This feature may not be available for certain subscriptions such as support offers, Enterprise Agreements, or Azure in Open.

Select your subscription from the Subscriptions page. Opt-in for each subscription you own. Click Invoices then Email my invoice.

Click Opt in and accept the terms.

Scenario: During the testing phase, auditors in the finance department must be able to review all Azure costs from the past week.