AZ-104-2

Question 51: 51. You have an Azure subscription that contains a virtual network named VNet1. You plan to deploy a virtual machine named VM1 to VNet1. You need to ensure that VM1 only allows inbound traffic from your on-premises network. Which two actions should you perform? Each correct answer presents part of the solution. E. Create an outbound security rule

• Create a network security group (NSG)
• Create an Azure firewall
• Configure a service endpoint
• Create an inbound security rule

Question 52: 52. You need to grant a user the ability to create and manage all types of resources in a resource group. Which Azure role should you assign to the user?

• Owner
• Contributor
• Reader
• User Access Administrator

Question 53: 53. You have an Azure subscription that contains a storage account. You have an on-premises server that runs Windows Server 2016. You plan to back up the server to the storage account. You need to create a Recovery Services vault for the backups. What is the minimum number of Recovery Services vaults that you must create?

• 0
• 1
• 2
• 3

Question 54: 54. You have an Azure subscription that contains the resources shown in the following table: [Table showing: StorageAccount1 in RG1, VM1 in RG1, VM2 in RG2, VNet1 in RG2] You plan to configure replication of VM1 to another Azure region. You need to create a Recovery Services vault for the planned configuration. In which resource group should you create the Recovery Services vault?

• RG1
• RG2
• A new resource group
• Any existing resource group

Question 55: 55. You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains four subnets named Gateway, Perimeter, NVA, and Production. You have an on-premises network that uses the 10.0.0.0/24 address space. You need to create a site-to-site VPN between the on-premises network and VNet1. Which subnet should you use for the VPN gateway?

• Gateway
• Perimeter
• NVA
• Production

Question 56: 56. You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a subnet named Subnet1. You have an on-premises network that contains several servers. You need to ensure that all Azure-bound traffic from the on-premises network is routed through a network virtual appliance (NVA) in VNet1. What should you create?

• A local network gateway
• A route table
• An application security group
• A network security group (NSG)

Question 57: 57. You have an Azure subscription that contains a virtual network named VNet1. You plan to deploy several Azure virtual machines to VNet1. You need to ensure that the services running on the virtual machines are accessible from the internet over HTTP. What should you create?

• A load balancer
• An application gateway
• A network security group (NSG)
• A firewall

Question 58: 58. You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains one subnet named Subnet1. You need to create a private endpoint for a storage account named storage1. Which IP address will be assigned to the private endpoint?

• A public IP address from the Azure IP address pool
• A private IP address from the address space of VNet1
• A private IP address from the address space of Subnet1
• A private IP address from a custom IP address pool

Question 59: 59. You have an Azure subscription that contains a virtual network named VNet1. VNet1 contains a subnet named Subnet1. You plan to deploy an Azure Kubernetes Service (AKS) cluster to Subnet1. You need to ensure that the AKS cluster can create and use an internal load balancer. Which networking component should you add to VNet1?

• A network security group (NSG)
• A route table
• A network virtual appliance
• A NAT gateway

Question 60: 60. You have an Azure subscription that contains a virtual network named VNet1. You plan to deploy an Azure Bastion host. Which two actions must you perform before you can deploy the Azure Bastion host? Each correct answer presents part of the solution. E. Create a VPN gateway

• Create a public IP address
• Create a virtual machine
• Create a gateway subnet
• Create an AzureBastionSubnet subnet