HOTSPOT (Drag and Drop is not supported)You have a Microsoft Entra tenant that contains a user named User1.You review the licenses assigned to User1 as shown in the following exhibit.Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.NOTE: Each correct selection is worth one point.Hot Area:
Answer(s): A
Box 1: 1User1 is consuming for Microsoft Intune.User1 has one Microsoft Intune Suite License through Microsoft 365 E5 Intune direct assignment. User1 has one Microsoft Intune Suite License through Microsoft Intune Suite direct assignment. User1 has one Microsoft Intune Suite License through Microsoft Intune Suite inherited (Group1).Note: Multiple groups and multiple licensesA user can be a member of multiple groups with licenses. Here are some things to consider:Multiple licenses for the same product can overlap, and they result in all enabled services being applied to the user. An example could be that M365-P1 contains the foundational services to deploy to all users, and M365- P2 contains the P2 services to deploy only to some users. You can add a user to one or both groups and only use one license for the product.Note 1:Direct licenses coexist with group licensesWhen you use group-based licensing, consider the following scenarios:Users still use only one license of a product if different license options for that product are used in the different group-based licenses.Note 2: Microsoft IntuneThe following plans are available for Microsoft Intune.Microsoft Intune Plan 1A cloud-based unified endpoint management solution that is included in the following licenses:-> Microsoft 365 E5 Microsoft 365 E3 Etc.Microsoft Intune SuiteAn add-on to Microsoft Intune Plan 1 that unifies mission-critical advanced endpoint management and security solutions.Etc.Box 2: unassign the license for User1 and remove User1 from Group1.To remove Microsoft Fabric (Free) from the license assignments of user1, you must .User1 has one Microsoft Fabric (Free) through direct assignment. User1 has one Microsoft Fabric (Free) through inherited (Group1).
https://learn.microsoft.com/en-us/mem/intune/fundamentals/licenses https://learn.microsoft.com/en-us/entra/identity/users/licensing-group-advanced
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that is linked to a Microsoft Entra tenant named contoso.com. The tenant contains the users shown in the following table.You enable self-service password reset (SSPR) for all users and configure SSPR to have the following authentication methods:Number of methods required to reset: 2Methods available to users: Mobile phone, Security questions Number of questions required to register: 3Number of questions required to reset: 3 You select the following security questions:What is your favorite food?In what city was your first job?What was the name of your first pet?For each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: NoNo - SecAdmin1 must answer the following question during the self-service password rest: In What city was your first job?SecAdmin1 is Security Administrator.Note:Azure administrators have some restrictions on using SSPR that are different to regular user accountsMicrosoft enforces a strong default two-gate password reset policy for any Azure administrator role. This prevents administrators from using security questions.Administrator reset policy differencesBy default, administrator accounts are enabled for self-service password reset, and a strong default two-gate password reset policy is enforced.The two-gate policy requires two pieces of authentication data, such as an email address, authenticator app, or a phone number, and it prohibits security questions.A two-gate policy applies in the following circumstances:All the following Azure administrator roles are affected:* Billing Administrator* Security Administrator* Etc.Box 2: NoNo - BillAdmin1 must answer the following question during the self-service password reset: What is your favorite food?BillAdmin1 is Billing Administrator. Box 3: YesYes- User must answer the following question during the self-service password reset: What was the name of your first pet?User is Reports Reader.All three questions will be used. Reference:https://learn.microsoft.com/en-us/entra/identity/authentication/concept-sspr-policy https://learn.microsoft.com/en-us/entra/identity/authentication/passwords-faq
You have a Microsoft Entra tenant that contains the identities shown in the following table.You have a custom security attribute named Attr1. You need to assign Attr1 to all the supported identities. To which identities can you assign Attr1?
Answer(s): D
Custom security attributes in Microsoft Entra IDCustom security attributes in Microsoft Entra ID are business-specific attributes (key-value pairs) that you can define and assign to Microsoft Entra objects. These attributes can be used to store information, categorize objects, or enforce fine-grained access control over specific Azure resources.Objects that support custom security attributesYou can add custom security attributes for the following Microsoft Entra objects: Microsoft Entra usersMicrosoft Entra enterprise applications (service principals)
https://learn.microsoft.com/en-us/entra/fundamentals/custom-security-attributes-overview
You have an Azure subscription that contains two users named User1 and User2.You need to enable self-service password reset (SSPR) for User1. The solution must ensure that SSPR is disabled for User2.What should you do first?
How to migrate MFA and SSPR policy settings to the Authentication methods policy for Microsoft Entra IDYou can migrate Microsoft Entra ID legacy policy settings that separately control multifactor authentication (MFA) and self-service password reset (SSPR) to unified management with the Authentication methods policy.Note: Authentication methods policyThe Authentication methods policy is the recommended way to manage authentication methods, including modern methods like passwordless authentication. Authentication Policy Administrators can edit this policy to enable authentication methods for all users or specific groups.Methods enabled in the Authentication methods policy can typically be used anywhere in Microsoft Entra ID, for both authentication and password reset scenarios.
https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-authentication-methods-manage https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods-manage
You have an Azure subscription that contains a virtual machine named VM1 and two users named User1 and User2.You assign User1 the Contributor role for VM1.Which two actions can User1 perform on VM1? Each correct answer presents a complete solution.NOTE: Each correct selection is worth one point.
Answer(s): A,D
ContributorGrants full access to manage all resources, but does not allow you to assign roles in Azure RBAC[Not B, Not C], manage assignments in Azure Blueprints, or share image galleries [Not E].
https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/privileged
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that contains a storage account named contoso2023. The contoso2023 storage account contains the resources shown in the following table.The contoso2023 storage account is configured as shown in the following exhibit.You have a Microsoft Entra tenant that contains the users shown in the following table.For each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
Grant limited access to Azure Storage resources using shared access signatures (SAS) Azure Storage supports three types of shared access signatures:User delegation SAS Service SAS Account SASBox 1: YesYes - User1 can access the content in cont1.User1: User delegation SAS with maximum available permissionA user delegation SAS is secured with Microsoft Entra credentials and also by the permissions specified for the SAS. A user delegation SAS is supported for Blob Storage and Data Lake Storage, and can be used for calls to blob endpoints and dfs endpoints. It's not currently supported for Queue Storage, Table Storage, or Azure Files.Box 2: NoNo - User2 can access the content in cont1.User2: Service SAS with maximum available permissionA service SAS is secured with the storage account key. However, we see that: Allow account key access is disabled.Box 3: NoNo - User3 can access the content in cont1.User3: Account SAS with maximum available permissionAn account SAS is secured with the storage account key. However, we see that: Allow account key access is disabled.Note:
https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription that is linked to a Microsoft Entra tenant.Self-service password reset (SSPR) is enabled for all users and is configured as shown in the Registrationexhibit. (Click the Registration tab.)The tenant contains the users shown in the following table.User1 and User2 use SSPR successfully.You update the SSPR authentication methods as shown in the Authentication methods exhibit. (Click theAuthentication methods tab.)You create a user named User3. User3 signs in to the tenant.For each of the following statements, select Yes if the statement is true. Otherwise, select No.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: NoNo - User1 can reset their password by using SSPR.User1 has the following registered SSPR authentication methods: Mobile app code, Email, Mobile phone (SMS only)Password reset, Authentication methods are configured as:Number of methods required to reset: 2Methods available to users: Mobile app notification [User2], Email[User1, User2] User1 can only use one method. Two are required.Box 2: YesYes - User2 can reset their password by using SSPR.User1 has the following registered SSPR authentication methods: Mobile app notification[OK], Mobile app code, Email[OK], Security QuestionsUser2 can use the two required methods. Box 3: YesYes - User3 can skip SSR registration for a maximum of 180 days.We see: Number of days before users are asked to re-confirm their authentication information: 180 Yes, as User3 has successfully signed in just now.
You have an Azure subscription that contains a resource group named RG1. RG1 contains the resources shown in the following table.You plan to assign the Azure policy shown in the exhibit. (Click the Exhibit tab)What will occur when the policy is assigned?
We see:Policy scope: RG1 Exclusion: RG1/VM1Policy definition: Require tag on resources Policy enforcement: EnabledParameters, Tag name: Tag1Note: With "Policy enforcement: Enabled" in Azure Policy, you're activating the enforcement of policies, meaning they will be actively applied to your Azure resources. This will prevent the creation or modification of non-compliant resources, ensuring they adhere to your defined rules and compliance requirements.
https://learn.microsoft.com/en-us/azure/governance/policy/tutorials/create-and-manage
Post your Comments and Discuss Microsoft AZ-104 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-104 content, but please register or login to continue.