Free AZ-104 Exam Braindumps
Microsoft Azure Administrator Questions 193–200 (page: 26)

Explanation:

Box 1: Premium SSD that uses zone-redundant storage (ZRS) Use Premium SSD for lowest latency and highest performance.
Zone-redundant storage (ZRS) copies your data synchronously across three Azure availability zones in the primary region. For applications requiring high availability, Microsoft recommends using ZRS in the primary region, and also replicating to a secondary region.
Incorrect:
Locally redundant storage (LRS) copies your data synchronously three times within a single physical location in the primary region. LRS is the least expensive replication option, but isn't recommended for applications requiring high availability or durability.
Box 2: Read/Write
Host caching works by bringing storage closer to the VM that can be written or read to quickly.
You can adjust the host caching to match your workload requirements for each disk. You can set your host caching to be:
Read-only: For workloads that only do read operations
Read/write: For workloads that do a balance of read and write operations
If your workload doesn't follow either of these patterns, we don't recommend that you use host caching. Reference:
https://learn.microsoft.com/en-us/azure/storage/common/storage-redundancy https://learn.microsoft.com/en-us/azure/virtual-machines/disks-performance

Explanation:

B: Set up a key encryption key (optional)
If you want to use a key encryption key (KEK) for an additional layer of security for encryption keys, add a KEK to your key vault. Use the Add-AzKeyVaultKey cmdlet to create a key encryption key in the key vault. You can also import a KEK from your on-premises key management HSM.
E: Set key vault advanced access policies
The Azure platform needs access to the encryption keys or secrets in your key vault to make them available to the VM for booting and decrypting the volumes. Enable disk encryption on the key vault or deployments will fail.
Set key vault advanced access policies through the Azure portal
1. Select your keyvault, go to Access Policies, and Click to show advanced access policies.
2. Select the box labeled Enable access to Azure Disk Encryption for volume encryption.
3. Select Enable access to Azure Virtual Machines for deployment and/or Enable Access to Azure Resource Manager for template deployment, if needed.
4. Select Save.

Reference:

https://learn.microsoft.com/en-us/azure/virtual-machines/windows/disk-encryption-key-vault-aad

Explanation:

Azure Disk Encryption helps protect and safeguard your data to meet your organizational security and compliance commitments. ADE encrypts the OS and data disks of Azure virtual machines (VMs) inside your
VMs by using the DM-Crypt feature of Linux or the BitLocker feature of Windows. ADE is integrated with Azure Key Vault to help you control and manage the disk encryption keys and secrets, with the option to encrypt with a key encryption key (KEK).
Note: There are several types of encryption available for your managed disks, including Azure Disk Encryption (ADE), Server-Side Encryption (SSE) and encryption at host.
Incorrect:
Confidential disk encryption
Confidential disk encryption binds disk encryption keys to the virtual machine's TPM and makes the protected disk content accessible only to the VM. The TPM and VM guest state is always encrypted in attested code using keys released by a secure protocol that bypasses the hypervisor and host operating system. Currently only available for the OS disk.
Encryption at host
Encryption at host is a Virtual Machine option that enhances Azure Disk Storage Server-Side Encryption to ensure that all temp disks and disk caches are encrypted at rest and flow encrypted to the Storage clusters.
When you enable encryption at host, that encryption starts on the VM host itself, the Azure server that your VM is allocated to. The data for your temporary disk and OS/data disk caches are stored on that VM host. After enabling encryption at host, all this data is encrypted at rest and flows encrypted to the Storage service, where it is persisted. Essentially, encryption at host encrypts your data from end-to-end. Encryption at host does not use your VM's CPU and doesn't impact your VM's performance.

Reference:

https://learn.microsoft.com/en-us/azure/virtual-machines/disk-encryption-overview

Explanation:

Reference:

https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview

Explanation:

Create SAS tokes for your storage containers
User delegation SAS tokens are secured with Microsoft Entra credentials. SAS tokens provide secure, delegated access to resources in your Azure storage account.
SAS tokens support HTTP, but it is recommended to require HTTPS. Note: Azure Blob Storage offers three resource types:
Storage accounts provide a unique namespace in Azure for your data.
Data storage containers are located in storage accounts and organize sets of blobs (files, text, or images). Blobs are located in containers and store text and binary data such as files, text, and images.
Incorrect:
an access policy
A stored access policy provides an additional level of control over service-level shared access signatures (SASs) on the server side. Establishing a stored access policy serves to group shared access signatures and to provide additional restrictions for signatures that are bound by the policy.
You can use a stored access policy to change the start time, expiry time, or permissions for a signature. You can also use a stored access policy to revoke a signature after it has been issued.
Azure Content Delivery Network (CDN)
A content delivery network (CDN) is a distributed network of servers that can efficiently deliver web content to users. A CDN store cached content on edge servers in point-of-presence (POP) locations that are close to end users, to minimize latency.
* access keys
When you create a storage account, Azure generates two 512-bit storage account access keys for that account. These keys can be used to authorize access to data in your storage account via Shared Key authorization, or via SAS tokens that are signed with the shared key.

Reference:

https://learn.microsoft.com/en-us/azure/ai-services/translator/document-translation/how-to-guides/create-sas- tokens

Explanation:

B, not D: Cool access tire minimizes costs for infrequently accessed data compared to the Hot access tier. C, not A: Need geo-redundant storage (GRS) to replicate data to a secondary Azure region.
E: Need hierarchical namespace for Azure Data Lake Storage.
Note: A key mechanism that allows Azure Data Lake Storage Gen2 to provide file system performance at object storage scale and prices is the addition of a hierarchical namespace. This allows the collection of objects/files within an account to be organized into a hierarchy of directories and nested subdirectories in the same way that the file system on your computer is organized. With a hierarchical namespace enabled, a storage account becomes capable of providing the scalability and cost-effectiveness of object storage, with file system semantics that are familiar to analytics engines and frameworks.

Reference:

https://learn.microsoft.com/en-us/azure/storage/blobs/data-lake-storage-namespace

Explanation:

Box 1: Yes
We see: tierToCool daysAfterCreationGreaterThan 15
Example:
The following sample JSON defines a lifecycle policy that moves a block blob whose name begins with log to the cool tier if it has been more than 30 days since the blob was modified.
{
"rules": [
{
"enabled": true, "name": "move-to-cool",
"type": "Lifecycle", "definition": { "actions": {
"baseBlob": { "tierToCool": {
"daysAfterModificationGreaterThan": 30
}
}
},
"filters": {
"blobTypes": [ "blockBlob"
],
"prefixMatch": [ "sample-container/log"
]
}
}
}
]
}
Box 2: No
We see: prefixMatch container1
The lifecycle management policy does not apply to container2.
Note: Blob storage versioning automatically maintains previous versions of an object and identifies them with timestamps. You can restore a previous version of a blob to recover your data if it's erroneously modified or deleted.
Box 3: No
We see: tierToArchive: daysAfterLastTierChangeGreaterThan 7 After 7 days, not after 30 days.
Note:
In order to read or download a blob that is in the archive tier, it needs to be moved to the online tier, hot or cool and this process is called rehydration.

Reference:

https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-policy-configure https://sigmoidanalytics.medium.com/rehydrate-bulk-archived-data-in-azure-storage-using-powershell-script- 7886f7286375
https://learn.microsoft.com/en-us/azure/storage/blobs/versioning-enable

Explanation:

Storage account type
When planning to change your replication settings, consider the following limitations related to the storage account type.
The following table provides an overview of redundancy options available for storage account types and whether conversion and manual migration are supported:


Replication change table
The following table provides an overview of how to switch from each type of replication to another.


Incorrect:
storage1
Standard general purpose v1 does not support ZRS.
storage3
Need to switch to LRS first, then perform a conversion to ZRS.
* storage4
Blob storage does not support conversion.

Reference:

https://learn.microsoft.com/en-us/azure/storage/common/redundancy-migration?tabs=portal#storage-account- type
https://learn.microsoft.com/en-us/azure/storage/common/redundancy-migration