Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Azure Storage account named storage1.You need to enable a user named User1 to list and regenerate storage account keys for storage1. Solution: You assign the Reader and Data Access role to User1.Does this meet the goal?
Answer(s): B
Correct:You assign the Storage Account Key Operator Service Role to User1.To rotate an account's access keys, the user must either be a Service Administrator, or must be assigned an Azure role that includes the Microsoft.Storage/storageAccounts/regeneratekey/action. Some Azure built-in roles that include this action are the Owner, Contributor, and Storage Account Key Operator Service Role roles.Incorrect:* You assign the Reader and Data Access role to User1.You assign the Storage Account Encryption Scope Contributor Role to User1.
https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Azure Storage account named storage1.You need to enable a user named User1 to list and regenerate storage account keys for storage1. Solution: You assign the Storage Account Key Operator Service Role to User1.Does this meet the goal?
Answer(s): A
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Azure Storage account named storage1.You need to enable a user named User1 to list and regenerate storage account keys for storage1. Solution: You assign the Storage Account Encryption Scope Contributor Role to User1.Does this meet the goal?
Correct:You assign the Storage Account Key Operator Service Role to User1.To rotate an account's access keys, the user must either be a Service Administrator, or must be assigned an Azure role that includes the Microsoft.Storage/storageAccounts/regeneratekey/action. Some Azure built-in roles that include this action are the Owner, Contributor, and Storage Account Key Operator Service Role roles.Incorrect:* You assign the Reader and Data Access role to User1.* You assign the Storage Account Encryption Scope Contributor Role to User1.
You have an Azure subscription that contains a Standard SKU Azure container registry named ContReg1. You need to ensure that ContReg1 supports geo-replication.What should you do first for ContReg1?
Answer(s): E
Geo-replication is a feature of Premium registries. If your registry isn't yet Premium, you can change from Basic and Standard to Premium in the Azure portal.
https://learn.microsoft.com/en-us/azure/container-registry/container-registry-geo-replication
Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.You have an Azure Storage account named storage1.You need to enable a user named User1 to list and regenerate storage account keys for storage1. Solution: You assign the Storage Account Contributor role to User1.Does this meet the goal?
The Storage Account Contributor role allows a user to manage the storage account, which includes actions like listing and regenerating storage account keys. Therefore, assigning this role to User1 meets the requirement of enabling them to list and regenerate storage account keys for storage1.
You have an Azure subscription that contains the Azure container instances shown in the following table.You create a storage account that contains a file share named storage1 in the East US Azure region. You need to mount storage1 to the container instances.To which container instances can you mount storage1?
Mount an Azure file share in Azure Container InstancesAzure Container Instances can mount an Azure file share created with Azure Files. You can only mount Azure Files shares to Linux containers.
https://learn.microsoft.com/en-us/azure/container-instances/container-instances-volume-azure-files
HOTSPOT (Drag and Drop is not supported)You have an Azure subscription.You plan to create the Azure Storage account as shown in the following exhibit.Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.NOTE: Each correct selection is worth one point.Hot Area:
Box 1: 3The minimum number of copies of the storage account will be . We see Replication: Locally-redundant storage (LRS)Locally redundant storage (LRS) replicates your storage account three times within a single data center in the primary region.Box 2: Access tier (default)To reduce the cost of infrequently access data in the storage account, you must modify thesetting.We see Access tier (default): Hot Access tiers for blob dataAzure Storage access tiers include:Hot tier - An online tier optimized for storing data that is accessed or modified frequently. The hot tier has the highest storage costs, but the lowest access costs.Cool tier - An online tier optimized for storing data that is infrequently accessed or modified. Data in the cooltier should be stored for a minimum of 30 days. The cool tier has lower storage costs and higher access costs compared to the hot tier.Cold tier - An online tier optimized for storing data that is rarely accessed or modified, but still requires fast retrieval. Data in the cold tier should be stored for a minimum of 90 days. The cold tier has lower storage costs and higher access costs compared to the cool tier.
https://learn.microsoft.com/en-us/azure/storage/common/storage-redundancy https://learn.microsoft.com/en-us/azure/storage/blobs/access-tiers-overview
You have an Azure subscription that contains the resources shown in the following table.The Not allowed resource types Azure policy that has policy enforcement enabled is assigned to RG1 and uses the following parameters:Microsoft.Network/virtualNetworks Microsoft.Compute/virtualMachinesIn RG1, you need to create a new virtual machine named VM2 which is connected to VNET1. What should you do first?
Answer(s): D
Allow vírtual machines to be created again.Note: Disallow resource types in your cloud environmentOne popular goal of cloud governance is restricting what resource types are allowed in the environment. Businesses have many motivations behind resource type restrictions. For example, resource types might be costly or might go against business standards and strategies. Rather than using many policies for individual resource types, Azure Policy offers two built-in policies to achieve this goal:Allowed resource typesThis policy enables you to specify the resource types that your organization can deploy* Not allowed resource typesRestrict which resource types can be deployed in your environment. Limiting resource types can reduce the complexity and attack surface of your environment while also helping to manage costs. Compliance results are only shown for non-compliant resources.The first step in disabling resource types is to assign the Not allowed resource types policy definition. Reference:https://learn.microsoft.com/en-us/azure/governance/policy/tutorials/disallowed-resources
Post your Comments and Discuss Microsoft AZ-104 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the AZ-104 content, but please register or login to continue.