Microsoft AZ-104 - Questions & Answers

Virtual network peering provides private connectivity between two VNets over the Microsoft backbone without requiring a VPN gateway, which keeps administration overhead low. Once peered, resources can communicate using private IP addresses as if they were on the same network.
Compared to a site-to-site VPN, peering avoids gateway deployment/configuration and is typically the simplest approach for Azure-to-Azure connectivity when the requirement is communication between VNets.

AZ-104 Exam Objective Hierarchy (Mapped to this question) 4.0 Implement and manage virtual networking (15-20%) 4.1 Configure and manage virtual networks in Azure 4.1.2 Create and configure virtual network peering

Scenario: Litware must meet technical requirements including: Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in the Montreal office.
IP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of direction, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a security group, the name of the rule that denied the packet is returned. While any source or destination IP can be chosen, IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to the on-premises environment.

References:
https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview

To automate notifications based on VM changes, a common pattern is: Event Grid captures the VM resource event and triggers a Logic App, which can then send email or post messages (for example to Teams) without requiring custom code.

AZ-104 Exam Objective Hierarchy (Mapped to this question) 5.0 Monitor and maintain Azure resources (10-15%) 5.1 Monitor resources in Azure 5.1.4 Set up alert rules, action groups, and alert processing rules in Azure Monitor

Scenario: Ensure Azure Multi-Factor Authentication (MFA) for the users in the finance department only.

The recommendation is to use conditional access policies that can then be targeted to groups of users, specific applications, or other conditions.

Technically, The finance department needs to migrate their users from AD to AAD using AADC based on the finance OU, and need to enforce MFA use. This is conditional access policy. Employees also often get promotions and/or join other departments and when that occurs, the user's OU attribute will change when the admin puts the user in a new OU, and the dynamic group conditional access exception (OU= [Department Name Value]) will move the user to the appropriate dynamic group on next AADC delta sync.

References:
https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates
https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamicmembership
https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview

Cost analysis: Correct Option

In cost analysis blade of Azure, you can see all the detail for custom time span. You can use this to determine expenditure of last few day, weeks, and month. Below options are available in Cost analysis blade for filtering information by time span: last 7 days , last 30 days, and custom date range. Choosing the first option (last 7 days) auditors can view the costs by time span.

Cost analysis shows data for the current month by default. Use the date selector to switch to common date ranges quickly. Examples include the last seven days, the last month, the current year, or a custom date range. Pay-as-you-go subscriptions also include date ranges based on your billing period, which isn't bound to the calendar month, like the current billing period or last invoice. Use the <PREVIOUS and
NEXT> links at the top of the menu to jump to the previous or next period, respectively. For example, <PREVIOUS will switch from the Last 7 days to 8-14 days ago or 15-21 days ago.

Invoice: Incorrect Option

Invoices can only be used for past billing periods not for current billing period, i.e. if your requirement is to know the last week's cost then that also not filled by invoices because Azure generates invoice at the end of the month. Even though Invoices have custom timespan, but when you put in dates for a week, the pane would be empty.

Resource Provider: Incorrect Option

When deploying resources, you frequently need to retrieve information about the resource providers and types. For example, if you want to store keys and secrets, you work with the Microsoft.KeyVault resource provider. This resource provider offers a resource type called vaults for creating the key vault. This is not useful for reviewing all Azure costs from the past week which is required for audit.

Payment method: Incorrect Option

Payment methods is not useful for reviewing all Azure costs from the past week which is required for audit.

References:
https://docs.microsoft.com/en-us/azure/cost-management-billing/costs/quick-acm-cost-analysis
https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/download-azure-invoice-daily-usage-date