AZ-104 Azure Administrator
What are Resource Groups? - ANS-A container that holds related resources for an
Azure solution. Includes those resources (VMs, app services, storage account), that you
want to manage as a group.
Web developers cannot access Application Insights, in order to implement
insutrumentation, use web tests, and set up alerts - how do you allow them to do these
things? - ANS-Assign Component Contributor role to the resource group
sAMAccountName for an Active Directory user is too long - how do you fix this? -
ANS-Change the name to less than 20 characters with only letters and numbers and
apostrophes
Company has several departments, with multiple VMs in each, and resource group RG1
- how do you associate each VM to its department - ANS-Assign tags
How would you make sure members of an Azure group need to use MFA and an Azure
AD-joined device when connecting from untrusted locations? - ANS-New Conditional
Access Policy -> Select Users or workload identities under Assignments -> verify Users
and Groups is selected -> select users/ groups as required.
Choose Windows Azure Service Management API so it applies to sign-in events.
Under "Grant" select Grant Access + require MFA + require device to be marked as
compliant
And finally enable the policy + press "Create"
Which cmdlet allows a custom deployment of a linux server? - ANS-Az VM Create
allows for the optional tag of "--custom-data" which allows parsing a cloud init yml file.
How do you inject a certificate from Key Vault? - ANS-Create Key Vault -> generate
certificate and store -> prepare certificate -> create secure cloud-init config that includes
the lines required to gather certificate secrets.
How do you change the usage model setting for Azure AD? - ANS-You can't change the
usage model of an existing provider.
,You must delete and lose config settings then create a new one and reactivate the
existing server with activation credentials from the new provider.
How would you replicate a new on-prem Active Directory change to Azure AD? -
ANS-Use:
Start-ADSyncSyncCycle -PolicyType Delta
to synchronise only recent changes - assuming the initial was already done
Can also use Azure AD Connect if installed: Synchronisation Service -> connectors ->
actions/ run
policytype initial will do a full sync which can take a while for large directories - it is
usually done when you have changed Azure AD Connect Configuration
What is the NetLogon service on a domain controller? - ANS-Handles authenticating
users in to the domain. Can also do logging of Netlogon events
Which Azure storage redundancy would you recommend with these requirements:
Data must be stored on multiple nodes
Data must be stored on nodes in separate geographic locations
Data can be read for the secondary location as well as the primary at any time -
ANS-Read-only geo-redundant storage
This is like geo-redundant storage but the second location can also be read from even if
the primary has not done a failover to it.
What are the features of Locally-redundant storage? - ANS-Lowest cost option
11 nines
3 copies of the data on 3 separate machines in the same data centre.
What are the features of Zone-redundant storage? - ANS-Replication between 3
different availability zones in the same region
Each zone has separate power, cooling, and networking
12 nines
Recommended:
transient fault handling, implement retry policies with exponential back-off
How do you view the ARM template used to deploy a VM and Azure Storage account? -
ANS-Use the Resource Group blade -> select resources with checkboxes -> export
template
, Resizing a VM in an availability set fails. How do you resize it? - ANS-Stop all VMs in
the availability set, resize, restart one by one
This is because the hardware of that VM does not support the new size and new
hardware must be dedicated upon a reboot
When attaching a data disk from one VM to another, how would you do this while
keeping the VMs offline for as little time as possible? - ANS-Detach the disk, save, then
go to the other VM and attach exisiting disk
When aiming for the maximum number of VMs accessible in the event of failure or
maintenance: Which value should you set for platformUpdateDomainCount? - ANS-20
is the maximum number of update domains
Which resources do you need to create an ARM template that references an
administrative password that CANNOT be in plain text. - ANS-Azure Key Vault to store
the password, and an access policy
RBAC may be better as access policy is old
Which PowerShell cmdlet should you use to upload on-prem virtual hard disks for use in
Azure? - ANS-Use Add-AzVHD from your local machine
Requires: Azure PowerShell module
convert VHD to VHDx
convert to fixed size
resize to include the 512 byte offset
Hyper-V must be enabled.
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/upload-generalized-m
anaged
How should you ensure that some PowerShell scripts automatically configure some new
Windows VMs? - ANS-Configure a SetupComplete.cmd batch file in the
%windir%\setup\scripts directory
These will be run immediately after Windows is installed.
Enabled only for Enterprise and Server Windows editions.
What are Resource Groups? - ANS-A container that holds related resources for an
Azure solution. Includes those resources (VMs, app services, storage account), that you
want to manage as a group.
Web developers cannot access Application Insights, in order to implement
insutrumentation, use web tests, and set up alerts - how do you allow them to do these
things? - ANS-Assign Component Contributor role to the resource group
sAMAccountName for an Active Directory user is too long - how do you fix this? -
ANS-Change the name to less than 20 characters with only letters and numbers and
apostrophes
Company has several departments, with multiple VMs in each, and resource group RG1
- how do you associate each VM to its department - ANS-Assign tags
How would you make sure members of an Azure group need to use MFA and an Azure
AD-joined device when connecting from untrusted locations? - ANS-New Conditional
Access Policy -> Select Users or workload identities under Assignments -> verify Users
and Groups is selected -> select users/ groups as required.
Choose Windows Azure Service Management API so it applies to sign-in events.
Under "Grant" select Grant Access + require MFA + require device to be marked as
compliant
And finally enable the policy + press "Create"
Which cmdlet allows a custom deployment of a linux server? - ANS-Az VM Create
allows for the optional tag of "--custom-data" which allows parsing a cloud init yml file.
How do you inject a certificate from Key Vault? - ANS-Create Key Vault -> generate
certificate and store -> prepare certificate -> create secure cloud-init config that includes
the lines required to gather certificate secrets.
How do you change the usage model setting for Azure AD? - ANS-You can't change the
usage model of an existing provider.
,You must delete and lose config settings then create a new one and reactivate the
existing server with activation credentials from the new provider.
How would you replicate a new on-prem Active Directory change to Azure AD? -
ANS-Use:
Start-ADSyncSyncCycle -PolicyType Delta
to synchronise only recent changes - assuming the initial was already done
Can also use Azure AD Connect if installed: Synchronisation Service -> connectors ->
actions/ run
policytype initial will do a full sync which can take a while for large directories - it is
usually done when you have changed Azure AD Connect Configuration
What is the NetLogon service on a domain controller? - ANS-Handles authenticating
users in to the domain. Can also do logging of Netlogon events
Which Azure storage redundancy would you recommend with these requirements:
Data must be stored on multiple nodes
Data must be stored on nodes in separate geographic locations
Data can be read for the secondary location as well as the primary at any time -
ANS-Read-only geo-redundant storage
This is like geo-redundant storage but the second location can also be read from even if
the primary has not done a failover to it.
What are the features of Locally-redundant storage? - ANS-Lowest cost option
11 nines
3 copies of the data on 3 separate machines in the same data centre.
What are the features of Zone-redundant storage? - ANS-Replication between 3
different availability zones in the same region
Each zone has separate power, cooling, and networking
12 nines
Recommended:
transient fault handling, implement retry policies with exponential back-off
How do you view the ARM template used to deploy a VM and Azure Storage account? -
ANS-Use the Resource Group blade -> select resources with checkboxes -> export
template
, Resizing a VM in an availability set fails. How do you resize it? - ANS-Stop all VMs in
the availability set, resize, restart one by one
This is because the hardware of that VM does not support the new size and new
hardware must be dedicated upon a reboot
When attaching a data disk from one VM to another, how would you do this while
keeping the VMs offline for as little time as possible? - ANS-Detach the disk, save, then
go to the other VM and attach exisiting disk
When aiming for the maximum number of VMs accessible in the event of failure or
maintenance: Which value should you set for platformUpdateDomainCount? - ANS-20
is the maximum number of update domains
Which resources do you need to create an ARM template that references an
administrative password that CANNOT be in plain text. - ANS-Azure Key Vault to store
the password, and an access policy
RBAC may be better as access policy is old
Which PowerShell cmdlet should you use to upload on-prem virtual hard disks for use in
Azure? - ANS-Use Add-AzVHD from your local machine
Requires: Azure PowerShell module
convert VHD to VHDx
convert to fixed size
resize to include the 512 byte offset
Hyper-V must be enabled.
https://docs.microsoft.com/en-us/azure/virtual-machines/windows/upload-generalized-m
anaged
How should you ensure that some PowerShell scripts automatically configure some new
Windows VMs? - ANS-Configure a SetupComplete.cmd batch file in the
%windir%\setup\scripts directory
These will be run immediately after Windows is installed.
Enabled only for Enterprise and Server Windows editions.
