Microsoft Azure Administrator (AZ-104日本語版) - AZ-104日本語 Exam Practice Test

Explanation:
Detailed Explanation
' New-AzResourceLock ' is the Azure PowerShell cmdlet that creates a management lock at a specified scope;
' Lock-AzRmStorageContainerImmutabilityPolicy ' locks a blob container ' s immutability policy (unrelated to resource-group locks), and ' Set-AzResource ' / ' Set-AzAppConfigurationLock ' do not create resource locks. To prevent inadvertent MODIFICATION as well as deletion, the lock level must be ReadOnly - a CanNotDelete lock only blocks deletion and still allows administrators to change resource properties, which would not satisfy the requirement to prevent modification. A ReadOnly lock applied at RG1 scope prevents any write or delete operation on every resource in RG1 by any principal, including Owners, until the lock is removed, addressing the stated goal directly.
Official Reference
Lock resources to prevent unexpected changes - https://learn.microsoft.com/en-us/azure/azure-resource- manager/management/lock-resources

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Explanation:
Detailed Explanation
Free disk space on a guest volume is not a native Azure platform metric - it is a guest-OS performance counter that must be collected through the Log Analytics agent (or Azure Monitor Agent in current deployments) into a Log Analytics workspace before it can be alerted on. The correct sequence is therefore:
first create a Log Analytics workspace to serve as the destination for the collected data; second, enable and configure the " Windows Performance Counters " data source in that workspace to collect the LogicalDisk(C:)
\% Free Space (or Free Megabytes) counter from the Log Analytics agents running on VM1 and VM2; and third, create a log-search-based alert rule against that collected data with a threshold corresponding to under
20 GB free. " Configure the Diagnostic settings " and " Create an Azure SQL database " are distractors unrelated to guest-level disk-space alerting. Currency note: the classic Log Analytics (MMA) agent used in this workflow reached end of support on 31 August 2024; new deployments should use Azure Monitor Agent with a Data Collection Rule instead, though the conceptual sequence (workspace # collect counters # alert rule) is unchanged.
Official Reference
Collect Windows performance counters with Log Analytics agent - https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-performance-counters
Topic 4, Humongous Insurance
Overview
Existing Environment
Huongous Insurance is an insurance company that has three offices in Miami, Tokoyo, and Bankok. Each has
5000 users.
Active Directory Environment
Humongous Insurance has a single-domain Active Directory forest named humongousinsurance.com. The functional level of the forest is Windows Server 2012.
You recently provisioned an Azure Active Directory (Azure AD) tenant.
Network Infrastructure
Each office has a local data center that contains all the servers for that office. Each office has a dedicated connection to the Internet.
Each office has several link load balancers that provide access to the servers.
Active Directory Issue
Several users in humongousinsurance.com have UPNs that contain special characters.
You suspect that some of the characters are unsupported in Azure AD.
Licensing Issue
You attempt to assign a license in Azure to several users and receive the following error message: " Licenses not assigned. License agreement failed for one user. " You verify that the Azure subscription has the available licenses.
Requirements
Planned Changes
Humongous Insurance plans to open a new office in Paris. The Paris office will contain 1,000 users who will be hired during the next 12 months. All the resources used by the Paris office users will be hosted in Azure.
Planned Azure AD Infrastructure
The on-premises Active Directory domain will be synchronized to Azure AD.
All client computers in the Paris office will be joined to an Azure AD domain.
Planned Azure Networking Infrastructure
You plan to create the following networking resources in a resource group named All_Resources:
Default Azure system routes that will be the only routes used to route traffic A virtual network named Paris-VNet that will contain two subnets named Subnet1 and Subnet2 A virtual network named ClientResources-VNet that will contain one subnet named ClientSubnet A virtual network named AllOffices-VNet that will contain two subnets named Subnet3 and Subnet4 You plan to enable peering between Paris-VNet and AllOffices-VNet. You will enable the Use remote gateways setting for the Paris-VNet peerings.
You plan to create a private DNS zone named humongousinsurance.local and set the registration network to the ClientResources-VNet virtual network.
Planned Azure Computer Infrastructure
Each subnet will contain several virtual machines that will run either Windows Server 2012 R2, Windows Server 2016, or Red Hat Linux.
Department Requirements
Humongous Insurance identifies the following requirements for the company ' s departments:
Web administrators will deploy Azure web apps for the marketing department. Each web app will be added to a separate resource group. The initial configuration of the web apps will be identical. The web administrators have permission to deploy web apps to resource groups.
During the testing phase, auditors in the finance department must be able to review all Azure costs from the past week.
Authentication Requirements
Users in the Miami office must use Azure Active Directory Seamless Single Sign-on (Azure AD Seamless SSO) when accessing resources in Azure.

Explanation:
Detailed Explanation
Every fired Azure Monitor alert instance carries a user-editable ' User response ' /alert state with three values:
New (the default state when an alert first fires), Acknowledged (marks it as being actively investigated), and Closed (marks it resolved). Closed is the terminal state of this workflow - once an alert instance ' s user response is set to Closed, it can no longer be transitioned to a different state from that same instance; a fresh alert instance must fire again to obtain a new, editable ' New ' state. Alert1 ' s row shows User response = Closed, so per this rule it cannot be changed further. Alert2 ' s row shows User response = New, and from New the valid forward transitions are directly to Acknowledged or directly to Closed (the workflow does not require passing through Acknowledged first), matching ' can be changed to Acknowledged or Closed. ' Official Reference Manage your alert instances - Azure Monitor - https://learn.microsoft.com/en-us/azure/azure-monitor/alerts
/alerts-manage-alert-instances

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Explanation:
Detailed Explanation
Native client support - the ability to connect through Bastion using a local tool such as the Azure CLI ' s ' az network bastion rdp ' command instead of the browser-based portal experience - is a Standard SKU-only Bastion feature; Basic SKU supports only the in-portal HTML5 session. The sequence must therefore begin by upgrading Bastion1 from Basic to Standard SKU, since native client support cannot be enabled at all on Basic. Once upgraded, the administrator enables ' Native Client Support ' on the Bastion resource, which allows CLI/native RDP and SSH tunneling. Only after both prerequisites are in place can Device1 use ' az network bastion rdp --name Bastion1 --resource-group < rg > --target-resource-id < VM1 resource ID > ' to open a native Remote Desktop session to VM1, which lacks a public IP and therefore relies entirely on Bastion for connectivity. Kerberos authentication, JIT VM access, and a plain mstsc.exe call are all distractors unrelated to enabling native-client Bastion connectivity.
Official Reference
Connect to a VM using Bastion and native client - https://learn.microsoft.com/en-us/azure/bastion/native- client

Explanation:
Detailed Explanation
The deployment stack manages only VNet2 (the resource defined in Deploy.bicep); its DenySettingsMode DenyWriteAndDelete creates a deny assignment that blocks write and delete operations specifically on the stack ' s managed resources, and this deny assignment overrides ordinary Azure RBAC allow permissions - even for an Owner - because deny assignments always take precedence. So Admin1 (Owner at Sub1) can neither delete VNet2 nor modify it by adding a subnet: both are No. VNet1 is a pre-existing resource in RG1 that the stack does not manage, so it is completely unaffected by the deny assignment; Admin2 ' s Contributor role at RG1 scope includes Microsoft.Network/virtualNetworks/subnets/write, so Admin2 can add a subnet to VNet1: Yes.
Official Reference
Azure deployment stacks - protect managed resources with denySettings - https://learn.microsoft.com/en-us
/azure/azure-resource-manager/bicep/deployment-stacks

Explanation:
Detailed Explanation
For a hybrid-synchronized user, on-premises Active Directory (via Azure AD Connect) is the source of authority for most directory attributes, including JobTitle - the Microsoft Entra admin center blocks direct edits to such synced attributes for synced users, requiring the change to be made on-premises and synced down instead. User2 is synced (on-premises sync enabled = Yes), so JobTitle cannot be edited directly in Azure AD for User2, while cloud-only User1 and guest User3 (neither synced from on-premises) can have JobTitle edited directly. UsageLocation, by contrast, is a cloud-only attribute never sourced from on-premises AD synchronization at all - it exists purely to support Microsoft 365/Entra licensing and can always be edited directly in Azure AD for any user regardless of sync status. Both answers match the source document ' s key.
Official Reference
Azure AD Connect sync - attributes synchronized from on-premises Active Directory - https://learn.
microsoft.com/en-us/entra/identity/hybrid/connect/reference-connect-sync-attributes-synchronized

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).

Explanation: Only visible for PassTestking members. You can sign-up / login (it's free).