最新的Microsoft Azure Administrator (AZ-104 Korean Version) - AZ-104 Korean免費考試真題

說明：（僅 Fast2test 成員可見）

Explanation:
Detailed Explanation
Standard SKU resources cannot mix with Basic SKU resources on the same NIC - a VM whose NIC already carries a (Basic SKU) public IP cannot be added to a Standard Load Balancer ' s backend pool until that public IP is removed (or replaced with a Standard SKU one, but removal is the option offered here).
Separately, Standard Load Balancer and Standard public IPs are secure by default: unlike Basic SKU, all inbound traffic is implicitly denied unless an NSG explicitly allows it. Since VM1 currently has no NSG at all, no traffic reaching it through slb1 will succeed until an NSG is created and configured with the appropriate allow rules. Both selections reflect Microsoft ' s documented Standard Load Balancer prerequisites and match the source document ' s answer key.
Official Reference
Azure Standard Load Balancer overview - closed to inbound traffic by default - https://learn.microsoft.com
/en-us/azure/load-balancer/load-balancer-standard-overview

說明：（僅 Fast2test 成員可見）

說明：（僅 Fast2test 成員可見）

說明：（僅 Fast2test 成員可見）

Explanation:
Detailed Explanation
The exported template ' s networkAcls.defaultAction is ' Allow, ' meaning the storage firewall is not restricting any network (no ' Selected networks ' allowlist is in effect), so any public IP, including
131.107.103.10, can reach the account - Yes. The account kind is StorageV2 (general-purpose v2), which fully supports blob-level tiering to Hot, Cool, and Archive - Yes. Being a Microsoft Entra Global Administrator grants no implicit data-plane access to Azure Storage resources; Global Administrator is a directory-management role and does not, by itself, satisfy Azure Files ' identity-based authentication requirements (which additionally require configuring azureFilesIdentityBasedAuthentication and assigning an explicit RBAC data role such as Storage File Data SMB Share Contributor) - none of which are present in this template, so Global Administrators cannot access the file share using Azure AD credentials - No. All three selections match the source document ' s answer key.
Official Reference
Configure Azure Storage firewalls / Enable identity-based authentication for Azure Files - https://learn.
microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-enable

Explanation:
Detailed Explanation
Microsoft Entra ID explicitly excludes the ' Security questions ' authentication method from any account that holds an administrative directory role -- administrators (such as a Security Administrator or Billing Administrator) can never register or use security questions for SSPR, regardless of tenant-wide SSPR policy, because that method is considered too weak for privileged accounts. SecAdmin1 and BillAdmin1 therefore cannot be required to answer a security question (No, No), even though the tenant policy lists it as an available method. A standard, non-administrative user such as User1 has no such restriction; since only two methods are enabled tenant-wide (mobile phone and security questions) and two are required to reset, User1 must use both enabled methods, including the security question (Yes). This matches the source document ' s key.
Official Reference
Microsoft Entra self-service password reset authentication methods - https://learn.microsoft.com/en-us/entra
/identity/authentication/concept-sspr-howitworks

Explanation:
Detailed Explanation
App1 ' s three tiers (web front end, processing middle tier, SQL database) sit in the same Azure region
/subscription with no stated requirement for network isolation across regions, hybrid connectivity boundaries, or separate address spaces, so a single virtual network is sufficient and keeps the design simple and cost- effective, consistent with the " minimize administrative effort " requirement. The binding constraint is instead
" minimize the number of open ports between the App1 tiers, " which is achieved by placing each tier in its own subnet and then applying a network security group per subnet that permits only the specific ports each tier legitimately needs from its neighboring tier (for example, HTTPS from the Internet to the web subnet, and only the application port from web to middle tier, and only the SQL port from middle tier to the database subnet). That calls for three subnets - one per tier - inside one VNet. This is a standard three-tier network segmentation pattern and matches Microsoft ' s reference architecture guidance for multi-tier applications on Azure.
Official Reference
Network security groups overview - https://learn.microsoft.com/en-us/azure/virtual-network/network- security-groups-overview

Explanation:
Detailed Explanation
Each virtual machine requires exactly one NIC to carry both its private IP address and an associated public IP address (a NIC IP configuration supports one private and one public IP simultaneously), so five VMs require a minimum of five NICs - you cannot share a NIC across VMs. Because all five VMs require identical inbound and outbound security rules, a single NSG is sufficient: that one NSG can be associated with either the subnet or all five NICs, and its rule set applies uniformly to every attached resource. There is no requirement to create a separate NSG per VM when the rule sets are identical, so the minimum is 1, not 5.
Official Reference
Network security groups overview - https://learn.microsoft.com/en-us/azure/virtual-network/network- security-groups-overview

Explanation:
CORRECTED ANSWER: Subnet name: AzureBastionSubnet | Address prefix: 10.10.10.0/27) Detailed Explanation Azure Bastion requires a dedicated subnet with the exact, case-sensitive reserved name AzureBastionSubnet
- Azure will not deploy Bastion into a subnet with any other name, ruling out AzureFirewallSubnet (reserved for Azure Firewall instead), LAN01, and RemoteAccessSubnet. CURRENCY UPDATE: Microsoft Learn ' s current Azure Bastion configuration settings documentation states the subnet size " must be /26 or larger (/25, /24, etc.) " for Bastion resources deployed on or after 2 November 2021, with /26 specifically recommended to support host-scaling features - the older /27 minimum has been retired for new deployments. None of this question ' s offered address prefixes (/27, /29, /30) actually satisfies the current /26- or-larger requirement: /29 and /30 are far too small to ever have been valid, and /27, while it was the historical minimum before November 2021, no longer meets today ' s requirement for a new deployment. If forced to choose only among the given options, /27 is the closest/least-wrong, but administrators building a new template today should size AzureBastionSubnet at /26 or larger, which is not represented among this question
' s choices.
Official Reference
About Azure Bastion configuration settings - https://learn.microsoft.com/en-us/azure/bastion/configuration- settings

Explanation:
Lifecycle management: storage1, storage2, and storage3
The Archive access tier: storage2 only
Azure Blob Storage lifecycle management policies are supported for block blobs and append blobs in general-purpose v2 (StorageV2) accounts and premium BlockBlobStorage accounts. Therefore, storage1 and storage2 support lifecycle management because both are StorageV2 accounts, while storage3 also supports lifecycle management because it is a premium block blob account. Microsoft specifically lists lifecycle management policy support for these account types. However, premium BlockBlobStorage has an important limitation: lifecycle policies can perform supported operations such as deletion, but tiering to cool, cold, or archive is not supported for premium block blob storage.
Archive-tier eligibility is further restricted by the account ' s redundancy configuration. Microsoft states that the Archive tier supports only LRS, GRS, and RA-GRS . It does not support ZRS, GZRS, or RA-GZRS .
Consequently, storage1 cannot use Archive because it uses GZRS. storage3 cannot use Archive because it is both premium BlockBlobStorage and configured with ZRS. storage2 uses StorageV2 with RA-GRS , which satisfies both the account-type and redundancy requirements for Archive.
Reference topics: Azure Storage account types, Blob lifecycle management, access tiers, Archive tier, redundancy options, StorageV2 and premium BlockBlobStorage .

Explanation:
Detailed Explanation
Azure Backup ' s File Recovery feature (used to restore individual files without performing a full VM restore) is initiated from the Recovery Services vault ' s backup item by clicking File Recovery, then selecting the desired restore point, which generates a downloadable script/executable and an access password. Running that script mounts the recovery point as an accessible volume. For a Linux VM specifically, Microsoft ' s documentation directs users to copy the recovered files using command-line tools such as AzCopy or rsync
/scp, since a graphical File Explorer is a Windows-only concept and not applicable to a Linux source VM ' s recovered volume -- confirming AzCopy, not File Explorer, is the correct final step here. This sequence matches the source key exactly.
Official Reference
Recover files from an Azure virtual machine backup - https://learn.microsoft.com/en-us/azure/backup
/backup-azure-restore-files-from-vm

Explanation:
Detailed Explanation
To force all inbound traffic entering VNet1 (via the VPN/ExpressRoute gateway) through the network virtual appliance VM1, the route table must be associated with the GatewaySubnet - that is where traffic first lands after crossing the gateway, so a route there intercepts it before it reaches any workload subnet. The route ' s address prefix must cover the entire VNet1 address space (10.0.0.0/16) so that traffic destined for any subnet is redirected, and the next hop type must be Virtual appliance (pointing at VM1 ' s private IP), since Virtual network or Virtual network gateway next hop types would simply use default system routing rather than sending traffic to VM1. This matches Azure ' s documented user-defined route (UDR) pattern for forced tunneling through an NVA.
Official Reference
Virtual network traffic routing - https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks- udr-overview

Explanation:
Detailed Explanation
Azure Backup creates only one physical recovery point per scheduled run, but tags it with every retention rule that matches the day it falls on, and keeps that single recovery point for the longest of all matching retention periods. March 1 matches four rules simultaneously: it is a daily backup (30 days), it falls on a Sunday matching the weekly rule (10 weeks), it is the 1st of the month matching the day-based monthly rule (36 months), and - critically - it falls in March on day 1, exactly matching the day-based yearly rule (10 years).
The longest of these is 10 years, so the March 1 backup is retained for 10 years. November 1 matches the daily (30 days), weekly (10 weeks, since it is also a Sunday), and monthly (36 months, being the 1st of the month) rules, but it does not match the yearly rule, which is scoped specifically to March - so its longest applicable retention is 36 months. This reflects the standard " longest matching tag wins " behavior of GFS (grandfather-father-son) retention in Azure Backup policies.
Official Reference
Configure Azure VM backups with the enhanced policy - https://learn.microsoft.com/en-us/azure/backup
/backup-azure-vms-enhanced-policy