Microsoft Azure Administrator (AZ-104日本語版) - AZ-104日本語 Exam Practice Test

Explanation:
CORRECTED ANSWER: On the virtual networks: Enable peering between VNet1 and VNet2. On Bastion1:
Enable IP-based connection.
Detailed Explanation
The exhibit ' s baked-in selection ( ' Deploy an additional Azure Bastion host to VNet2 ' + ' Enable Kerberos authentication ' ) fails the stated goal of minimizing cost: deploying a second Standard-SKU Bastion host in VNet2 doubles the hourly Bastion charge, and Kerberos authentication only affects native-client sign-in protocol, not cross-VNet reachability. The Standard SKU feature ' IP-based connection ' lets a single Bastion host RDP/SSH to any private IP address reachable from its VNet, including VMs in a peered VNet, without deploying another Bastion instance. Because Bastion1 and VM1 ' s VNet are not peered, VNet peering (a free, low-effort control-plane construct) must be established first so that Bastion1 ' s VNet has network reachability to VM1 ' s private IP; IP- based connection is then enabled on Bastion1 to permit connecting to that out-of- VNet address. This combination satisfies both cost and effort minimization without additional Bastion or gateway resources.
Official Reference
Connect to a VM using IP address through Bastion - https://learn.microsoft.com/en-us/azure/bastion
/connect-ip-address

Explanation:
Detailed Explanation
Every fired Azure Monitor alert instance carries a user-editable ' User response ' /alert state with three values:
New (the default state when an alert first fires), Acknowledged (marks it as being actively investigated), and Closed (marks it resolved). Closed is the terminal state of this workflow - once an alert instance ' s user response is set to Closed, it can no longer be transitioned to a different state from that same instance; a fresh alert instance must fire again to obtain a new, editable ' New ' state. Alert1 ' s row shows User response = Closed, so per this rule it cannot be changed further. Alert2 ' s row shows User response = New, and from New the valid forward transitions are directly to Acknowledged or directly to Closed (the workflow does not require passing through Acknowledged first), matching ' can be changed to Acknowledged or Closed. ' Official Reference Manage your alert instances - Azure Monitor - https://learn.microsoft.com/en-us/azure/azure-monitor/alerts
/alerts-manage-alert-instances

Explanation:
Detailed Explanation
Resource locks applied directly to an individual resource (as opposed to locks applied at the resource-group scope) do not block a move operation. Microsoft Learn ' s resource-locking guidance clarifies that a CanNotDelete (Delete) lock never blocks moves, and a ReadOnly lock only blocks moving resources into or out of a resource group when the lock is applied at the resource-group level - a ReadOnly lock on an individual resource such as VNET1 or VNET2 here does not prevent that specific resource from being relocated. Since every lock in this scenario (Lock1/Delete on the storage accounts, Lock2/ReadOnly on the virtual networks) is scoped to the resource, not the resource group, all three resources in each group (the public IP, the virtual network, and the storage account) remain movable. This matches the source document ' s answer key.
Official Reference
Lock resources to prevent unexpected changes - move behavior - https://learn.microsoft.com/en-us/azure
/azure-resource-manager/management/lock-resources

Explanation:
Detailed Explanation
To force all inbound traffic entering VNet1 (via the VPN/ExpressRoute gateway) through the network virtual appliance VM1, the route table must be associated with the GatewaySubnet - that is where traffic first lands after crossing the gateway, so a route there intercepts it before it reaches any workload subnet. The route ' s address prefix must cover the entire VNet1 address space (10.0.0.0/16) so that traffic destined for any subnet is redirected, and the next hop type must be Virtual appliance (pointing at VM1 ' s private IP), since Virtual network or Virtual network gateway next hop types would simply use default system routing rather than sending traffic to VM1. This matches Azure ' s documented user-defined route (UDR) pattern for forced tunneling through an NVA.
Official Reference
Virtual network traffic routing - https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks- udr-overview

Explanation:
Detailed Explanation
Azure Backup reports require that the Recovery Services vault, the destination storage account, and the destination Log Analytics workspace used in the AzureBackupReports diagnostic setting all reside in the same Azure region as the vault, due to how the backup reporting data pipeline is built. Vault1 is located in West Europe. Of the three storage accounts, only storage3 is in West Europe (storage1 is East US, storage2 is West US), so storage3 is the only valid destination. Of the three Log Analytics workspaces, only Analytics3 is in West Europe (Analytics1 is East US, Analytics2 is West US), so Analytics3 is the only valid destination.
Selecting a storage account or workspace in any other region would be rejected by the Diagnostics settings blade for this log.
Official Reference
Configure Azure Backup reports - https://learn.microsoft.com/en-us/azure/backup/configure-reports

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Explanation:
CORRECTED ANSWER: Allowed resource types: Container and Object (both required). Allowed permissions: Read and List (both required); leave Service, Write, Delete, Add, Create, Update, Process, Immutable storage, and Permanent delete unchecked.
Detailed Explanation
Per Microsoft ' s Create Account SAS reference table, the List Blobs (enumerate) operation is only authorized when the SAS includes the Container resource type together with the List permission, while the Get Blob (download) operation is only authorized when the SAS includes the Object resource type together with the Read permission - Container and Object are distinct, non-overlapping scopes (Container governs container- level APIs; Object governs blob-data APIs) and neither substitutes for the other. A SAS built with only Container+Read+List (the original three-checkbox answer) would successfully enumerate blob names but would be rejected with AuthorizationPermissionMismatch the moment a client tried to actually download a blob ' s content, since Read without the Object resource type does not cover Get Blob. Least privilege for ' enumerate and download ' therefore requires exactly four checkboxes: Container, Object, Read, and List - no Service scope and no write/delete-class permissions.
Official Reference
Create an account SAS (resource types and permissions table) - https://learn.microsoft.com/en-us/rest/api
/storageservices/create-account-sas

Explanation:
CORRECTED ANSWER: Three resource groups are created when you run the script: No (four are created - RGS0, RGS1, ResGrp8, RGroup4). A resource group named RGroup5 is created: No (length(parameters( ' obj1 ' )) evaluates to 4, so the name is RGroup4, not RGroup5). All the resource groups are created in the East US Azure region: Yes.
Detailed Explanation
Microsoft.Resources/resourceGroups can only be deployed via a subscription-level deployment such as New- AzDeployment, matching the command shown; the -Location parameter only stores deployment metadata and does not set any resource ' s location. The ' copy ' element on resource 1 with count=2 creates two separate resource group instances using copyIndex() (0 and 1), producing RGS0 and RGS1 - combined with the two standalone resources (ResGrp8 and RGroup-with-length), that totals four resource groups, not three, so statement 1 is No. The ARM length() function applied to an object returns its count of top-level properties; obj1 has exactly four (propA, propB, propC, propD), so the third resource is named RGroup4, not RGroup5
- statement 2 is No. Every resource ' s location resolves to eastus (explicit literal, last(var1), and par1 ' s default), so statement 3 is Yes.
Official Reference
Resource iteration in ARM templates (copy) and template functions - https://learn.microsoft.com/en-us/azure
/azure-resource-manager/templates/copy-resources