Microsoft Azure Administrator (AZ-104 Deutsch Version) - AZ-104 Deutsch Exam Practice Test

Explanation:
Official Reference
How network security groups filter network traffic - https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works

Explanation:
Detailed Explanation
The deployment stack manages only VNet2 (the resource defined in Deploy.bicep); its DenySettingsMode DenyWriteAndDelete creates a deny assignment that blocks write and delete operations specifically on the stack ' s managed resources, and this deny assignment overrides ordinary Azure RBAC allow permissions - even for an Owner - because deny assignments always take precedence. So Admin1 (Owner at Sub1) can neither delete VNet2 nor modify it by adding a subnet: both are No. VNet1 is a pre-existing resource in RG1 that the stack does not manage, so it is completely unaffected by the deny assignment; Admin2 ' s Contributor role at RG1 scope includes Microsoft.Network/virtualNetworks/subnets/write, so Admin2 can add a subnet to VNet1: Yes.
Official Reference
Azure deployment stacks - protect managed resources with denySettings - https://learn.microsoft.com/en-us
/azure/azure-resource-manager/bicep/deployment-stacks

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Explanation:
CORRECTED ANSWER: On January 15, 2024, App1 will have only one backup in storage: Yes. On February 6, 2024, you can access the backup of the App2 test slot from January 15, 2024: No. On January 15,
2024, you can restore the App2 production slot backup from January 6 to the App2 test slot: Yes.
Detailed Explanation
App1 ' s retention is 0 days, but ' Keep at least one backup ' overrides retention-based purging so that the single most recent daily backup is always preserved while older ones are removed - by January 15 exactly one backup exists (statement 1: Yes). App Service backup configuration is per-slot, not shared: only the production slots were configured for scheduled backup, so the App2 test slot has no backup history at all, and
' the backup of the App2 test slot ' from January 15 does not exist to be accessed (statement 2: No - a common trap assuming slots share backup schedules). App Service explicitly supports restoring a backup to a different slot than it was taken from; App2 ' s 30-day retention easily covers the January 6 backup being restorable by January 15, so restoring the production backup into the test slot is valid (statement 3: Yes).
Official Reference
Back up and restore an app in Azure App Service - https://learn.microsoft.com/en-us/azure/app-service
/manage-backup

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Explanation:
Detailed Explanation
Azure Policy assignments can only be created at management group, subscription, or resource group scope - the assignment scope selector in the portal and the Azure Policy REST API do not support assigning a policy directly to an individual resource such as a VM, so VM1 is not a valid assignment target even though the policy ' s effect ultimately evaluates resources like VM1 once assigned at a scope above it. This means Policy1 can be assigned to the Tenant Root Group, ManagementGroup1, Subscription1, or RG1 - but not VM1 directly. Exclusions, by contrast, are explicitly designed to support finer granularity: an assignment ' s excludedScopes property accepts any scope at or below the assignment scope, including an individual resource, so VM1 can legitimately be specified as an exclusion even though it could never be an assignment target itself. The correct answers are therefore Tenant Root Group/ManagementGroup1/Subscription1/RG1 for assignment, and all five levels - including VM1 - for exclusions.
Official Reference
Azure Policy assignment structure and scope - https://learn.microsoft.com/en-us/azure/governance/policy
/concepts/assignment-structure

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Explanation:
Detailed Explanation
The tenant ' s guest user access restriction is set to the middle, default option ( ' limited access to properties and memberships of directory objects ' ), not the most restrictive ' own directory objects only ' option, so guests retain read access to standard profile attributes -- including Manager -- of other directory objects; User2 can view User1 ' s Manager property. Guest invite restrictions are set to the most inclusive option, which would normally let User2 send invitations, but Collaboration restrictions independently enforce an allow-list containing only fabrikam.com -- northwindtraders.com is not on that list, so the invitation to [email protected] is blocked regardless of the invite-restriction setting; both settings must permit an invitation for it to succeed. Guest accounts have restricted default Microsoft Entra permissions that exclude self-service object-creation actions such as creating a Microsoft 365 group; nothing in this scenario elevates User2 ' s guest permissions, so User2 cannot create a group.
Official Reference
Configure external collaboration settings - https://learn.microsoft.com/en-us/entra/external-id/external- collaboration-settings-configure

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).