Microsoft Microsoft Certifications AZ-720 Questions & Answers

• Question 61:

  A company has users in Azure Active Directory (Azure AD). The company enables the users to use Azure AD multi-factor authentication (MFA).

  A user named User1 reports they receive the following error while setting up additional security verification settings for MFA:

  Sorry! We can't process your request. Your session is invalid or expired. There was an error processing your request because your session is invalid or expired. Please try again.

  You need to help the user complete the MFA setup.

  What should you do?

  A. From the Microsoft 365 Admin portal, clear the Block this user from signing in option for the user.

  B. Instruct the user to complete the setup process within 10 minutes.

  C. Instruct the user to enter the correct verification code.

  D. Instruct the user to clear their web browser cache.

  E. From the Azure AD portal, reset the user's password.

  Correct Answer: B

  https://learn.microsoft.com/en-us/microsoft-365/troubleshoot/active-directory/sorry-we-cant-process-your-request-error

• Question 62:

  A company has an Azure tenant. The company deploys an Azure firewall named FW1 to control access from an on-premises datacenter to an Azure virtual machine named VM1.

  The company troubleshoots ICMP connectivity from the on-premises datacenter to VM1. You are unable to ping VM1 from an on-premises server.

  You need to determine if ICMP connectivity to VM1 is allow on FW1.

  What should you do?

  A. Use the ping command targeting the IP address of VM1 and review the Infrastructure rules log of FW1.

  B. Use the ping command targeting the IP address of VM1 and review the command's response.

  C. Use the ping command targeting the IP address of VM1 and review the Network rules log of FW1.

  D. Use the ping command targeting the fully qualified domain name of VM1 and review the command's response.

  Correct Answer: C

  According to Microsoft, the ICMP protocol is not permitted through the Azure load balancer. To test connectivity, Microsoft recommends that you do a port ping. While Ping.exe uses ICMP, you can use other tools, such as PSPing, Nmap, and telnet, to test connectivity to a specific TCP port1.

• Question 63:

  A company has an Azure Active Directory (Azure AD) tenant. The company provisions an Azure Active Directory Domain Services (Azure AD DS) instance.

  Users report that they are unable to sign into Azure AD DS after being provisioned from Azure AD. You verify the user accounts exist in Azure AD DS.

  You need to resolve the issue.

  What should you do?

  A. Delete the Azure application named AzureActiveDirectoryDomainControllerServices and then enable Azure AD DS again.

  B. Deploy Azure AD Connect.

  C. Delete the Azure application named Azure AD Domain Services Sync and then enable Azure AD DS again.

  D. Instruct the users to change their password in Azure AD.

  Correct Answer: D

  Azure AD doesn't generate or store password hashes in the format that's required for NTLM or Kerberos authentication until you enable Azure AD DS for your tenant. Therefore, Azure AD can't automatically generate these NTLM or Kerberos password hashes based on users' existing credentials. For cloud-only environments with no on-premises synchronization, you need to instruct users to change their password in Azure AD after enabling Azure AD DS. This will generate the required password hashes and sync them to Azure AD DS within 20 minutes.

• Question 64:

  A company uses Azure Site Recovery (ASR) for a VMware environment that includes the following virtual machines (VMs):

  

  The company reports that they are unable to configure all of the servers for replication.

  You need to evaluate the servers and server roles to determine which servers can be protected.

  Which server can you protect by using ASR?

  A. VM1

  B. VM2

  C. VM3

  D. VM4

  Correct Answer: D

  VM4, the domain controller without a doubt

• Question 65:

  A company manages a solution that uses Azure Functions.

  A function returns the following error: Azure Function Runtime is unreachable.

  You need to troubleshoot the issue.

  What are two possible causes of the issue?

  A. The execution quota is full.

  B. The company did not configure a timer trigger.

  C. The storage account application settings were deleted.

  D. The function key was deleted.

  E. The storage account for the function was deleted.

  Correct Answer: CE

  Two possible causes of the issue where a function returns the error "Azure Function Runtime is unreachable" are: C. The storage account application settings were deleted. E. The storage account for the function was deleted.

  According to Microsoft, this issue occurs when the Functions runtime can't start. The most common reason for this is that the function app has lost access to its storage account. If that account is deleted or if the storage account application settings were deleted, your functions won't work

  https://learn.microsoft.com/en-us/azure/azure-functions/functions-recover-storage-account

• Question 66:

  A company deploys the Azure Application Gateway Web Application Firewall (WAF) to protect their web applications. Users in a remote office location report the following issues:

  1.

  Unable to access part of a web application.

  2.

  Part of the web application is failing to load.

  3.

  Parts of the web application has activities that are not performing as expected.

  4.

  You need to troubleshoot the issue. Which diagnostic log should you review?

  A. Performance

  B. Firewall

  C. Access

  D. Azure Activity

  Correct Answer: C

  Access log is the way to start checking for this type of issue - see my updated comments.

• Question 67:

  A company deploys ExpressRoute.

  The company reports that there is an autonomous system (AS) number mismatch.

  You need to identify the AS number of the circuit.

  Which PowerShell cmdlet should you run?

  A. Get-AzExpressRouteCircuitPeeringConfig

  B. Get-AzExpressRouteCircuitStats

  C. Get-AzExpressRouteCircuitRouteTable

  D. Get-AzExpressRouteCircuit

  Correct Answer: A

• Question 68:

  A company has two virtual networks (VNets) that reside in the same Azure region.

  An administrator reports that virtual machines (VMs) in each VNet are unable to connect to VMs in the other VNet.

  You need to configure a connection between the two networks that maximizes throughput and minimizes latency.

  What should you do?

  A. Configure a VPN gateway.

  B. Create a site-to-site VPN connection.

  C. Configure virtual network peering.

  D. Create a point-to-site VPN connection.

  Correct Answer: C

  To configure a connection between two virtual networks (VNets) that reside in the same Azure region that maximizes throughput and minimizes latency, you should configure virtual network peering. Therefore, option C is correct. You should configure virtual network peering.

• Question 69:

  HOTSPOT

  A company uses an Azure Backup agent to back up specific files and folder from an Azure virtual machine (VM) and an on-premises VM.

  An administrator reports that the backup job fails on both VMs. Errors are returned in Microsoft Azure Recovery Services (MARS).

  You need to troubleshoot the backup issues.

  Which troubleshooting solution should you use?

  Hot Area:

  

  Correct Answer:

  

• Question 70:

  HOTSPOT

  A company uses an Azure VPN gateway with an IP address of 203.0.113.20.

  Users report that the VPN connection frequently drops.

  You need to determine when each connection failure occurred.

  How should you complete the Azure Monitor query?

  Hot Area:

  

  Correct Answer: