Microsoft Azure Administrator (AZ-104 Korean Version) - AZ-104 Korean Exam Practice Test

Explanation:
Detailed Explanation
Group1 ' s dynamic rule matches any user whose city starts with ' m ' (case-insensitive). User1 (Montreal) and User2 (Melbourne) both satisfy this and are members of Group1. Group2 ' s dynamic rule matches any user whose department is NOT ' HR ' . User1 ' s department is Human resources (HR), so the -notIn[ " HR " ] condition evaluates false and User1 is excluded from Group2 -- User1 belongs to Group1 only. User2 ' s department is Marketing (not HR), so the condition evaluates true and User2 is a member of both Group1 (city match) and Group2 (department match) -- Group1 and Group2 only. Group3 uses Assigned (not dynamic) membership and no manual assignment is given for either user, so neither user is a member of Group3. Both selections match the source key.
Official Reference
Dynamic membership rules for groups in Microsoft Entra ID - https://learn.microsoft.com/en-us/entra
/identity/users/groups-dynamic-membership

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Explanation:
CORRECTED ANSWER: VMs on Subnet1 can connect to VMs on Subnet3: Yes | VMs on ClientSubnet can connect to the Internet: No (see currency note) | VMs on Subnet3 and Subnet4 can connect to the Internet: No (see currency note) Detailed Explanation Paris-VNet (Subnet1/Subnet2) is peered with AllOffices-VNet (Subnet3/Subnet4); VNet peering, combined with the default system routes described, allows direct connectivity between VMs across the peered networks over the Azure backbone with no gateway required for VNet-to-VNet traffic itself (the " Use remote gateways
" setting only affects transit through an on-premises gateway, not direct peer connectivity) - so Subnet1-to- Subnet3 connectivity is Yes. IMPORTANT CURRENCY UPDATE: Microsoft retired default outbound Internet access for newly created Azure VMs effective 30 September 2025. Previously, any VM without an explicit outbound method automatically received a default outbound public IP via system routes (the classical basis for a " Yes " answer here); as of today, a VM created without an explicit outbound method - a NAT gateway, a Standard Load Balancer with outbound rules, or a directly attached public IP, none of which are described in this scenario - has no outbound Internet path by default. Under current Azure behavior, both the ClientSubnet-to-Internet and Subnet3/4-to-Internet statements are No unless an explicit outbound method is added.
Official Reference
Default outbound access for VMs in Azure - retirement - https://learn.microsoft.com/en-us/azure/virtual- network/ip-services/default-outbound-access

Explanation:
Detailed Explanation
A storage account is a standalone resource with no dependency on a specific resource group ' s region, so moving storage1 to RG2 is fully supported (Yes). NIC1, however, is currently attached to a running virtual machine (VM1) and depends on VNET1, which is remaining in RG1 -- Azure does not permit moving a network interface to a different resource group while it is attached to an existing VM and while its dependent virtual network stays behind; the NIC and its dependencies must move together with the VM as a set. Both statements about moving NIC1 therefore evaluate to No, matching the source key (note: the source document repeats an identical ' move NIC1 to RG2 ' statement twice, which is a duplication artifact in the exhibit rather than a distinct third statement).
Official Reference
Move resources - support and dependency requirements for networking resources - https://learn.microsoft.
com/en-us/azure/azure-resource-manager/management/move-limitations/networking-move-limitations

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Explanation:
CORRECTED ANSWER: VM2 can connect to the TCP port 1433 services on VM1: Yes. VM1 can connect to the TCP port 1433 services on VM2: Yes. VM2 can connect to the TCP port 1433 services on VM3: Yes.
Detailed Explanation
Microsoft Learn ' s NSG documentation confirms that rules are evaluated strictly by priority NUMBER, lowest first, with processing stopping at the first match - specificity never overrides priority. NSG2 ' s priority-101 Allow rule (source 10.10.2.0/24 # destination 10.10.1.0/24, port 1433) is evaluated before the priority-125 Block rule and already matches VM2#VM1 traffic (10.10.2.5 is within 10.10.2.0/24; 10.10.1.5 is within 10.10.1.0/24), so the traffic is allowed and the more specific priority-125 block is never reached - the source document ' s original ' No ' for this statement is corrected to Yes. Subnet1 ' s NSG1 has no custom rules shown, so its default AllowVnetInBound rule permits this same intra-VNet traffic. VM1#VM2 traffic is outbound from VM1 (unaffected by NSG2 ' s inbound-only rules, permitted by default outbound rules) and inbound to VM2, which has no NSG at all - unrestricted, so Yes. VM2 and VM3 share Subnet2, which has no NSG, and neither VM has a NIC-level NSG, so that traffic is also unrestricted - Yes.
Official Reference
Network security group rules - priority-based evaluation, not specificity-based - https://learn.microsoft.com
/en-us/azure/virtual-network/network-security-groups-overview

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Explanation:
Detailed Explanation
Resource locks applied directly to an individual resource (as opposed to locks applied at the resource-group scope) do not block a move operation. Microsoft Learn ' s resource-locking guidance clarifies that a CanNotDelete (Delete) lock never blocks moves, and a ReadOnly lock only blocks moving resources into or out of a resource group when the lock is applied at the resource-group level - a ReadOnly lock on an individual resource such as VNET1 or VNET2 here does not prevent that specific resource from being relocated. Since every lock in this scenario (Lock1/Delete on the storage accounts, Lock2/ReadOnly on the virtual networks) is scoped to the resource, not the resource group, all three resources in each group (the public IP, the virtual network, and the storage account) remain movable. This matches the source document ' s answer key.
Official Reference
Lock resources to prevent unexpected changes - move behavior - https://learn.microsoft.com/en-us/azure
/azure-resource-manager/management/lock-resources

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).