Microsoft AZ-104 Exam With Confidence Using Practice Dumps

 Users: Admin1 and Admin2 only

 Group: Group1, or Group3

In Microsoft Entra ID (Azure Active Directory), Self-Service Password Reset (SSPR) is configured at the tenant level and can be scoped either to all users or to selected groups. Both who can configure SSPR and which groups are eligible are strictly defined by Microsoft Entra role permissions and group support rules.

Who can configure SSPR

Microsoft Entra documentation clearly states that only the following administrative roles are authorized to configure and manage SSPR settings:

Global Administrator

Authentication Policy Administrator

In this scenario:

Admin1 is a Global Administrator → ✅ Allowed

Admin2 is an Authentication Policy Administrator → ✅ Allowed

Admin3 holds Authentication Administrator and Security Administrator roles → ❌ These roles cannot configure SSPR policies

Microsoft explicitly distinguishes authentication method management from SSPR policy configuration, which is why Authentication Administrators and Security Administrators do not have permission to configure SSPR.

✔ Correct Users selection: Admin1 and Admin2 only

Which groups can have SSPR enabled

When enabling SSPR for Selected users, Microsoft Entra supports only assigned membership security-based groups.

According to Microsoft documentation:

Security groups (Assigned) → ✅ Supported

Mail-enabled security groups (Assigned) → ✅ Supported

Microsoft 365 groups → ❌ Not supported

Dynamic groups → ❌ Not supported

Applying this to the provided groups:

Group1 – Security, Assigned → ✅ Eligible

Group2 – Microsoft 365, Dynamic → ❌ Not eligible

Group3 – Mail-enabled security, Assigned → ✅ Eligible

✔ Correct Group selection: Group1 or Group3 only

Final Answer Summary

Section

Correct Selection

Users

Admin1 and Admin2 only

Group

Group1 or Group3 only

Microsoft Entra Administrator documentation extract:

“Only Global Administrators and Authentication Policy Administrators can configure self-service password reset settings.”

“SSPR can be enabled for security groups and mail-enabled security groups with assigned membership. Dynamic groups and Microsoft 365 groups are not supported.”

✅ Final Verified Answer:

Users: Admin1 and Admin2 only

Group: Group1 or Group3 only

To automate the deployment of a virtual machine scale set that uses the Windows Server 2016 Datacenter image and has web server components installed, you need to perform the following actions:

Modify the extensionProfile section of the Azure Resource Manager template. This section defines the extensions that are applied to the scale set virtual machines after they are provisioned. You can use the Custom Script Extension to run PowerShell scripts that install and configure the web server components. For more information, see Deploy an application to an Azure Virtual Machine Scale Set1.

Upload a configuration script. This is the PowerShell script that contains the commands to install and configure the web server components. You can upload the script to a storage account or a GitHub repository, and then reference it in the extensionProfile section of the template. For an example of a configuration script, see Tutorial: Install applications in Virtual Machine Scale Sets with Azure PowerShell2.

When configuring an Azure App Service app (WebApp1), several hosting plans determine scaling capabilities and supported features such as custom domains, SSL, and auto-scaling.

According to Microsoft Azure Administrator Documentation:

Custom Domain Verification:To map a custom domain (like app.contoso.com) to an Azure Web App, Azure must verify that you own the domain.Microsoft documentation specifies:

“To verify a custom domain, create a TXT record in your DNS zone. The TXT record contains a verification token that Azure uses to confirm ownership of the domain before binding it to your App Service.”

(Source: Azure App Service – Map custom domain)

While an A record or CNAME record is eventually used to direct traffic to the app, the TXT record is used solely for domain verification.

Scaling Requirement (Up to 8 Instances):The Free and Shared App Service plans have significant limitations:

Free / Shared: No scaling (only 1 instance, no custom domain SSL support).

Basic: Supports up to 3 instances.

Standard: Supports up to 10 instances, includes auto-scaling, and supports custom domains and SSL.

Premium: Adds advanced scaling and isolation but is more expensive and unnecessary here.

Microsoft documentation states:

“The Standard pricing tier supports auto-scaling up to 10 instances and custom domains, offering a balance between cost and capability.”

(Source: Azure App Service Plan Tiers Overview)

Since the requirement includes automatic scaling up to eight instances and custom domain verification, the Standard plan is the minimum suitable tier — satisfying both performance and cost-efficiency conditions.

✅ Final Verified Answer:

Pricing plan: Standard

Record type: TXT

Justification Summary (from Microsoft Documentation):

Custom domain verification → Requires a TXT record.

Auto-scale up to 8 instances → Requires at least the Standard plan.

Minimize cost and effort → Standard plan is the optimal balance.