AZ-104 Practice Test 1 — 10 Questions

Question 1

A storage automation service principal must upload, read, and delete blob data in one container by using Microsoft Entra authentication. It must not manage storage account settings, keys, or other containers. Which approach is best?

Accepted Answer

Create a custom role with blob dataActions only and assign it at the container scope.. Option B is correct because it creates a custom Azure RBAC role with only the required blob data actions (e.g., Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read, write, delete) and assigns it at the container scope. This ensures the service principal can upload, read, and delete blobs in that specific container using Microsoft Entra authentication, without any permissions to manage storage account settings, keys, or other containers.

Answer

Assign Storage Account Contributor at the resource group scope.

Answer

Assign Reader and give the service principal a storage account access key.

Answer

Assign Contributor at the subscription scope and restrict access with naming conventions.

Question 2

A subnet contains several application servers. You need to allow inbound TCP 3389 only from a management subnet named Subnet-Mgmt and deny RDP from all other sources. What should you do?

Accepted Answer

Create an NSG rule allowing TCP 3389 from the Subnet-Mgmt address range and rely on the default deny afterward.. Option A is correct because Network Security Groups (NSGs) in Azure filter traffic based on rules that are evaluated in priority order. By creating an inbound rule that allows TCP 3389 (RDP) from the Subnet-Mgmt address range, and relying on the default implicit deny rule that blocks all other inbound traffic, you effectively restrict RDP access to only the management subnet. No additional configuration is needed to deny traffic from other sources, as the default deny handles that automatically.

Answer

Create a route table that sends RDP traffic to the management subnet.

Answer

Deploy a private endpoint for each application server.

Answer

Enable service endpoints on the application subnet.

Question 3

A subscription admin wants to investigate who changed a resource and also review the platform-generated events for that subscription. Which two types of logs can be sent to Log Analytics and queried later? Select two.

Accepted Answer

Activity log entries. The Activity log (option A) records subscription-level events such as who created, modified, or deleted a resource, making it essential for investigating administrative changes. Resource diagnostic logs (option B) capture platform-generated events emitted by a resource itself (e.g., Azure SQL Database audit logs, network security group flow logs), which can be sent to Log Analytics for querying. Both log types can be configured to stream to a Log Analytics workspace, enabling Kusto Query Language (KQL) analysis.

Answer

Azure Backup vault names

Answer

Virtual network address spaces

Answer

Managed disk size settings

Question 4

Based on the exhibit, which Azure feature should the administrator use to track this kind of platform-wide service issue?

Accepted Answer

Service Health, because it reports Azure platform incidents that affect customers in a region.. Service Health is the correct feature because it provides a personalized dashboard of all Azure service incidents, planned maintenance, and health advisories that impact the customer's subscriptions and regions. It aggregates platform-wide issues (e.g., regional outages or degradation) that Azure engineering has confirmed, making it the appropriate tool for tracking a platform-wide service issue affecting multiple resources in a region.

Answer

Resource Health, because it shows whether a specific virtual machine is healthy or unavailable.

Answer

Activity Log, because it lists every administrative action taken in the subscription.

Answer

Azure Advisor, because it gives recommendations to improve the virtual machine configuration.

Question 5

An administrator wants a script running on an Azure VM to create a resource in Azure without storing any passwords or client secrets on the VM. What should the administrator configure first?

Accepted Answer

A system-assigned managed identity on the VM. A system-assigned managed identity enables an Azure VM to authenticate to Azure services (e.g., Azure Resource Manager) without storing any credentials in the VM. The identity is automatically created and managed by Azure, and the VM can obtain an access token from Azure AD via the Instance Metadata Service (IMDS) endpoint (169.254.169.254) using a simple HTTP call. This allows the script to securely create resources without hardcoding passwords or client secrets.

Answer

A shared local account on the VM

Answer

An Azure Policy exemption

Answer

A public IP address on the VM

Question 6

A PowerShell script runs on an Azure VM every night and uses Azure CLI commands to create tags and VM resources in another subscription. The script cannot store a password or client secret. What should it use to authenticate to Azure?

Accepted Answer

az login --identity.. Option B is correct because the script runs on an Azure VM and can use a managed identity to authenticate without storing any secrets. The `az login --identity` command uses the VM's system-assigned or user-assigned managed identity to obtain an Azure AD access token via the Azure Instance Metadata Service (IMDS) endpoint. This satisfies the requirement of no password or client secret storage.

Answer

az login with a username and password.

Answer

Connect-AzAccount with device code authentication.

Answer

An app registration secret stored in a PowerShell variable.

Question 7

A storage account becomes unavailable because Azure has a regional platform issue. The operations team wants a notification whenever Azure marks the resource or region unhealthy, and they want to avoid continuous log ingestion just to detect the outage. What should they configure?

Accepted Answer

A Service Health alert based on the Activity log, scoped appropriately.. Option C is correct because a Service Health alert, configured from the Azure Activity log, provides proactive notifications when Azure services or regions experience an outage or degradation. This alert is triggered by Azure's own health signals, eliminating the need for continuous log ingestion or custom metric monitoring to detect platform-level issues.

Answer

A metric alert on storage capacity with an action group.

Answer

A log alert on storage diagnostic logs that watches for 503 responses.

Answer

An Azure Policy assignment that audits the storage account state.

Question 8

A support engineer must start and restart one specific virtual machine from the Azure portal, but must not be able to delete the VM, change networking, or grant access to others. Which two actions should be included in a custom role? Select two.

Accepted Answer

Microsoft.Compute/virtualMachines/start/action grants the ability to start the VM without broader management permissions.. Option A is correct because Microsoft.Compute/virtualMachines/start/action is a specific permission that allows starting a VM without granting broader management capabilities like deletion or network changes. This action is part of the Azure RBAC role definition and can be included in a custom role to limit the support engineer's scope to only starting the VM.

Answer

Microsoft.Compute/virtualMachines/delete gives the ability to remove the VM from the subscription.

Answer

Microsoft.Network/networkInterfaces/write is needed because a VM start or restart always requires NIC modification rights.

Answer

Microsoft.Authorization/roleAssignments/write would let the engineer grant access to other users and manage permissions.

Question 9

A storage account must stay online for applications, but administrators have a temporary freeze on configuration changes. Users can still view the account, but attempts to change the access tier, create a container, or update networking all fail. What most likely caused the behavior?

Accepted Answer

A ReadOnly lock was applied to the storage account.. A ReadOnly lock (Azure Resource Manager lock) prevents any modification to the storage account, including changing the access tier, creating containers, or updating networking settings, while still allowing read operations like viewing the account. This matches the described behavior exactly because the lock is applied at the resource scope and blocks all write/delete operations, but does not affect read access.

Answer

A CanNotDelete lock was applied to the storage account.

Answer

An Azure Policy audit assignment was applied to the storage account.

Answer

The account was moved to a different subscription.

Question 10

You create a private endpoint for an Azure Storage account. Virtual machines in VNet-Prod must resolve the storage account name to the private IP address of that endpoint. Which Azure feature should you configure?

Accepted Answer

A private DNS zone linked to VNet-Prod. A private endpoint uses a private IP address from the VNet, but DNS resolution must be explicitly configured to map the storage account's FQDN to that private IP. By creating a private DNS zone (privatelink.blob.core.windows.net) linked to VNet-Prod, Azure automatically creates an A record for the private endpoint IP, enabling VMs to resolve the storage account name to the private IP instead of the public IP.

Answer

A user-defined route

Answer

An Azure Firewall policy

Answer

A Recovery Services vault