AZ-104 Practice Test 2 — 10 Questions

Question 1

A support engineer must start, stop, and restart only one virtual machine named vm-app01. The engineer should not gain permissions on any other virtual machine in the subscription. What is the best scope for the role assignment?

Accepted Answer

The vm-app01 virtual machine resource itself.. Option C is correct because Azure RBAC allows role assignments to be scoped to individual resources, such as a specific virtual machine. By assigning a role like 'Virtual Machine Contributor' at the vm-app01 resource scope, the support engineer will have permissions to start, stop, and restart only that VM, and no other resources in the subscription or resource group.

Answer

The entire subscription that contains vm-app01.

Answer

The resource group that contains vm-app01.

Answer

The management group that contains the subscription.

Question 2

A team deploys a Linux VM that must read secrets from Azure Key Vault without storing any usernames, passwords, or client secrets on the VM. What should the administrator enable on the VM?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity enables the Linux VM to authenticate to Azure Key Vault without any stored credentials. Azure automatically creates a service principal in Entra ID for the VM, and the VM can obtain an access token from the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) to authenticate to Key Vault. This eliminates the need to store usernames, passwords, or client secrets on the VM.

Answer

A storage account access key

Answer

A service endpoint on the VM subnet

Answer

A user account in Entra ID with a stored password

Question 3

A team has Windows VMs in a subnet that need to access an Azure Storage account. The storage account should remain reachable through its public endpoint, but only traffic from that one subnet should be allowed. Which configuration best meets the requirement?

Accepted Answer

Enable a service endpoint on the subnet and add a virtual network rule for that subnet on the storage account firewall.. Option B is correct because a service endpoint extends the virtual network private address space to the storage account, allowing traffic from the specified subnet to reach the storage account via the Azure backbone while keeping the public endpoint accessible. By adding a virtual network rule on the storage account firewall, you restrict access to only traffic originating from that subnet, meeting the requirement of allowing only that subnet through the public endpoint.

Answer

Create a private endpoint and disable public network access on the storage account.

Answer

Place the subnet behind a NAT gateway and use a shared public IP.

Answer

Add a VPN gateway and route storage traffic through the branch office.

Question 4

A team needs one Azure Files share that can be mounted by both Windows and Linux VMs. The VMs are joined to the same on-premises Active Directory Domain Services domain, and the security team forbids storage account keys. The team also wants to manage access with existing AD group memberships. What should the administrator configure?

Accepted Answer

Use Azure Files over SMB and enable AD DS authentication. Option A is correct because Azure Files supports SMB protocol, which can be mounted by both Windows and Linux VMs. By enabling AD DS authentication, the administrator can use existing on-premises Active Directory group memberships to control access to the file share without requiring storage account keys, satisfying the security team's requirement.

Answer

Use a blob container and mount it through the Blob API

Answer

Use anonymous access on an Azure File share

Answer

Use a premium NFS file share with a shared access signature

Question 5

A subscription already grants Contributor to an application team. The organization wants to prevent deployments in unsupported Azure regions and ensure every new resource has an Environment tag. Which two controls should be implemented with Azure Policy rather than RBAC? Select two.

Accepted Answer

Assign an allowed-locations policy at the management group or subscription scope.. Option A is correct because Azure Policy can enforce an 'allowed-locations' policy at the management group or subscription scope to restrict resource deployment to only approved Azure regions. This is a governance control that operates declaratively, evaluating resource properties against policy rules before or after creation, unlike RBAC which controls identity-based permissions. Option C is correct because Azure Policy can enforce the 'Environment' tag on new resources using a 'require a tag and its value' policy, ensuring compliance without modifying role assignments.

Answer

Create a custom RBAC role that blocks resources deployed outside approved regions.

Answer

Add a CanNotDelete lock to every resource group.

Answer

Grant User Access Administrator to the deployment team.

Question 6

A switch administrator wants log entries from multiple devices to be collected on one central server for later review. Which service should be configured?

Accepted Answer

Syslog. Syslog is the standard protocol (RFC 5424) used for collecting and centralizing log messages from network devices, servers, and other infrastructure components. By configuring each device to send syslog messages to a central syslog server, the administrator can aggregate logs for unified review, monitoring, and troubleshooting. This directly meets the requirement for centralized log collection.

Answer

DNS

Answer

NTP

Answer

SNMP trap suppression

Question 7

A hub VNet already has a VPN gateway connected to on-premises. A new spoke VNet must reach on-premises through the hub gateway and should not deploy its own gateway. What configuration should be enabled on the peering?

Accepted Answer

Enable gateway transit on the hub peering and Use remote gateways on the spoke peering.. Option A is correct because enabling 'Use remote gateways' on the spoke VNet peering and 'Allow gateway transit' on the hub VNet peering allows the spoke VNet to route traffic to on-premises through the hub's VPN gateway without deploying its own gateway. This configuration leverages BGP routes (if the VPN gateway is route-based) to propagate on-premises prefixes to the spoke, enabling transitive routing across the peering.

Answer

Create a service endpoint from the spoke to the hub.

Answer

Add a default route to Internet in the spoke subnet.

Answer

Enable accelerated networking on the spoke subnet.

Question 8

An administrator is deploying a site-to-site VPN gateway in the Azure portal. The deployment fails validation because the gateway does not have a public-facing address to terminate the tunnel. What must be created and associated with the VPN gateway?

Accepted Answer

A public IP address resource associated with the VPN gateway.. A site-to-site VPN gateway in Azure requires a public IP address to terminate the IPSec tunnel from the on-premises device. The public IP address resource must be created and associated with the VPN gateway during deployment; without it, the gateway has no routable endpoint for the tunnel, causing validation to fail.

Answer

A load balancer frontend IP configuration in front of the gateway subnet.

Answer

A NAT gateway attached to GatewaySubnet.

Answer

A private endpoint for the virtual network gateway resource.

Question 9

A team has an approved Windows VM that already includes their application, patches, and monitoring agent. They want future VMs to start with the same configuration. What should they use?

Accepted Answer

A managed image created from the approved VM. A managed image captures the entire VM configuration, including the OS, application, patches, and monitoring agent, allowing you to create multiple identical VMs from a single source. Unlike a snapshot, which is tied to a specific disk and requires manual steps to replicate the full VM setup, a managed image provides a reusable template for consistent deployments. This approach ensures future VMs start with the exact same configuration as the approved VM.

Answer

An availability set

Answer

A snapshot of the OS disk

Answer

A larger virtual machine size

Question 10

A team in RG-Apps must be able to start, stop, and deallocate virtual machines and read their properties. Built-in roles available to the team are broader than necessary. What should the administrator do?

Accepted Answer

Create a custom role with only the required VM actions and assign it at RG-Apps scope.. Option B is correct because the team needs specific actions (start, stop, deallocate, read properties) that are a subset of the Virtual Machine Contributor role's permissions. Creating a custom role with only the required actions (Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, Microsoft.Compute/virtualMachines/read, etc.) and assigning it at the RG-Apps scope provides least-privilege access without granting broader capabilities like creating or deleting VMs.

Answer

Assign Virtual Machine Contributor at the subscription scope.

Answer

Assign Reader and Virtual Machine Contributor together at the resource group scope.

Answer

Assign Owner at the resource group scope to avoid troubleshooting access issues.