AZ-104 Practice Test 11 — 15 Questions

Question 1

A batch job fails with a blob read error after the administrator moved a 200-GB blob to the archive tier. The file must be available again within a few hours, and the administrator wants the least disruptive recovery. What should be done?

Accepted Answer

Change the blob tier to Hot or Cool and wait for the rehydration process to finish.. Option B is correct because moving a blob to the archive tier makes it offline; to read it, you must first rehydrate it by changing the tier to Hot or Cool. Rehydration typically completes within a few hours (up to 15 hours for archive), meeting the requirement. This is the least disruptive method as it avoids data loss or additional uploads.

Answer

Delete the archived blob and upload a new copy from backup.

Answer

Enable soft delete on the storage account and retry the read operation.

Answer

Convert the storage account to premium performance.

Question 2

A help desk analyst wants a query in Log Analytics that returns Azure virtual machines that have stopped sending a heartbeat for more than 15 minutes. Which KQL query should the analyst run?

Accepted Answer

Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen < ago(15m). Option A is correct because the Heartbeat table in Log Analytics records a heartbeat signal from Azure Monitor agents every 5 minutes by default. The query uses `summarize` to find the latest `TimeGenerated` per computer, then filters with `where LastSeen < ago(15m)` to identify VMs that have not sent a heartbeat in over 15 minutes, indicating they are likely offline or unresponsive.

Answer

AzureActivity | where OperationNameValue contains 'Heartbeat' | summarize count() by ResourceGroup

Answer

Perf | where CounterName == '% Processor Time' | summarize avg(CounterValue) by Computer

Answer

SecurityEvent | where EventID == 4624 | summarize count() by Computer

Question 3

A contractor team changes every few weeks. The administrator wants Azure access to stay the same when individual contractors leave or join, without editing role assignments for each person. What should be assigned the Azure role?

Accepted Answer

A Microsoft Entra ID security group. Assigning the Azure role to a Microsoft Entra ID security group allows the administrator to manage access by adding or removing contractors from the group, rather than editing individual role assignments. This approach ensures that role assignments remain unchanged when contractors leave or join, as the group itself retains the role. It leverages Azure RBAC's support for group-based access control, which is the recommended method for dynamic teams.

Answer

Each contractor user account individually

Answer

A device group

Answer

An Azure subscription

Question 4

A contractor needs Contributor on only VM1 and VM2 in rg-prod. Other resources in rg-prod must remain untouched, and the contractor must not gain access to any other resource groups or subscriptions. Which two role-assignment scopes meet the requirement? Select two.

Accepted Answer

Assign the role at the VM1 resource scope.. Option A is correct because assigning the Contributor role at the VM1 resource scope grants the contractor permissions exclusively to that virtual machine, leaving all other resources in rg-prod and other scopes untouched. This meets the requirement of limiting access to only VM1 and VM2 within rg-prod.

Answer

Assign the role at the rg-prod resource group scope.

Answer

Assign the role at the subscription scope.

Answer

Assign the role at the management group scope.

Question 5

A company wants to prevent users from creating storage accounts unless the resources include a costCenter tag. Which Azure feature should be used?

Accepted Answer

Azure Policy, because it can evaluate and enforce required resource properties.. Azure Policy is correct because it can enforce organizational standards by evaluating resource properties during creation and modification. By defining a policy that requires a 'costCenter' tag on all storage accounts, Azure Policy will deny creation of any storage account that does not include that tag, ensuring compliance without manual intervention.

Answer

Azure RBAC, because it controls whether users can create resources.

Answer

A resource lock, because it can force resources to use tags.

Answer

A service endpoint, because it can filter which resources are allowed in a subscription.

Question 6

A contractor must import data into one blob container for six hours. The contractor should not receive the storage account key, and access must be limited to that container only. Which credential should the administrator generate?

Accepted Answer

A user delegation SAS, because it is signed with Microsoft Entra credentials and is time limited.. A user delegation SAS is signed with Microsoft Entra credentials (formerly Azure AD) and can be scoped to a specific blob container with a time limit. This meets the requirement of granting the contractor access only to that container for six hours without exposing the storage account key.

Answer

A storage account access key, because it can be copied into the import tool.

Answer

A shared key connection string, because it works with any tool that needs blob access.

Answer

A managed identity token, because the contractor can use it outside Azure directly.

Question 7

A company stores customer documents in Azure Blob Storage. The business requires the data to stay available if one availability zone in the region has an outage. Which redundancy option should the administrator choose?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones within a primary region, ensuring data remains accessible if one zone fails. This meets the requirement for intra-region zone-level fault tolerance without the cost or complexity of geo-replication.

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 8

A developer deleted a single configuration file on a Windows Azure VM. The administrator wants to restore only that file from the latest backup without replacing the entire VM. Which restore workflow should be used?

Accepted Answer

Use file recovery from the backup item. Option B is correct because Azure Backup provides file-level recovery for Azure VMs using the 'File Recovery' feature. This allows you to mount the recovery point as a drive on the VM (or another machine) and copy individual files without restoring the entire VM. It uses iSCSI to present the backup snapshot directly to the VM for granular file access.

Answer

Restore the entire VM to a new instance

Answer

Create a new storage account and copy the file from there

Answer

Enable a resource lock on the VM

Question 9

Based on the exhibit, a backup administrator accidentally stopped protection for a critical VM and then deleted its backup item. The team wants Azure Backup to retain the deleted item long enough to recover it after the mistake is discovered the next day. What should be enabled on the vault?

Accepted Answer

Soft delete for backup data. Soft delete for backup data is the correct answer because it provides a safety net for accidentally deleted backup items. When enabled, Azure Backup retains deleted backup data for an additional 14 days (default) in a soft-deleted state, allowing administrators to recover the data before it is permanently purged. This directly addresses the scenario where protection was stopped and the backup item was deleted, as the data remains recoverable within the retention period.

Answer

A read-only resource lock on the VM

Answer

A network security group rule allowing port 445

Answer

Instant restore snapshots set to 30 days

Question 10

A container group runs a one-time import job in Azure Container Instances. After the job finishes successfully, it should not restart. Which restart policy should you choose?

Accepted Answer

Never. The 'Never' restart policy ensures that the container group does not restart after the job completes, which is ideal for a one-time import job that should run exactly once. Azure Container Instances supports three restart policies: Always, OnFailure, and Never. For a job that must not restart after successful completion, 'Never' is the correct choice because it prevents any automatic restart regardless of the exit code.

Answer

Always

Answer

OnFailure

Answer

Manual

Question 11

A development VM is recreated from scratch every week. The team wants the operating system disk to boot as quickly as possible and does not need the OS disk contents to survive deallocation. Which disk choice should the administrator make?

Accepted Answer

An ephemeral OS disk. An ephemeral OS disk is created on the local VM host storage, not on Azure managed storage, which eliminates network latency and provides significantly faster boot times. Since the team does not need the OS disk contents to survive deallocation and recreates the VM weekly, ephemeral disks are ideal as they are reset to the original image state on each deployment.

Answer

A Premium SSD managed OS disk

Answer

A Standard SSD managed OS disk

Answer

The VM temporary disk as the operating system disk

Question 12

A finance team stores documents in Azure Storage. The account must survive a failure of one availability zone in the primary region and also remain available if the primary region becomes unavailable. Which two replication options meet this requirement? Select two.

Accepted Answer

GZRS, because it combines zone redundancy in the primary region with geo-replication to a secondary region.. Option C (GZRS) is correct because it provides both zone-redundant storage (ZRS) within the primary region, ensuring survival of an availability zone failure, and geo-replication (GRS) to a secondary region, ensuring availability if the entire primary region becomes unavailable. This meets both requirements of the question.

Answer

LRS, because it keeps copies only within one datacenter and does not provide zone or geo protection.

Answer

ZRS, because it replicates across zones in one region but does not add secondary-region replication.

Answer

RA-GRS, because it allows reading from the secondary region but does not use zone-redundant storage in the primary region.

Question 13

A hub-and-spoke environment uses a DNS server VM in the hub VNet at 10.8.0.4 to resolve internal names such as app01.corp.local. The spoke VNet can reach hub VMs by IP after peering, but name resolution still fails from the spoke. What should the administrator configure so VMs in the spoke use the hub DNS server?

Accepted Answer

Configure the spoke VNet to use 10.8.0.4 as a custom DNS server.. Option B is correct because in Azure, a spoke VNet must explicitly be configured with a custom DNS server address to use a non-default DNS resolver. By setting the spoke VNet's DNS server to 10.8.0.4, all VMs in the spoke will send their DNS queries to that hub VM, resolving internal names like app01.corp.local. Without this configuration, the spoke VNet uses Azure-provided DNS, which cannot resolve custom private DNS zones hosted on the hub VM.

Answer

Add an inbound NSG rule on the spoke subnet to allow UDP and TCP 53 to 10.8.0.4.

Answer

Create a service endpoint for Microsoft.Storage on the spoke subnet.

Answer

Add a user-defined route for 10.8.0.4/32 pointing to the virtual network gateway.

Question 14

A help desk team must be able to reset passwords for cloud users in Microsoft Entra ID, but they must not be able to create or delete users. Which built-in role should you assign?

Accepted Answer

User Administrator. The User Administrator role in Microsoft Entra ID (formerly Azure AD) grants permissions to reset passwords for cloud users, but explicitly excludes the ability to create or delete users. This makes it the correct choice for a help desk team that needs password reset capabilities without broader user management rights.

Answer

Global Administrator

Answer

Reader

Answer

Billing Administrator

Question 15

A developer packages an internal web app as a Linux container. The app must be published with built-in HTTPS, deployment slots, and autoscale, and the team does not want to manage OS patching or container hosts. Which Azure service should the administrator choose?

Accepted Answer

Azure App Service. Azure App Service is the correct choice because it natively supports Linux containers, built-in HTTPS via TLS/SSL, deployment slots for staging and production swaps, and autoscale based on metrics or schedules. It also abstracts OS patching and container host management, meeting the team's requirement to avoid managing infrastructure.

Answer

Azure Container Instances

Answer

Azure Virtual Machines

Answer

Azure Kubernetes Service