AZ-104 Practice Test 11 — 15 Questions

Question 1

An administrator wants a script running on an Azure VM to create a resource in Azure without storing any passwords or client secrets on the VM. What should the administrator configure first?

Accepted Answer

A system-assigned managed identity on the VM. A system-assigned managed identity enables an Azure VM to authenticate to Azure services (e.g., Azure Resource Manager) without storing any credentials in the VM. The identity is automatically created and managed by Azure, and the VM can obtain an access token from Azure AD via the Instance Metadata Service (IMDS) endpoint (169.254.169.254) using a simple HTTP call. This allows the script to securely create resources without hardcoding passwords or client secrets.

Answer

A shared local account on the VM

Answer

An Azure Policy exemption

Answer

A public IP address on the VM

Question 2

A contractor is a member of an Entra security group that has the Contributor role on a resource group. When the contractor tries to deploy, the portal says the role is not active. The activation request requires approver approval, and the previous activation window has expired. What should the contractor do?

Accepted Answer

Activate the eligible role through Privileged Identity Management and obtain approval if required.. The contractor has an eligible role assignment that requires activation through Privileged Identity Management (PIM). Since the previous activation window has expired, the role is no longer active, and the contractor must initiate a new activation request, which may require approver approval. Option D correctly describes this process, as PIM is the Azure service designed for just-in-time access to privileged roles.

Answer

Wait for the role assignment to propagate to Azure.

Answer

Create a new security group and assign Contributor directly.

Answer

Sign out of the portal and sign back in only.

Question 3

Based on the exhibit, where should the administrator go next to review the failed backup job details?

Accepted Answer

Jobs, because it contains the backup job status and error details.. The Jobs blade in Azure Backup is the central location for reviewing the status, progress, and detailed error messages of all backup jobs, including failed ones. It provides a filtered view of backup, restore, and other operations, allowing the administrator to drill into specific job failures to see error codes and recommended actions.

Answer

Backup policy, because it shows the retention and schedule configuration.

Answer

Backup items, because it lists protected resources and recovery points.

Answer

Properties, because it contains the general vault settings.

Question 4

Based on the exhibit, the Prod management group contains three subscriptions that host application workloads. An operations group must be able to read all current and future resources in those Prod subscriptions, but it must not have access to Sandbox. Where should you assign the Reader role?

Accepted Answer

Assign Reader to OpsGroup at the Prod management group.. Assigning the Reader role at the Prod management group scope ensures that OpsGroup inherits read permissions to all current and future subscriptions and resources within that management group, while excluding the Sandbox subscription which is outside the Prod hierarchy. This leverages Azure RBAC inheritance, where roles assigned at a management group propagate to all child subscriptions and resource groups, meeting the requirement for a single assignment that covers all Prod workloads without granting access to Sandbox.

Answer

Assign Reader to OpsGroup at the Corp management group.

Answer

Assign Reader to OpsGroup at one application resource group in AppSub1.

Answer

Assign Reader to OpsGroup at each subscription individually.

Question 5

A legal department archived a 120-GB blob three weeks ago. They now need the file available for review later today, and waiting more than a day would delay a court filing. What should the administrator do to make the blob readable as quickly as possible?

Accepted Answer

Start rehydration from Archive and choose High priority.. Rehydrating a blob from the Archive tier with High priority typically makes the blob readable within 1 hour, meeting the urgent same-day requirement. The Archive tier is offline, so the blob must be rehydrated (changed to an online tier like Hot or Cool) before it can be accessed. High-priority rehydration is designed for time-sensitive scenarios like this court filing deadline.

Answer

Copy the blob to a new container and leave it in the Archive tier until the users need it.

Answer

Change the access tier from Archive directly to Cool and then download the blob immediately.

Answer

Enable soft delete on the container and restore the blob from deleted items.

Question 6

A contractor pool changes every month. The operations team wants Azure role access to stay the same when people join or leave, without editing role assignments for each person. Which two actions should the administrator take? Select two.

Accepted Answer

Create a security group in Microsoft Entra ID for the contractor pool.. Creating a security group in Microsoft Entra ID (formerly Azure AD) allows the administrator to manage membership dynamically or manually as contractors join or leave. By assigning the Azure role to this security group (Option D), role assignments remain constant; only group membership changes, eliminating the need to edit individual role assignments. This approach leverages Azure RBAC's support for security groups as assignable principals, ensuring consistent access control.

Answer

Assign the Azure role directly to each contractor account.

Answer

Create a Microsoft 365 group and use it for VM sign-in.

Answer

Use a user-assigned managed identity for each contractor.

Question 7

A company has 15 branch Windows file servers that must show the same shared drive content. Users should keep working during short WAN outages, and local servers should cache frequently used files. Which Azure feature should you deploy?

Accepted Answer

Azure File Sync, because it synchronizes on-premises file servers with an Azure file share and supports cloud tiering.. Azure File Sync is the correct choice because it synchronizes on-premises Windows file servers with an Azure file share, enabling multi-site file server consolidation. It supports cloud tiering, which caches frequently accessed files locally on each branch server while freeing up space by tiering cold data to the cloud. This ensures users can continue working during short WAN outages, as local caches provide access to synced files even when connectivity is lost.

Answer

Azure Blob Storage with lifecycle rules, because it can present files to multiple branches.

Answer

A private endpoint to Blob Storage, because it provides local caching for SMB file shares.

Answer

A managed disk shared across the branch servers, because it gives the same content to all locations.

Question 8

Based on the exhibit, why is the administrator's HTTPS test still being denied, and what should be changed?

Accepted Answer

Move Allow-HTTPS-Admin to a priority lower than 200.. The administrator's HTTPS test is denied because Azure Network Security Groups (NSGs) process rules in priority order, from lowest to highest numeric value. The deny rule at priority 200 is evaluated before the allow rule at priority 300, so the HTTPS traffic is blocked. To allow HTTPS traffic, the allow rule must have a lower priority number (e.g., 100) than the deny rule, ensuring it is evaluated first. Option B correctly identifies that moving Allow-HTTPS-Admin to a priority lower than 200 (i.e., a smaller number) will allow the traffic before the deny rule is applied.

Answer

Increase the deny rule priority number from 200 to 300.

Answer

Change Allow-HTTPS-Admin to use protocol Any.

Answer

Assign a public IP address to the VM.

Question 9

Based on the exhibit, the VPN gateway deployment fails during validation. What resource is missing?

Accepted Answer

A public IP address resource associated with the VPN gateway.. A VPN gateway requires a dedicated public IP address resource to establish the IPsec tunnel with the on-premises VPN device. During validation, Azure checks that a public IP address is associated with the gateway; if missing, the deployment fails because the gateway cannot route traffic over the internet or terminate the VPN connection.

Answer

A network security group attached to GatewaySubnet.

Answer

A route table with a default route to the on-premises network.

Answer

A private endpoint for the on-premises VPN device.

Question 10

A lifecycle rule moves blobs to the archive tier after 90 days. A file was archived 2 weeks ago, and a reporting job now needs to read it tomorrow morning. What should you expect?

Accepted Answer

The file must be rehydrated to an online tier before it can be read, so access is delayed.. Blobs in the Azure Archive tier are offline and cannot be read directly. To access the data, you must first rehydrate the blob to an online tier (Hot, Cool, or Cold) using a copy or change-tier operation, which introduces a delay (typically up to 15 hours for standard priority rehydration). The file was archived only 2 weeks ago, so it is still in the Archive tier and requires rehydration before the reporting job can read it tomorrow morning.

Answer

The file is immediately readable, but only through the archive endpoint and at a higher request rate.

Answer

The file is permanently deleted when it enters archive, so the job must use a backup restore.

Answer

The file can be read immediately if the account has read-access geo-redundancy enabled.

Question 11

A company wants to stop users from creating resources in regions that are not approved and also require a Department tag on new resources. Which two tasks are best handled by Azure Policy? Select two.

Accepted Answer

Restrict allowed deployment locations.. Azure Policy can enforce organizational standards by evaluating resource properties against business rules. Option A is correct because the 'Allowed Locations' policy definition restricts users from deploying resources to any region not explicitly permitted, directly addressing the requirement to block unapproved regions. Option B is correct because the 'Require a tag and its value on resources' policy definition can enforce that a Department tag must exist on all new resources, ensuring compliance with tagging requirements.

Answer

Give users Contributor access to the subscription.

Answer

Create Microsoft Entra ID users for contractors.

Answer

Place a CanNotDelete lock on every resource group.

Question 12

A VM cannot connect to another VM on TCP 1433. You need to determine whether an NSG is blocking the flow and identify which rule applies. Which Network Watcher tool should you use?

Accepted Answer

IP flow verify. IP flow verify is the correct Network Watcher tool because it tests whether a packet is allowed or denied to or from a specific VM, based on a 5-tuple (source IP, destination IP, protocol, source port, destination port). For TCP 1433 (SQL Server), you can specify the exact flow parameters, and IP flow verify will evaluate all effective security rules, including NSG rules, and return the specific rule that allowed or denied the traffic.

Answer

Packet capture

Answer

Connection troubleshoot

Answer

Effective routes

Question 13

A team manages three backend servers in one subnet. The servers are replaced periodically, so their private IP addresses change. The NSG must allow inbound traffic from the web tier without updating individual IP addresses each time. Which destination object should be used in the NSG rule?

Accepted Answer

Application security group. An Application Security Group (ASG) allows you to group backend servers logically, regardless of their private IP addresses, and reference that group as the destination in an NSG rule. When servers are replaced and their IPs change, the ASG membership is automatically updated, so the NSG rule continues to apply without manual intervention. This is the correct approach for dynamic workloads where IP addresses are not static.

Answer

Service tag

Answer

Route table

Answer

Private endpoint

Question 14

An application uses two Azure VMs in the same datacenter and must continue through planned maintenance and a single hardware host failure. The administrator does not need separate datacenter protection. Which option should be used?

Accepted Answer

Availability set. An availability set distributes VMs across multiple fault domains (hardware hosts) and update domains within a single Azure datacenter. This ensures that during planned maintenance (update domains) or a single hardware host failure (fault domains), at least one VM remains available. Since the requirement does not include separate datacenter protection, an availability set is the correct choice.

Answer

Availability zones

Answer

Proximity placement group

Answer

Virtual machine scale set

Question 15

Backend virtual machines are rebuilt frequently and often receive different private IP addresses. An administrator must allow the frontend tier to reach the backend tier on TCP 8443 without editing NSG rules every time the backend IP changes. What should the administrator use in the NSG rule?

Accepted Answer

An Application Security Group that contains the backend VMs.. An Application Security Group (ASG) allows you to group backend VMs logically and reference that group in a Network Security Group (NSG) rule. When backend VMs are rebuilt and receive new private IPs, you simply add the new VMs to the same ASG, and the existing NSG rule (which references the ASG as the destination) automatically applies to the new IPs without any manual rule edits. This decouples security policy from dynamic IP addresses, making it the ideal solution for frequently changing backend IPs.

Answer

A static private IP address for each backend VM.

Answer

A user-defined route pointing frontend traffic to the backend subnet.

Answer

A private endpoint for the backend tier.