AZ-104 Practice Test 12 — 15 Questions

Question 1

Based on the exhibit, a site-to-site VPN gateway deployment fails. What prerequisite should the administrator provide so the gateway can be created successfully?

Accepted Answer

A public IP address resource that will be associated with the VPN gateway.. A site-to-site VPN gateway in Azure requires a public IP address resource to be associated with it for the tunnel to be established. The VPN gateway uses this public IP as the endpoint for on-premises VPN devices to connect to over the internet. Without a public IP, the gateway cannot be provisioned because it has no routable external address for IPsec/IKE negotiation.

Answer

A NAT gateway on the GatewaySubnet to translate tunnel traffic.

Answer

A private endpoint in the GatewaySubnet for tunnel termination.

Answer

A network security group that allows inbound TCP 443 to the subnet.

Question 2

An application runs on an Azure VM in a subnet and must access a storage account over the public endpoint without using a private IP address. The administrator wants to restrict access so only that subnet can reach the account. What should be configured?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account network rules.. A service endpoint for Microsoft.Storage extends the virtual network identity to the subnet, allowing the storage account firewall to accept traffic from that subnet via its public endpoint. This meets the requirement of restricting access to the storage account's public endpoint without using a private IP address.

Answer

Create a private endpoint for the storage account and disable the public endpoint.

Answer

Allow trusted Microsoft services to bypass the firewall.

Answer

Add a user-defined route that points storage traffic to the virtual network gateway.

Question 3

A three-tier application uses separate web and app VMs that are scaled in and out regularly. The administrator must allow only the web tier to connect to the app tier on TCP 8080 without continually updating IP addresses. What should be configured in the NSG rule?

Accepted Answer

Use application security groups for the web and app tiers and reference those groups in the NSG rule.. Application security groups (ASGs) allow you to group VMs logically by their application role (e.g., web tier, app tier) and reference those groups directly in NSG rules. This eliminates the need to maintain individual IP addresses or CIDR ranges when VMs scale in or out, because the NSG rule dynamically applies to all VMs in the ASG. By creating an inbound NSG rule that allows TCP 8080 from the web-tier ASG to the app-tier ASG, the administrator achieves the required connectivity without manual IP updates.

Answer

Add a subnet-to-subnet peering connection between the web and app subnets.

Answer

Create a load balancer backend pool rule for TCP 8080.

Answer

Use a user-defined route that sends TCP 8080 traffic to the app tier.

Question 4

A VM sends traffic to 172.16.5.10, but the administrator suspects the traffic is taking an unexpected next hop. They want to see the effective route table applied to the VM NIC, including system routes, user-defined routes, and propagated routes. Which Network Watcher tool should be used?

Accepted Answer

Effective routes. Effective routes is the correct Network Watcher tool because it displays the complete route table applied to a VM NIC, including system routes, user-defined routes (UDRs), and BGP-propagated routes from virtual network gateways. This allows the administrator to see exactly which next hop is selected for traffic to 172.16.5.10 based on the longest prefix match, identifying any unexpected routing behavior.

Answer

IP flow verify

Answer

Packet capture

Answer

Connection troubleshoot

Question 5

A finance team wants every resource created in one production resource group to carry CostCenter=PRD automatically. They do not want deployments blocked if a team forgets the tag, but they do want existing resources and future resources in that resource group to converge on the correct tag value. What should the administrator configure?

Accepted Answer

Assign a modify policy for CostCenter=PRD at the production resource group scope and create a remediation task.. Azure Policy with a 'modify' effect can automatically add or correct the CostCenter tag on resources within the specified scope. By assigning the policy at the production resource group scope and creating a remediation task, the policy will audit existing resources and, via a managed identity, apply the tag value to non-compliant resources without blocking deployment. This satisfies the requirement for automatic convergence without preventing creation if the tag is missing.

Answer

Apply a CanNotDelete lock to the production resource group.

Answer

Assign Contributor on the subscription and require teams to enter the tag manually.

Answer

Set the tag on the management group and expect all resources to inherit it automatically.

Question 6

A development team needs a new Windows VM created from an approved hardened image, and IIS must be installed automatically after deployment. Which three actions should the administrator take? Select three.

Accepted Answer

Use an Azure Compute Gallery image version created from the approved hardened build.. An Azure Compute Gallery (formerly Shared Image Gallery) allows you to create and store custom VM images, including hardened builds. Using a gallery image version ensures the VM is deployed from an approved, pre-configured image that meets security and compliance requirements, avoiding the need to manually harden a fresh marketplace image.

Answer

Start from a fresh marketplace image and harden it manually after the VM is running.

Answer

Install IIS interactively after logging in to the VM with an administrator account.

Question 7

Two VNets are peered successfully, and a VM in the spoke can reach a private endpoint in the hub by IP address. However, the VM cannot resolve the storage account name to the private endpoint FQDN. The private DNS zone is linked only to the hub VNet. What should the administrator do?

Accepted Answer

Link the private DNS zone to the spoke VNet as well.. The VM can reach the private endpoint by IP, confirming that network connectivity (peering and routing) is working. However, name resolution fails because the private DNS zone, which contains the private endpoint FQDN mapping, is linked only to the hub VNet. By linking the private DNS zone to the spoke VNet (option B), the spoke VMs will use Azure-provided DNS to resolve the storage account name to the private IP, enabling seamless name resolution across the peered VNets.

Answer

Add a route table to the spoke subnet pointing to the private endpoint IP.

Answer

Enable gateway transit on the peering connection.

Answer

Create an NSG rule to allow DNS traffic to the storage account.

Question 8

A platform team is tuning alerting for a production VM and the surrounding Azure resources. Match each Azure Monitor component to the function it performs in this design.

Accepted Answer

Azure Monitor Metrics: Collects and analyzes numerical data such as CPU and memory usage from Azure resources.. Azure Monitor Metrics handles numerical data, Logs handles log data; Application Insights is for app monitoring; Alerts notify on conditions; Workbooks and Dashboards are visualization tools.

Answer

Azure Monitor Metrics: Collects and analyzes log data such as event logs and error traces.

Answer

Application Insights: Collects and analyzes numerical data such as CPU and memory usage.

Question 9

You need to control inbound and outbound traffic to resources in a subnet by allowing or denying traffic based on IP address, port, and protocol. Which Azure feature should you use?

Accepted Answer

A network security group. A network security group (NSG) is the correct Azure feature because it contains security rules that allow or deny inbound and outbound traffic at the subnet or network interface level based on source/destination IP address, port, and protocol (TCP, UDP, or Any). This directly matches the requirement to control traffic by these three parameters.

Answer

A route table

Answer

A private DNS zone

Answer

Azure Advisor

Question 10

A company is building a hub-and-spoke Azure network. The hub VNet already uses 10.50.0.0/16. A new spoke VNet will later be peered to the hub and connected to on-premises through VPN. What is the most important planning step before creating the peering?

Accepted Answer

Choose a non-overlapping address space for the spoke and reserve room for future subnets.. Azure VNet peering requires non-overlapping address spaces to establish connectivity. If the spoke uses the same address space as the hub (10.50.0.0/16), routing conflicts will occur, and the peering will fail or cause unpredictable traffic behavior. Additionally, reserving room for future subnets ensures the spoke can scale without needing to re-architect the network.

Answer

Reuse 10.50.0.0/16 in the spoke so routing to the hub is simpler.

Answer

Create a route table first so peering can learn the spoke routes.

Answer

Enable a service endpoint to allow the spoke to communicate with the hub.

Question 11

Based on the exhibit, a user accidentally deleted one file from the VM and you need to restore only that file without recovering the entire virtual machine. What should you use?

Accepted Answer

Run file recovery from the available recovery point.. Azure Backup for Azure VMs supports file-level recovery from VM backup snapshots without restoring the entire VM. By selecting 'File Recovery' from the backup item's recovery point, you can mount the backup as a drive on the VM or a recovery machine, browse the file system, and copy the deleted file back to its original location. This avoids the overhead and downtime of a full VM restore.

Answer

Restore the entire VM to the original resource group.

Answer

Create a new backup policy with longer retention and wait for the next backup.

Answer

Use Azure Monitor alerts to trigger an automatic file restore.

Question 12

A stateless API must automatically add or remove identical VM instances when CPU usage crosses thresholds. The team also wants Microsoft to distribute instances across fault domains when possible. Which service should the administrator deploy?

Accepted Answer

A virtual machine scale set. A virtual machine scale set (VMSS) is the correct choice because it provides built-in autoscaling capabilities that automatically add or remove identical VM instances based on CPU usage thresholds. VMSS also supports automatic distribution of instances across fault domains when configured with a fault domain count greater than 1, meeting the requirement for Microsoft to distribute instances across fault domains.

Answer

An availability set

Answer

Azure Load Balancer

Answer

Azure App Service

Question 13

An analytics team keeps quarterly telemetry exports in Azure Blob Storage. The files are accessed only a few times per year, but when they are needed they must remain online and immediately readable without any rehydration delay. Which access tier should you use?

Accepted Answer

Cold, because it is intended for rarely accessed online data with lower storage cost.. The Cold tier is designed for data that is rarely accessed but must remain online with immediate read access, offering lower storage costs than Cool or Hot tiers while avoiding the rehydration delay of Archive. The scenario specifies files are accessed only a few times per year but must be immediately readable without any rehydration delay, which matches Cold tier's purpose of providing online access with no latency for infrequent reads.

Answer

Hot, because it is optimized for frequent reads and writes.

Answer

Cool, because it is designed for infrequently accessed data that still stays online.

Answer

Archive, because it is the cheapest tier and can be opened directly in the portal.

Question 14

Based on the exhibit, the OS disk on a production VM is corrupted, but the VM must stay in place and keep its NIC and data disks. Which restore option should you choose?

Accepted Answer

Restore the disk, then attach or swap it as needed to repair the existing VM.. When an OS disk is corrupted, you can restore just the disk from a recovery point and then either attach it as a data disk to the existing VM or swap the OS disk. This approach preserves the VM's NIC, data disks, and IP configuration, meeting the requirement to keep the VM in place.

Answer

Restore the VM as a new virtual machine and delete the existing one immediately.

Answer

Use Azure Monitor to roll back the last deployment automatically.

Answer

Enable a diagnostic setting on the VM so the OS disk will be repaired.

Question 15

A user deleted one Excel file from a Windows Server VM that is protected by Azure Backup. The VM must keep running, and the administrator must restore only that file as quickly as possible. What should the administrator do?

Accepted Answer

Use File Recovery from the Recovery Services vault, mount the recovery point, and copy back the deleted file.. Azure Backup for Azure VMs supports file-level recovery from recovery points without restoring the entire VM. The File Recovery feature mounts the recovery point as an iSCSI target on the VM, allowing the administrator to browse and copy the deleted Excel file directly. This is the fastest method because it avoids the overhead of a full VM restore or snapshot management.

Answer

Restore the entire virtual machine from the most recent recovery point.

Answer

Fail over the VM by using Azure Site Recovery and then copy the file from the replica.

Answer

Create a snapshot of the VM disk and restore the spreadsheet from the snapshot.