AZ-104 Practice Test 12 — 15 Questions

Question 1

An application on a VM in subnet AppSubnet must access a storage account over the public endpoint. The security team wants to allow traffic only from AppSubnet and does not want to deploy a private endpoint. What should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable the Microsoft.Storage service endpoint on AppSubnet and allow that virtual network in the storage account firewall.. Enabling a Microsoft.Storage service endpoint on AppSubnet allows traffic from that subnet to the storage account over the Azure backbone network, while still using the public endpoint. Then, configuring the storage account firewall to allow that virtual network restricts access exclusively to AppSubnet, meeting the security requirement without deploying a private endpoint.

Answer

Disable the storage account firewall and rely on the VM's source IP address.

Answer

Create a private endpoint and leave the firewall set to allow all networks.

Answer

Grant the VM Contributor access to the storage account and the network rule will be enforced automatically.

Question 2

A reporting server must be resized from 4 vCPU to 8 vCPU for a four-hour batch window. The VM name, NIC, private IP, and attached managed disks must stay the same, and the team accepts a brief outage during the change. Which two actions should you choose? Select two.

Accepted Answer

Deallocate the VM before changing its size.. Deallocating the VM (stopping it in the Azure portal) releases the underlying hardware reservation, which is required before changing the VM size to a different SKU. This ensures the VM can be resized to a supported size without conflicts, and the brief outage is acceptable as stated in the scenario.

Answer

Delete the VM and recreate it with a new size.

Answer

Generalize the VM first to preserve the existing configuration.

Answer

Take a snapshot of the OS disk instead of resizing.

Question 3

A VM in VNet A can reach a storage account through a private endpoint, but when the VM resolves the storage account name it still gets the public IP address. What should you configure so name resolution returns the private endpoint address?

Accepted Answer

The private DNS zone linked to the VNet. When a private endpoint is created for a storage account, the DNS configuration must be updated so that the storage account's fully qualified domain name resolves to the private endpoint's private IP address instead of the public IP. Linking a private DNS zone (privatelink.blob.core.windows.net) to the virtual network and configuring a virtual network link ensures that the VM's DNS queries for the storage account are answered with the private endpoint IP. Without this, the VM continues to use the public IP from public DNS.

Answer

A user-defined route to the storage private endpoint

Answer

A resource lock on the storage account

Answer

A managed identity for the VM

Question 4

A business-critical storage account must survive a zone outage in the primary region and also keep a read-only copy in the paired region for reporting if the primary region becomes unavailable. Which redundancy option should you choose?

Accepted Answer

RA-GZRS because it provides zone redundancy and read access to the secondary region.. (RA-GZRS) is correct because it combines zone-redundant storage (ZRS) within the primary region, ensuring data survives a zone outage, with read-access geo-redundant storage (RA-GRS) to the paired region, providing a readable secondary copy for reporting if the primary region becomes unavailable. This meets both requirements: zone-level fault tolerance and read-only access to the secondary region during a primary outage.

Answer

ZRS because it protects against a single datacenter failure.

Answer

GZRS because it provides a readable secondary region by default.

Answer

RA-GRS because it provides zone redundancy and read access to the secondary region.

Question 5

A security team requires all outbound internet traffic from a workload subnet to pass through an NVA at 10.1.4.4. The subnet is already associated with an NSG that allows the traffic. Which UDR should the administrator add to the route table for that subnet?

Accepted Answer

Destination 0.0.0.0/0 with next hop type Virtual appliance and next hop IP 10.1.4.4.. A User Defined Route (UDR) with destination 0.0.0.0/0 and next hop type 'Virtual appliance' forces all outbound internet traffic from the subnet to be forwarded to the NVA at 10.1.4.4 for inspection. The 0.0.0.0/0 prefix matches all internet-bound traffic, and the 'Virtual appliance' next hop type enables routing to a private IP address within the virtual network, overriding the default system route that would otherwise send traffic directly to the Internet.

Answer

Destination 10.1.4.4/32 with next hop type Internet.

Answer

Destination 0.0.0.0/0 with next hop type Virtual network gateway.

Answer

Destination 10.1.4.0/24 with next hop type None.

Question 6

A VM in AppSubnet must reach a database VM in DbSubnet on TCP 1433. AppSubnet's NSG has an outbound deny rule for TCP 1433 to Any at priority 200. DbSubnet's NSG has an inbound allow rule for TCP 1433 from ASG-App to ASG-Db at priority 300. Both NICs are in the correct application security groups. Connectivity tests fail. What should the administrator change?

Accepted Answer

Create an outbound allow rule on AppSubnet with a lower priority number than 200 for TCP 1433 to ASG-Db.. The AppSubnet's NSG has an outbound deny rule for TCP 1433 to Any at priority 200, which blocks all outbound traffic on that port regardless of destination. To allow the VM in AppSubnet to reach the database VM in DbSubnet, an outbound allow rule must be created with a lower priority number (e.g., 100) so it is evaluated before the deny rule. This rule should specify the destination as ASG-Db (the application security group of the database VM) to precisely permit the required traffic.

Answer

Remove the inbound allow rule from DbSubnet so the default rules can take over.

Answer

Move the inbound allow rule on DbSubnet to priority 100 so it is evaluated sooner.

Answer

Assign the database VM NIC to ASG-App so the destination rule matches a broader group.

Question 7

Based on the exhibit, a site-to-site VPN gateway deployment fails. What prerequisite should the administrator provide so the gateway can be created successfully?

Accepted Answer

A public IP address resource that will be associated with the VPN gateway.. A site-to-site VPN gateway in Azure requires a public IP address resource to be associated with it for the tunnel to be established. The VPN gateway uses this public IP as the endpoint for on-premises VPN devices to connect to over the internet. Without a public IP, the gateway cannot be provisioned because it has no routable external address for IPsec/IKE negotiation.

Answer

A NAT gateway on the GatewaySubnet to translate tunnel traffic.

Answer

A private endpoint in the GatewaySubnet for tunnel termination.

Answer

A network security group that allows inbound TCP 443 to the subnet.

Question 8

An application runs on an Azure VM in a subnet and must access a storage account over the public endpoint without using a private IP address. The administrator wants to restrict access so only that subnet can reach the account. What should be configured?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account network rules.. A service endpoint for Microsoft.Storage extends the virtual network identity to the subnet, allowing the storage account firewall to accept traffic from that subnet via its public endpoint. This meets the requirement of restricting access to the storage account's public endpoint without using a private IP address.

Answer

Create a private endpoint for the storage account and disable the public endpoint.

Answer

Allow trusted Microsoft services to bypass the firewall.

Answer

Add a user-defined route that points storage traffic to the virtual network gateway.

Question 9

A three-tier application uses separate web and app VMs that are scaled in and out regularly. The administrator must allow only the web tier to connect to the app tier on TCP 8080 without continually updating IP addresses. What should be configured in the NSG rule?

Accepted Answer

Use application security groups for the web and app tiers and reference those groups in the NSG rule.. Application security groups (ASGs) allow you to group VMs logically by their application role (e.g., web tier, app tier) and reference those groups directly in NSG rules. This eliminates the need to maintain individual IP addresses or CIDR ranges when VMs scale in or out, because the NSG rule dynamically applies to all VMs in the ASG. By creating an inbound NSG rule that allows TCP 8080 from the web-tier ASG to the app-tier ASG, the administrator achieves the required connectivity without manual IP updates.

Answer

Add a subnet-to-subnet peering connection between the web and app subnets.

Answer

Create a load balancer backend pool rule for TCP 8080.

Answer

Use a user-defined route that sends TCP 8080 traffic to the app tier.

Question 10

A VM sends traffic to 172.16.5.10, but the administrator suspects the traffic is taking an unexpected next hop. They want to see the effective route table applied to the VM NIC, including system routes, user-defined routes, and propagated routes. Which Network Watcher tool should be used?

Accepted Answer

Effective routes. Effective routes is the correct Network Watcher tool because it displays the complete route table applied to a VM NIC, including system routes, user-defined routes (UDRs), and BGP-propagated routes from virtual network gateways. This allows the administrator to see exactly which next hop is selected for traffic to 172.16.5.10 based on the longest prefix match, identifying any unexpected routing behavior.

Answer

IP flow verify

Answer

Packet capture

Answer

Connection troubleshoot

Question 11

A finance team wants every resource created in one production resource group to carry CostCenter=PRD automatically. They do not want deployments blocked if a team forgets the tag, but they do want existing resources and future resources in that resource group to converge on the correct tag value. What should the administrator configure?

Accepted Answer

Assign a modify policy for CostCenter=PRD at the production resource group scope and create a remediation task.. Azure Policy with a 'modify' effect can automatically add or correct the CostCenter tag on resources within the specified scope. By assigning the policy at the production resource group scope and creating a remediation task, the policy will audit existing resources and, via a managed identity, apply the tag value to non-compliant resources without blocking deployment. This satisfies the requirement for automatic convergence without preventing creation if the tag is missing.

Answer

Apply a CanNotDelete lock to the production resource group.

Answer

Assign Contributor on the subscription and require teams to enter the tag manually.

Answer

Set the tag on the management group and expect all resources to inherit it automatically.

Question 12

A development team needs a new Windows VM created from an approved hardened image, and IIS must be installed automatically after deployment. Which three actions should the administrator take? Select three.

Accepted Answer

Use an Azure Compute Gallery image version created from the approved hardened build.. An Azure Compute Gallery (formerly Shared Image Gallery) allows you to create and store custom VM images, including hardened builds. Using a gallery image version ensures the VM is deployed from an approved, pre-configured image that meets security and compliance requirements, avoiding the need to manually harden a fresh marketplace image.

Answer

Start from a fresh marketplace image and harden it manually after the VM is running.

Answer

Install IIS interactively after logging in to the VM with an administrator account.

Question 13

Two VNets are peered successfully, and a VM in the spoke can reach a private endpoint in the hub by IP address. However, the VM cannot resolve the storage account name to the private endpoint FQDN. The private DNS zone is linked only to the hub VNet. What should the administrator do?

Accepted Answer

Link the private DNS zone to the spoke VNet as well.. The VM can reach the private endpoint by IP, confirming that network connectivity (peering and routing) is working. However, name resolution fails because the private DNS zone, which contains the private endpoint FQDN mapping, is linked only to the hub VNet. By linking the private DNS zone to the spoke VNet (option B), the spoke VMs will use Azure-provided DNS to resolve the storage account name to the private IP, enabling seamless name resolution across the peered VNets.

Answer

Add a route table to the spoke subnet pointing to the private endpoint IP.

Answer

Enable gateway transit on the peering connection.

Answer

Create an NSG rule to allow DNS traffic to the storage account.

Question 14

A platform team is tuning alerting for a production VM and the surrounding Azure resources. Match each Azure Monitor component to the function it performs in this design.

Accepted Answer

Azure Monitor Metrics: Collects and analyzes numerical data such as CPU and memory usage from Azure resources.. Azure Monitor Metrics handles numerical data, Logs handles log data; Application Insights is for app monitoring; Alerts notify on conditions; Workbooks and Dashboards are visualization tools.

Answer

Azure Monitor Metrics: Collects and analyzes log data such as event logs and error traces.

Answer

Application Insights: Collects and analyzes numerical data such as CPU and memory usage.

Question 15

A company is building a hub-and-spoke Azure network. The hub VNet already uses 10.50.0.0/16. A new spoke VNet will later be peered to the hub and connected to on-premises through VPN. What is the most important planning step before creating the peering?

Accepted Answer

Choose a non-overlapping address space for the spoke and reserve room for future subnets.. Azure VNet peering requires non-overlapping address spaces to establish connectivity. If the spoke uses the same address space as the hub (10.50.0.0/16), routing conflicts will occur, and the peering will fail or cause unpredictable traffic behavior. Additionally, reserving room for future subnets ensures the spoke can scale without needing to re-architect the network.

Answer

Reuse 10.50.0.0/16 in the spoke so routing to the hub is simpler.

Answer

Create a route table first so peering can learn the spoke routes.

Answer

Enable a service endpoint to allow the spoke to communicate with the hub.