AZ-104 Practice Test 13 — 15 Questions

Question 1

Based on the exhibit, a user accidentally deleted one file from the VM and you need to restore only that file without recovering the entire virtual machine. What should you use?

Accepted Answer

Run file recovery from the available recovery point.. Azure Backup for Azure VMs supports file-level recovery from VM backup snapshots without restoring the entire VM. By selecting 'File Recovery' from the backup item's recovery point, you can mount the backup as a drive on the VM or a recovery machine, browse the file system, and copy the deleted file back to its original location. This avoids the overhead and downtime of a full VM restore.

Answer

Restore the entire VM to the original resource group.

Answer

Create a new backup policy with longer retention and wait for the next backup.

Answer

Use Azure Monitor alerts to trigger an automatic file restore.

Question 2

A stateless API must automatically add or remove identical VM instances when CPU usage crosses thresholds. The team also wants Microsoft to distribute instances across fault domains when possible. Which service should the administrator deploy?

Accepted Answer

A virtual machine scale set. A virtual machine scale set (VMSS) is the correct choice because it provides built-in autoscaling capabilities that automatically add or remove identical VM instances based on CPU usage thresholds. VMSS also supports automatic distribution of instances across fault domains when configured with a fault domain count greater than 1, meeting the requirement for Microsoft to distribute instances across fault domains.

Answer

An availability set

Answer

Azure Load Balancer

Answer

Azure App Service

Question 3

An analytics team keeps quarterly telemetry exports in Azure Blob Storage. The files are accessed only a few times per year, but when they are needed they must remain online and immediately readable without any rehydration delay. Which access tier should you use?

Accepted Answer

Cold, because it is intended for rarely accessed online data with lower storage cost.. The Cold tier is designed for data that is rarely accessed but must remain online with immediate read access, offering lower storage costs than Cool or Hot tiers while avoiding the rehydration delay of Archive. The scenario specifies files are accessed only a few times per year but must be immediately readable without any rehydration delay, which matches Cold tier's purpose of providing online access with no latency for infrequent reads.

Answer

Hot, because it is optimized for frequent reads and writes.

Answer

Cool, because it is designed for infrequently accessed data that still stays online.

Answer

Archive, because it is the cheapest tier and can be opened directly in the portal.

Question 4

Based on the exhibit, the OS disk on a production VM is corrupted, but the VM must stay in place and keep its NIC and data disks. Which restore option should you choose?

Accepted Answer

Restore the disk, then attach or swap it as needed to repair the existing VM.. When an OS disk is corrupted, you can restore just the disk from a recovery point and then either attach it as a data disk to the existing VM or swap the OS disk. This approach preserves the VM's NIC, data disks, and IP configuration, meeting the requirement to keep the VM in place.

Answer

Restore the VM as a new virtual machine and delete the existing one immediately.

Answer

Use Azure Monitor to roll back the last deployment automatically.

Answer

Enable a diagnostic setting on the VM so the OS disk will be repaired.

Question 5

A user deleted one Excel file from a Windows Server VM that is protected by Azure Backup. The VM must keep running, and the administrator must restore only that file as quickly as possible. What should the administrator do?

Accepted Answer

Use File Recovery from the Recovery Services vault, mount the recovery point, and copy back the deleted file.. Azure Backup for Azure VMs supports file-level recovery from recovery points without restoring the entire VM. The File Recovery feature mounts the recovery point as an iSCSI target on the VM, allowing the administrator to browse and copy the deleted Excel file directly. This is the fastest method because it avoids the overhead of a full VM restore or snapshot management.

Answer

Restore the entire virtual machine from the most recent recovery point.

Answer

Fail over the VM by using Azure Site Recovery and then copy the file from the replica.

Answer

Create a snapshot of the VM disk and restore the spreadsheet from the snapshot.

Question 6

A team is creating a new spoke VNet that will later be peered to an existing hub VNet and connected to on-premises networks. The proposed address space for the spoke is 10.60.1.0/24. The hub already uses 10.60.0.0/16. What should the administrator do before deploying the spoke?

Accepted Answer

Choose a non-overlapping address space for the spoke, such as 10.61.1.0/24.. VNet address spaces must not overlap when peered or connected via VPN/ExpressRoute. The proposed spoke address 10.60.1.0/24 falls within the hub's 10.60.0.0/16 range, creating an overlap that would prevent successful peering and routing. A non-overlapping address space like 10.61.1.0/24 ensures unique IP ranges, allowing proper route propagation and connectivity.

Answer

Use the proposed address space because the spoke subnet is smaller than the hub address space.

Answer

Create a private endpoint in the spoke to separate its routing table from the hub.

Answer

Enable gateway transit on the hub peering before creating the spoke.

Question 7

A contractor must manage only VM1 and VM2 in rg-prod. The contractor must not be able to manage any other resource in the resource group. Which two role assignment scopes should you create? Select two.

Accepted Answer

Assign the role at the VM1 resource scope.. Assigning the role at the VM1 resource scope (Option A) is correct because Azure RBAC allows you to scope a role assignment to an individual resource, such as a virtual machine. This grants the contractor permissions to manage only VM1, without affecting any other resources in the resource group. The same logic applies to VM2, making the resource-level scope the precise way to restrict management to just those two VMs.

Answer

Assign the role at the rg-prod resource group scope.

Answer

Assign the role at the subscription scope.

Answer

Assign the role at the management group scope.

Question 8

An application on an Azure VM has outgrown its current CPU and memory. The administrator wants to increase compute capacity without rebuilding the application or changing the VM image. What should be done?

Accepted Answer

Resize the virtual machine to a larger size. Resizing the VM to a larger size (Option A) directly increases the CPU and memory resources allocated to the VM without requiring any changes to the application or the underlying OS disk image. Azure allows you to change the VM size as long as the new size is available in the current hardware cluster and the VM is deallocated (stopped) first. This is the simplest and most appropriate method to scale up compute capacity while preserving the existing configuration and data.

Answer

Create a new snapshot of the OS disk

Answer

Move the VM to an availability set

Answer

Attach a data disk

Question 9

A VM backup policy is being designed in a Recovery Services vault. Match each backup policy element to the behavior it controls.

Accepted Answer

Retention Range: Defines how long backup snapshots and recovery points are kept.. A backup policy in a Recovery Services vault includes retention settings (how long to keep backups), schedule (when to back up), snapshot retention (for instant restores), policy type (Standard vs Enhanced), time zone, and frequency (daily/weekly).

Answer

Retention Range: Controls the time zone for backup scheduling.

Answer

Backup Schedule: Defines how many backups are retained.

Question 10

An administrator is reviewing a KQL query used to investigate failed operations in a Log Analytics workspace. Match each KQL operator to the effect it has on the query output.

Accepted Answer

where: Filters results to rows matching a specified condition. These are standard KQL operators used in Log Analytics queries. 'where' filters, 'project' selects columns, 'extend' adds computed columns, 'summarize' aggregates, 'join' merges tables, and 'order by' sorts results.

Answer

extend: Filters results to rows matching a specified condition

Answer

join: Adds computed columns to the result set

Answer

order by: Groups data and applies aggregation

Question 11

Order the steps to configure Azure Traffic Manager for geographic routing.

Accepted Answer

1. Create Traffic Manager profile, 2. Set geographic routing method, 3. Add endpoints with geographic mapping, 4. Configure monitoring settings, 5. Update DNS to point to Traffic Manager.. Create profile, set geographic routing, add endpoints with mapping, configure monitoring, update DNS.

Answer

1. Update DNS to point to Traffic Manager, 2. Create Traffic Manager profile, 3. Add endpoints with geographic mapping, 4. Set geographic routing method, 5. Configure monitoring settings.

Answer

1. Create Traffic Manager profile, 2. Add endpoints with geographic mapping, 3. Set geographic routing method, 4. Configure monitoring settings, 5. Update DNS to point to Traffic Manager.

Answer

1. Create Traffic Manager profile, 2. Set geographic routing method, 3. Configure monitoring settings, 4. Add endpoints with geographic mapping, 5. Update DNS to point to Traffic Manager.

Question 12

An application runs in a subnet and must reach a storage account over the public endpoint, but only that subnet should be allowed. The team does not want to use a private endpoint. Which two configurations should the administrator use? Select two.

Accepted Answer

Enable the Microsoft.Storage service endpoint on the subnet.. Enabling the Microsoft.Storage service endpoint on the subnet (A) ensures that traffic from the subnet to the storage account's public endpoint is routed through the Azure backbone network and uses the source IP of the subnet's virtual network, allowing the storage account firewall to identify the traffic. Adding the subnet to the storage account's virtual network rules (B) then explicitly permits only that subnet's traffic, denying all other public endpoint access. Together, these two configurations restrict access to the storage account's public endpoint exclusively to the specified subnet without requiring a private endpoint.

Answer

Create a private endpoint for the storage account.

Answer

Assign the Reader role to the subnet.

Answer

Turn on blob soft delete.

Question 13

A team wants an Azure VM in a subnet to reach a storage account securely without opening the account to the entire internet. Which two configuration choices can be used to achieve this? Select two.

Accepted Answer

Private endpoint. Private endpoint (A) assigns a private IP address from the VM's subnet to the storage account, enabling secure connectivity over the Microsoft backbone network without exposing the account to the public internet. Service endpoint (B) extends the virtual network identity to the storage account via its public endpoint but restricts access to traffic originating from the specified subnet, also avoiding full internet exposure. Both options satisfy the requirement for secure, subnet-restricted access.

Answer

Enable anonymous blob access

Answer

Move the account to the Archive tier

Answer

Apply a delete lock to the storage account

Question 14

Based on the exhibit, the support team needs a searchable 90-day history of who deleted Azure resources and when. The current workspace only contains VM guest logs. Which configuration should you add?

Accepted Answer

Configure a diagnostic setting at the subscription scope to send the Azure Activity log to Log Analytics and retain it for 90 days.. The Azure Activity log records all control-plane events, including resource deletions, at the subscription level. By configuring a diagnostic setting to stream the Activity log to a Log Analytics workspace, you can retain the data for up to 90 days (or longer with data export rules) and make it searchable via KQL queries. The current workspace only contains VM guest logs, so adding this setting directly meets the requirement without relying on guest-level or network-level logs.

Answer

Enable guest-level diagnostics on each VM so deletion events are captured.

Answer

Turn on NSG flow logs for all subnets to capture resource deletions.

Answer

Store VM backups in the vault and use restore points as an audit trail.

Question 15

An administrator is deploying a site-to-site VPN gateway in the Azure portal. The deployment fails validation because the gateway does not have a public-facing address to terminate the tunnel. What must be created and associated with the VPN gateway?

Accepted Answer

A public IP address resource associated with the VPN gateway.. A site-to-site VPN gateway in Azure requires a public IP address to terminate the IPSec tunnel from the on-premises device. The public IP address resource must be created and associated with the VPN gateway during deployment; without it, the gateway has no routable endpoint for the tunnel, causing validation to fail.

Answer

A load balancer frontend IP configuration in front of the gateway subnet.

Answer

A NAT gateway attached to GatewaySubnet.

Answer

A private endpoint for the virtual network gateway resource.