AZ-104 Practice Test 13 — 15 Questions

Question 1

A project team adds and removes contractors every few weeks. The team needs Azure access to follow membership changes without updating role assignments for each person. What should the administrator use to delegate the access?

Accepted Answer

Create a Microsoft Entra security group, add the contractors, and assign the Azure role to the group.. Option B is correct because assigning an Azure role to a Microsoft Entra security group allows the administrator to manage access by simply adding or removing contractors from the group, without needing to update role assignments for each individual. This leverages Azure RBAC's support for group-based assignments, which automatically propagate role permissions to new members and revoke them from removed members.

Answer

Assign the Azure role directly to each contractor user account.

Answer

Use a Microsoft 365 group and assign the Azure role to it.

Answer

Create a management group for the contractors and assign the role there.

Question 2

A storage account hosts blobs used by a public website. You need to reduce the risk of accidental deletion by developers while allowing updates to existing blobs. What should you configure?

Accepted Answer

Enable blob soft delete.. Blob soft delete protects against accidental deletion by retaining deleted blobs for a specified retention period, allowing recovery. This meets the requirement to reduce risk from developers while still permitting updates to existing blobs, as soft delete only applies to delete operations, not overwrites.

Answer

Enable immutable storage for the container.

Answer

Move the account to premium performance.

Answer

Enable static website hosting only.

Question 3

A security analyst is reviewing deleted-resource evidence, exported diagnostics, and heartbeat data. Match each monitoring term to the best description.

Question 4

A storage account must be reachable only from resources in one Azure subnet, and public network access should not be used. Which configuration best meets this requirement?

Accepted Answer

Create a private endpoint for the storage account in the subnet. A private endpoint assigns the storage account a private IP address from the specified Azure subnet, effectively bringing the storage account into the virtual network. This ensures that all traffic to the storage account stays within the Microsoft Azure backbone network and never traverses the public internet, meeting the requirement to restrict access exclusively to resources in that subnet while disabling public network access.

Answer

Enable blob versioning on the storage account

Answer

Assign a ReadOnly lock to the storage account

Answer

Enable a shared access signature

Question 5

A team manages a production VM and its supporting storage account. Match each operational requirement to the Azure Monitor component that should be configured.

Question 6

A support engineer is investigating a failed Azure VM backup job in Log Analytics. Match each KQL operator to the result it produces.

Question 7

A workload subnet must send all outbound internet traffic through a network virtual appliance at 10.4.2.4. What should the administrator configure?

Accepted Answer

A route table with a user-defined route sending 0.0.0.0/0 to 10.4.2.4.. Option B is correct because a user-defined route (UDR) with a destination of 0.0.0.0/0 and a next hop of Virtual Appliance (10.4.2.4) overrides the default system route for internet traffic, forcing all outbound traffic from the subnet to be forwarded to the network virtual appliance (NVA) for inspection or NAT. This is the standard method to implement forced tunneling or centralized internet egress in Azure.

Answer

An NSG rule that allows outbound traffic to 10.4.2.4.

Answer

A private DNS zone for the subnet.

Answer

A service endpoint for the virtual network.

Question 8

A team wants an Azure VM in a subnet to reach a storage account securely without opening the account to the entire internet. Which two configuration choices can be used to achieve this? Select two.

Accepted Answer

Private endpoint. Private endpoint (A) assigns a private IP address from the VM's subnet to the storage account, enabling secure connectivity over the Microsoft backbone network without exposing the account to the public internet. Service endpoint (B) extends the virtual network identity to the storage account via its public endpoint but restricts access to traffic originating from the specified subnet, also avoiding full internet exposure. Both options satisfy the requirement for secure, subnet-restricted access.

Answer

Enable anonymous blob access

Answer

Move the account to the Archive tier

Answer

Apply a delete lock to the storage account

Question 9

A Virtual Machine Scale Set must add instances automatically when average CPU usage is above 75 percent and remove instances when CPU drops below 30 percent. Which feature should you configure?

Accepted Answer

Autoscale rules in Azure Monitor. Autoscale rules in Azure Monitor allow you to define conditions for automatically scaling a Virtual Machine Scale Set (VMSS) based on metrics like average CPU usage. You can set a scale-out rule to add instances when CPU exceeds 75% and a scale-in rule to remove instances when CPU drops below 30%, with a cool-down period to prevent flapping. This is the native Azure feature designed for such metric-based auto-scaling scenarios.

Answer

A Recovery Services vault policy

Answer

Boot diagnostics

Answer

Azure Advisor only

Question 10

A VM-hosted app needs to upload blobs without storing a storage account key or password on the VM. Which two authentication options meet this requirement? Select two.

Accepted Answer

System-assigned managed identity. System-assigned managed identity (Option A) is correct because it allows the VM to authenticate to Azure Blob Storage without storing any credentials on the VM. When enabled, Azure automatically creates a service principal in Azure AD for the VM, and the VM can obtain an access token from the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) to authenticate to storage. This eliminates the need for any storage account key or password on the VM.

Answer

Storage account access key in an application setting

Answer

Shared access signature token saved on the VM

Answer

Anonymous public access to the container

Question 11

A web application runs in Azure App Service and uploads files to Azure Blob Storage. The storage account has shared key access disabled, and the app must not store secrets in configuration. If the App Service is deleted and recreated later, the storage access should be removed automatically with the app. What should you configure?

Accepted Answer

A system-assigned managed identity with Blob Data Contributor permissions on the container.. A system-assigned managed identity is tied to the App Service lifecycle, so when the app is deleted, the identity is automatically removed, revoking access to Blob Storage. Granting Blob Data Contributor permissions on the container allows the app to upload files without storing any secrets, satisfying the requirement that shared key access is disabled and no secrets are stored in configuration.

Answer

A user-assigned managed identity with Blob Data Reader permissions on the storage account.

Answer

A shared access signature generated from the storage account key.

Answer

A storage account access key stored in an application setting.

Question 12

A VM-hosted application must read blobs from Azure Storage without storing any keys or passwords. Which two identity types can the VM use to authenticate to Azure Storage? Select two.

Accepted Answer

System-assigned managed identity, because it is tied to one VM and can request tokens without stored secrets.. System-assigned managed identity is correct because it is directly tied to a single VM and can request tokens from Azure AD without storing any secrets or keys. The VM uses its managed identity to authenticate to Azure Storage by obtaining an OAuth 2.0 token, which is then passed to the storage service via the Authorization header. This eliminates the need for any stored credentials, meeting the requirement of not storing keys or passwords.

Answer

Storage account shared key, because it is the preferred credential when you want to avoid passwords.

Answer

Basic authentication with a storage account name and password, because Azure Storage supports that model directly.

Answer

Anonymous public access, because it lets the VM read blobs without any authentication at all.

Question 13

A web application is made up of several Azure resources that are deployed, updated, and retired together. The team wants one container for applying access control, tags, and deletion protection consistently to the whole application. What should they use?

Accepted Answer

A resource group.. A resource group is the correct container because it is a logical grouping of Azure resources that share the same lifecycle, allowing you to apply access control (RBAC), tags, and deletion protection (resource locks) consistently to all resources within the group. This aligns with the requirement to deploy, update, and retire resources together as a single unit.

Answer

A subscription dedicated to the application.

Answer

A management group.

Answer

A tag value that names the application.

Question 14

A VM backup policy is being designed in a Recovery Services vault. Match each backup policy element to the behavior it controls.

Question 15

A workload needs more CPU and memory than the current Azure VM size provides. The administrator wants to increase compute capacity without redeploying the application. What should be done?

Accepted Answer

Resize the VM to a larger size. Resizing the Azure VM to a larger size (option A) directly increases the CPU and memory resources allocated to the VM without requiring redeployment of the application. Azure supports resizing VMs within the same hardware family or to a different family, provided the new size is available in the current region and the VM is not part of a VMSS with overprovisioning constraints. The resize operation updates the VM's SKU, and after a reboot, the new resources are available to the OS and applications.

Answer

Move the VM into an availability set

Answer

Replace the VM with a snapshot

Answer

Assign a user-assigned managed identity