AZ-104 Practice Test 13 — 15 Questions

Question 1

A team is creating a new spoke VNet that will later be peered to an existing hub VNet and connected to on-premises networks. The proposed address space for the spoke is 10.60.1.0/24. The hub already uses 10.60.0.0/16. What should the administrator do before deploying the spoke?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Choose a non-overlapping address space for the spoke, such as 10.61.1.0/24.. VNet address spaces must not overlap when peered or connected via VPN/ExpressRoute. The proposed spoke address 10.60.1.0/24 falls within the hub's 10.60.0.0/16 range, creating an overlap that would prevent successful peering and routing. A non-overlapping address space like 10.61.1.0/24 ensures unique IP ranges, allowing proper route propagation and connectivity.

Answer

Use the proposed address space because the spoke subnet is smaller than the hub address space.

Answer

Create a private endpoint in the spoke to separate its routing table from the hub.

Answer

Enable gateway transit on the hub peering before creating the spoke.

Question 2

A contractor must manage only VM1 and VM2 in rg-prod. The contractor must not be able to manage any other resource in the resource group. Which two role assignment scopes should you create? Select two.

Accepted Answer

Assign the role at the VM1 resource scope.. Assigning the role at the VM1 resource scope (Option A) is correct because Azure RBAC allows you to scope a role assignment to an individual resource, such as a virtual machine. This grants the contractor permissions to manage only VM1, without affecting any other resources in the resource group. The same logic applies to VM2, making the resource-level scope the precise way to restrict management to just those two VMs.

Answer

Assign the role at the rg-prod resource group scope.

Answer

Assign the role at the subscription scope.

Answer

Assign the role at the management group scope.

Question 3

An application on an Azure VM has outgrown its current CPU and memory. The administrator wants to increase compute capacity without rebuilding the application or changing the VM image. What should be done?

Accepted Answer

Resize the virtual machine to a larger size. Resizing the VM to a larger size (Option A) directly increases the CPU and memory resources allocated to the VM without requiring any changes to the application or the underlying OS disk image. Azure allows you to change the VM size as long as the new size is available in the current hardware cluster and the VM is deallocated (stopped) first. This is the simplest and most appropriate method to scale up compute capacity while preserving the existing configuration and data.

Answer

Create a new snapshot of the OS disk

Answer

Move the VM to an availability set

Answer

Attach a data disk

Question 4

A VM backup policy is being designed in a Recovery Services vault. Match each backup policy element to the behavior it controls.

Accepted Answer

Retention Range: Defines how long backup snapshots and recovery points are kept.. A backup policy in a Recovery Services vault includes retention settings (how long to keep backups), schedule (when to back up), snapshot retention (for instant restores), policy type (Standard vs Enhanced), time zone, and frequency (daily/weekly).

Answer

Retention Range: Controls the time zone for backup scheduling.

Answer

Backup Schedule: Defines how many backups are retained.

Question 5

An administrator is reviewing a KQL query used to investigate failed operations in a Log Analytics workspace. Match each KQL operator to the effect it has on the query output.

Accepted Answer

where: Filters results to rows matching a specified condition. These are standard KQL operators used in Log Analytics queries. 'where' filters, 'project' selects columns, 'extend' adds computed columns, 'summarize' aggregates, 'join' merges tables, and 'order by' sorts results.

Answer

extend: Filters results to rows matching a specified condition

Answer

join: Adds computed columns to the result set

Answer

order by: Groups data and applies aggregation

Question 6

Order the steps to configure Azure Traffic Manager for geographic routing.

Accepted Answer

1. Create Traffic Manager profile, 2. Set geographic routing method, 3. Add endpoints with geographic mapping, 4. Configure monitoring settings, 5. Update DNS to point to Traffic Manager.. Create profile, set geographic routing, add endpoints with mapping, configure monitoring, update DNS.

Answer

1. Update DNS to point to Traffic Manager, 2. Create Traffic Manager profile, 3. Add endpoints with geographic mapping, 4. Set geographic routing method, 5. Configure monitoring settings.

Answer

1. Create Traffic Manager profile, 2. Add endpoints with geographic mapping, 3. Set geographic routing method, 4. Configure monitoring settings, 5. Update DNS to point to Traffic Manager.

Answer

1. Create Traffic Manager profile, 2. Set geographic routing method, 3. Configure monitoring settings, 4. Add endpoints with geographic mapping, 5. Update DNS to point to Traffic Manager.

Question 7

An application runs in a subnet and must reach a storage account over the public endpoint, but only that subnet should be allowed. The team does not want to use a private endpoint. Which two configurations should the administrator use? Select two.

Accepted Answer

Enable the Microsoft.Storage service endpoint on the subnet.. Enabling the Microsoft.Storage service endpoint on the subnet (A) ensures that traffic from the subnet to the storage account's public endpoint is routed through the Azure backbone network and uses the source IP of the subnet's virtual network, allowing the storage account firewall to identify the traffic. Adding the subnet to the storage account's virtual network rules (B) then explicitly permits only that subnet's traffic, denying all other public endpoint access. Together, these two configurations restrict access to the storage account's public endpoint exclusively to the specified subnet without requiring a private endpoint.

Answer

Create a private endpoint for the storage account.

Answer

Assign the Reader role to the subnet.

Answer

Turn on blob soft delete.

Question 8

A team wants an Azure VM in a subnet to reach a storage account securely without opening the account to the entire internet. Which two configuration choices can be used to achieve this? Select two.

Accepted Answer

Private endpoint. Private endpoint (A) assigns a private IP address from the VM's subnet to the storage account, enabling secure connectivity over the Microsoft backbone network without exposing the account to the public internet. Service endpoint (B) extends the virtual network identity to the storage account via its public endpoint but restricts access to traffic originating from the specified subnet, also avoiding full internet exposure. Both options satisfy the requirement for secure, subnet-restricted access.

Answer

Enable anonymous blob access

Answer

Move the account to the Archive tier

Answer

Apply a delete lock to the storage account

Question 9

Based on the exhibit, the support team needs a searchable 90-day history of who deleted Azure resources and when. The current workspace only contains VM guest logs. Which configuration should you add?

Accepted Answer

Configure a diagnostic setting at the subscription scope to send the Azure Activity log to Log Analytics and retain it for 90 days.. The Azure Activity log records all control-plane events, including resource deletions, at the subscription level. By configuring a diagnostic setting to stream the Activity log to a Log Analytics workspace, you can retain the data for up to 90 days (or longer with data export rules) and make it searchable via KQL queries. The current workspace only contains VM guest logs, so adding this setting directly meets the requirement without relying on guest-level or network-level logs.

Answer

Enable guest-level diagnostics on each VM so deletion events are captured.

Answer

Turn on NSG flow logs for all subnets to capture resource deletions.

Answer

Store VM backups in the vault and use restore points as an audit trail.

Question 10

An administrator is deploying a site-to-site VPN gateway in the Azure portal. The deployment fails validation because the gateway does not have a public-facing address to terminate the tunnel. What must be created and associated with the VPN gateway?

Accepted Answer

A public IP address resource associated with the VPN gateway.. A site-to-site VPN gateway in Azure requires a public IP address to terminate the IPSec tunnel from the on-premises device. The public IP address resource must be created and associated with the VPN gateway during deployment; without it, the gateway has no routable endpoint for the tunnel, causing validation to fail.

Answer

A load balancer frontend IP configuration in front of the gateway subnet.

Answer

A NAT gateway attached to GatewaySubnet.

Answer

A private endpoint for the virtual network gateway resource.

Question 11

A reporting team wants a storage redundancy option that keeps a readable copy in the paired region. Which two choices provide read access to the secondary region? Select two.

Accepted Answer

Read-access geo-redundant storage (RA-GRS).. Read-access geo-redundant storage (RA-GRS) is correct because it provides geo-redundant storage (GRS) with the additional capability to read from the secondary region. This ensures that if the primary region becomes unavailable, the reporting team can still access a readable copy of the data in the paired region. RA-GRS replicates data asynchronously to a secondary region and allows read access to that secondary copy at all times.

Answer

Locally redundant storage (LRS).

Answer

Zone-redundant storage (ZRS).

Answer

Geo-redundant storage (GRS).

Question 12

Arrange the steps to configure Azure Load Balancer with a backend pool.

Accepted Answer

Create Load Balancer → Configure frontend IP configuration → Configure backend pool → Add health probes → Configure load balancing rules → Associate VMs to backend pool. Create LB, configure frontend and backend, add probes, rules, then associate VMs.

Answer

Create Load Balancer → Configure backend pool → Configure frontend IP configuration → Add health probes → Configure load balancing rules → Associate VMs to backend pool

Answer

Create Load Balancer → Configure frontend IP configuration → Configure load balancing rules → Configure backend pool → Add health probes → Associate VMs to backend pool

Answer

Create Load Balancer → Configure frontend IP configuration → Configure backend pool → Configure load balancing rules → Associate VMs to backend pool → Add health probes

Question 13

An existing application in AppSubnet1 must access an Azure Storage account. The team does not want to add a private endpoint or change DNS records, but they do want to allow access only from AppSubnet1. Which configuration should the administrator use?

Accepted Answer

Enable the Microsoft.Storage service endpoint on AppSubnet1 and restrict the storage account to selected virtual networks.. Enabling the Microsoft.Storage service endpoint on AppSubnet1 allows traffic from that subnet to be routed directly to the Azure Storage service over the Azure backbone network, bypassing the internet. By then restricting the storage account's firewall to 'selected virtual networks' and adding AppSubnet1's virtual network and subnet, access is limited exclusively to that subnet without needing a private endpoint or DNS changes.

Answer

Create a private endpoint and remove all public network access from the storage account.

Answer

Add a network security group rule that allows outbound TCP 443 to the storage account.

Answer

Enable peering between AppSubnet1 and the storage account network.

Question 14

An administrator archives monthly log exports in a blob container to reduce storage cost. During an audit, one archived blob must be downloaded and opened later the same day. What must the administrator do before the blob can be read?

Accepted Answer

Change the blob tier from Archive to Hot or Cool and wait for rehydration to finish. Blobs stored in the Archive tier are offline and must be rehydrated to the Hot or Cool tier before they can be read. Rehydration can take up to 15 hours, so the administrator must initiate a tier change and wait for completion before downloading the blob. Option B correctly identifies this required step.

Answer

Read the blob directly from the Archive tier because archive data remains immediately online

Answer

Copy the blob to a new container in the same account to bypass the archive restriction

Answer

Assign an Azure RBAC role to the auditor so the archived blob becomes available immediately

Question 15

A team operates two Azure VMs that both need to call Azure services with the same identity. The VMs are rebuilt frequently, and the identity must continue to work if either VM is deleted and recreated. Which identity should the administrator attach?

Accepted Answer

A user-assigned managed identity attached to both VMs. A user-assigned managed identity is the correct choice because it is a standalone Azure resource that can be attached to multiple VMs. When a VM is deleted and recreated, the identity persists independently and can be reassigned to the new VM, ensuring continuous access to Azure services without credential management.

Answer

A system-assigned managed identity on one of the VMs

Answer

A service principal with a client secret stored on each VM

Answer

A certificate uploaded to each VM and used for Azure sign-in