AZ-104 Practice Test 14 — 15 Questions

Question 1

A reporting team wants a storage redundancy option that keeps a readable copy in the paired region. Which two choices provide read access to the secondary region? Select two.

Accepted Answer

Read-access geo-redundant storage (RA-GRS).. Read-access geo-redundant storage (RA-GRS) is correct because it provides geo-redundant storage (GRS) with the additional capability to read from the secondary region. This ensures that if the primary region becomes unavailable, the reporting team can still access a readable copy of the data in the paired region. RA-GRS replicates data asynchronously to a secondary region and allows read access to that secondary copy at all times.

Answer

Locally redundant storage (LRS).

Answer

Zone-redundant storage (ZRS).

Answer

Geo-redundant storage (GRS).

Question 2

Arrange the steps to configure Azure Load Balancer with a backend pool.

Accepted Answer

Create Load Balancer → Configure frontend IP configuration → Configure backend pool → Add health probes → Configure load balancing rules → Associate VMs to backend pool. Create LB, configure frontend and backend, add probes, rules, then associate VMs.

Answer

Create Load Balancer → Configure backend pool → Configure frontend IP configuration → Add health probes → Configure load balancing rules → Associate VMs to backend pool

Answer

Create Load Balancer → Configure frontend IP configuration → Configure load balancing rules → Configure backend pool → Add health probes → Associate VMs to backend pool

Answer

Create Load Balancer → Configure frontend IP configuration → Configure backend pool → Configure load balancing rules → Associate VMs to backend pool → Add health probes

Question 3

An existing application in AppSubnet1 must access an Azure Storage account. The team does not want to add a private endpoint or change DNS records, but they do want to allow access only from AppSubnet1. Which configuration should the administrator use?

Accepted Answer

Enable the Microsoft.Storage service endpoint on AppSubnet1 and restrict the storage account to selected virtual networks.. Enabling the Microsoft.Storage service endpoint on AppSubnet1 allows traffic from that subnet to be routed directly to the Azure Storage service over the Azure backbone network, bypassing the internet. By then restricting the storage account's firewall to 'selected virtual networks' and adding AppSubnet1's virtual network and subnet, access is limited exclusively to that subnet without needing a private endpoint or DNS changes.

Answer

Create a private endpoint and remove all public network access from the storage account.

Answer

Add a network security group rule that allows outbound TCP 443 to the storage account.

Answer

Enable peering between AppSubnet1 and the storage account network.

Question 4

An administrator archives monthly log exports in a blob container to reduce storage cost. During an audit, one archived blob must be downloaded and opened later the same day. What must the administrator do before the blob can be read?

Accepted Answer

Change the blob tier from Archive to Hot or Cool and wait for rehydration to finish. Blobs stored in the Archive tier are offline and must be rehydrated to the Hot or Cool tier before they can be read. Rehydration can take up to 15 hours, so the administrator must initiate a tier change and wait for completion before downloading the blob. Option B correctly identifies this required step.

Answer

Read the blob directly from the Archive tier because archive data remains immediately online

Answer

Copy the blob to a new container in the same account to bypass the archive restriction

Answer

Assign an Azure RBAC role to the auditor so the archived blob becomes available immediately

Question 5

A team operates two Azure VMs that both need to call Azure services with the same identity. The VMs are rebuilt frequently, and the identity must continue to work if either VM is deleted and recreated. Which identity should the administrator attach?

Accepted Answer

A user-assigned managed identity attached to both VMs. A user-assigned managed identity is the correct choice because it is a standalone Azure resource that can be attached to multiple VMs. When a VM is deleted and recreated, the identity persists independently and can be reassigned to the new VM, ensuring continuous access to Azure services without credential management.

Answer

A system-assigned managed identity on one of the VMs

Answer

A service principal with a client secret stored on each VM

Answer

A certificate uploaded to each VM and used for Azure sign-in

Question 6

A subnet has a user-defined route for 0.0.0.0/0 that sends traffic to a network virtual appliance at 10.10.1.4. The VM in the subnet still reaches an Azure Storage account using the public endpoint, but the administrator expected all outbound traffic to go through the NVA. What is the most likely reason?

Accepted Answer

The storage account traffic is using a more specific route than the 0.0.0.0/0 route.. The most likely reason is that the storage account traffic is using a more specific route than the 0.0.0.0/0 route. Azure uses longest prefix match routing, so a route with a smaller prefix (e.g., a specific public IP range for Azure Storage) will take precedence over the default route. The 0.0.0.0/0 route only applies when no more specific route exists, and Azure automatically adds platform routes for Azure services like Storage, which can override user-defined routes.

Answer

Azure always ignores user-defined routes for storage traffic.

Answer

NSG outbound rules override user-defined routes in Azure.

Answer

The subnet needs a public IP address assigned to each VM for the route to take effect.

Question 7

A deployment pipeline uploads content to a blob container in Azure Storage. The pipeline authenticates with Microsoft Entra ID and must grant a partner temporary write access for 12 hours without sharing the storage account key. The access should be limited to the container only. Which access method should the administrator use?

Accepted Answer

User delegation SAS. A user delegation SAS is the correct choice because it uses Microsoft Entra ID credentials to sign the SAS token, providing temporary, delegated access to a specific container without exposing the storage account key. It supports granular permissions and an expiration time of up to 12 hours, meeting the partner's write access requirement while limiting access to the container only.

Answer

Shared access key authentication

Answer

Account SAS

Answer

Service endpoint access with network rules only

Question 8

A subscription already grants Contributor to an application team. The organization wants to prevent deployments in unsupported Azure regions and ensure every new resource has an Environment tag. Which two controls should be implemented with Azure Policy rather than RBAC? Select two.

Accepted Answer

Assign an allowed-locations policy at the management group or subscription scope.. Azure Policy can enforce an 'allowed-locations' policy at the management group or subscription scope to restrict resource deployment to only approved Azure regions. This is a governance control that operates declaratively, evaluating resource properties against policy rules before or after creation, unlike RBAC which controls identity-based permissions. Option C is correct because Azure Policy can enforce the 'Environment' tag on new resources using a 'require a tag and its value' policy, ensuring compliance without modifying role assignments.

Answer

Create a custom RBAC role that blocks resources deployed outside approved regions.

Answer

Add a CanNotDelete lock to every resource group.

Answer

Grant User Access Administrator to the deployment team.

Question 9

A team can already deploy virtual machines, but they want to prevent users from creating VMs unless the deployment includes an approved tag. They also want to see which existing resources do not meet the rule. What should the administrator use?

Accepted Answer

An Azure Policy assignment with a deny or audit effect for the tag requirement.. Azure Policy with a 'deny' effect prevents creation of VMs that lack the required tag, while the 'audit' effect identifies non-compliant existing resources without blocking them. This directly addresses both requirements: enforcing the tag on new deployments and discovering which existing resources violate the rule.

Answer

A custom RBAC role that removes the create action for virtual machines.

Answer

A resource lock on the resource group.

Answer

An Entra ID dynamic group for the VM creators.

Question 10

You need to deploy a new Ubuntu VM that automatically creates an app user and installs packages the first time it boots. Which approach should you use?

Accepted Answer

Use cloud-init in the VM creation settings to perform first-boot configuration.. B is correct because cloud-init is the standard, native mechanism for performing first-boot configuration on Linux VMs in Azure. It allows you to inject a configuration file (e.g., YAML or shell script) during VM creation that automatically creates users, installs packages, and runs custom commands on the first boot, without requiring any post-deployment scripts or manual intervention.

Answer

Use an availability set so the VM runs the initialization tasks during host placement.

Answer

Use an Azure Policy assignment to install the packages after deployment.

Answer

Use a managed disk snapshot and attach it to the VM after deployment.

Question 11

A Virtual Machine Scale Set must add instances automatically when average CPU usage is above 75 percent and remove instances when CPU drops below 30 percent. Which feature should you configure?

Accepted Answer

Autoscale rules in Azure Monitor. Autoscale rules in Azure Monitor allow you to define conditions for automatically scaling a Virtual Machine Scale Set (VMSS) based on metrics like average CPU usage. You can set a scale-out rule to add instances when CPU exceeds 75% and a scale-in rule to remove instances when CPU drops below 30%, with a cool-down period to prevent flapping. This is the native Azure feature designed for such metric-based auto-scaling scenarios.

Answer

A Recovery Services vault policy

Answer

Boot diagnostics

Answer

Azure Advisor only

Question 12

A storage account must be reachable only from workloads in one Azure subnet. The team wants to keep using the storage account's public FQDN, avoid creating a private IP address in the virtual network, and avoid managing private DNS zones. What should the administrator configure?

Accepted Answer

A service endpoint on the subnet and a storage firewall rule for that subnet. A service endpoint on the subnet and a storage firewall rule for that subnet is correct because it allows the storage account to be reachable only from workloads in one Azure subnet while still using the storage account's public FQDN. Service endpoints extend the virtual network identity to the storage account over the Microsoft backbone, and the firewall rule restricts access to that specific subnet. This avoids creating a private IP address in the virtual network and eliminates the need to manage private DNS zones, as the public endpoint is retained.

Answer

A private endpoint for the storage account

Answer

An NSG rule that allows TCP 443 to the storage account

Answer

An application security group tied to the storage account

Question 13

Based on the exhibit, which Azure feature should the administrator use to track this kind of platform-wide service issue?

Accepted Answer

Service Health, because it reports Azure platform incidents that affect customers in a region.. Service Health is the correct feature because it provides a personalized dashboard of all Azure service incidents, planned maintenance, and health advisories that impact the customer's subscriptions and regions. It aggregates platform-wide issues (e.g., regional outages or degradation) that Azure engineering has confirmed, making it the appropriate tool for tracking a platform-wide service issue affecting multiple resources in a region.

Answer

Resource Health, because it shows whether a specific virtual machine is healthy or unavailable.

Answer

Activity Log, because it lists every administrative action taken in the subscription.

Answer

Azure Advisor, because it gives recommendations to improve the virtual machine configuration.

Question 14

Match each Azure Storage redundancy option to the best description.

Accepted Answer

LRS: Data is replicated three times within a single data center.. Each redundancy option provides increasing durability and availability: LRS is lowest cost, ZRS protects against zone failure, GRS adds geo-replication, RA-GRS allows read from secondary, GZRS combines zone and geo, RA-GZRS adds read access to secondary.

Answer

RA-GRS: Data is replicated across availability zones and also to a secondary region with read access from secondary.

Answer

RA-GZRS: Data is replicated to a secondary region and supports read access from that secondary.

Question 15

An administrator archived monthly log exports in a blob container six weeks ago. An auditor now needs to open one of those files later today, and the file must be readable from Azure Storage rather than restored from a separate backup copy. What should the administrator do?

Accepted Answer

Start rehydration of the blob to the Hot tier before opening it.. Blobs in the Archive tier are offline and cannot be read directly. To access the data, the blob must first be rehydrated to the Hot or Cool tier, which changes its state to online and readable. Rehydration can take up to 15 hours, so the administrator must start this process well before the auditor needs the file.

Answer

Open the blob directly from the Archive tier because archived blobs remain online for read access.

Answer

Change the blob to the Cold tier, because Cold is designed for archived content.

Answer

Use a snapshot of the archived blob, because snapshots can be opened even when the base blob is archived.