AZ-104 Practice Test 14 — 15 Questions

Question 1

A subnet has a user-defined route for 0.0.0.0/0 that sends traffic to a network virtual appliance at 10.10.1.4. The VM in the subnet still reaches an Azure Storage account using the public endpoint, but the administrator expected all outbound traffic to go through the NVA. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The storage account traffic is using a more specific route than the 0.0.0.0/0 route.. The most likely reason is that the storage account traffic is using a more specific route than the 0.0.0.0/0 route. Azure uses longest prefix match routing, so a route with a smaller prefix (e.g., a specific public IP range for Azure Storage) will take precedence over the default route. The 0.0.0.0/0 route only applies when no more specific route exists, and Azure automatically adds platform routes for Azure services like Storage, which can override user-defined routes.

Answer

Azure always ignores user-defined routes for storage traffic.

Answer

NSG outbound rules override user-defined routes in Azure.

Answer

The subnet needs a public IP address assigned to each VM for the route to take effect.

Question 2

A deployment pipeline uploads content to a blob container in Azure Storage. The pipeline authenticates with Microsoft Entra ID and must grant a partner temporary write access for 12 hours without sharing the storage account key. The access should be limited to the container only. Which access method should the administrator use?

Accepted Answer

User delegation SAS. A user delegation SAS is the correct choice because it uses Microsoft Entra ID credentials to sign the SAS token, providing temporary, delegated access to a specific container without exposing the storage account key. It supports granular permissions and an expiration time of up to 12 hours, meeting the partner's write access requirement while limiting access to the container only.

Answer

Shared access key authentication

Answer

Account SAS

Answer

Service endpoint access with network rules only

Question 3

A subscription already grants Contributor to an application team. The organization wants to prevent deployments in unsupported Azure regions and ensure every new resource has an Environment tag. Which two controls should be implemented with Azure Policy rather than RBAC? Select two.

Accepted Answer

Assign an allowed-locations policy at the management group or subscription scope.. Azure Policy can enforce an 'allowed-locations' policy at the management group or subscription scope to restrict resource deployment to only approved Azure regions. This is a governance control that operates declaratively, evaluating resource properties against policy rules before or after creation, unlike RBAC which controls identity-based permissions. Option C is correct because Azure Policy can enforce the 'Environment' tag on new resources using a 'require a tag and its value' policy, ensuring compliance without modifying role assignments.

Answer

Create a custom RBAC role that blocks resources deployed outside approved regions.

Answer

Add a CanNotDelete lock to every resource group.

Answer

Grant User Access Administrator to the deployment team.

Question 4

A team can already deploy virtual machines, but they want to prevent users from creating VMs unless the deployment includes an approved tag. They also want to see which existing resources do not meet the rule. What should the administrator use?

Accepted Answer

An Azure Policy assignment with a deny or audit effect for the tag requirement.. Azure Policy with a 'deny' effect prevents creation of VMs that lack the required tag, while the 'audit' effect identifies non-compliant existing resources without blocking them. This directly addresses both requirements: enforcing the tag on new deployments and discovering which existing resources violate the rule.

Answer

A custom RBAC role that removes the create action for virtual machines.

Answer

A resource lock on the resource group.

Answer

An Entra ID dynamic group for the VM creators.

Question 5

You need to deploy a new Ubuntu VM that automatically creates an app user and installs packages the first time it boots. Which approach should you use?

Accepted Answer

Use cloud-init in the VM creation settings to perform first-boot configuration.. B is correct because cloud-init is the standard, native mechanism for performing first-boot configuration on Linux VMs in Azure. It allows you to inject a configuration file (e.g., YAML or shell script) during VM creation that automatically creates users, installs packages, and runs custom commands on the first boot, without requiring any post-deployment scripts or manual intervention.

Answer

Use an availability set so the VM runs the initialization tasks during host placement.

Answer

Use an Azure Policy assignment to install the packages after deployment.

Answer

Use a managed disk snapshot and attach it to the VM after deployment.

Question 6

A Virtual Machine Scale Set must add instances automatically when average CPU usage is above 75 percent and remove instances when CPU drops below 30 percent. Which feature should you configure?

Accepted Answer

Autoscale rules in Azure Monitor. Autoscale rules in Azure Monitor allow you to define conditions for automatically scaling a Virtual Machine Scale Set (VMSS) based on metrics like average CPU usage. You can set a scale-out rule to add instances when CPU exceeds 75% and a scale-in rule to remove instances when CPU drops below 30%, with a cool-down period to prevent flapping. This is the native Azure feature designed for such metric-based auto-scaling scenarios.

Answer

A Recovery Services vault policy

Answer

Boot diagnostics

Answer

Azure Advisor only

Question 7

A storage account must be reachable only from workloads in one Azure subnet. The team wants to keep using the storage account's public FQDN, avoid creating a private IP address in the virtual network, and avoid managing private DNS zones. What should the administrator configure?

Accepted Answer

A service endpoint on the subnet and a storage firewall rule for that subnet. A service endpoint on the subnet and a storage firewall rule for that subnet is correct because it allows the storage account to be reachable only from workloads in one Azure subnet while still using the storage account's public FQDN. Service endpoints extend the virtual network identity to the storage account over the Microsoft backbone, and the firewall rule restricts access to that specific subnet. This avoids creating a private IP address in the virtual network and eliminates the need to manage private DNS zones, as the public endpoint is retained.

Answer

A private endpoint for the storage account

Answer

An NSG rule that allows TCP 443 to the storage account

Answer

An application security group tied to the storage account

Question 8

Based on the exhibit, which Azure feature should the administrator use to track this kind of platform-wide service issue?

Accepted Answer

Service Health, because it reports Azure platform incidents that affect customers in a region.. Service Health is the correct feature because it provides a personalized dashboard of all Azure service incidents, planned maintenance, and health advisories that impact the customer's subscriptions and regions. It aggregates platform-wide issues (e.g., regional outages or degradation) that Azure engineering has confirmed, making it the appropriate tool for tracking a platform-wide service issue affecting multiple resources in a region.

Answer

Resource Health, because it shows whether a specific virtual machine is healthy or unavailable.

Answer

Activity Log, because it lists every administrative action taken in the subscription.

Answer

Azure Advisor, because it gives recommendations to improve the virtual machine configuration.

Question 9

Match each Azure Storage redundancy option to the best description.

Accepted Answer

LRS: Data is replicated three times within a single data center.. Each redundancy option provides increasing durability and availability: LRS is lowest cost, ZRS protects against zone failure, GRS adds geo-replication, RA-GRS allows read from secondary, GZRS combines zone and geo, RA-GZRS adds read access to secondary.

Answer

RA-GRS: Data is replicated across availability zones and also to a secondary region with read access from secondary.

Answer

RA-GZRS: Data is replicated to a secondary region and supports read access from that secondary.

Question 10

An administrator archived monthly log exports in a blob container six weeks ago. An auditor now needs to open one of those files later today, and the file must be readable from Azure Storage rather than restored from a separate backup copy. What should the administrator do?

Accepted Answer

Start rehydration of the blob to the Hot tier before opening it.. Blobs in the Archive tier are offline and cannot be read directly. To access the data, the blob must first be rehydrated to the Hot or Cool tier, which changes its state to online and readable. Rehydration can take up to 15 hours, so the administrator must start this process well before the auditor needs the file.

Answer

Open the blob directly from the Archive tier because archived blobs remain online for read access.

Answer

Change the blob to the Cold tier, because Cold is designed for archived content.

Answer

Use a snapshot of the archived blob, because snapshots can be opened even when the base blob is archived.

Question 11

A finance team stores PDF statements in Azure Blob Storage. The workload must survive a zone failure in the primary region, and if the entire region becomes unavailable, auditors still need read-only access to the copies in the secondary region. Which redundancy option should you choose?

Accepted Answer

RA-GZRS, because it combines zone redundancy with geo-replication and read access to the secondary region.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it combines zone redundancy (synchronous replication across Azure availability zones within the primary region) with geo-replication (asynchronous replication to a secondary region), and crucially enables read access to the secondary region even when the primary is unavailable. This meets the requirement to survive a zone failure (via ZRS) and provide read-only access during a full regional outage (via the read-access geo-replication endpoint).

Answer

ZRS, because it keeps copies across zones but does not replicate to another region.

Answer

LRS, because it keeps three copies in a single datacenter and is sufficient for regional resilience.

Answer

GRS, because it provides geo-replication and always allows direct reads from the secondary region.

Question 12

A subscription admin wants to investigate who changed a resource and also review the platform-generated events for that subscription. Which two types of logs can be sent to Log Analytics and queried later? Select two.

Accepted Answer

Activity log entries. The Activity log (option A) records subscription-level events such as who created, modified, or deleted a resource, making it essential for investigating administrative changes. Resource diagnostic logs (option B) capture platform-generated events emitted by a resource itself (e.g., Azure SQL Database audit logs, network security group flow logs), which can be sent to Log Analytics for querying. Both log types can be configured to stream to a Log Analytics workspace, enabling Kusto Query Language (KQL) analysis.

Answer

Azure Backup vault names

Answer

Virtual network address spaces

Answer

Managed disk size settings

Question 13

An organization has an Azure Storage account that must be reachable from Azure VMs and from an on-premises application. Internet access to the storage account must be disabled, and the service should be accessible only over private IP paths. Which solution best meets the requirement?

Accepted Answer

Use a private endpoint for the storage account and connect on-premises through a site-to-site VPN or ExpressRoute path.. A private endpoint assigns the storage account a private IP address from the Azure VNet, making it accessible over a private IP path. On-premises connectivity is achieved via a site-to-site VPN or ExpressRoute, which extends the private network. This configuration disables internet access by blocking the public endpoint, meeting the requirement to disable internet access.

Answer

Enable a service endpoint on the Azure VNet and keep the storage account public endpoint enabled.

Answer

Use VNet peering only and leave the storage account firewall open to selected public IPs.

Answer

Assign a public IP address to the storage account and restrict access with an NSG.

Question 14

Based on the exhibit, what should the administrator change if the business wants backups to be kept for 30 days instead of 7 days?

Accepted Answer

Increase the retain daily backup points setting to 30 days.. The backup retention policy in Azure Backup is configured via the 'Retain daily backup points' setting, which specifies how many days daily recovery points are kept. To change retention from 7 to 30 days, the administrator must increase this value to 30. This directly controls the lifespan of daily backups in the Recovery Services vault.

Answer

Change the backup schedule from daily to hourly.

Answer

Increase the instant recovery snapshot retention to 30 days.

Answer

Enable a CanNotDelete lock on the Recovery Services vault.

Question 15

A Windows VM must install a monitoring agent, run a bootstrap script during provisioning, and download a configuration file from an Azure resource without storing any credentials in the script or on disk. Which two Azure compute features should the administrator use? Select two.

Accepted Answer

Use a Custom Script Extension to run the bootstrap actions after provisioning.. The Custom Script Extension (CSE) is the correct Azure feature to run a bootstrap script after provisioning because it executes a script on the VM during or after deployment, enabling installation of the monitoring agent and other configuration tasks. It is the standard method for post-deployment automation on Azure VMs, and it can reference a script stored in Azure Storage or a public URL without embedding credentials.

Answer

Enable boot diagnostics and review the serial console output.

Answer

Attach a read-only managed disk to store the configuration file.

Answer

Use an availability set to keep the bootstrap script highly available.