AZ-104 Practice Test 14 — 15 Questions

Question 1

A Windows VM needs a one-time command run immediately after deployment, and a second VM must automatically install an agent and copy configuration files during provisioning. Which two Azure compute features should the administrator use? Select two.

Accepted Answer

Run Command. Run Command (A) is correct because it allows a one-time command to be executed immediately on a Windows VM after deployment, without requiring any agent or extension. Custom Script Extension (B) is correct because it enables automated installation of an agent and copying of configuration files during VM provisioning by running a script (e.g., PowerShell or Bash) as part of the deployment process.

Answer

Azure Monitor agent

Answer

Azure Policy assignment

Answer

Azure Bastion

Question 2

After a Windows VM is deployed, an administrator must install IIS, copy application files, and run a post-deployment configuration script without connecting interactively to the server. Which Azure feature should be used?

Accepted Answer

Custom Script Extension.. The Custom Script Extension (CSE) is the correct Azure feature because it allows you to run scripts on an Azure VM after deployment without requiring interactive login. It is specifically designed for post-deployment configuration tasks like installing IIS, copying application files, and executing configuration scripts, all executed via the Azure VM agent.

Answer

An availability zone assignment.

Answer

A route table association.

Answer

A user-assigned managed identity alone.

Question 3

A stateless web service must handle traffic spikes by adding or removing instances automatically based on CPU usage. Which Azure service fits best?

Accepted Answer

Virtual machine scale set with autoscale. A Virtual Machine Scale Set (VMSS) with autoscale is the correct choice because it automatically adjusts the number of VM instances based on CPU utilization metrics, enabling the stateless web service to handle traffic spikes by scaling out (adding instances) and scaling in (removing instances) as needed. This aligns with the requirement for a stateless, elastic, and automated scaling solution.

Answer

One larger standalone VM

Answer

Availability set with two VMs

Answer

Recovery Services vault backup

Question 4

A Windows VM in Azure is protected by Azure Backup. A developer accidentally deleted one application folder, but the VM must keep serving users while the administrator restores only that folder. What should the administrator do?

Accepted Answer

Use File Recovery from the appropriate recovery point and copy the folder back.. Option B is correct because Azure Backup's File Recovery feature allows you to mount a recovery point as a drive on the running VM, enabling you to copy specific files or folders without restoring the entire VM or disrupting production. This is the only method that meets the requirement of restoring only the deleted folder while the VM continues serving users.

Answer

Restore the entire VM from the latest recovery point into the production resource group.

Answer

Restore the managed disk and attach it to the running VM as a second OS disk.

Answer

Create a new Recovery Services vault and re-protect the VM before restoring anything.

Question 5

A Windows VM protected by Azure Backup is missing one application file, but the VM must stay online during recovery. Which restore approach should the administrator use?

Accepted Answer

Use the file recovery option from the Recovery Services vault for the relevant recovery point. Azure Backup's file recovery option allows you to mount a recovery point as a drive on the running VM without restoring the entire VM or taking it offline. This enables you to copy the missing application file directly from the backup while the VM remains operational, meeting the requirement to stay online.

Answer

Restore the entire VM to a new deployment and then copy the file back

Answer

Trigger an Azure Site Recovery failover to a recovery region

Answer

Create a new backup policy with a shorter retention period and run the next scheduled backup

Question 6

A Windows VM and a Linux VM in the same on-premises Active Directory Domain Services domain must mount the same Azure Files share over SMB. Security policy forbids storage account keys and long-lived SAS tokens. What should the administrator configure?

Accepted Answer

Use Azure Files with Active Directory Domain Services authentication and grant permissions to the required AD group.. Option A is correct because Azure Files supports identity-based authentication over SMB using on-premises Active Directory Domain Services (AD DS). By enabling AD DS authentication for the storage account and granting share-level permissions to an AD group that includes both the Windows and Linux VMs, the administrator can mount the Azure Files share without using storage account keys or SAS tokens. This satisfies the security policy while allowing SMB access from both operating systems.

Answer

Use a private endpoint and rely on network isolation instead of authentication.

Answer

Use the storage account access key because SMB requires shared-key authentication.

Answer

Use Azure Files NFS authentication because Linux and Windows workloads can both mount it.

Question 7

An administrator assigned a policy definition with the Modify effect to add tag Environment=Prod to resources in a subscription. Existing VMs still do not show the tag. Which two actions should the administrator take to bring the existing VMs into compliance? Select two.

Accepted Answer

Create a remediation task for the policy assignment.. A is correct because a policy with the Modify effect does not automatically apply to existing non-compliant resources; a remediation task must be triggered to evaluate and update those resources. Remediation uses the managed identity assigned to the policy to perform the modification, which is why verifying that identity has the necessary permissions (option B) is also required. Without remediation, only new resources created after the policy assignment will have the tag applied.

Answer

Reassign the policy at the resource group scope only.

Answer

Switch the policy effect to AuditIfNotExists.

Answer

Manually tag only the newest virtual machines.

Question 8

A web tier and an app tier run on separate Azure VMs in the same region. Each VM's NIC is added to an application security group named WebASG or AppASG. The administrator must allow only the web tier to connect to the app tier on TCP 8443, and future VM scale-outs must be included automatically. Which NSG rule should be created?

Accepted Answer

An inbound rule with source WebASG, destination AppASG, protocol TCP, and destination port 8443.. Option B is correct because application security groups (ASGs) allow you to configure network security as a natural extension of an application's structure, enabling you to group VMs by their roles (e.g., web tier, app tier) and define rules based on those groups. By creating an inbound NSG rule with source WebASG and destination AppASG on TCP port 8443, any VM added to WebASG can initiate traffic to any VM in AppASG, and future scale-outs are automatically included without manual IP updates. This approach is dynamic, scalable, and aligns with the requirement for automatic inclusion of new VMs.

Answer

An inbound rule that uses the current web VM's private IP as the source and the current app VM's private IP as the destination.

Answer

A route table that sends TCP 8443 traffic from the web subnet to the app subnet.

Answer

An Azure Firewall application rule collection that permits all traffic between the two subnets.

Question 9

A storage account must be reachable only from one Azure virtual network. The team wants the storage service to have a private IP in that VNet, public network access disabled, and name resolution to work without using the public endpoint. What should the administrator configure?

Accepted Answer

A private endpoint and a private DNS zone linked to the VNet. A private endpoint assigns the storage account a private IP from the VNet's address space, making it reachable only within that VNet. Disabling public network access ensures no traffic can reach the storage account via its public endpoint. A private DNS zone linked to the VNet enables name resolution to resolve the storage account's FQDN to the private IP without using the public endpoint.

Answer

A service endpoint on the subnet and a storage firewall rule

Answer

A public IP address and IP-based firewall exceptions

Answer

A shared access signature and blob container ACLs

Question 10

After a Windows VM is created, the administrator wants IIS installed and a configuration script run automatically without signing in to the server. Which Azure feature should be used?

Accepted Answer

A virtual machine extension. A virtual machine extension (such as the Custom Script Extension for Windows) allows you to deploy and run scripts on an Azure VM after provisioning, without requiring any interactive sign-in. This is the correct Azure feature to automatically install IIS and execute a configuration script as part of the VM deployment or post-deployment automation.

Answer

An availability set

Answer

An Azure Policy assignment

Answer

A network security group rule

Question 11

An administrator is reviewing a KQL query used to investigate failed operations in a Log Analytics workspace. Match each KQL operator to the effect it has on the query output.

Question 12

An analytics team stores exported reports in a storage account. They want the data to survive a zone failure and a regional outage, and if the primary region becomes unavailable they also want read-only access to the replica while failover is being planned. Which redundancy option should you select?

Accepted Answer

RA-GZRS. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is correct because it combines zone-redundant storage (ZRS) within the primary region with geo-redundant replication to a secondary region, and crucially provides read-only access to the secondary replica even when the primary region is available. This meets the requirement for data survival during both a zone failure and a regional outage, while allowing read-only access to the replica during failover planning.

Answer

GZRS

Answer

RA-GRS

Answer

ZRS

Question 13

An application depends on a regional Azure service. Operations wants an automatic notification if Microsoft posts an incident that affects only the region where the app runs, even when the individual VMs remain healthy. Which two Azure Monitor capabilities should be configured? Select two.

Accepted Answer

Service health alert. A Service health alert is correct because it monitors for service incidents, maintenance, and health advisories published by Azure for a specific region or service. When Microsoft posts an incident affecting only the region where the application runs, the alert triggers automatically, even if individual VMs remain healthy. This meets the requirement for automatic notification of regional Azure service incidents.

Answer

Metric alert rule

Answer

Log Analytics query

Answer

Resource lock

Question 14

An administrator wants to let a help desk group start, stop, and restart virtual machines in one resource group, but the group must not be able to delete the VMs or any other resource in the group. Which two actions should the administrator take? Select two.

Accepted Answer

Create a custom RBAC role with only VM start, stop, restart, and read actions.. Option A is correct because creating a custom RBAC role with only VM start, stop, restart, and read actions ensures the help desk group can perform only those specific operations without any delete permissions. This role must be assigned at the resource group scope (Option B) to limit its effect to that resource group, preventing the group from modifying or deleting resources in other scopes. Together, these two actions fulfill the requirement precisely.

Answer

Assign Virtual Machine Contributor to the help desk group.

Answer

Apply a CanNotDelete lock to the resource group.

Answer

Use Azure Policy to block VM deletion and leave RBAC unchanged.

Question 15

An operations team wants to deploy the same set of Azure VMs every month from source control. The deployment should be readable, repeatable, and stored as code. What should they use?

Accepted Answer

Bicep template. Bicep is a domain-specific language (DSL) that uses declarative syntax to deploy Azure resources as code. It provides readability, repeatability, and version control integration, making it ideal for deploying the same set of VMs monthly from source control. Unlike ARM templates, Bicep offers cleaner syntax and modularity, but both are valid infrastructure-as-code solutions.

Answer

Manual portal deployment

Answer

Azure Advisor recommendation

Answer

Azure Resource Explorer