AZ-104 Practice Test 15 — 15 Questions

Question 1

A finance team stores PDF statements in Azure Blob Storage. The workload must survive a zone failure in the primary region, and if the entire region becomes unavailable, auditors still need read-only access to the copies in the secondary region. Which redundancy option should you choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

RA-GZRS, because it combines zone redundancy with geo-replication and read access to the secondary region.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it combines zone redundancy (synchronous replication across Azure availability zones within the primary region) with geo-replication (asynchronous replication to a secondary region), and crucially enables read access to the secondary region even when the primary is unavailable. This meets the requirement to survive a zone failure (via ZRS) and provide read-only access during a full regional outage (via the read-access geo-replication endpoint).

Answer

ZRS, because it keeps copies across zones but does not replicate to another region.

Answer

LRS, because it keeps three copies in a single datacenter and is sufficient for regional resilience.

Answer

GRS, because it provides geo-replication and always allows direct reads from the secondary region.

Question 2

A subscription admin wants to investigate who changed a resource and also review the platform-generated events for that subscription. Which two types of logs can be sent to Log Analytics and queried later? Select two.

Accepted Answer

Activity log entries. The Activity log (option A) records subscription-level events such as who created, modified, or deleted a resource, making it essential for investigating administrative changes. Resource diagnostic logs (option B) capture platform-generated events emitted by a resource itself (e.g., Azure SQL Database audit logs, network security group flow logs), which can be sent to Log Analytics for querying. Both log types can be configured to stream to a Log Analytics workspace, enabling Kusto Query Language (KQL) analysis.

Answer

Azure Backup vault names

Answer

Virtual network address spaces

Answer

Managed disk size settings

Question 3

An organization has an Azure Storage account that must be reachable from Azure VMs and from an on-premises application. Internet access to the storage account must be disabled, and the service should be accessible only over private IP paths. Which solution best meets the requirement?

Accepted Answer

Use a private endpoint for the storage account and connect on-premises through a site-to-site VPN or ExpressRoute path.. A private endpoint assigns the storage account a private IP address from the Azure VNet, making it accessible over a private IP path. On-premises connectivity is achieved via a site-to-site VPN or ExpressRoute, which extends the private network. This configuration disables internet access by blocking the public endpoint, meeting the requirement to disable internet access.

Answer

Enable a service endpoint on the Azure VNet and keep the storage account public endpoint enabled.

Answer

Use VNet peering only and leave the storage account firewall open to selected public IPs.

Answer

Assign a public IP address to the storage account and restrict access with an NSG.

Question 4

Based on the exhibit, what should the administrator change if the business wants backups to be kept for 30 days instead of 7 days?

Accepted Answer

Increase the retain daily backup points setting to 30 days.. The backup retention policy in Azure Backup is configured via the 'Retain daily backup points' setting, which specifies how many days daily recovery points are kept. To change retention from 7 to 30 days, the administrator must increase this value to 30. This directly controls the lifespan of daily backups in the Recovery Services vault.

Answer

Change the backup schedule from daily to hourly.

Answer

Increase the instant recovery snapshot retention to 30 days.

Answer

Enable a CanNotDelete lock on the Recovery Services vault.

Question 5

A Windows VM must install a monitoring agent, run a bootstrap script during provisioning, and download a configuration file from an Azure resource without storing any credentials in the script or on disk. Which two Azure compute features should the administrator use? Select two.

Accepted Answer

Use a Custom Script Extension to run the bootstrap actions after provisioning.. The Custom Script Extension (CSE) is the correct Azure feature to run a bootstrap script after provisioning because it executes a script on the VM during or after deployment, enabling installation of the monitoring agent and other configuration tasks. It is the standard method for post-deployment automation on Azure VMs, and it can reference a script stored in Azure Storage or a public URL without embedding credentials.

Answer

Enable boot diagnostics and review the serial console output.

Answer

Attach a read-only managed disk to store the configuration file.

Answer

Use an availability set to keep the bootstrap script highly available.

Question 6

In Log Analytics, you need to find AzureActivity records for VM stop or deallocate operations from the last 24 hours. Which query should you use?

Accepted Answer

AzureActivity | where TimeGenerated > ago(24h) | where OperationNameValue has_any ("Microsoft.Compute/virtualMachines/deallocate/action", "Microsoft.Compute/virtualMachines/powerOff/action"). It uses the `has_any` operator to filter AzureActivity records for the exact operation names corresponding to VM stop (powerOff) and deallocate actions, and it restricts the time range to the last 24 hours using `ago(24h)`. This directly matches the requirement to find VM stop or deallocate operations within the specified timeframe.

Answer

AzureActivity | summarize count() by OperationNameValue

Answer

AzureActivity | where ResourceType == "Microsoft.Compute/virtualMachines" | project TimeGenerated, ResourceGroup

Answer

AzureActivity | sort by TimeGenerated asc

Question 7

An administrator assigned a policy definition with the Modify effect to add tag Environment=Prod to resources in a subscription. Existing VMs still do not show the tag. Which two actions should the administrator take to bring the existing VMs into compliance? Select two.

Accepted Answer

Create a remediation task for the policy assignment.. A is correct because a policy with the Modify effect does not automatically apply to existing non-compliant resources; a remediation task must be triggered to evaluate and update those resources. Remediation uses the managed identity assigned to the policy to perform the modification, which is why verifying that identity has the necessary permissions (option B) is also required. Without remediation, only new resources created after the policy assignment will have the tag applied.

Answer

Reassign the policy at the resource group scope only.

Answer

Switch the policy effect to AuditIfNotExists.

Answer

Manually tag only the newest virtual machines.

Question 8

An external consultant must access a resource group in your tenant using the consultant's existing work account. You want to avoid creating a separate username and password pair. Which two actions should the administrator take? Select two.

Accepted Answer

Invite the consultant as a guest user in Microsoft Entra ID.. Inviting the consultant as a guest user in Microsoft Entra ID (formerly Azure AD) allows the consultant to use their existing work account (external identity) without creating a new username/password. This leverages B2B collaboration, which uses the consultant's home directory for authentication, and the guest user object is created in your tenant to represent them.

Answer

Create a new member user account with an internal password.

Answer

Add the consultant to the Global Administrator role.

Answer

Share the subscription ID and tenant ID only.

Question 9

A line-of-business app must keep serving users if an entire Azure region becomes unavailable. Is Azure Backup by itself enough to meet this requirement?

Accepted Answer

No, you also need disaster recovery replication such as Azure Site Recovery. Azure Backup is designed to protect data by creating recovery points that can be used to restore VMs or files, but it does not provide automatic failover or continuous replication to another region. To meet the requirement of keeping an app running during a regional outage, you need a disaster recovery solution like Azure Site Recovery, which replicates VMs to a secondary region and enables orchestrated failover with minimal downtime.

Answer

Yes, because backup alone guarantees immediate failover to another region

Answer

Yes, as long as the VM has a backup policy

Answer

Yes, if diagnostic settings are enabled on the VM

Question 10

A project team has 12 operators who need to read resource properties and restart only the virtual machines in one application resource group. Access should be removed automatically when an operator leaves the team, and any new VMs added to that resource group should inherit the same access without further changes. What should the administrator configure?

Accepted Answer

Create an Entra ID group, add the operators to it, and assign a custom least-privilege role to the group at the resource group scope.. It uses an Entra ID group to manage access, which allows automatic removal of operators from the group when they leave the team, and any new VMs added to the resource group will inherit the role assignment at the resource group scope. A custom least-privilege role ensures operators can only read resource properties and restart VMs, meeting the specific requirements without over-permissioning.

Answer

Assign the role directly to each operator at the resource group scope.

Answer

Assign Virtual Machine Contributor to the team at the subscription scope.

Answer

Use a resource lock and add the operators as lock owners.

Question 11

Before changing a managed data disk on a production VM, you want a point-in-time copy that you can keep and restore later if needed. What should you create?

Accepted Answer

A managed disk snapshot. A managed disk snapshot captures a point-in-time, read-only copy of a managed disk. You can use it to restore the VM to that exact state by creating a new disk from the snapshot and attaching it to the VM. Snapshots are independent of the source disk's lifecycle, so you can keep them indefinitely for backup or recovery purposes.

Answer

An availability set

Answer

A load balancer backend pool

Answer

A resource lock

Question 12

Based on the exhibit, what should the administrator change to allow only the web tier to reach the app tier on TCP 8443?

Accepted Answer

Move the allow rule for WebTier-ASG to a priority lower than 100.. The exhibit shows a default-deny NSG rule at priority 100 that blocks all traffic from VirtualNetwork to VirtualNetwork. To allow only the web tier (WebTier-ASG) to reach the app tier (AppTier-ASG) on TCP 8443, the administrator must move the allow rule for WebTier-ASG to a priority lower than 100 (e.g., 90). This ensures the allow rule is evaluated before the deny rule, as NSG rules are processed in priority order (lowest number first).

Answer

Change the deny rule source from VirtualNetwork to Internet.

Answer

Associate the NSG with the virtual machine NIC instead of the subnet.

Answer

Replace the ASG destination with the subnet address range.

Question 13

An administrator enabled Azure VM backup yesterday and now wants to confirm whether the most recent backup job succeeded. Which two places can they check? Select two.

Accepted Answer

Recovery Services vault backup jobs. The Recovery Services vault backup jobs (Option C) is correct because it provides a dedicated view of all backup jobs associated with the vault, including status, start time, and duration. Backup Center (Option D) is correct because it offers a centralized, cross-vault, cross-region dashboard to monitor backup jobs and alerts, making it ideal for confirming the success of the most recent backup.

Answer

Activity log

Answer

Azure Advisor

Answer

Resource Graph

Question 14

A container group runs a one-time import job in Azure Container Instances. After the job finishes successfully, it should not restart. Which restart policy should you choose?

Accepted Answer

Never. The 'Never' restart policy ensures that the container group does not restart after the job completes, which is ideal for a one-time import job that should run exactly once. Azure Container Instances supports three restart policies: Always, OnFailure, and Never. For a job that must not restart after successful completion, 'Never' is the correct choice because it prevents any automatic restart regardless of the exit code.

Answer

Always

Answer

OnFailure

Answer

Manual

Question 15

Based on the exhibit, which Azure feature should the administrator add so ownership and chargeback information remains visible even if resources are moved between resource groups?

Accepted Answer

Tags. Tags are metadata key-value pairs that can be assigned to Azure resources and resource groups. They persist even when resources are moved between resource groups, making them ideal for tracking ownership and chargeback information across organizational boundaries. Unlike other options, tags are specifically designed for cost tracking, ownership attribution, and resource categorization.

Answer

Management groups

Answer

Resource locks

Answer

Role assignments