AZ-104 Practice Test 15 — 15 Questions

Question 1

An enterprise wants to enforce three governance controls for all subscriptions under a management group: allowed locations, required tags, and permitted VM sizes. The team wants a single place to assign and track compliance for all three controls. What should the administrator use?

Accepted Answer

One policy initiative assigned at the management group. A policy initiative (also known as a policy set) allows you to group multiple policy definitions (e.g., allowed locations, required tags, permitted VM sizes) into a single, reusable package. Assigning this initiative at the management group level enforces all three governance controls across every subscription under that management group, providing a single place to assign and track compliance via Azure Policy's compliance dashboard.

Answer

Three separate policy assignments at each subscription

Answer

A custom RBAC role assigned to each subscription

Answer

A resource lock on each subscription

Question 2

An application uploads documents by using one of the storage account access keys. The team wants to rotate keys without interrupting uploads. Which process should the administrator follow?

Accepted Answer

Switch the app to the secondary key, regenerate the primary key, and then update the app back later.. Option B is correct because it follows the safe key rotation pattern: switch the application to use the secondary key, regenerate the primary key (which invalidates the old primary key), and then later update the application back to the primary key if desired. This ensures the application never loses access during the rotation, as it always has a valid key in use.

Answer

Regenerate both keys at the same time so the account is fully refreshed.

Answer

Disable shared key authorization before rotating the keys.

Answer

Delete the storage account and create a new one with the same name.

Question 3

A shared resource group contains a critical virtual machine and a storage account. Administrators must still be able to update settings, but nobody should accidentally delete either resource during routine maintenance. Which lock should be applied?

Accepted Answer

CanNotDelete lock on the resource group.. The CanNotDelete lock on the resource group prevents deletion of the resource group and all resources within it, while still allowing administrators to update settings. This meets the requirement of protecting both the critical VM and storage account from accidental deletion during routine maintenance, without blocking configuration changes.

Answer

ReadOnly lock on the resource group.

Answer

A policy assignment that denies delete operations.

Answer

A management group assignment with Contributor removed.

Question 4

Based on the exhibit, a Windows VM must install IIS and run a configuration script automatically right after deployment. The administrator does not want to sign in to the VM manually. Which Azure feature should be used?

Accepted Answer

Virtual machine extension, such as the Custom Script Extension.. The Custom Script Extension (CSE) is the correct Azure feature because it allows you to run PowerShell or Bash scripts on a VM after deployment without manual sign-in. By specifying the script in the VM's deployment template or via Azure CLI/Portal, IIS can be installed and the configuration script executed automatically during provisioning. This aligns with the requirement for zero-touch post-deployment automation.

Answer

Azure Policy with a modify effect.

Answer

An availability set.

Answer

A private endpoint.

Question 5

You need to allow or deny traffic to and from resources in an Azure subnet based on source IP address, destination port, and protocol. Which Azure feature should you use?

Accepted Answer

A network security group. A network security group (NSG) is the correct Azure feature because it acts as a stateful, distributed firewall that filters traffic to and from Azure resources in a virtual network. NSGs contain security rules that allow or deny inbound and outbound traffic based on source/destination IP address, port, and protocol (TCP, UDP, or ICMP). This directly matches the requirement to control traffic based on source IP, destination port, and protocol.

Answer

A route table

Answer

A private DNS zone

Answer

Azure Advisor

Question 6

Which two statements accurately describe the value of centralized DHCP in enterprise networks?

Accepted Answer

It can reduce the need to maintain separate DHCP servers in every subnet or site.. Centralized DHCP can simplify operations by keeping address assignment services in a more controlled central location rather than distributing separate servers everywhere. In practical terms, this can reduce administration overhead and make policy changes easier. The tradeoff is that Layer 3 boundaries must then be handled properly so client requests can still reach the server.

This is why DHCP relay becomes important in many campus and branch designs.

Answer

It removes the need for relay across Layer 3 boundaries.

Answer

It eliminates the need for default gateways.

Answer

It is useful only on wireless networks.

Question 7

Users on the internet cannot access an HTTPS website hosted on VM-Web01. The VM has a public IP address, the web service is running, and the guest OS firewall allows TCP 443. What is the most likely Azure-side issue?

Accepted Answer

The NSG does not allow inbound TCP 443. The most likely Azure-side issue is that the Network Security Group (NSG) associated with the VM's subnet or NIC does not have an inbound rule allowing TCP 443. Even if the guest OS firewall permits HTTPS and the web service is running, the NSG acts as a distributed firewall that filters traffic at the Azure network boundary. Without an explicit inbound security rule for TCP 443, all HTTPS traffic from the internet is dropped before reaching the VM.

Answer

The VM uses managed disks

Answer

Azure Backup is not enabled

Answer

The storage account uses the Cool tier

Question 8

Match each Azure VM administration requirement on the left with the most appropriate Azure CLI command on the right. Use each answer once.

Question 9

Which statement best explains why centralized logging is valuable in security operations?

Accepted Answer

It improves visibility by collecting events from multiple devices in one place for review and investigation.. Centralized logging aggregates security events (e.g., Windows Event Log, syslog, Azure Activity Log) from multiple sources into a single repository like Azure Log Analytics or a SIEM. This consolidation enables security analysts to correlate events across devices, detect patterns indicative of attacks, and perform efficient forensic investigations without needing to access each device individually.

Answer

It guarantees that no unauthorized action can occur.

Answer

It replaces the need for NTP and authentication.

Answer

It automatically assigns IP addresses to monitoring systems.

Question 10

You have an Azure load balancer in front of two virtual machines. The load balancer reports both instances as unavailable even though the VMs are running. What is the most likely cause?

Accepted Answer

The health probe is failing.. The health probe is the mechanism by which the Azure Load Balancer determines the availability of backend instances. If the probe is misconfigured (e.g., wrong port, protocol, path, or interval) or the backend VMs are not responding to the probe requests (e.g., firewall blocking the probe traffic or the application not listening on the specified port), the load balancer marks both instances as 'Unavailable' even though the VMs are running. This is the most common cause of backend pool unavailability.

Answer

The VMs are in an availability set.

Answer

The storage account uses the Cool tier.

Answer

The subscription has a budget alert.

Question 11

Match each lifecycle management requirement to the blob tier transition or action that should be configured.

Question 12

You need to be notified whenever the average CPU usage of VM-App01 exceeds 80 percent for 10 minutes. The solution must send an email to the operations team automatically. What should you configure?

Accepted Answer

Create an Azure Monitor metric alert and link it to an action group.. Option A is correct because Azure Monitor metric alerts can evaluate performance counters like CPU usage over a specified time window (e.g., 10 minutes) and trigger an action group when the threshold (80%) is exceeded. The action group can be configured with an email notification to the operations team, meeting the requirement automatically.

Answer

Create an Azure Advisor recommendation alert.

Answer

Create an activity log alert for the virtual machine.

Answer

Create a subscription budget alert.

Question 13

You need to ensure that a contractor can manage virtual machines only in the RG-Test resource group and cannot access any other resource groups in the subscription. What is the best way to achieve this?

Accepted Answer

Assign the Virtual Machine Contributor role at the RG-Test scope. Assigning the Virtual Machine Contributor role at the RG-Test scope grants the contractor permissions to manage virtual machines within that specific resource group only, adhering to the principle of least privilege. This role includes actions like creating, starting, stopping, and deleting VMs, but does not allow access to other resource groups in the subscription because the role assignment is scoped to RG-Test.

Answer

Assign the Virtual Machine Contributor role at the subscription scope

Answer

Assign the Reader role at the RG-Test scope

Answer

Assign the Owner role at the RG-Test scope

Question 14

A shared resource group contains a VM and a storage account used by payroll. Administrators still need to modify configuration and apply patches, but accidental deletion of either resource must be prevented. What should the administrator apply?

Accepted Answer

A CanNotDelete lock on each resource.. Option B is correct because a CanNotDelete lock prevents the deletion of a resource while still allowing all other operations, including configuration modifications and patching. This meets the requirement of protecting the VM and storage account from accidental deletion while preserving administrative access for updates.

Answer

A ReadOnly lock on the entire resource group.

Answer

A policy assignment that denies delete operations on the resource group.

Answer

A management group with a deny assignment.

Question 15

Based on the exhibit, the help desk team must be able to restart virtual machines in RG-App, but they must not be able to create, delete, or resize VMs. What is the best action?

Accepted Answer

Create a custom RBAC role that allows VM start, restart, and deallocate actions, then assign it at RG-App.. Option C is correct because the help desk team needs only specific actions (start, restart, deallocate) without the ability to create, delete, or resize VMs. The built-in Virtual Machine Contributor role includes write permissions that allow creating and deleting VMs, so a custom RBAC role that explicitly grants only the required actions (Microsoft.Compute/virtualMachines/start/action, restart/action, deallocate/action) and is assigned at the RG-App scope meets the requirement precisely.

Answer

Assign Virtual Machine Contributor to HelpDeskGroup at the subscription scope.

Answer

Assign Contributor to HelpDeskGroup at RG-App.

Answer

Assign Owner to HelpDeskGroup at RG-App and use Azure Policy to block unwanted changes.