AZ-104 Practice Test 16 — 15 Questions

Question 1

A storage account should accept requests only from a specific virtual network subnet in Azure. The team does not want traffic to reach the public endpoint from the internet. What should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a storage network rule for the subnet or use a private endpoint. Azure storage accounts can restrict access to specific virtual network subnets using service endpoints or private endpoints. A storage network rule for the subnet allows traffic only from that subnet, while a private endpoint maps the storage account to a private IP in the VNet, completely bypassing the public endpoint. This ensures no internet traffic reaches the public endpoint, meeting the requirement.

Answer

Enable anonymous blob access

Answer

Move the container to the Archive tier

Answer

Assign the Contributor role to the subnet

Question 2

Your application stores regulatory records in Azure Blob Storage. The records must remain in a write-once-read-many state for four years and must not be altered or deleted during that time. What should you configure?

Accepted Answer

Immutable blob storage with a time-based retention policy. Immutable blob storage with a time-based retention policy enforces a write-once-read-many (WORM) state, ensuring that blobs cannot be modified or deleted for a specified duration. This directly meets the regulatory requirement of four-year retention without alteration or deletion, as the policy locks the data at the container level and prevents any changes until the retention period expires.

Answer

Blob soft delete

Answer

Lifecycle management to move data to Archive

Answer

A shared access signature

Question 3

A company needs to peer VNet-Prod, which uses 10.30.0.0/16, with VNet-Shared, which uses 10.30.64.0/18. The peering creation fails with an address-space overlap error. The team can renumber the shared environment, but they do not want to change any addresses in VNet-Prod. What should the administrator do before retrying the peering?

Accepted Answer

Reconfigure VNet-Shared to use a non-overlapping address range, then recreate its subnets and migrate workloads.. VNet peering requires that the address spaces of the two VNets do not overlap. VNet-Prod uses 10.30.0.0/16, which includes the range 10.30.64.0/18 used by VNet-Shared, causing the overlap error. The only way to resolve this without changing VNet-Prod is to reconfigure VNet-Shared to use a non-overlapping address range, which involves deleting and recreating its subnets and migrating workloads, as stated in option B.

Answer

Add an NSG that allows traffic between the two VNets.

Answer

Rename VNet-Shared so Azure treats it as a different network.

Answer

Enable gateway transit on both VNets so Azure can route around the overlap.

Question 4

An employee deleted one spreadsheet stored on a Windows VM that is protected by Azure Backup. The administrator must recover only that file without restoring the entire VM. What should be used?

Accepted Answer

The file recovery process from the Recovery Services vault recovery point.. Azure Backup for Azure VMs supports file-level recovery from a recovery point without restoring the entire VM. The file recovery process mounts the recovery point as an iSCSI target on the VM, allowing the administrator to browse and copy the deleted spreadsheet directly from the snapshot. This is the only option that provides granular, non-disruptive file restoration from a VM backup.

Answer

A full VM restore to replace the existing virtual machine.

Answer

Blob rehydration from Archive tier in the storage account.

Answer

A restore point collection operation in Azure Compute.

Question 5

A Windows VM runs an application that uploads files to a blob container every hour. Security forbids storing storage account keys or long-lived SAS tokens on the VM. The application must be able to write only to that container and nothing else. What should the administrator configure?

Accepted Answer

Assign Storage Blob Data Contributor to the VM's managed identity at the container scope. It uses Azure RBAC to grant the VM's managed identity the Storage Blob Data Contributor role at the container scope. This allows the application to write only to that specific container without requiring any storage account keys or SAS tokens on the VM, satisfying the security requirement. Managed identities provide an automatically managed service principal in Azure AD, enabling secure authentication to Azure services without storing credentials.

Answer

Store the storage account key in an environment variable on the VM

Answer

Create a service SAS with write permission on the storage account

Answer

Assign Contributor on the storage account to the VM's system-assigned identity

Question 6

Based on the exhibit, which next hop will Azure use for traffic from the VM to 10.50.1.20?

Accepted Answer

Internet, because the /24 route is more specific than the default route.. Azure uses the most specific route (longest prefix match) to determine next hop. The route for 10.50.1.0/24 with next hop Internet is more specific than the default route 0.0.0.0/0, so traffic to 10.50.1.20 will be forwarded to the Internet, not the virtual appliance.

Answer

Virtual appliance 10.1.1.4, because all traffic always follows the default route.

Answer

Virtual network, because private IP addresses always stay inside Azure.

Answer

No route is selected, so the packet is dropped before leaving the subnet.

Question 7

Based on the exhibit, the VM backup item was accidentally deleted from the vault yesterday, but the VM itself still exists. What should you do to resume protection with the existing backup item?

Accepted Answer

Recover or undelete the backup item from the vault before the soft-delete retention expires.. Azure Backup uses soft-delete for backup items, which retains deleted backup data for 14 days by default. Since the backup item was accidentally deleted yesterday, it is still in the soft-delete state and can be recovered or undeleted from the vault before the retention period expires. Once recovered, protection can be resumed on the existing VM without data loss or reconfiguration.

Answer

Delete the VM and recreate it so the backup can start again.

Answer

Create a new action group so the vault can re-enable protection.

Answer

Disable diagnostic settings on the vault and then re-enable them.

Question 8

An application running on a VM in a subnet must access an Azure Storage account. The security team wants the storage account to accept traffic only from that subnet, but they do not want a private IP address in the VNet and they do not want to change DNS records. What should the administrator configure?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and restrict the storage firewall to that subnet.. A service endpoint for Microsoft.Storage allows the subnet to send traffic to the storage account over the Azure backbone network using the storage account's public endpoint, without requiring a private IP address or DNS changes. The storage firewall then restricts access to only that subnet's traffic, meeting the security team's requirements.

Answer

Create a private endpoint and a private DNS zone for the storage account.

Answer

Allow access only from the VM public IP address.

Answer

Place the storage account in the same resource group as the VM.

Question 9

Based on the exhibit, the security team needs 30 days of searchable log data for a storage account and wants to create queries that can be used in workbooks and alerts. The current configuration only sends data to an archive location. What should the administrator configure?

Accepted Answer

Add a Log Analytics workspace destination to the diagnostic setting.. The current diagnostic setting only archives logs to a storage account, which does not support interactive querying, workbooks, or alert rules. By adding a Log Analytics workspace destination to the same diagnostic setting, logs are sent to a centralized workspace where they become searchable via KQL, enabling real-time queries, workbook visualizations, and alert triggers. This meets the security team's requirement for 30 days of searchable log data without changing the existing archive destination.

Answer

Change the storage account redundancy to RA-GRS.

Answer

Enable a CanNotDelete lock on the storage account.

Answer

Configure a private endpoint for the storage account.

Question 10

Why is centralized logging valuable during security incident response?

Accepted Answer

It makes related events from many devices easier to collect and correlate.. Centralized logging aggregates logs from multiple sources (e.g., Azure VMs, network security groups, Azure Firewall) into a single repository like Azure Log Analytics or Azure Sentinel. This correlation enables security analysts to identify patterns across devices, such as a chain of events from an initial breach to lateral movement, which is critical for incident response. Without centralization, manually correlating timestamps and log formats from disparate systems would be impractical during an active attack.

Answer

It guarantees that attacks cannot succeed.

Answer

It replaces access control mechanisms.

Answer

It forces all systems to use one VLAN.

Question 11

Which two statements about Azure route tables and user-defined routes are correct? Select two.

Accepted Answer

You can associate a route table with a subnet.. Route tables in Azure are associated at the subnet level, not directly to a virtual machine. This association allows the route table's user-defined routes (UDRs) to override system default routes for traffic leaving that subnet. The subnet must be in the same region as the route table, and a single route table can be associated with multiple subnets.

Answer

Route tables can be associated directly to a single virtual machine without using its subnet.

Answer

A user-defined route automatically overrides a network security group deny rule.

Answer

System routes are never used when a route table exists.

Question 12

A team manages many application VMs and backend VMs. The VM IP addresses change whenever they are rebuilt, but the same traffic rule must always allow the app tier to reach the backend tier on TCP 8443. What should the administrator use in the NSG rule?

Accepted Answer

Application Security Groups for the app and backend VMs.. Application Security Groups (ASGs) allow you to group VMs logically and reference them directly in NSG rules without relying on static IP addresses. Since the VM IPs change on rebuild, ASGs ensure the NSG rule for TCP 8443 always applies to the correct app and backend tiers, regardless of IP changes.

Answer

Static private IP addresses for each virtual machine.

Answer

A user-defined route between the app and backend subnets.

Answer

An availability set for each tier.

Question 13

A compliance team wants to bundle three policy definitions—allowed locations, required cost center tags, and approved VM sizes—so they can assign them together to a management group and review compliance in one place. Later they want to exempt one pilot subscription from the entire set for 60 days. What should they use?

Accepted Answer

A policy initiative at the management group scope.. A policy initiative (also called a policy set) allows you to group multiple policy definitions into a single, reusable bundle. By assigning the initiative at the management group scope, all three policies apply together to every subscription under that group. When the pilot subscription needs an exemption, you can create an exemption resource on that subscription for the entire initiative, specifying a 60-day expiration, which temporarily excludes it from all bundled policies while keeping compliance reporting unified.

Answer

A custom RBAC role with resource permissions for policy management.

Answer

A resource lock on the pilot subscription.

Answer

A separate management group for each of the three policy definitions.

Question 14

Match each access requirement to the most appropriate Azure Storage authentication or authorization approach.

Accepted Answer

SAS: Provides time-limited delegated access with specified permissions.. SAS provides delegated access; Azure AD authentication uses identity; public access allows anonymous reads; RBAC controls permissions; Azure AD DS extends on-prem AD; Service SAS can include IP restrictions.

Answer

SAS: Uses Azure AD identities to authenticate.

Answer

Azure AD authentication: Provides anonymous read access.

Question 15

Your company stores monthly reports in Azure Blob Storage. The reports are rarely accessed, but when needed they must be read within seconds rather than hours. You need to minimize storage cost while preserving near-immediate availability. Which access tier should you use?

Accepted Answer

Cool. Cool tier is correct because it offers low storage cost for infrequently accessed data while maintaining near-immediate (milliseconds) retrieval latency. The reports are rarely accessed but must be available within seconds, which Cool tier satisfies, whereas Archive would incur hours-long rehydration delays.

Answer

Hot

Answer