AZ-104 Practice Test 16 — 15 Questions

Question 1

You create a private endpoint for an Azure Storage account and disable public network access on the account. A VM in a peered VNet cannot reach the storage account by name. The private endpoint resides in VNet-App. What is the most likely missing configuration?

Accepted Answer

A private DNS zone linked so the relevant VNet can resolve the storage account to the private endpoint IP. When you create a private endpoint for an Azure Storage account and disable public network access, the storage account's public DNS name must resolve to the private endpoint's private IP address within the VNet. This requires a private DNS zone (privatelink.blob.core.windows.net) linked to the VNet where the VM resides. Without that DNS zone link, the VM in the peered VNet will resolve the storage account name to the public IP, which is unreachable because public access is disabled, causing the connection failure.

Answer

An NSG rule allowing outbound DNS to 8.8.8.8

Answer

A Recovery Services vault in the peered VNet

Answer

A public IP address on the private endpoint NIC

Question 2

Based on the exhibit, which OS disk option best fits a development VM that is rebuilt often and does not need the disk contents to survive deallocation?

Accepted Answer

An ephemeral OS disk.. An ephemeral OS disk is created on the local VM host and not stored in Azure Storage, so it provides lower latency and is automatically deleted when the VM is deallocated. This makes it ideal for development VMs that are rebuilt often and do not require disk persistence across deallocations.

Answer

A Standard HDD managed OS disk.

Answer

A premium managed data disk used as the OS disk.

Answer

A shared disk attached to multiple VMs.

Question 3

The operations team manages several Azure VMs in one resource group. They need an alert whenever average CPU percentage on any VM in the group stays above 80% for 10 minutes, and the alert must send email and SMS to the on-call team. What should the administrator configure?

Accepted Answer

Create an Azure Monitor metric alert rule at the resource-group scope and attach an action group.. Option B is correct because Azure Monitor metric alerts can be created at the resource-group scope, which allows a single alert rule to monitor the 'Percentage CPU' metric across all VMs in that group. The alert triggers when the average CPU stays above 80% for 10 minutes (evaluated using a fixed aggregation window). An action group attached to the alert rule sends email and SMS notifications to the on-call team, meeting all requirements without manual intervention.

Answer

Create a Log Analytics query alert on the Activity log and manually notify the on-call team.

Answer

Export VM diagnostics to a storage account and have operators review the files after each incident.

Answer

Create a resource lock on the VMs and use Azure Policy to notify the team about CPU spikes.

Question 4

Based on the exhibit, which Azure service should you deploy to provide browser-based administrative access to the VM without assigning it a public IP address?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP/SSH connectivity to virtual machines directly in the Azure portal over TLS, without requiring a public IP address on the VM. It uses a hardened bastion host in your virtual network that brokers the connection, eliminating exposure of the VM to the internet.

Answer

Azure VPN Gateway

Answer

Public IP address on the VM

Answer

Azure Load Balancer

Question 5

Match each storage networking requirement to the Azure storage network control that should be used.

Question 6

Based on the exhibit, which alert type should the administrator create to detect when Azure marks the storage account unhealthy because of a platform issue?

Accepted Answer

Resource Health alert.. Resource Health alerts are specifically designed to notify administrators when an Azure service or resource becomes unhealthy due to platform issues. In this scenario, the storage account being marked unhealthy by Azure due to a platform issue is exactly the kind of event that a Resource Health alert captures, as it monitors the health status of Azure resources and triggers alerts on state transitions (e.g., from 'Available' to 'Degraded' or 'Unavailable').

Answer

Metric alert on account capacity.

Answer

Log search alert against AzureDiagnostics.

Answer

Autoscale rule based on storage transactions.

Question 7

Two virtual machines named VM-Web01 and VM-Web02 host the same public web application. Users on the internet must connect through a single public IP address, and incoming requests should be distributed across both VMs. What should you deploy?

Accepted Answer

A public load balancer. A public load balancer (Azure Load Balancer with a public frontend IP) is required because it provides a single public IP address for internet clients and distributes incoming traffic across the backend VMs (VM-Web01 and VM-Web02) using a configured load-balancing rule. This ensures high availability and scalability for the web application.

Answer

An internal load balancer

Answer

A private DNS zone

Answer

A Recovery Services vault

Question 8

You deploy a Windows Server VM and need to run several PowerShell commands after deployment without signing in to the VM. Which Azure feature should you use?

Accepted Answer

Use the Custom Script Extension on the VM.. The Custom Script Extension (CSE) is the correct Azure feature because it allows you to run PowerShell or Bash scripts on a VM after deployment without requiring interactive sign-in. It executes the script via the Azure VM Agent, which runs as a local system process, making it ideal for post-deployment configuration tasks like installing software or running commands.

Answer

Put the VM in an availability zone.

Answer

Attach a managed identity and rely on Azure Policy.

Answer

Create a snapshot before startup.

Question 9

Every backup job for a newly deployed Azure VM fails immediately and reports that the VM agent is not ready. Which two checks should the administrator perform first? Select two.

Accepted Answer

Verify that the Azure VM Agent is installed and the service is running inside the guest.. The Azure VM Agent is required for the Azure Backup service to communicate with the VM and orchestrate snapshot operations. If the agent is not installed or the service (Windows: WindowsAzureGuestAgent, Linux: waagent) is not running, backup jobs will fail immediately with the 'agent not ready' error. Verifying agent status is the first logical step because without a functioning agent, no backup can proceed.

Answer

Increase the recovery point retention in the backup policy.

Answer

Recreate the Recovery Services vault in another region.

Answer

Disable the backup policy until the VM is rebooted several times.

Question 10

Match each routing situation to the next-hop or route-selection behavior Azure will use.

Question 11

You have a virtual machine scale set that must increase the number of instances automatically when average CPU utilization exceeds 75 percent and decrease when utilization drops below 30 percent. What should you configure?

Accepted Answer

An Azure Monitor autoscale rule on the scale set. Azure Monitor autoscale rules allow you to define conditions for automatically scaling out (increasing instances) when average CPU utilization exceeds a threshold (e.g., 75%) and scaling in (decreasing instances) when it drops below a lower threshold (e.g., 30%). These rules are applied directly to the virtual machine scale set, enabling dynamic scaling based on performance metrics.

Answer

A boot diagnostics configuration

Answer

An availability set

Answer

A custom script extension

Question 12

Two backend VMs must remain available if an Azure host is patched or fails. A full datacenter outage is not part of the requirement, and the team wants the VMs to stay in the same region with predictable east-west latency. Which placement option should the administrator choose?

Accepted Answer

An availability set. An availability set distributes VMs across multiple fault domains (separate physical racks with independent power, cooling, and network) within a single Azure datacenter. This protects against host patching and hardware failures while keeping VMs in the same datacenter, ensuring predictable east-west latency. The requirement explicitly excludes a full datacenter outage, so availability zones (which span separate datacenters) are unnecessary.

Answer

Availability zones in separate datacenters

Answer

A proximity placement group

Answer

A single VM scale set instance

Question 13

Which two Network Watcher tools can help you diagnose whether a VM can reach another address and whether a specific flow is allowed or denied? Select two.

Accepted Answer

Connection troubleshoot. Connection Troubleshoot (A) is correct because it performs end-to-end connectivity checks between a source VM and a target (IP/FQDN/URL), testing latency, packet loss, and hop-by-hop routing. It also identifies whether the connection is blocked by NSG or firewall rules, making it ideal for diagnosing reachability and flow permission issues.

Answer

Packet capture

Answer

Effective routes

Answer

Network topology

Question 14

Match each Azure Storage redundancy option to the best description.

Question 15

You need to assign the same RBAC role to 15 administrators so they can manage backups for several virtual machines. You want to minimize ongoing administrative effort when membership changes. What should you use?

Accepted Answer

A Microsoft Entra group and a single role assignment to the group.. Option A is correct because assigning a single RBAC role to a Microsoft Entra group allows you to manage permissions centrally. When membership changes, you only need to add or remove users from the group, and the role assignment automatically applies to the new members. This minimizes ongoing administrative effort compared to managing individual role assignments.

Answer

A separate custom role assignment for each administrator.

Answer

A resource lock on every virtual machine.

Answer

A policy exemption for the administrators.