AZ-104 Practice Test 17 — 15 Questions

Question 1

A records archive stores thousands of blobs that are usually read-only. The administrator wants blobs older than 90 days to move automatically to a lower-cost online tier without manual intervention. Which solution should be configured?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a blob lifecycle management policy with a rule that moves blobs after 90 days.. Azure Blob Storage lifecycle management policies allow you to define rules that automatically transition blobs to a lower-cost access tier (e.g., from Hot to Cool or from Cool to Archive) based on the age of the blob. In this scenario, a rule can be configured to move blobs older than 90 days to the Cool or Archive tier without any manual intervention, meeting the requirement for automated cost optimization.

Answer

Manually change each blob tier when the archive team remembers to review it.

Answer

Enable object replication so the blobs are copied to another storage account.

Answer

Move the account to the Archive access tier and leave it there permanently.

Question 2

A storage account becomes unavailable because Azure has a regional platform issue. The operations team wants a notification whenever Azure marks the resource or region unhealthy, and they want to avoid continuous log ingestion just to detect the outage. What should they configure?

Accepted Answer

A Service Health alert based on the Activity log, scoped appropriately.. A Service Health alert, configured from the Azure Activity log, provides proactive notifications when Azure services or regions experience an outage or degradation. This alert is triggered by Azure's own health signals, eliminating the need for continuous log ingestion or custom metric monitoring to detect platform-level issues.

Answer

A metric alert on storage capacity with an action group.

Answer

A log alert on storage diagnostic logs that watches for 503 responses.

Answer

An Azure Policy assignment that audits the storage account state.

Question 3

A reporting system requires a storage account that is zone resilient in the primary region and also keeps a geo-replicated secondary copy that can be read during an outage. Which redundancy option should you select?

Accepted Answer

RA-GZRS, because it combines zone redundancy, geo-replication, and read access to the secondary region.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it provides synchronous replication across three Azure availability zones in the primary region for zone resilience, asynchronous geo-replication to a secondary region for disaster recovery, and enables read access to the secondary copy during an outage. This meets all three requirements: zone resiliency, geo-replication, and readable secondary region.

Answer

ZRS, because it protects against zone failure and also provides a readable secondary region.

Answer

GRS, because it stores a secondary copy in another region but does not offer zone redundancy in the primary region.

Answer

LRS, because local replication is enough when the workload already has application-level retries.

Question 4

An admin enables backup on a newly deployed Azure VM, but every backup job fails immediately with a message that the VM agent is not ready. What should the administrator verify first?

Accepted Answer

The Azure VM Agent is installed, running, and able to provision backup-related extensions.. The Azure VM Agent (also known as the Windows Guest Agent or Linux Agent) is required for the Azure Backup service to install the backup extension (e.g., IaaSBcdrExtension for Windows or SnapshotV2 for Linux). If the agent is not installed, not running, or is in a 'Not Ready' state, the backup extension cannot be provisioned, causing immediate failure. The administrator should first verify that the VM Agent is installed and its status is 'Ready' in the VM's properties.

Answer

The VM is placed in an availability zone that supports backup.

Answer

The VM has a public IP address assigned for outbound connectivity.

Answer

The VM is added to a load balancer backend pool.

Question 5

Based on the exhibit, the operations team wants an alert that fires when any VM has not sent a heartbeat in the last 15 minutes. Which KQL query should they use as the condition for the log alert?

Accepted Answer

Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen < ago(15m). The query uses `summarize max(TimeGenerated) by Computer` to get the latest heartbeat timestamp per VM, then filters with `where LastSeen < ago(15m)` to identify VMs whose last heartbeat is older than 15 minutes. This directly matches the alert condition: any VM that has not sent a heartbeat in the last 15 minutes.

Answer

Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen > ago(15m)

Answer

Heartbeat | where TimeGenerated > ago(15m) | summarize count() by Computer | where count() == 0

Answer

Heartbeat | distinct Computer | where Computer == "VM01"

Question 6

Based on the exhibit, what inbound NSG rule should the administrator add to allow only the web tier to reach the app tier on TCP 8080?

Accepted Answer

Source: WebASG, Destination: AppASG, Protocol: TCP, Port: 8080, Priority: 250. The inbound NSG rule must allow traffic from the web tier (source: WebASG) to the app tier (destination: AppASG) on TCP port 8080. A priority of 250 is lower than the default rules (65000+) and ensures this rule is evaluated before any higher-numbered deny rules, while being high enough to leave room for more specific rules if needed.

Answer

Source: Internet, Destination: VirtualNetwork, Protocol: TCP, Port: 8080, Priority: 250

Answer

Source: AppASG, Destination: WebASG, Protocol: TCP, Port: 8080, Priority: 250

Answer

Source: WebASG, Destination: AppASG, Protocol: TCP, Port: 8080, Priority: 350

Question 7

Based on the exhibit, the workload must keep running if an entire datacenter in the region becomes unavailable. The region supports availability zones. What should you deploy?

Accepted Answer

Availability zones with the VMs distributed across zones.. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across multiple zones ensures that if one entire datacenter fails, the workload continues running in the other zone(s), meeting the requirement for regional datacenter-level resilience.

Answer

An availability set with one update domain per VM.

Answer

A single VM with a premium SSD data disk.

Answer

An Azure proximity placement group.

Question 8

A team has an approved Windows VM that already includes their application, patches, and monitoring agent. They want future VMs to start with the same configuration. What should they use?

Accepted Answer

A managed image created from the approved VM. A managed image captures the entire VM configuration, including the OS, application, patches, and monitoring agent, allowing you to create multiple identical VMs from a single source. Unlike a snapshot, which is tied to a specific disk and requires manual steps to replicate the full VM setup, a managed image provides a reusable template for consistent deployments. This approach ensures future VMs start with the exact same configuration as the approved VM.

Answer

An availability set

Answer

A snapshot of the OS disk

Answer

A larger virtual machine size

Question 9

A team needs to run a Linux container for 15 to 20 minutes at a time, triggered by an external system. They do not want to manage servers, clusters, or a web framework. Which Azure service is the best fit?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the best fit because it allows you to run a container directly in Azure without managing any underlying servers or orchestrators. The service is designed for short-lived, burst workloads (like 15–20 minutes) and can be triggered on-demand via an external system (e.g., HTTP request, Azure Logic Apps, or SDK). ACI automatically starts the container, runs it, and then stops and deallocates resources when the task completes, matching the exact requirement of no server, cluster, or web framework management.

Answer

Azure App Service

Answer

Azure Kubernetes Service

Answer

A virtual machine

Question 10

An Azure VM backup job starts failing immediately after protection is enabled. The error states that the VM agent is not ready. The VM was created from a custom image and no extensions have ever installed successfully. What should the administrator verify first?

Accepted Answer

That the Azure VM Agent service is installed and running inside the guest OS.. The error 'VM agent not ready' indicates that the Azure Backup extension cannot communicate with the VM agent inside the guest OS. Since the VM was created from a custom image and no extensions have ever installed successfully, the most likely cause is that the Azure VM Agent service is not installed or not running. The agent is required for backup extensions to function, so verifying its status inside the guest OS is the first troubleshooting step.

Answer

That the Recovery Services vault is in the same resource group as the VM.

Answer

That soft delete is enabled on the vault.

Answer

That the subscription has enough free Azure Backup storage capacity.

Question 11

A customer runs two Windows VMs in a region that does not support availability zones. The app can lose one VM but must keep running through planned maintenance and a single host failure. Which deployment pattern should you use?

Accepted Answer

Place both VMs in an availability set.. An availability set ensures that VMs are placed on different fault domains (separate physical hardware) and update domains (separate maintenance batches). This protects against both a single host failure and planned Azure maintenance, meeting the requirement that the app can lose one VM but keep running.

Answer

Use a single-instance deployment and add more backup jobs.

Answer

Use availability zones because they always exist in every region.

Answer

Put both VMs on the same dedicated host to avoid migration during maintenance.

Question 12

An operations team wants all internet-bound traffic from a workload subnet to pass through a network virtual appliance at 10.1.0.4 for inspection. Which next hop type should be used in a user-defined route for destination 0.0.0.0/0?

Accepted Answer

Virtual appliance. To force all internet-bound traffic from a subnet through a network virtual appliance (NVA) at 10.1.0.4, you must create a user-defined route (UDR) with destination 0.0.0.0/0 and next hop type 'Virtual appliance'. This directs traffic to the NVA's private IP for inspection, overriding Azure's default system route that would otherwise send 0.0.0.0/0 traffic directly to the Internet via the Azure backbone.

Answer

Internet

Answer

Virtual network gateway

Answer

None

Question 13

A company has 25 remote employees who need to connect from their laptops to Azure VMs that have only private IP addresses. No on-premises VPN appliance exists, and the VMs must not be assigned public IP addresses. Which solution should the administrator deploy?

Accepted Answer

Point-to-site VPN Gateway. A Point-to-Site (P2S) VPN Gateway is the correct solution because it allows individual remote clients (laptops) to establish a secure VPN connection from anywhere to Azure VMs with private IP addresses, without requiring a public IP on the VMs or an on-premises VPN appliance. P2S uses SSTP, IKEv2, or OpenVPN protocols to create a tunnel from each client to the Azure virtual network, enabling access to private resources.

Answer

Site-to-site VPN Gateway

Answer

ExpressRoute circuit

Answer

Public load balancer with inbound NAT rules

Question 14

You already created a metric alert rule. You want the alert to send email and call a webhook when it fires. Which component should you link to the alert rule?

Accepted Answer

An action group. An action group is the correct component because it defines the notification and automation actions (such as sending an email or invoking a webhook) that are triggered when a metric alert rule fires. In Azure Monitor, alert rules are linked to action groups to execute these responses; without an action group, the alert can only log the event but cannot perform any external notification or automation.

Answer

A diagnostic setting

Answer

A Log Analytics workspace

Answer

An Azure Policy initiative

Question 15

A hub VNet already has a VPN gateway connected to on-premises. A spoke VNet must send on-premises traffic through the hub gateway without deploying its own gateway. Which peering settings are needed?

Accepted Answer

Enable gateway transit on the hub peering and use remote gateways on the spoke peering.. It enables gateway transit on the hub-side peering connection and uses remote gateways on the spoke-side peering connection. This configuration allows the spoke VNet to route on-premises traffic through the hub's VPN gateway without deploying its own gateway, leveraging the hub as a transit point.

Answer

Enable forwarded traffic on both peerings and add a route table to the spoke subnet.

Answer

Create a private endpoint in the spoke VNet and route on-premises traffic through it.

Answer

Deploy a second VPN gateway in the spoke and connect it in active-active mode.