AZ-104 Practice Test 17 — 15 Questions

Question 1

A line-of-business web tier consists of two Azure VMs in a region that supports availability zones. The business requirement is to survive a full datacenter outage in that region without deploying to a second region. What should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Availability zones with the VMs placed in different zones. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Placing the two VMs in different zones ensures that if one entire datacenter fails, the other VM remains operational, meeting the requirement to survive a full datacenter outage without deploying to a second region.

Answer

An availability set with multiple update domains

Answer

A proximity placement group for both VMs

Answer

A single-zone virtual machine scale set

Question 2

A VM in subnet S1 must accept RDP only from the administrator workstation at 203.0.113.25. The subnet NSG has a custom inbound deny-all rule at priority 200 and a custom allow-RDP rule at priority 300 for source 203.0.113.25, destination Any, TCP 3389. RDP is still blocked from the workstation. What should the administrator change?

Accepted Answer

Move the allow-RDP rule to a lower priority number than 200.. Network Security Group (NSG) rules are evaluated in priority order, with lower numbers having higher precedence. The deny-all rule at priority 200 is evaluated before the allow-RDP rule at priority 300, so the deny rule blocks the RDP traffic before the allow rule can be applied. To allow RDP from the workstation, the allow-RDP rule must have a lower priority number (e.g., 100) than the deny-all rule, ensuring it is evaluated first.

Answer

Change the allow rule from inbound to outbound traffic.

Answer

Change the protocol from TCP to Any on the deny-all rule.

Answer

Attach a user-defined route so the workstation can reach the VM directly.

Question 3

Before changing a managed data disk attached to a VM, you want a point-in-time copy that can be restored later if the change fails. What should you create?

Accepted Answer

Managed disk snapshot. A managed disk snapshot is a point-in-time, read-only copy of a managed disk that can be used to restore the disk to that exact state if a change fails. Snapshots are incremental, capturing only the changes since the last snapshot, and they exist independently of the source disk, allowing you to create a new disk from the snapshot for recovery.

Answer

Availability set

Answer

Image

Answer

Resource lock

Question 4

An operations team must be able to restart virtual machines in one resource group. They must not create, delete, resize, or change disks or networking. Which two actions should the administrator take? Select two.

Accepted Answer

Create a custom RBAC role that includes only read and restart actions for virtual machines.. A custom RBAC role can be defined to include only the 'Microsoft.Compute/virtualMachines/read' and 'Microsoft.Compute/virtualMachines/restart/action' permissions, which precisely limits the operations team to reading and restarting VMs without allowing create, delete, resize, or disk/network changes. This aligns with the principle of least privilege.

Answer

Assign the Virtual Machine Contributor role to the operations group.

Answer

Create an Azure Policy assignment that denies VM creation in the resource group.

Answer

Apply a ReadOnly lock to the resource group.

Question 5

An administrator added an NSG rule named Allow-Admin-HTTPS with priority 250 to permit inbound TCP 443 from a single public IP. The NSG also contains a Deny-All-Inbound rule with priority 200. The administrator still cannot connect to the VM over HTTPS from the allowed IP. What should be changed to resolve the issue?

Accepted Answer

Change the allow rule priority to a number lower than 200.. The Deny-All-Inbound rule with priority 200 is evaluated before the Allow-Admin-HTTPS rule with priority 250 because NSG rules are processed in order of ascending priority (lower numbers are evaluated first). Since the deny rule matches all inbound traffic, it blocks the HTTPS connection before the allow rule can be evaluated. To resolve this, the allow rule must have a priority lower than 200 (e.g., 150) so it is evaluated first and permits the traffic from the specified public IP.

Answer

Change the deny rule priority to 65000 so it is evaluated first.

Answer

Convert the allow rule to an outbound rule instead of inbound.

Answer

Replace the NSG with a route table so HTTPS can pass through the subnet.

Question 6

A records archive stores thousands of blobs that are usually read-only. The administrator wants blobs older than 90 days to move automatically to a lower-cost online tier without manual intervention. Which solution should be configured?

Accepted Answer

Create a blob lifecycle management policy with a rule that moves blobs after 90 days.. Azure Blob Storage lifecycle management policies allow you to define rules that automatically transition blobs to a lower-cost access tier (e.g., from Hot to Cool or from Cool to Archive) based on the age of the blob. In this scenario, a rule can be configured to move blobs older than 90 days to the Cool or Archive tier without any manual intervention, meeting the requirement for automated cost optimization.

Answer

Manually change each blob tier when the archive team remembers to review it.

Answer

Enable object replication so the blobs are copied to another storage account.

Answer

Move the account to the Archive access tier and leave it there permanently.

Question 7

A storage account becomes unavailable because Azure has a regional platform issue. The operations team wants a notification whenever Azure marks the resource or region unhealthy, and they want to avoid continuous log ingestion just to detect the outage. What should they configure?

Accepted Answer

A Service Health alert based on the Activity log, scoped appropriately.. A Service Health alert, configured from the Azure Activity log, provides proactive notifications when Azure services or regions experience an outage or degradation. This alert is triggered by Azure's own health signals, eliminating the need for continuous log ingestion or custom metric monitoring to detect platform-level issues.

Answer

A metric alert on storage capacity with an action group.

Answer

A log alert on storage diagnostic logs that watches for 503 responses.

Answer

An Azure Policy assignment that audits the storage account state.

Question 8

A reporting system requires a storage account that is zone resilient in the primary region and also keeps a geo-replicated secondary copy that can be read during an outage. Which redundancy option should you select?

Accepted Answer

RA-GZRS, because it combines zone redundancy, geo-replication, and read access to the secondary region.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it provides synchronous replication across three Azure availability zones in the primary region for zone resilience, asynchronous geo-replication to a secondary region for disaster recovery, and enables read access to the secondary copy during an outage. This meets all three requirements: zone resiliency, geo-replication, and readable secondary region.

Answer

ZRS, because it protects against zone failure and also provides a readable secondary region.

Answer

GRS, because it stores a secondary copy in another region but does not offer zone redundancy in the primary region.

Answer

LRS, because local replication is enough when the workload already has application-level retries.

Question 9

An admin enables backup on a newly deployed Azure VM, but every backup job fails immediately with a message that the VM agent is not ready. What should the administrator verify first?

Accepted Answer

The Azure VM Agent is installed, running, and able to provision backup-related extensions.. The Azure VM Agent (also known as the Windows Guest Agent or Linux Agent) is required for the Azure Backup service to install the backup extension (e.g., IaaSBcdrExtension for Windows or SnapshotV2 for Linux). If the agent is not installed, not running, or is in a 'Not Ready' state, the backup extension cannot be provisioned, causing immediate failure. The administrator should first verify that the VM Agent is installed and its status is 'Ready' in the VM's properties.

Answer

The VM is placed in an availability zone that supports backup.

Answer

The VM has a public IP address assigned for outbound connectivity.

Answer

The VM is added to a load balancer backend pool.

Question 10

Based on the exhibit, the operations team wants an alert that fires when any VM has not sent a heartbeat in the last 15 minutes. Which KQL query should they use as the condition for the log alert?

Accepted Answer

Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen < ago(15m). The query uses `summarize max(TimeGenerated) by Computer` to get the latest heartbeat timestamp per VM, then filters with `where LastSeen < ago(15m)` to identify VMs whose last heartbeat is older than 15 minutes. This directly matches the alert condition: any VM that has not sent a heartbeat in the last 15 minutes.

Answer

Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen > ago(15m)

Answer

Heartbeat | where TimeGenerated > ago(15m) | summarize count() by Computer | where count() == 0

Answer

Heartbeat | distinct Computer | where Computer == "VM01"

Question 11

Based on the exhibit, what inbound NSG rule should the administrator add to allow only the web tier to reach the app tier on TCP 8080?

Accepted Answer

Source: WebASG, Destination: AppASG, Protocol: TCP, Port: 8080, Priority: 250. The inbound NSG rule must allow traffic from the web tier (source: WebASG) to the app tier (destination: AppASG) on TCP port 8080. A priority of 250 is lower than the default rules (65000+) and ensures this rule is evaluated before any higher-numbered deny rules, while being high enough to leave room for more specific rules if needed.

Answer

Source: Internet, Destination: VirtualNetwork, Protocol: TCP, Port: 8080, Priority: 250

Answer

Source: AppASG, Destination: WebASG, Protocol: TCP, Port: 8080, Priority: 250

Answer

Source: WebASG, Destination: AppASG, Protocol: TCP, Port: 8080, Priority: 350

Question 12

Based on the exhibit, the workload must keep running if an entire datacenter in the region becomes unavailable. The region supports availability zones. What should you deploy?

Accepted Answer

Availability zones with the VMs distributed across zones.. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across multiple zones ensures that if one entire datacenter fails, the workload continues running in the other zone(s), meeting the requirement for regional datacenter-level resilience.

Answer

An availability set with one update domain per VM.

Answer

A single VM with a premium SSD data disk.

Answer

An Azure proximity placement group.

Question 13

A team has an approved Windows VM that already includes their application, patches, and monitoring agent. They want future VMs to start with the same configuration. What should they use?

Accepted Answer

A managed image created from the approved VM. A managed image captures the entire VM configuration, including the OS, application, patches, and monitoring agent, allowing you to create multiple identical VMs from a single source. Unlike a snapshot, which is tied to a specific disk and requires manual steps to replicate the full VM setup, a managed image provides a reusable template for consistent deployments. This approach ensures future VMs start with the exact same configuration as the approved VM.

Answer

An availability set

Answer

A snapshot of the OS disk

Answer

A larger virtual machine size

Question 14

A team needs to run a Linux container for 15 to 20 minutes at a time, triggered by an external system. They do not want to manage servers, clusters, or a web framework. Which Azure service is the best fit?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the best fit because it allows you to run a container directly in Azure without managing any underlying servers or orchestrators. The service is designed for short-lived, burst workloads (like 15–20 minutes) and can be triggered on-demand via an external system (e.g., HTTP request, Azure Logic Apps, or SDK). ACI automatically starts the container, runs it, and then stops and deallocates resources when the task completes, matching the exact requirement of no server, cluster, or web framework management.

Answer

Azure App Service

Answer

Azure Kubernetes Service

Answer

A virtual machine

Question 15

An Azure VM backup job starts failing immediately after protection is enabled. The error states that the VM agent is not ready. The VM was created from a custom image and no extensions have ever installed successfully. What should the administrator verify first?

Accepted Answer

That the Azure VM Agent service is installed and running inside the guest OS.. The error 'VM agent not ready' indicates that the Azure Backup extension cannot communicate with the VM agent inside the guest OS. Since the VM was created from a custom image and no extensions have ever installed successfully, the most likely cause is that the Azure VM Agent service is not installed or not running. The agent is required for backup extensions to function, so verifying its status inside the guest OS is the first troubleshooting step.

Answer

That the Recovery Services vault is in the same resource group as the VM.

Answer

That soft delete is enabled on the vault.

Answer

That the subscription has enough free Azure Backup storage capacity.