AZ-104 Practice Test 18 — 15 Questions

Question 1

An administrator creates a route table with a UDR for 10.20.0.0/16 and next hop type Virtual appliance. A VM in the subnet still does not send that traffic to the appliance. The route table contents are correct. What should be checked first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Whether the route table is associated with the correct subnet.. The most common reason a UDR fails to take effect is that the route table is not associated with the subnet containing the VM. Even if the route table contents are correct, the VM's traffic will follow default system routes unless the route table is explicitly linked to the subnet. Association is a required step to override Azure's default routing behavior.

Answer

Whether the NSG has an outbound deny rule for port 80.

Answer

Whether the VM uses a managed identity.

Answer

Whether the virtual machine is in an availability set.

Question 2

A company has a hub virtual network with a DNS server VM at 10.50.0.4 that hosts internal names such as app01.corp.local. A spoke virtual network is already peered to the hub. VMs in the spoke can reach resources in the hub by IP address, but they cannot resolve the internal host names. The company wants to keep DNS centralized and avoid deploying another DNS server in the spoke. What should the administrator configure?

Accepted Answer

Set the spoke virtual network to use 10.50.0.4 as a custom DNS server.. The spoke virtual network must be configured to use the hub DNS server (10.50.0.4) as a custom DNS server. This ensures that all VMs in the spoke send DNS queries to the hub server, which hosts the internal zone for corp.local. Since the hub and spoke are already peered, DNS traffic can flow over the peering connection without additional routing, keeping DNS centralized.

Answer

Create a private DNS zone for corp.local and link it only to the spoke subnet.

Answer

Add a user-defined route in the spoke to send DNS traffic to the hub VNet.

Answer

Enable gateway transit on the peering and set use remote gateways on the spoke.

Question 3

A stateless web app runs on two Ubuntu VMs behind an Azure Load Balancer. The region supports availability zones. The business wants the app to survive a full datacenter outage and also avoid having both VMs on the same maintenance boundary. Which deployment should you choose?

Accepted Answer

Place the VMs in separate availability zones in the same region.. Deploying the VMs in separate availability zones ensures they are placed in physically distinct datacenters within the same region, protecting against a full datacenter outage. Additionally, each availability zone has its own fault and update domains, so the VMs will never share the same maintenance boundary, meeting both business requirements.

Answer

Place both VMs in a single availability set.

Answer

Deploy one VM and rely on Azure Backup for recovery.

Answer

Deploy both VMs without any fault-domain configuration.

Question 4

An administrator enabled diagnostic settings on an Azure Storage account using the resource-specific schema. A coworker then ran a query against AzureDiagnostics and got no rows, even though failed blob writes occurred during the last hour. What is the best fix?

Accepted Answer

Query the storage account's dedicated resource-specific log table and filter for failed write operations.. When a diagnostic setting is configured with the resource-specific schema, Azure routes logs to dedicated tables (e.g., StorageBlobLogs) rather than the legacy AzureDiagnostics table. Querying AzureDiagnostics returns no rows because the logs are not stored there. The correct fix is to query the appropriate resource-specific log table (e.g., StorageBlobLogs) and filter for failed write operations, as this table contains the detailed, schema-specific data for the storage account's blob operations.

Answer

Switch the diagnostic setting back to the legacy AzureDiagnostics schema so all logs land there.

Answer

Use the Azure Activity log because blob write failures are always control-plane events.

Answer

Create a metric alert on storage capacity because that metric includes failed requests.

Question 5

Based on the exhibit, what should the administrator use to temporarily allow the legacy storage account to remain noncompliant without changing the policy for everyone?

Accepted Answer

Create a policy exemption for the legacy storage account or its resource group.. A policy exemption allows the administrator to exclude a specific resource (the legacy storage account) or its resource group from the Azure Policy evaluation without modifying the underlying policy definition. This is the correct approach because it temporarily grants noncompliance for that resource while the policy remains enforced for all other resources, aligning with the requirement to avoid changing the policy for everyone.

Answer

Modify the policy definition so all storage accounts can use public network access.

Answer

Apply a ReadOnly lock to the storage account.

Answer

Move the storage account to another subscription so the policy no longer applies.

Question 6

Based on the exhibit, a Windows VM must install IIS and run a configuration script automatically right after deployment. The administrator does not want to sign in to the VM manually. Which Azure feature should be used?

Accepted Answer

Virtual machine extension, such as the Custom Script Extension.. The Custom Script Extension (CSE) is the correct Azure feature because it allows you to run PowerShell or Bash scripts on a VM after deployment without manual sign-in. By specifying the script in the VM's deployment template or via Azure CLI/Portal, IIS can be installed and the configuration script executed automatically during provisioning. This aligns with the requirement for zero-touch post-deployment automation.

Answer

Azure Policy with a modify effect.

Answer

An availability set.

Answer

A private endpoint.

Question 7

A finance team stores monthly reports in Azure Blob Storage. The data must remain available if one datacenter in the Azure region fails, but the company does not need read access from a secondary region. Which redundancy option should the administrator choose?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones within a single region, ensuring durability even if one datacenter (zone) fails. Since the requirement specifies no need for read access from a secondary region, ZRS meets the high-availability need without the cost or complexity of geo-replication.

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 8

A team standardizes 30 Windows VMs for a line-of-business application. They install IIS, a monitoring agent, and baseline security settings on one reference VM. Future deployments must use that same build and be easy to version. Which Azure feature should the administrator create?

Accepted Answer

An image version in Azure Compute Gallery. B is correct because an image version in Azure Compute Gallery (formerly Shared Image Gallery) captures the entire VM configuration—including IIS, monitoring agent, and security settings—into a reusable, versioned image. This allows the team to deploy standardized VMs from the same build and easily manage updates by creating new image versions, meeting the requirements for consistency and versioning.

Answer

A snapshot of the reference VM's OS disk

Answer

An availability set for the reference VM

Answer

A custom script extension on each new VM

Question 9

A team needs one Azure Files share that can be mounted by both Windows and Linux VMs. The VMs are joined to the same on-premises Active Directory Domain Services domain, and the security team forbids storage account keys. The team also wants to manage access with existing AD group memberships. What should the administrator configure?

Accepted Answer

Use Azure Files over SMB and enable AD DS authentication. Azure Files supports SMB protocol, which can be mounted by both Windows and Linux VMs. By enabling AD DS authentication, the administrator can use existing on-premises Active Directory group memberships to control access to the file share without requiring storage account keys, satisfying the security team's requirement.

Answer

Use a blob container and mount it through the Blob API

Answer

Use anonymous access on an Azure File share

Answer

Use a premium NFS file share with a shared access signature

Question 10

Based on the exhibit, a support lead must manage role assignments for RG-Apps so the team can grant or revoke access for others. The support lead must not be able to change resource configurations. Which role should you assign?

Accepted Answer

User Access Administrator at RG-Apps. The User Access Administrator role at the RG-Apps scope allows the support lead to manage role assignments (grant or revoke access) for others without having permissions to modify resource configurations. This role is specifically designed for delegating access management while preventing changes to the resources themselves, which aligns with the requirement.

Answer

Owner at RG-Apps

Answer

Contributor at RG-Apps

Answer

Reader at RG-Apps

Question 11

A company runs two identical Linux VMs for a stateless web app in an Azure region that supports availability zones. The business requires protection from a full datacenter outage, not just planned host maintenance. Which deployment choice best meets this requirement?

Accepted Answer

Deploy the VMs across availability zones.. Deploying the two VMs across different availability zones ensures that each VM resides in a physically separate datacenter within the region. This architecture protects against a full datacenter outage, as an availability zone failure affects only one zone, leaving the other VM operational. Availability zones provide a 99.99% SLA for VMs when two or more instances are deployed across zones, which aligns with the requirement for protection beyond planned host maintenance.

Answer

Place both VMs in an availability set.

Answer

Use a proximity placement group for both VMs.

Answer

Deploy both VMs in a single-zone virtual machine scale set.

Question 12

A VM-based app must upload invoices to a blob container every hour. Security prohibits storing account keys or SAS tokens on the VM. The app should authenticate with Microsoft Entra ID and be allowed only to write blobs in one container. What should you configure?

Accepted Answer

Enable a managed identity on the VM and assign Storage Blob Data Contributor at the container scope.. Enabling a managed identity on the VM allows the app to authenticate with Microsoft Entra ID without storing any secrets. Assigning the Storage Blob Data Contributor role at the container scope grants the VM’s managed identity the minimum required permission to write blobs only to that specific container, adhering to the principle of least privilege.

Answer

Create an account SAS token and store it in the VM's application settings.

Answer

Assign Reader on the storage account so the VM can reach the container securely.

Answer

Grant Storage Account Contributor at the subscription scope so the app can manage all storage resources.

Question 13

Based on the exhibit, which identity type should be used so the on-premises build server can authenticate to Azure without using a human account password?

Accepted Answer

Service principal. A service principal is the correct identity type for an on-premises build server to authenticate to Azure without a human account password because it represents a non-human identity that can be assigned to applications, services, and automation tools. Service principals authenticate using client secrets or certificates, enabling secure, password-less authentication via OAuth 2.0 client credentials grant flow, which is ideal for automated build pipelines.

Answer

System-assigned managed identity

Answer

User-assigned managed identity

Answer

Azure Storage access key

Question 14

Based on the exhibit, what should the administrator configure to meet the storage access requirement?

Accepted Answer

Enable the Microsoft.Storage service endpoint on AppSubnet and allow that subnet on the storage account.. Enabling the Microsoft.Storage service endpoint on AppSubnet allows traffic from that subnet to be routed directly to the storage account over the Azure backbone network, bypassing the internet. By then configuring the storage account firewall to allow access only from that subnet, the administrator ensures that only resources within AppSubnet can access the storage account, meeting the requirement for restricted access.

Answer

Create a private endpoint and disable all public network access.

Answer

Create a VPN gateway between the subnet and the storage account.

Answer

Attach a NAT gateway to the subnet and add a route table entry.

Question 15

After applying a custom image, a VM boots to a black screen with a blinking cursor. The OS never reaches the login prompt. The administrator needs the fastest way to inspect the boot process and view serial console output. What should be enabled or checked?

Accepted Answer

Boot diagnostics. Boot diagnostics captures serial console output and screenshots of the VM during boot. When a VM boots to a black screen with a blinking cursor, the serial console log provides the exact kernel or bootloader messages (e.g., GRUB, initramfs errors) without requiring OS-level access. This is the fastest way to inspect the boot process because it works even when the OS is unresponsive.

Answer

Azure Monitor metrics for the VM

Answer

Network watcher packet capture

Answer

Azure Advisor recommendations