AZ-104 Practice Test 19 — 15 Questions

Question 1

A finance team stores application blobs in an Azure Storage account. The data must remain available if a single availability zone in the region is lost, and the team does not need automatic read access from another region. Which redundancy option best meets the requirement?

Accepted Answer

Zone-redundant storage (ZRS), which replicates data across availability zones in the same region.. Zone-redundant storage (ZRS) replicates your data synchronously across three Azure availability zones within the primary region. This ensures that if a single zone fails, the data remains available and durable without requiring any manual intervention or failover, meeting the requirement of no automatic read access from another region.

Answer

Locally redundant storage (LRS), which keeps three copies in one datacenter only.

Answer

Geo-redundant storage (GRS), which replicates data to a paired region and supports failover.

Answer

Read-access geo-redundant storage (RA-GRS), which allows reads from the secondary region.

Question 2

Based on the exhibit, what should the administrator configure so the alert sends email and SMS when CPU stays above the threshold?

Accepted Answer

Associate an Azure Monitor action group with the alert rule.. An Azure Monitor action group defines the notification channels (e.g., email, SMS) and actions to trigger when an alert fires. Associating an action group with the alert rule enables the administrator to send both email and SMS when the CPU threshold is breached. Without an action group, the alert rule can only log the condition but cannot deliver notifications.

Answer

Create a diagnostic setting on the virtual machine and send metrics to a Log Analytics workspace.

Answer

Enable boot diagnostics on the virtual machine so the CPU threshold can be reported.

Answer

Apply a resource lock to the virtual machine to prevent the CPU from increasing further.

Question 3

A compliance team wants to identify all resources in a department that are missing an Environment tag, but they do not want to stop users from creating or changing resources. Which two choices should the administrator make? Select two.

Accepted Answer

Use an Azure Policy assignment with the Audit effect.. Option A is correct because the Audit effect in Azure Policy allows the compliance team to identify resources missing an Environment tag without blocking resource creation or modification. This effect logs non-compliant resources to the activity log, enabling visibility without enforcement. Option B is correct because assigning the policy at the management group scope ensures it applies to all subscriptions within that department, covering all resources under a single governance boundary.

Answer

Use the Deny effect.

Answer

Grant Reader on the subscription to the compliance team.

Answer

Apply a ReadOnly lock to all resource groups.

Question 4

You need to let a junior administrator manage virtual machines only in the RG-Dev resource group. The administrator must not be able to change role assignments or manage other resource groups. Which role assignment should you use?

Accepted Answer

Virtual Machine Contributor at the RG-Dev scope. The Virtual Machine Contributor role at the RG-Dev scope grants the junior administrator full permissions to manage virtual machines (including start, stop, restart, delete, and modify VM configurations) but explicitly denies the ability to manage role assignments (RBAC) or access to other resource groups. This aligns with the principle of least privilege, ensuring the administrator can perform their required tasks without exceeding their authority.

Answer

Owner at the RG-Dev scope

Answer

Reader at the subscription scope

Answer

Contributor at the subscription scope

Question 5

A reporting application must run on an Azure VM with at least 8 vCPUs and 64 GiB of RAM. The team also wants headroom for short spikes without falling below the requirement. Which two VM sizes meet or exceed the requirement? Select two.

Accepted Answer

Standard_E8s_v5. Standard_E8s_v5 is correct because it provides 8 vCPUs and 64 GiB of RAM, meeting the minimum requirement exactly. The E-series is memory-optimized, offering a high memory-to-core ratio suitable for reporting workloads, and the v5 generation includes Intel Xeon Platinum 8370C processors with support for premium storage and accelerated networking, ensuring headroom for short spikes without dropping below the requirement.

Answer

Standard_D8s_v5

Answer

Standard_F8s_v2

Answer

Standard_B8ms

Question 6

A network team wants reliable time, name resolution, centralized logs, and visibility into traffic patterns. Which two services directly match those goals?

Accepted Answer

NTP. NTP (Network Time Protocol) is correct because it provides reliable time synchronization across network devices, which is essential for accurate log timestamps and security protocols. This directly matches the goal of reliable time.

Answer

Syslog

Answer

DHCP

Question 7

Your company wants every subscription under the Corp-MG management group to block the creation of resource groups unless the deployment includes the tags CostCenter and Environment. You need a centralized solution that is inherited by child subscriptions. What should you configure?

Accepted Answer

An Azure Policy assignment at the management group scope. Azure Policy at the management group scope is the correct centralized solution because it enforces a policy (e.g., requiring tags) that is inherited by all child subscriptions and resource groups. This ensures that any deployment without the required tags is denied, meeting the requirement for a governance rule that applies across the entire Corp-MG hierarchy.

Answer

A custom RBAC role at the tenant root

Answer

A CanNotDelete lock on each subscription

Answer

A subscription budget alert

Question 8

A contractor needs temporary access to upload and download files in only one blob container for 8 hours. You do not want to share the storage account key, and you want to revoke access later without affecting other containers. What should you create?

Accepted Answer

A container-level SAS token backed by a stored access policy, so you can limit and revoke access.. A container-level SAS token backed by a stored access policy is the correct solution because it allows you to grant temporary, scoped access to a single blob container without exposing the storage account key. The stored access policy enables you to revoke the SAS token at any time by modifying or deleting the policy, which immediately invalidates all tokens associated with it, without affecting other containers.

Answer

A storage account access key, because it can be limited to one container by policy.

Answer

Anonymous public access on the container, because it is the easiest way to time-limit access.

Answer

Azure RBAC on the storage account only, because RBAC automatically expires after a few hours.

Question 9

A service desk must grant and revoke access to an internal application for a changing group of employees. The service desk must not receive any Azure subscription or resource permissions. Which two actions should you take? Select two.

Accepted Answer

Use a Microsoft Entra security group to represent application access.. Using a Microsoft Entra security group creates a stable access boundary for the application, and making the service desk an owner lets them add or remove members without touching Azure RBAC. That is the least-privilege way to delegate access administration. It keeps resource permissions out of the model, avoids tenant-wide admin roles, and supports frequent employee changes cleanly through group membership updates.

Why others are wrong: Contributor on a resource group gives Azure resource control, not just membership administration. User Administrator is a directory-wide role and is too broad for one application group. Individual user assignments defeat the goal of delegated membership management and create ongoing maintenance. The correct pattern is group-based access with delegated ownership.

Answer

Assign the service desk the Contributor role on the application resource group.

Answer

Assign the service desk the User Administrator directory role to manage the application users.

Answer

Create individual user assignments for every employee instead of using group-based access.

Question 10

A shared resource group contains a VPN gateway and several virtual machines used by the finance department. Administrators must still be able to resize the VMs and update NSG rules, but no one should be able to delete the resource group or anything in it during the quarter-end freeze. Which lock should be applied?

Accepted Answer

CanNotDelete lock on the resource group. The CanNotDelete lock (option B) prevents deletion of the resource group and all resources within it, while still allowing read and update operations such as resizing VMs and modifying NSG rules. This meets the requirement to block deletions during the quarter-end freeze without hindering administrative changes. ReadOnly locks would block all write operations, including resizing and NSG rule updates, which is not desired.

Answer

ReadOnly lock on the resource group

Answer

Management group lock on the subscription

Answer

Azure Policy deny effect on the resource group

Question 11

A storage account's platform logs must be searchable later with KQL in a central workspace. Which two actions should the administrator take? Select two.

Accepted Answer

Create a diagnostic setting on the storage account. Option A is correct because a diagnostic setting on the storage account is required to route platform logs (e.g., storage read/write/delete operations) to a destination. Option C is correct because a Log Analytics workspace is the destination that enables KQL-based searching and analysis of those logs. Without both, the logs cannot be stored in a central, queryable repository.

Answer

Configure a NAT gateway on the storage subnet

Answer

Assign the Reader role on the subscription

Answer

Enable a VM backup policy

Question 12

An administrator has already increased the size of a managed data disk attached to a running Windows VM. Azure now shows the larger disk size, but the application still cannot use the new capacity. What should the administrator do next?

Accepted Answer

Expand the partition or volume inside the guest operating system.. When a managed data disk attached to a running Windows VM is resized in Azure, the underlying virtual hard disk (VHD) expands, but the guest operating system does not automatically recognize the new unallocated space. The administrator must use the Disk Management tool (diskmgmt.msc) or the diskpart command to extend the volume or partition into the unallocated space. This is a standard operating system task, not an Azure control-plane action.

Answer

Detach the disk, shrink it, and reattach it to refresh the filesystem.

Answer

Convert the data disk to a shared disk so Windows can auto-detect the size increase.

Answer

Redeploy the virtual machine to apply the new disk size.

Question 13

Arrange the steps to create a virtual network in Azure with a subnet and deploy a VM.

Question 14

Order the steps to configure Azure AD Connect for hybrid identity.

Question 15

Arrange the steps to assign a custom RBAC role to a user in Azure.