AZ-104 Practice Test 19 — 15 Questions

Question 1

Based on the exhibit, what configuration should the administrator change so VMs in the spoke can resolve internal names from the hub?

Accepted Answer

Set the spoke VNet custom DNS server to 10.50.0.4.. The hub VNet has a DNS server at 10.50.0.4 that is configured to resolve internal names. By setting the spoke VNet's custom DNS server to 10.50.0.4, VMs in the spoke will forward DNS queries to that server, enabling resolution of internal names from the hub. This overrides the default Azure-provided DNS and directs name resolution to the hub's DNS infrastructure.

Answer

Add a route table entry that points to the hub DNS server.

Answer

Enable a service endpoint for Microsoft.Storage on the spoke subnet.

Answer

Create a private endpoint for the spoke VM subnet.

Question 2

An administrator creates a new spoke virtual network with address space 10.100.1.0/24 and tries to peer it to an existing hub virtual network that already uses 10.100.0.0/16. The peering fails. The business wants private connectivity between the hub and spoke. What action should the administrator take first?

Accepted Answer

Change the spoke VNet to a non-overlapping address range before attempting peering again.. VNet peering requires that the address spaces of the peered virtual networks do not overlap. The hub already uses 10.100.0.0/16, which includes the spoke's 10.100.1.0/24 range, causing a conflict. Changing the spoke to a non-overlapping address range, such as 10.200.1.0/24, resolves this and allows the peering to succeed.

Answer

Add a route table to the spoke and point the default route to the hub.

Answer

Enable gateway transit on the hub and use the remote gateway from the spoke.

Answer

Deploy a private DNS zone and link it to both VNets.

Question 3

A build server in an on-premises datacenter must deploy ARM templates to Azure. The automation must not use a human account password, and Microsoft Entra conditional access for device sign-in is not available because the server is outside Azure. The security team allows a non-human credential but wants the strongest practical option for this scenario. What should the administrator configure?

Accepted Answer

A service principal authenticated with a certificate.. A service principal authenticated with a certificate provides a non-human credential that does not require a human password and is the strongest practical option for an on-premises build server that cannot use managed identities (which are Azure-resource-scoped) or device-based conditional access. Certificate-based authentication for service principals uses asymmetric cryptography (X.509 certificates) with a private key stored securely on the build server, offering higher security than a client secret and meeting the requirement to avoid human account passwords.

Answer

A system-assigned managed identity on the build server.

Answer

A user-assigned managed identity shared with the build server.

Answer

A resource lock on the target resource group to permit template deployment.

Question 4

Based on the exhibit, what should the administrator deploy to monitor CPU and free disk space on a small set of VMs while keeping telemetry cost low?

Accepted Answer

Deploy Azure Monitor Agent and collect only the required performance counters with a data collection rule.. Azure Monitor Agent (AMA) is the modern, cost-effective agent for collecting performance counters like CPU and free disk space from VMs. By using a Data Collection Rule (DCR) to specify only the required counters, the administrator minimizes data ingestion volume, directly controlling telemetry costs. This approach avoids the overhead of sending all guest logs or using more expensive monitoring tools.

Answer

Enable diagnostic settings on each VM and send all guest logs to a storage account.

Answer

Install Application Insights on each VM and enable request tracing.

Answer

Create a resource lock on each VM to preserve the current state.

Question 5

A VM-hosted application must read blobs from an Azure Storage account without storing any secret in code or configuration. Which identity should you enable on the VM?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity (B) is the correct choice because it allows the VM to authenticate to Azure Storage without storing any credentials in code or configuration. Azure automatically manages the identity's lifecycle and provides a token that the VM can use to access the storage account via Microsoft Entra ID authentication, eliminating the need for secrets.

Answer

A storage account access key

Answer

A shared access signature (SAS) token

Answer

A local administrator account on the VM

Question 6

A developer deleted a single configuration file on a Windows Azure VM. The administrator wants to restore only that file from the latest backup without replacing the entire VM. Which restore workflow should be used?

Accepted Answer

Use file recovery from the backup item. Azure Backup provides file-level recovery for Azure VMs using the 'File Recovery' feature. This allows you to mount the recovery point as a drive on the VM (or another machine) and copy individual files without restoring the entire VM. It uses iSCSI to present the backup snapshot directly to the VM for granular file access.

Answer

Restore the entire VM to a new instance

Answer

Create a new storage account and copy the file from there

Answer

Enable a resource lock on the VM

Question 7

Based on the exhibit, a security team wants to search Key Vault audit events in Log Analytics for 30 days and create alerts when secrets are accessed unexpectedly. The current diagnostic configuration is not sending the right data. What should the administrator enable?

Accepted Answer

Enable AuditEvent and send the logs to a Log Analytics workspace.. The Key Vault diagnostic setting must include the AuditEvent category to capture all audit logs, including secret operations. Sending these logs to a Log Analytics workspace enables the security team to query them for 30 days and create alerts on unexpected secret access. Without AuditEvent enabled, no audit data is available for analysis.

Answer

Enable only AllMetrics and keep sending data to the storage account.

Answer

Create a private endpoint for the Key Vault.

Answer

Turn on a resource lock with the ReadOnly effect.

Question 8

Based on the exhibit, which feature should you enable so the subnet can access the storage account without creating a private IP address in the VNet?

Accepted Answer

Service endpoint. Service endpoints allow a subnet to securely and privately connect to Azure PaaS services (like Storage Accounts) over the Azure backbone network without requiring a private IP address in the VNet. They extend the VNet identity to the service, enabling access via the service's public endpoint while restricting traffic to the subnet. This matches the requirement exactly: no private IP is created in the VNet, and the storage account is accessed directly.

Answer

Private endpoint

Answer

VPN Gateway

Answer

Azure Firewall

Question 9

Match each NSG or ASG scenario to the most accurate Azure security behavior.

Accepted Answer

NSG applied to subnet: Traffic filtering is applied to all network interfaces in that subnet.. NSGs filter traffic at subnet or NIC level, while ASGs group VMs for scalable rule application. Service tags simplify rules for Azure services.

Answer

Service tag in NSG: Allows traffic only to specific IP ranges defined by user.

Answer

ASG automatically updates NSG rules: ASGs integrate with NSGs but do not auto-update rules; rules must reference the ASG.

Question 10

Match each storage or PaaS access requirement to the correct Azure networking approach or DNS action.

Accepted Answer

Azure VPN Gateway: Connect on-premises network to Azure storage account over the internet using an encrypted tunnel. VPN and ExpressRoute provide private connectivity, Private Link ensures private IP access, and DNS CNAME records map custom domains to Azure endpoints.

Answer

Azure VPN Gateway: Connect on-premises network to Azure storage account with a dedicated private connection that does not traverse the internet

Answer

Azure Private Link: Map a custom domain name to an Azure App Service endpoint

Question 11

A subnet is connected to a NAT gateway, but outbound connections to a public software update site are still leaving through a network virtual appliance. The route table contains a 0.0.0.0/0 user-defined route to the appliance, and the business wants the NAT gateway to handle internet traffic while preserving private routes to the appliance. What is the best fix?

Accepted Answer

Remove the default UDR to the appliance and leave only the private-prefix routes in place.. The 0.0.0.0/0 user-defined route (UDR) to the network virtual appliance (NVA) has a higher priority than the NAT gateway's default route, so all internet-bound traffic is forced through the appliance. Removing that UDR while keeping private-prefix routes (e.g., 10.0.0.0/8) ensures that only private traffic uses the appliance, and internet traffic follows the NAT gateway's default route. This satisfies the business requirement of using the NAT gateway for internet traffic while preserving private routes through the NVA.

Answer

Increase the priority of the NSG rules on the subnet.

Answer

Associate the NAT gateway with the virtual network instead of the subnet.

Answer

Enable service endpoints on the subnet to bypass the appliance.

Question 12

A team wants to keep Azure platform logs for a storage account in a central location and analyze them with queries. The logs should be queryable together with other Azure resource logs. What destination should the administrator choose for the diagnostic setting?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the correct destination because it allows you to collect Azure platform logs (such as resource logs, activity logs, and metrics) from multiple resources into a central location. These logs can then be queried together using Kusto Query Language (KQL) across different resource types, enabling cross-resource analysis and correlation. This meets the requirement for queryable logs alongside other Azure resource logs.

Answer

A storage account only

Answer

An action group

Answer

A management group

Question 13

A three-tier application uses separate web and app VMs. The requirement is to allow only the web tier to reach the app tier on TCP 8080. The app subnet NSG already contains a DenyAllInbound rule at priority 200. What should the administrator do?

Accepted Answer

Create an inbound allow rule for the web ASG to the app ASG on TCP 8080 with priority 150.. The existing DenyAllInbound rule at priority 200 will block all traffic to the app subnet unless a higher-priority (lower number) allow rule is created. By creating an inbound allow rule for the web Application Security Group (ASG) to the app ASG on TCP 8080 with priority 150, the administrator ensures that traffic from the web tier is explicitly permitted before the deny rule is evaluated, satisfying the requirement.

Answer

Move the DenyAllInbound rule to priority 300 so all traffic is blocked first.

Answer

Add a user-defined route from the web subnet to the app subnet.

Answer

Associate the web and app NICs with the same application security group.

Question 14

A production resource group must not be deleted accidentally, but administrators still need to update resources inside it. Which lock should you apply to the resource group?

Accepted Answer

CanNotDelete lock. The CanNotDelete lock (option B) is correct because it prevents deletion of the resource group while still allowing all other operations, including updates to resources within it. This lock type is specifically designed to protect against accidental deletion without blocking read, write, or modify actions, which aligns perfectly with the requirement that administrators need to update resources inside the group.

Answer

ReadOnly lock

Answer

Contributor role

Answer

Azure Policy deny assignment

Question 15

Quarterly invoices were moved to the Archive tier by a lifecycle rule. An auditor now needs one specific blob available for download within the next hour. What should the administrator do?

Accepted Answer

Start a high-priority rehydration of the blob to the Hot tier, then wait for completion before downloading.. Blobs in the Archive tier are offline and must be rehydrated to an online tier (Hot or Cool) before they can be accessed. A high-priority rehydration completes within one hour, meeting the auditor's deadline. Changing a lifecycle rule (A) or directly setting the tier (B) does not initiate the necessary rehydration process, and copying an archived blob (D) fails because the blob is offline.

Answer

Change the lifecycle rule so the blob will automatically move back to Hot on the next run.

Answer

Set the blob directly to the Hot tier and download it immediately.

Answer

Copy the archived blob to another container by using the portal copy command.