AZ-104 Practice Test 19 — 15 Questions

Question 1

A company runs two identical Linux VMs for a stateless web app in an Azure region that supports availability zones. The business requires protection from a full datacenter outage, not just planned host maintenance. Which deployment choice best meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy the VMs across availability zones.. Deploying the two VMs across different availability zones ensures that each VM resides in a physically separate datacenter within the region. This architecture protects against a full datacenter outage, as an availability zone failure affects only one zone, leaving the other VM operational. Availability zones provide a 99.99% SLA for VMs when two or more instances are deployed across zones, which aligns with the requirement for protection beyond planned host maintenance.

Answer

Place both VMs in an availability set.

Answer

Use a proximity placement group for both VMs.

Answer

Deploy both VMs in a single-zone virtual machine scale set.

Question 2

A VM-based app must upload invoices to a blob container every hour. Security prohibits storing account keys or SAS tokens on the VM. The app should authenticate with Microsoft Entra ID and be allowed only to write blobs in one container. What should you configure?

Accepted Answer

Enable a managed identity on the VM and assign Storage Blob Data Contributor at the container scope.. Enabling a managed identity on the VM allows the app to authenticate with Microsoft Entra ID without storing any secrets. Assigning the Storage Blob Data Contributor role at the container scope grants the VM’s managed identity the minimum required permission to write blobs only to that specific container, adhering to the principle of least privilege.

Answer

Create an account SAS token and store it in the VM's application settings.

Answer

Assign Reader on the storage account so the VM can reach the container securely.

Answer

Grant Storage Account Contributor at the subscription scope so the app can manage all storage resources.

Question 3

Based on the exhibit, what should the administrator configure to meet the storage access requirement?

Accepted Answer

Enable the Microsoft.Storage service endpoint on AppSubnet and allow that subnet on the storage account.. Enabling the Microsoft.Storage service endpoint on AppSubnet allows traffic from that subnet to be routed directly to the storage account over the Azure backbone network, bypassing the internet. By then configuring the storage account firewall to allow access only from that subnet, the administrator ensures that only resources within AppSubnet can access the storage account, meeting the requirement for restricted access.

Answer

Create a private endpoint and disable all public network access.

Answer

Create a VPN gateway between the subnet and the storage account.

Answer

Attach a NAT gateway to the subnet and add a route table entry.

Question 4

After applying a custom image, a VM boots to a black screen with a blinking cursor. The OS never reaches the login prompt. The administrator needs the fastest way to inspect the boot process and view serial console output. What should be enabled or checked?

Accepted Answer

Boot diagnostics. Boot diagnostics captures serial console output and screenshots of the VM during boot. When a VM boots to a black screen with a blinking cursor, the serial console log provides the exact kernel or bootloader messages (e.g., GRUB, initramfs errors) without requiring OS-level access. This is the fastest way to inspect the boot process because it works even when the OS is unresponsive.

Answer

Azure Monitor metrics for the VM

Answer

Network watcher packet capture

Answer

Azure Advisor recommendations

Question 5

Based on the exhibit, what configuration should the administrator change so VMs in the spoke can resolve internal names from the hub?

Accepted Answer

Set the spoke VNet custom DNS server to 10.50.0.4.. The hub VNet has a DNS server at 10.50.0.4 that is configured to resolve internal names. By setting the spoke VNet's custom DNS server to 10.50.0.4, VMs in the spoke will forward DNS queries to that server, enabling resolution of internal names from the hub. This overrides the default Azure-provided DNS and directs name resolution to the hub's DNS infrastructure.

Answer

Add a route table entry that points to the hub DNS server.

Answer

Enable a service endpoint for Microsoft.Storage on the spoke subnet.

Answer

Create a private endpoint for the spoke VM subnet.

Question 6

An administrator creates a new spoke virtual network with address space 10.100.1.0/24 and tries to peer it to an existing hub virtual network that already uses 10.100.0.0/16. The peering fails. The business wants private connectivity between the hub and spoke. What action should the administrator take first?

Accepted Answer

Change the spoke VNet to a non-overlapping address range before attempting peering again.. VNet peering requires that the address spaces of the peered virtual networks do not overlap. The hub already uses 10.100.0.0/16, which includes the spoke's 10.100.1.0/24 range, causing a conflict. Changing the spoke to a non-overlapping address range, such as 10.200.1.0/24, resolves this and allows the peering to succeed.

Answer

Add a route table to the spoke and point the default route to the hub.

Answer

Enable gateway transit on the hub and use the remote gateway from the spoke.

Answer

Deploy a private DNS zone and link it to both VNets.

Question 7

A build server in an on-premises datacenter must deploy ARM templates to Azure. The automation must not use a human account password, and Microsoft Entra conditional access for device sign-in is not available because the server is outside Azure. The security team allows a non-human credential but wants the strongest practical option for this scenario. What should the administrator configure?

Accepted Answer

A service principal authenticated with a certificate.. A service principal authenticated with a certificate provides a non-human credential that does not require a human password and is the strongest practical option for an on-premises build server that cannot use managed identities (which are Azure-resource-scoped) or device-based conditional access. Certificate-based authentication for service principals uses asymmetric cryptography (X.509 certificates) with a private key stored securely on the build server, offering higher security than a client secret and meeting the requirement to avoid human account passwords.

Answer

A system-assigned managed identity on the build server.

Answer

A user-assigned managed identity shared with the build server.

Answer

A resource lock on the target resource group to permit template deployment.

Question 8

Based on the exhibit, what should the administrator deploy to monitor CPU and free disk space on a small set of VMs while keeping telemetry cost low?

Accepted Answer

Deploy Azure Monitor Agent and collect only the required performance counters with a data collection rule.. Azure Monitor Agent (AMA) is the modern, cost-effective agent for collecting performance counters like CPU and free disk space from VMs. By using a Data Collection Rule (DCR) to specify only the required counters, the administrator minimizes data ingestion volume, directly controlling telemetry costs. This approach avoids the overhead of sending all guest logs or using more expensive monitoring tools.

Answer

Enable diagnostic settings on each VM and send all guest logs to a storage account.

Answer

Install Application Insights on each VM and enable request tracing.

Answer

Create a resource lock on each VM to preserve the current state.

Question 9

A VM-hosted application must read blobs from an Azure Storage account without storing any secret in code or configuration. Which identity should you enable on the VM?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity (B) is the correct choice because it allows the VM to authenticate to Azure Storage without storing any credentials in code or configuration. Azure automatically manages the identity's lifecycle and provides a token that the VM can use to access the storage account via Azure AD authentication, eliminating the need for secrets.

Answer

A storage account access key

Answer

A shared access signature (SAS) token

Answer

A local administrator account on the VM

Question 10

A developer deleted a single configuration file on a Windows Azure VM. The administrator wants to restore only that file from the latest backup without replacing the entire VM. Which restore workflow should be used?

Accepted Answer

Use file recovery from the backup item. Azure Backup provides file-level recovery for Azure VMs using the 'File Recovery' feature. This allows you to mount the recovery point as a drive on the VM (or another machine) and copy individual files without restoring the entire VM. It uses iSCSI to present the backup snapshot directly to the VM for granular file access.

Answer

Restore the entire VM to a new instance

Answer

Create a new storage account and copy the file from there

Answer

Enable a resource lock on the VM

Question 11

Based on the exhibit, a security team wants to search Key Vault audit events in Log Analytics for 30 days and create alerts when secrets are accessed unexpectedly. The current diagnostic configuration is not sending the right data. What should the administrator enable?

Accepted Answer

Enable AuditEvent and send the logs to a Log Analytics workspace.. The Key Vault diagnostic setting must include the AuditEvent category to capture all audit logs, including secret operations. Sending these logs to a Log Analytics workspace enables the security team to query them for 30 days and create alerts on unexpected secret access. Without AuditEvent enabled, no audit data is available for analysis.

Answer

Enable only AllMetrics and keep sending data to the storage account.

Answer

Create a private endpoint for the Key Vault.

Answer

Turn on a resource lock with the ReadOnly effect.

Question 12

Based on the exhibit, which feature should you enable so the subnet can access the storage account without creating a private IP address in the VNet?

Accepted Answer

Service endpoint. Service endpoints allow a subnet to securely and privately connect to Azure PaaS services (like Storage Accounts) over the Azure backbone network without requiring a private IP address in the VNet. They extend the VNet identity to the service, enabling access via the service's public endpoint while restricting traffic to the subnet. This matches the requirement exactly: no private IP is created in the VNet, and the storage account is accessed directly.

Answer

Private endpoint

Answer

VPN Gateway

Answer

Azure Firewall

Question 13

Match each NSG or ASG scenario to the most accurate Azure security behavior.

Accepted Answer

NSG applied to subnet: Traffic filtering is applied to all network interfaces in that subnet.. NSGs filter traffic at subnet or NIC level, while ASGs group VMs for scalable rule application. Service tags simplify rules for Azure services.

Answer

Service tag in NSG: Allows traffic only to specific IP ranges defined by user.

Answer

ASG automatically updates NSG rules: ASGs integrate with NSGs but do not auto-update rules; rules must reference the ASG.

Question 14

Match each storage or PaaS access requirement to the correct Azure networking approach or DNS action.

Accepted Answer

Azure VPN Gateway: Connect on-premises network to Azure storage account over the internet using an encrypted tunnel. VPN and ExpressRoute provide private connectivity, Private Link ensures private IP access, and DNS CNAME records map custom domains to Azure endpoints.

Answer

Azure VPN Gateway: Connect on-premises network to Azure storage account with a dedicated private connection that does not traverse the internet

Answer

Azure Private Link: Map a custom domain name to an Azure App Service endpoint

Question 15

A subnet is connected to a NAT gateway, but outbound connections to a public software update site are still leaving through a network virtual appliance. The route table contains a 0.0.0.0/0 user-defined route to the appliance, and the business wants the NAT gateway to handle internet traffic while preserving private routes to the appliance. What is the best fix?

Accepted Answer

Remove the default UDR to the appliance and leave only the private-prefix routes in place.. The 0.0.0.0/0 user-defined route (UDR) to the network virtual appliance (NVA) has a higher priority than the NAT gateway's default route, so all internet-bound traffic is forced through the appliance. Removing that UDR while keeping private-prefix routes (e.g., 10.0.0.0/8) ensures that only private traffic uses the appliance, and internet traffic follows the NAT gateway's default route. This satisfies the business requirement of using the NAT gateway for internet traffic while preserving private routes through the NVA.

Answer

Increase the priority of the NSG rules on the subnet.

Answer

Associate the NAT gateway with the virtual network instead of the subnet.

Answer

Enable service endpoints on the subnet to bypass the appliance.