AZ-104 Practice Test 20 — 15 Questions

Question 1

A subnet has a NAT gateway attached, but outbound internet traffic from the VMs is still leaving through a network virtual appliance. The subnet's route table includes a user-defined route for 0.0.0.0/0 with the next hop set to Virtual appliance. The business wants internet traffic to use the NAT gateway while keeping any required specific routes to on-premises networks. What should the administrator do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remove the 0.0.0.0/0 user-defined route and keep only specific routes for private prefixes.. The user-defined route (UDR) for 0.0.0.0/0 with next hop Virtual appliance is overriding the NAT gateway's default route. NAT gateways require a default route (0.0.0.0/0) with next hop 'Internet' to direct outbound traffic through them. By removing the conflicting UDR and keeping only specific routes for on-premises prefixes, the subnet will use the NAT gateway for internet traffic while maintaining connectivity to on-premises networks via the remaining UDRs.

Answer

Keep the default route and add a second NAT gateway to the subnet.

Answer

Disable network security groups on the subnet so the NAT gateway becomes active.

Answer

Set gateway route propagation to Disabled so the NAT gateway is preferred.

Question 2

A contractor needs read-only access to resources in one application resource group. The access must be removed immediately when the contractor is removed from the contractor team. What is the best access strategy?

Accepted Answer

Assign Reader to the Entra ID contractor group at the resource group scope.. Assigning the Reader role to the Entra ID contractor group at the resource group scope ensures that all members of the group inherit read-only access to resources within that specific resource group. When a contractor is removed from the Entra ID group, their access is immediately revoked because Azure RBAC evaluates group membership dynamically at authentication time. This approach follows the principle of least privilege and enables centralized access management via group-based assignments.

Answer

Assign Reader directly to the contractor's user account at the subscription scope.

Answer

Assign Contributor to the contractor group at the resource group scope.

Answer

Assign Reader to the contractor group at the management group scope.

Question 3

Based on the exhibit, where should the Reader role be assigned so the audit team automatically has access to every current and future subscription under Corp?

Accepted Answer

Assign Reader at the Corp management group scope.. Assigning the Reader role at the Corp management group scope uses Azure RBAC inheritance to grant the audit team read-only access to all current and future subscriptions under that management group. Because management group scope propagates role assignments to all child subscriptions and resource groups, this ensures automatic coverage without manual updates.

Answer

Assign Reader at the subscription scope for Sub-001.

Answer

Assign Reader at the resource group scope in each subscription.

Answer

Assign Reader directly to each resource that the audit team might review.

Question 4

A public web application runs on two identical VMs behind a load balancer. The region supports availability zones. The business wants the app to keep serving traffic if one datacenter in the region becomes unavailable. What should the administrator use?

Accepted Answer

Availability zones for the two VMs. Deploying the two VMs in different availability zones within the same region protects against a single datacenter failure. Each availability zone is a physically separate datacenter with independent power, cooling, and networking. If one zone goes down, the load balancer automatically routes traffic to the VM in the other zone, ensuring the application continues serving traffic.

Answer

An availability set with two VMs

Answer

A single virtual machine scale set instance

Answer

A proximity placement group

Question 5

Based on the exhibit, the security team wants AppSubnet to access an Azure Storage account through the public endpoint, but only that subnet should be allowed. They do not want a private IP or DNS changes. What should the administrator configure?

Accepted Answer

Enable the Microsoft.Storage service endpoint on AppSubnet and add AppSubnet as a network rule on the storage account.. Enabling the Microsoft.Storage service endpoint on AppSubnet allows traffic from that subnet to reach the storage account over the Azure backbone network using the public endpoint, without requiring a private IP or DNS changes. Adding AppSubnet as a network rule on the storage account restricts access exclusively to that subnet, fulfilling the security team's requirement.

Answer

Create a private endpoint for the storage account and disable public access.

Answer

Attach a route table that sends storage traffic to the internet.

Answer

Grant the subnet a Reader role assignment on the storage account.

Question 6

A company stores customer documents in Azure Blob Storage. The business requires the data to stay available if one availability zone in the region has an outage. Which redundancy option should the administrator choose?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones within a primary region, ensuring data remains accessible if one zone fails. This meets the requirement for intra-region zone-level fault tolerance without the cost or complexity of geo-replication.

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 7

A branch office uses an on-premises firewall that supports IPsec/IKE and has a stable public IP. The office needs always-on private connectivity to an Azure VNet over the internet. Which Azure component should the administrator deploy?

Accepted Answer

A site-to-site connection using Azure VPN Gateway.. A site-to-site VPN connection using Azure VPN Gateway is the correct choice because it provides always-on, encrypted connectivity over the internet between an on-premises network with a stable public IP and an Azure VNet. Azure VPN Gateway supports IPsec/IKE protocols, which are compatible with the branch office's firewall, enabling a secure tunnel that meets the requirement for private connectivity.

Answer

VNet peering between the branch office and the Azure VNet.

Answer

Azure Bastion in the target VNet.

Answer

A private endpoint for the Azure VNet.

Question 8

Based on the exhibit, what should the administrator do next so the VM can use the extra capacity on the resized data disk?

Accepted Answer

Extend the partition or file system inside the VM.. After resizing a managed disk in Azure, the additional capacity is allocated at the Azure platform level but is not automatically available to the operating system. The administrator must extend the partition or file system inside the VM using tools like Diskpart (Windows) or fdisk/resize2fs (Linux) to make the new space usable. This is a standard post-resize step because the OS still sees the original partition boundaries.

Answer

Resize the managed disk again in Azure.

Answer

Detach the disk and attach it to another VM.

Answer

Create a new virtual machine from the disk.

Question 9

Backup protection was enabled on a new Azure VM, but every backup job fails immediately with a message indicating the guest agent is not ready. What should the administrator verify first?

Accepted Answer

That the Azure VM agent is installed, running, and up to date inside the guest operating system.. The Azure Backup extension requires the Azure VM agent to be installed, running, and up to date inside the guest OS to coordinate backup operations. When the agent is not ready, the backup job fails immediately because the extension cannot communicate with the VM to take snapshots. Verifying the agent's status is the first troubleshooting step before investigating network or configuration issues.

Answer

That the recovery vault uses GZRS storage redundancy.

Answer

That the VM has a private endpoint to the Recovery Services vault.

Answer

That a resource lock has not been applied to the VM.

Question 10

Several Azure Monitor alerts across different subscriptions must notify the same on-call group by email, SMS, and webhook whenever they fire. The operations team wants to define the notification target once and reuse it from future metric alerts, log alerts, and activity log alerts. What should be created?

Accepted Answer

An action group that can be attached to multiple Azure Monitor alert rules.. An action group in Azure Monitor is the correct solution because it defines a reusable collection of notification channels (email, SMS, webhook) that can be attached to multiple alert rules across different subscriptions. This allows the operations team to define the on-call group notification target once and reuse it for metric alerts, log alerts, and activity log alerts, ensuring consistent notification behavior.

Answer

A metric alert with the same threshold applied to every resource that needs notification.

Answer

A diagnostic setting on each resource so the contact list is stored with the logs.

Answer

A Log Analytics workbook used as the shared notification destination.

Question 11

A Windows VM in Azure is protected by Azure Backup. A developer accidentally deleted one application folder, but the VM must keep serving users while the administrator restores only that folder. What should the administrator do?

Accepted Answer

Use File Recovery from the appropriate recovery point and copy the folder back.. Azure Backup's File Recovery feature allows you to mount a recovery point as a drive on the running VM, enabling you to copy specific files or folders without restoring the entire VM or disrupting production. This is the only method that meets the requirement of restoring only the deleted folder while the VM continues serving users.

Answer

Restore the entire VM from the latest recovery point into the production resource group.

Answer

Restore the managed disk and attach it to the running VM as a second OS disk.

Answer

Create a new Recovery Services vault and re-protect the VM before restoring anything.

Question 12

An administrator added a user to an Entra security group that already has Contributor on a resource group. The role assignment is correct, but the user still gets 'You do not have access' in the Azure portal 5 minutes later. What is the most likely next step?

Accepted Answer

Have the user sign out and sign back in to refresh the access token.. When a user is added to a security group that already has a role assignment, the new permissions take effect immediately in Azure RBAC, but the user's existing access token (which is cached by the Azure portal) does not include the new group membership claims. The token must be refreshed by signing out and signing back in, or by closing and reopening the browser, to force a new token acquisition that includes the updated role assignments.

Answer

Change the role assignment from the group to the subscription.

Answer

Delete and recreate the resource group.

Answer

Assign Owner directly to the user.

Question 13

A team has an approved Windows VM that already includes patches, a monitoring agent, and line-of-business software. They want future VMs to start from that same build. What should they use?

Accepted Answer

A custom image. A custom image captures the exact state of a VM, including installed patches, monitoring agents, and line-of-business software, allowing you to create multiple identical VMs from that golden image. Unlike a snapshot, which is tied to a specific disk and requires manual steps to create a VM, a custom image is stored as a managed image resource that can be used directly during VM provisioning via the Azure portal, CLI, or ARM templates.

Answer

A snapshot of the OS disk

Answer

An availability set

Answer

A larger VM size

Question 14

A company is deploying two Linux application VMs in Azure for a production workload. The region supports availability zones, and the business requires the workload to stay online if an entire datacenter in the region becomes unavailable. Which deployment choice best meets this requirement?

Accepted Answer

Deploy the VMs across two availability zones in the same region.. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying the two Linux VMs across two different zones ensures that if an entire datacenter fails, the VM in the other zone remains online, meeting the requirement for resilience against a full datacenter outage.

Answer

Place both VMs in the same availability set so Azure separates them across update domains.

Answer

Use a single larger VM size with premium SSD storage for better uptime.

Answer

Deploy the VMs in the same resource group and enable auto-shutdown.

Question 15

A VM in a subnet has both a subnet-level NSG and a NIC-level NSG. The subnet NSG allows inbound TCP 22 from the VirtualNetwork service tag, but the NIC NSG denies inbound TCP 22 from the same source. An administrator says the subnet rule should be enough because it allows the traffic. What is the actual behavior?

Accepted Answer

The traffic is blocked because a deny in either NSG is effective.. When both a subnet-level NSG and a NIC-level NSG are applied to a virtual machine, network traffic is evaluated against both NSGs. The effective rule is the most restrictive: if either NSG contains a deny rule that matches the traffic, the traffic is blocked. In this scenario, the NIC-level NSG explicitly denies inbound TCP 22 from the VirtualNetwork service tag, so even though the subnet NSG allows it, the deny at the NIC level takes precedence and the traffic is blocked.

Answer

The allow rule wins because subnet NSGs always override NIC NSGs.

Answer

The traffic is allowed because service tags bypass NIC-level rules.

Answer

The connection succeeds unless a route table sends the traffic elsewhere.