AZ-104 Practice Test 20 — 15 Questions

Question 1

A team wants to keep Azure platform logs for a storage account in a central location and analyze them with queries. The logs should be queryable together with other Azure resource logs. What destination should the administrator choose for the diagnostic setting?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the correct destination because it allows you to collect Azure platform logs (such as resource logs, activity logs, and metrics) from multiple resources into a central location. These logs can then be queried together using Kusto Query Language (KQL) across different resource types, enabling cross-resource analysis and correlation. This meets the requirement for queryable logs alongside other Azure resource logs.

Answer

A storage account only

Answer

An action group

Answer

A management group

Question 2

A three-tier application uses separate web and app VMs. The requirement is to allow only the web tier to reach the app tier on TCP 8080. The app subnet NSG already contains a DenyAllInbound rule at priority 200. What should the administrator do?

Accepted Answer

Create an inbound allow rule for the web ASG to the app ASG on TCP 8080 with priority 150.. The existing DenyAllInbound rule at priority 200 will block all traffic to the app subnet unless a higher-priority (lower number) allow rule is created. By creating an inbound allow rule for the web Application Security Group (ASG) to the app ASG on TCP 8080 with priority 150, the administrator ensures that traffic from the web tier is explicitly permitted before the deny rule is evaluated, satisfying the requirement.

Answer

Move the DenyAllInbound rule to priority 300 so all traffic is blocked first.

Answer

Add a user-defined route from the web subnet to the app subnet.

Answer

Associate the web and app NICs with the same application security group.

Question 3

A production resource group must not be deleted accidentally, but administrators still need to update resources inside it. Which lock should you apply to the resource group?

Accepted Answer

CanNotDelete lock. The CanNotDelete lock (option B) is correct because it prevents deletion of the resource group while still allowing all other operations, including updates to resources within it. This lock type is specifically designed to protect against accidental deletion without blocking read, write, or modify actions, which aligns perfectly with the requirement that administrators need to update resources inside the group.

Answer

ReadOnly lock

Answer

Contributor role

Answer

Azure Policy deny assignment

Question 4

Quarterly invoices were moved to the Archive tier by a lifecycle rule. An auditor now needs one specific blob available for download within the next hour. What should the administrator do?

Accepted Answer

Start a high-priority rehydration of the blob to the Hot tier, then wait for completion before downloading.. Blobs in the Archive tier are offline and must be rehydrated to an online tier (Hot or Cool) before they can be accessed. A high-priority rehydration completes within one hour, meeting the auditor's deadline. Changing a lifecycle rule (A) or directly setting the tier (B) does not initiate the necessary rehydration process, and copying an archived blob (D) fails because the blob is offline.

Answer

Change the lifecycle rule so the blob will automatically move back to Hot on the next run.

Answer

Set the blob directly to the Hot tier and download it immediately.

Answer

Copy the archived blob to another container by using the portal copy command.

Question 5

A subnet has a NAT gateway attached, but outbound internet traffic from the VMs is still leaving through a network virtual appliance. The subnet's route table includes a user-defined route for 0.0.0.0/0 with the next hop set to Virtual appliance. The business wants internet traffic to use the NAT gateway while keeping any required specific routes to on-premises networks. What should the administrator do?

Accepted Answer

Remove the 0.0.0.0/0 user-defined route and keep only specific routes for private prefixes.. The user-defined route (UDR) for 0.0.0.0/0 with next hop Virtual appliance is overriding the NAT gateway's default route. NAT gateways require a default route (0.0.0.0/0) with next hop 'Internet' to direct outbound traffic through them. By removing the conflicting UDR and keeping only specific routes for on-premises prefixes, the subnet will use the NAT gateway for internet traffic while maintaining connectivity to on-premises networks via the remaining UDRs.

Answer

Keep the default route and add a second NAT gateway to the subnet.

Answer

Disable network security groups on the subnet so the NAT gateway becomes active.

Answer

Set gateway route propagation to Disabled so the NAT gateway is preferred.

Question 6

A contractor needs read-only access to resources in one application resource group. The access must be removed immediately when the contractor is removed from the contractor team. What is the best access strategy?

Accepted Answer

Assign Reader to the Entra ID contractor group at the resource group scope.. Assigning the Reader role to the Entra ID contractor group at the resource group scope ensures that all members of the group inherit read-only access to resources within that specific resource group. When a contractor is removed from the Entra ID group, their access is immediately revoked because Azure RBAC evaluates group membership dynamically at authentication time. This approach follows the principle of least privilege and enables centralized access management via group-based assignments.

Answer

Assign Reader directly to the contractor's user account at the subscription scope.

Answer

Assign Contributor to the contractor group at the resource group scope.

Answer

Assign Reader to the contractor group at the management group scope.

Question 7

Based on the exhibit, where should the Reader role be assigned so the audit team automatically has access to every current and future subscription under Corp?

Accepted Answer

Assign Reader at the Corp management group scope.. Assigning the Reader role at the Corp management group scope uses Azure RBAC inheritance to grant the audit team read-only access to all current and future subscriptions under that management group. Because management group scope propagates role assignments to all child subscriptions and resource groups, this ensures automatic coverage without manual updates.

Answer

Assign Reader at the subscription scope for Sub-001.

Answer

Assign Reader at the resource group scope in each subscription.

Answer

Assign Reader directly to each resource that the audit team might review.

Question 8

A public web application runs on two identical VMs behind a load balancer. The region supports availability zones. The business wants the app to keep serving traffic if one datacenter in the region becomes unavailable. What should the administrator use?

Accepted Answer

Availability zones for the two VMs. Deploying the two VMs in different availability zones within the same region protects against a single datacenter failure. Each availability zone is a physically separate datacenter with independent power, cooling, and networking. If one zone goes down, the load balancer automatically routes traffic to the VM in the other zone, ensuring the application continues serving traffic.

Answer

An availability set with two VMs

Answer

A single virtual machine scale set instance

Answer

A proximity placement group

Question 9

Based on the exhibit, the security team wants AppSubnet to access an Azure Storage account through the public endpoint, but only that subnet should be allowed. They do not want a private IP or DNS changes. What should the administrator configure?

Accepted Answer

Enable the Microsoft.Storage service endpoint on AppSubnet and add AppSubnet as a network rule on the storage account.. Enabling the Microsoft.Storage service endpoint on AppSubnet allows traffic from that subnet to reach the storage account over the Azure backbone network using the public endpoint, without requiring a private IP or DNS changes. Adding AppSubnet as a network rule on the storage account restricts access exclusively to that subnet, fulfilling the security team's requirement.

Answer

Create a private endpoint for the storage account and disable public access.

Answer

Attach a route table that sends storage traffic to the internet.

Answer

Grant the subnet a Reader role assignment on the storage account.

Question 10

A company stores customer documents in Azure Blob Storage. The business requires the data to stay available if one availability zone in the region has an outage. Which redundancy option should the administrator choose?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones within a primary region, ensuring data remains accessible if one zone fails. This meets the requirement for intra-region zone-level fault tolerance without the cost or complexity of geo-replication.

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 11

A branch office uses an on-premises firewall that supports IPsec/IKE and has a stable public IP. The office needs always-on private connectivity to an Azure VNet over the internet. Which Azure component should the administrator deploy?

Accepted Answer

A site-to-site connection using Azure VPN Gateway.. A site-to-site VPN connection using Azure VPN Gateway is the correct choice because it provides always-on, encrypted connectivity over the internet between an on-premises network with a stable public IP and an Azure VNet. Azure VPN Gateway supports IPsec/IKE protocols, which are compatible with the branch office's firewall, enabling a secure tunnel that meets the requirement for private connectivity.

Answer

VNet peering between the branch office and the Azure VNet.

Answer

Azure Bastion in the target VNet.

Answer

A private endpoint for the Azure VNet.

Question 12

Based on the exhibit, what should the administrator do next so the VM can use the extra capacity on the resized data disk?

Accepted Answer

Extend the partition or file system inside the VM.. After resizing a managed disk in Azure, the additional capacity is allocated at the Azure platform level but is not automatically available to the operating system. The administrator must extend the partition or file system inside the VM using tools like Diskpart (Windows) or fdisk/resize2fs (Linux) to make the new space usable. This is a standard post-resize step because the OS still sees the original partition boundaries.

Answer

Resize the managed disk again in Azure.

Answer

Detach the disk and attach it to another VM.

Answer

Create a new virtual machine from the disk.

Question 13

Backup protection was enabled on a new Azure VM, but every backup job fails immediately with a message indicating the guest agent is not ready. What should the administrator verify first?

Accepted Answer

That the Azure VM agent is installed, running, and up to date inside the guest operating system.. The Azure Backup extension requires the Azure VM agent to be installed, running, and up to date inside the guest OS to coordinate backup operations. When the agent is not ready, the backup job fails immediately because the extension cannot communicate with the VM to take snapshots. Verifying the agent's status is the first troubleshooting step before investigating network or configuration issues.

Answer

That the recovery vault uses GZRS storage redundancy.

Answer

That the VM has a private endpoint to the Recovery Services vault.

Answer

That a resource lock has not been applied to the VM.

Question 14

Several Azure Monitor alerts across different subscriptions must notify the same on-call group by email, SMS, and webhook whenever they fire. The operations team wants to define the notification target once and reuse it from future metric alerts, log alerts, and activity log alerts. What should be created?

Accepted Answer

An action group that can be attached to multiple Azure Monitor alert rules.. An action group in Azure Monitor is the correct solution because it defines a reusable collection of notification channels (email, SMS, webhook) that can be attached to multiple alert rules across different subscriptions. This allows the operations team to define the on-call group notification target once and reuse it for metric alerts, log alerts, and activity log alerts, ensuring consistent notification behavior.

Answer

A metric alert with the same threshold applied to every resource that needs notification.

Answer

A diagnostic setting on each resource so the contact list is stored with the logs.

Answer

A Log Analytics workbook used as the shared notification destination.

Question 15

A Windows VM in Azure is protected by Azure Backup. A developer accidentally deleted one application folder, but the VM must keep serving users while the administrator restores only that folder. What should the administrator do?

Accepted Answer

Use File Recovery from the appropriate recovery point and copy the folder back.. Azure Backup's File Recovery feature allows you to mount a recovery point as a drive on the running VM, enabling you to copy specific files or folders without restoring the entire VM or disrupting production. This is the only method that meets the requirement of restoring only the deleted folder while the VM continues serving users.

Answer

Restore the entire VM from the latest recovery point into the production resource group.

Answer

Restore the managed disk and attach it to the running VM as a second OS disk.

Answer

Create a new Recovery Services vault and re-protect the VM before restoring anything.