AZ-104 Practice Exam 2 — 20 Questions

Question 1

Which three of the following statements about Azure App Service plans are correct? (Choose three.)

Accepted Answer

You can scale out an App Service plan independently of the apps running within it.. Apps in the same App Service plan share the same compute resources (VMs, memory, CPU) because the plan defines the underlying infrastructure. This is true even if the apps are in different resource groups, as the plan is the boundary for resource allocation, not the resource group.

Answer

Changing the pricing tier of an App Service plan always causes downtime for all apps in the plan.

Answer

The Free and Shared tiers support custom domain names and SSL binding without additional cost.

Answer

An App Service plan can only contain apps from the same region and the same resource group.

Question 2

Match each lifecycle management requirement to the blob tier transition or action that should be configured.

Accepted Answer

Move blobs not modified for 30 days: Transition to cool tier. Lifecycle management rules define actions (tier changes or deletion) based on age or access. The actions correspond to moving to cooler tiers (cool, cold, archive) or deleting, and can apply to snapshots.

Answer

Move blobs not modified for 30 days: Transition to archive tier

Answer

Move blobs not modified for 90 days: Transition to cool tier

Answer

Delete blobs after 365 days: Transition to cool tier

Question 3

Match each Azure CLI command to the action it performs for a virtual machine.

Accepted Answer

az vm create: Creates a new virtual machine.. Each Azure CLI command performs the corresponding VM lifecycle action: create, start, stop, deallocate (releases resources), delete, or list.

Answer

az vm start: Stops a running virtual machine.

Answer

az vm stop: Deallocates a virtual machine.

Question 4

Match each data-access pattern to the blob tier or required action.

Accepted Answer

Frequent read and write operations: Hot tier. Azure Blob Storage tiers are Hot (frequent access), Cool (infrequent, 30-day minimum), and Archive (rare, 180-day minimum). Rehydration is needed to access Archive blobs. Azure Files sync is used for replication.

Answer

Frequent read and write operations: Cool tier

Answer

Infrequent access with 30-day minimum storage duration: Archive tier

Question 5

Match each workload requirement to the Azure storage account kind that best fits it.

Accepted Answer

General-purpose v2: Provides support for blobs, files, queues, tables, and VM disks. Suitable for most general-purpose workloads.. Each storage kind is tailored for specific workloads: GPv2 is the default, BlockBlobStorage for high throughput, FileStorage for premium files, and others for legacy or specialized needs.

Answer

General-purpose v2: Premium performance for block blob and append blob data, with low latency.

Answer

BlockBlobStorage: Legacy blob-only account type.

Question 6

A Windows VM and a Linux VM are both joined to the same Active Directory Domain Services domain. Which two authentication methods can be used to mount the same Azure Files share over SMB? Select two.

Accepted Answer

Storage account key. The storage account key provides administrative access to the Azure Files share, allowing any SMB client (Windows or Linux) to mount the share by using the key as the credential. Option B is correct because when both VMs are joined to the same Active Directory Domain Services domain, the Azure Files share can be enabled for AD DS authentication, allowing domain-joined clients to mount the share using their domain credentials.

Answer

Blob SAS token

Answer

Network security group rule

Answer

Azure resource lock

Question 7

Based on the exhibit, which identity approach should be used so all three virtual machines can reuse the same Azure access without sharing secrets?

Accepted Answer

Use a user-assigned managed identity and attach it to all three VMs.. A user-assigned managed identity is a standalone Azure resource that can be assigned to multiple Azure VMs, allowing all three VMs to authenticate to Azure services (e.g., Azure Storage, Key Vault) using the same identity without sharing any secrets. This approach eliminates the need to manage or rotate credentials, as the identity is managed entirely by Azure AD and tokens are obtained via the Azure Instance Metadata Service (IMDS) endpoint.

Answer

Assign a system-assigned managed identity to each VM.

Answer

Create a storage account access key and place it in each VM's application settings.

Answer

Create a separate SAS token for each VM and rotate it manually.

Question 8

You need to prevent accidental deletion of a resource group while still allowing administrators to create and modify resources inside it. Which Azure lock should you apply?

Accepted Answer

CanNotDelete. The CanNotDelete lock prevents deletion of the resource group while still allowing all operations (read, write, modify) on resources within it. This lock type is designed specifically to protect against accidental deletion without restricting administrative actions like creating or updating resources.

Answer

ReadOnly

Answer

Delete lock

Answer

No lock and a budget alert

Question 9

A media company stores project video assets in Azure Blob Storage. The business requires the data to survive a single availability zone outage in the primary region. In addition, if the primary region becomes unavailable, operations staff must still be able to read the most recently replicated copy from the secondary region right away, even if writes are temporarily unavailable. Which redundancy option best meets this requirement?

Accepted Answer

RA-GZRS. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is correct because it combines zone-redundant storage (ZRS) within the primary region to survive a single availability zone outage, and geo-redundant storage (GRS) to replicate data to a secondary region. The 'RA' prefix enables read access to the secondary region immediately after a primary region failure, allowing operations staff to read the most recently replicated copy even if writes are temporarily unavailable.

Answer

ZRS

Answer

GZRS

Answer

RA-GRS

Question 10

Based on the exhibit, what should you do so the report can open the file tomorrow morning?

Accepted Answer

Change the blob to the Hot access tier and allow it to rehydrate before the report runs.. The blob is currently in the Archive access tier, which requires manual rehydration (changing the tier to Hot or Cool) before it can be read. Rehydration can take up to 15 hours, so changing the blob to the Hot access tier now and allowing it to complete rehydration before the report runs tomorrow ensures the file is available for reading.

Answer

Change the blob to the Cool access tier only, because Cool is always immediately readable.

Answer

Create a snapshot of the archived blob and use the snapshot instead.

Answer

Enable versioning on the storage account so the file becomes readable again.

Question 11

A department has 10 subscriptions and wants the same two governance rules applied to all current and future subscriptions. One rule audits missing tags, and the other denies unapproved locations. Which two actions should the administrator take? Select two.

Accepted Answer

Create an Azure Policy initiative that contains both policy definitions.. Azure Policy Initiative allows grouping multiple policy definitions (like audit for missing tags and deny for unapproved locations) into a single set for coordinated enforcement. Assigning the initiative at the management group scope ensures it applies to all current and future subscriptions under that management group, meeting the requirement for consistent governance across all 10 subscriptions and any new ones added later.

Answer

Assign each policy only to one resource group.

Answer

Use Azure RBAC instead of Policy for both requirements.

Answer

Create a read-only lock on each subscription.

Question 12

A VM suffered corruption and an auditor also needs one missing file. Match each Azure Backup restore workflow to the recovery outcome it provides.

Accepted Answer

Restore VM: Creates a new VM. Azure Backup restore workflows: 'Restore VM' creates a new VM, 'Restore files' recovers individual files, 'Restore as unmanaged/managed disks' recovers disks, 'Replace existing VM' overwrites the original, and 'Cross-region restore' restores to another region.

Answer

Restore VM: Recovers individual files

Answer

Restore files: Overwrites the original VM

Question 13

A container group runs a one-time import job that writes data to an external system. If the job succeeds, the container must stop and stay stopped. If the job fails, it should automatically retry by restarting. Which restart policy should the administrator choose?

Accepted Answer

OnFailure. The OnFailure restart policy is correct because it instructs Azure Container Instances (ACI) to restart the container only when the process exits with a non-zero exit code, indicating failure. For a one-time import job that must stop permanently on success (exit code 0) and retry on failure, OnFailure matches this exact behavior without unnecessary restarts.

Answer

Always

Answer

Never

Answer

Manual

Question 14

A company uses Azure Blob Storage for legal documents. The documents must not be modified or deleted for seven years after upload, even by administrators. What should you configure?

Accepted Answer

Immutable blob storage with a time-based retention policy. Immutable blob storage with a time-based retention policy (WORM – Write Once, Read Many) ensures that blobs cannot be modified or deleted for a specified retention period, even by administrators. This is the only Azure storage feature that provides legal hold or regulatory compliance for fixed records, such as legal documents that must remain unaltered for seven years.

Answer

Blob soft delete

Answer

Lifecycle management to move blobs to Archive

Answer

Blob versioning

Question 15

Based on the exhibit, the administrator cannot create VNet peering between the hub and spoke networks. What should be changed?

Accepted Answer

Change the spoke VNet address space so it does not overlap the hub.. VNet peering requires that the address spaces of the peered VNets do not overlap. Overlapping address spaces cause routing conflicts because Azure cannot distinguish between resources in the hub and spoke when IP addresses are identical or within the same CIDR range. Changing the spoke VNet address space to a non-overlapping range resolves this issue and allows peering to be established.

Answer

Change the hub VNet to use a smaller subnet mask.

Answer

Add a route table to the spoke VNet before creating peering.

Answer

Enable a service endpoint on both VNets.

Question 16

An operations team maintains a hardened Windows Server image with application prerequisites and monitoring tools already installed. They want to deploy future VMs from the same versioned image in multiple subscriptions and promote a new build only after testing. Which Azure feature should they use?

Accepted Answer

An Azure Compute Gallery image version. An Azure Compute Gallery (formerly Shared Image Gallery) allows you to store and manage multiple versions of a custom VM image, replicate them across regions, and share them across subscriptions. This enables the team to maintain a hardened, versioned image, deploy VMs from it in multiple subscriptions, and promote a new build only after testing by creating a new image version.

Answer

A managed disk snapshot created from one of the VMs

Answer

A custom script extension installed during VM provisioning

Answer

An availability set containing the VMs

Question 17

A stateless web application needs a group of identical Azure VMs that can automatically add more instances during the workday and remove them at night based on CPU usage. What should the administrator deploy?

Accepted Answer

A virtual machine scale set with autoscale rules. A virtual machine scale set (VMSS) with autoscale rules is the correct solution because it provides a group of identical, load-balanced VMs that can automatically scale out (add instances) during high CPU usage in the workday and scale in (remove instances) at night based on CPU thresholds. This matches the stateless, elastic requirement perfectly, as VMSS is designed for horizontal scaling of identical instances with autoscale policies tied to metrics like CPU percentage.

Answer

An availability set with two VMs

Answer

A single VM with a larger disk

Answer

An Azure Policy assignment to increase CPU capacity

Question 18

A records team wants blobs to be replicated to a secondary region, and the secondary copy must be readable if the primary region becomes unavailable. Which redundancy option should you choose?

Accepted Answer

Read-access geo-redundant storage (RA-GRS). RA-GRS (Read-access geo-redundant storage) is correct because it provides geo-redundant replication (GRS) to a secondary region, plus read access to the secondary copy even if the primary region is unavailable. This ensures the blob data is replicated asynchronously to a paired secondary region, and the secondary endpoint can be read immediately during a primary outage, meeting the team's requirement for readable secondary copies.

Answer

Locally redundant storage (LRS)

Answer

Zone-redundant storage (ZRS)

Answer

Geo-redundant storage (GRS)

Question 19

A web tier and an app tier run on separate Azure VMs in the same region. Each VM's NIC is added to an application security group named WebASG or AppASG. The administrator must allow only the web tier to connect to the app tier on TCP 8443, and future VM scale-outs must be included automatically. Which NSG rule should be created?

Accepted Answer

An inbound rule with source WebASG, destination AppASG, protocol TCP, and destination port 8443.. Application security groups (ASGs) allow you to configure network security as a natural extension of an application's structure, enabling you to group VMs by their roles (e.g., web tier, app tier) and define rules based on those groups. By creating an inbound NSG rule with source WebASG and destination AppASG on TCP port 8443, any VM added to WebASG can initiate traffic to any VM in AppASG, and future scale-outs are automatically included without manual IP updates. This approach is dynamic, scalable, and aligns with the requirement for automatic inclusion of new VMs.

Answer

An inbound rule that uses the current web VM's private IP as the source and the current app VM's private IP as the destination.

Answer

A route table that sends TCP 8443 traffic from the web subnet to the app subnet.

Answer

An Azure Firewall application rule collection that permits all traffic between the two subnets.

Question 20

A legal department stores project video assets in Azure Blob Storage. The files are reviewed only during quarterly audits, but when someone needs a file it must open immediately without waiting for rehydration. Which access tier should the administrator use for the blobs?

Accepted Answer

Cool, because it is for infrequent access while still keeping blobs online and immediately available.. The Cool access tier is designed for data that is infrequently accessed but must remain immediately available (online) without any rehydration delay. Since the legal department needs instant access during quarterly audits, Cool meets the requirement of low retrieval cost while keeping blobs online, unlike Archive which requires hours-long rehydration.

Answer

Hot, because it is optimized for frequent access and always costs the least to retrieve.

Answer

Archive, because it is the cheapest choice for data that is rarely used and can be restored instantly.

Answer

Premium, because it is intended for workload bursts and gives the best long-term storage economics.