AZ-104 Practice Exam 3 — 20 Questions

Question 1

A reporting server will run an in-memory analytics application that needs 8 vCPUs and 64 GiB of RAM. The administrator wants a VM family that is a good fit for memory-heavy workloads. Which VM family should be chosen?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Memory-optimized VM family. Memory-optimized VM families (e.g., Azure E-series) are designed for workloads that require a high memory-to-vCPU ratio, such as in-memory analytics applications. The requirement of 64 GiB of RAM for 8 vCPUs (8:1 ratio) aligns with the memory-optimized profile, which offers up to 8 GiB per vCPU or more, ensuring the application's data fits entirely in RAM for low-latency processing.

Answer

Burstable VM family

Answer

Compute-optimized VM family

Answer

Storage-optimized VM family

Question 2

A subnet has a user-defined route for 0.0.0.0/0 that sends all outbound traffic to a virtual appliance. Traffic to 10.20.4.12 must instead go directly to an Azure VPN gateway. What should you configure?

Accepted Answer

Add a more specific UDR for 10.20.4.0/24 that uses the virtual network gateway next hop.. User-Defined Routes (UDRs) use the longest prefix match to determine the next hop. The existing 0.0.0.0/0 route sends all outbound traffic to a virtual appliance, but adding a more specific route for 10.20.4.0/24 with a next hop of the virtual network gateway (VPN gateway) overrides the default route for that subnet, directing traffic to 10.20.4.12 through the VPN gateway.

Answer

Add a network security group rule that allows traffic to 10.20.4.12.

Answer

Increase the priority of the 0.0.0.0/0 route so it is preferred less often.

Answer

Remove the VPN gateway association from the virtual network.

Question 3

A media archive stores large video files that must survive a zone failure in the primary region and also be replicated to a paired region for disaster recovery. The archive team does not want anyone to read from the secondary region during normal operations, and cost should be lower than the read-access variant. Which redundancy option should you configure?

Accepted Answer

GZRS, because it adds zone redundancy and geo-replication without enabling secondary read access.. GZRS (Geo-Zone-Redundant Storage) is correct because it combines zone redundancy (three copies across availability zones in the primary region) with geo-replication to a paired secondary region, but crucially does not enable read access to the secondary region by default. This satisfies the requirement to survive a zone failure, provide disaster recovery to a paired region, and prevent reads from the secondary during normal operations, all at a lower cost than RA-GRS which includes secondary read access.

Answer

LRS, because it keeps copies in a single datacenter and is the lowest-cost option.

Answer

ZRS, because it protects against zone failures but not regional outages.

Answer

RA-GRS, because the read-access copy is needed whenever data is replicated to another region.

Question 4

A storage account must stay online for applications, but administrators have a temporary freeze on configuration changes. Users can still view the account, but attempts to change the access tier, create a container, or update networking all fail. What most likely caused the behavior?

Accepted Answer

A ReadOnly lock was applied to the storage account.. A ReadOnly lock (Azure Resource Manager lock) prevents any modification to the storage account, including changing the access tier, creating containers, or updating networking settings, while still allowing read operations like viewing the account. This matches the described behavior exactly because the lock is applied at the resource scope and blocks all write/delete operations, but does not affect read access.

Answer

A CanNotDelete lock was applied to the storage account.

Answer

An Azure Policy audit assignment was applied to the storage account.

Answer

The account was moved to a different subscription.

Question 5

A reporting application will run on a single Azure VM and needs 8 vCPUs, 64 GiB of RAM, and a temporary local disk for cache. The team wants a size that satisfies the requirement without oversizing memory or paying for an unnecessarily large specialty series. Which two VM sizes meet the requirement best? Select two.

Accepted Answer

E8as_v5. The E8as_v5 is correct because it provides 8 vCPUs and 64 GiB of RAM, matching the requirement exactly, and includes a temporary local disk (SSD) for cache. It belongs to the memory-optimized Esv5 series, which is designed for memory-intensive workloads without oversizing, and the 'as' variant includes local temporary storage.

Answer

D8as_v5

Answer

F8s_v2

Answer

M8ms

Question 6

Order the steps to set up Azure Site Recovery for on-premises to Azure.

Accepted Answer

Step 1: Create a Recovery Services vault, Step 2: Configure source and target settings, Step 3: Install the Mobility service agent on on-premises machines, Step 4: Enable replication, Step 5: Test failover. The correct sequence for setting up Azure Site Recovery for on-premises to Azure is: create a Recovery Services vault, configure source and target settings, install the Mobility service agent on on-premises machines, enable replication, and then test failover. This order ensures prerequisites are met and replication is active before testing.

Answer

Step 1: Install the Mobility service agent on on-premises machines, Step 2: Create a Recovery Services vault, Step 3: Configure source and target settings, Step 4: Enable replication, Step 5: Test failover

Answer

Step 1: Create a Recovery Services vault, Step 2: Configure source and target settings, Step 3: Enable replication, Step 4: Install the Mobility service agent on on-premises machines, Step 5: Test failover

Answer

Step 1: Create a Recovery Services vault, Step 2: Configure source and target settings, Step 3: Install the Mobility service agent on on-premises machines, Step 4: Test failover, Step 5: Enable replication

Question 7

Arrange the steps to create an Azure Storage account with a container and upload a blob.

Accepted Answer

Create storage account → Create container → Set access level → Upload blob → Generate SAS. Create storage account, create container, set access, upload blob, generate SAS.

Answer

Create container → Create storage account → Set access level → Upload blob → Generate SAS

Answer

Create storage account → Upload blob → Create container → Set access level → Generate SAS

Answer

Create storage account → Create container → Upload blob → Set access level → Generate SAS

Question 8

Based on the exhibit, a policy assigned at the subscription denies storage accounts that allow public network access. One existing storage account in RG-Legacy must remain publicly reachable for 30 days while a migration is completed. What should the administrator use?

Accepted Answer

Create a policy exemption for stlegacy01 at the resource scope.. A policy exemption at the resource scope is the correct approach because it allows the administrator to selectively exclude the specific storage account (stlegacy01) from the subscription-level policy that denies public network access. This exemption can be configured with an expiration date of 30 days, ensuring the legacy account remains publicly reachable during the migration while the policy continues to apply to all other resources. Policy exemptions are designed for exactly this scenario—temporary exceptions for compliance or migration needs—without altering the policy definition or assignment.

Answer

Remove the policy assignment from the subscription until the migration finishes.

Answer

Change the policy effect from Deny to Audit.

Answer

Move the legacy storage account to a separate subscription and assign the policy there.

Question 9

A customer-facing service needs to survive a single datacenter outage in a zone-supported region. You do not need cross-region failover, but you do need Azure to spread instances without manual placement errors. Which two deployment choices satisfy that goal? Select two.

Accepted Answer

Place the VMs in different availability zones within the same region.. Availability zones are physically separate datacenters within a region, each with independent power, cooling, and networking. Placing VMs in different zones ensures that a single datacenter outage does not affect all instances, meeting the survivability requirement without manual placement errors. Azure automatically distributes VMs across selected zones, eliminating human error in instance placement.

Answer

Use an availability set and expect it to cover a zone outage.

Answer

Keep all instances in one zone and rely on the load balancer.

Answer

Use a paired region for automatic in-region zone balancing.

Question 10

A contractor must import data into one blob container for six hours. The contractor should not receive the storage account key, and access must be limited to that container only. Which credential should the administrator generate?

Accepted Answer

A user delegation SAS, because it is signed with Microsoft Entra credentials and is time limited.. A user delegation SAS is signed with Microsoft Entra credentials (formerly Azure AD) and can be scoped to a specific blob container with a time limit. This meets the requirement of granting the contractor access only to that container for six hours without exposing the storage account key.

Answer

A storage account access key, because it can be copied into the import tool.

Answer

A shared key connection string, because it works with any tool that needs blob access.

Answer

A managed identity token, because the contractor can use it outside Azure directly.

Question 11

A customer wants official information about whether an Azure service issue is affecting their subscription or the wider Azure platform. Which two sources should they check? Select two.

Accepted Answer

Azure Service Health. Azure Service Health (B) provides personalized alerts and guidance when Azure service issues affect your subscription, including planned maintenance and health advisories. Azure Status (D) offers a global view of the health of all Azure services across regions, which is the official source for widespread platform issues. Together, they cover both subscription-specific and platform-wide service incidents.

Answer

Azure Advisor

Answer

Backup center

Answer

Resource Graph

Question 12

A finance application is deployed in a single resource group named rg-finance-app. The team must manage only the resources in that group and must not receive permissions for other resource groups in the subscription. Where should the Contributor role be assigned?

Accepted Answer

At the rg-finance-app resource group scope.. The Contributor role must be assigned at the rg-finance-app resource group scope to restrict permissions exclusively to that group. This ensures the team can manage only the resources within that resource group, without inheriting permissions to other resource groups in the subscription. Role assignments in Azure are inherited from higher scopes (management group, subscription) down to lower scopes, so assigning at the resource group scope is the most specific and restrictive level that meets the requirement.

Answer

At the management group that contains the subscription.

Answer

At the subscription scope.

Answer

At each individual resource in the resource group.

Question 13

A company wants to peer a new spoke virtual network to an existing hub VNet. The hub uses 10.40.0.0/16, and the new spoke was created with 10.40.128.0/17 because that range seemed available in the branch office plan. Peering creation fails. What should the administrator do?

Accepted Answer

Change the spoke VNet to a non-overlapping address space before peering.. VNet peering requires that the address spaces of the peered virtual networks do not overlap. The hub uses 10.40.0.0/16, and the spoke uses 10.40.128.0/17, which is a subset of the hub’s range. Azure blocks peering when there is any overlap to prevent routing conflicts. The correct fix is to change the spoke VNet to a non-overlapping address space, such as a different RFC 1918 range like 10.1.0.0/16, before attempting to peer.

Answer

Add a second address prefix to the spoke VNet and keep the overlapping range.

Answer

Enable gateway transit on the hub VNet before retrying peering.

Answer

Create custom DNS records for the spoke VNet so the address ranges no longer conflict.

Question 14

Before changing a production VM's data disk, you want a point-in-time copy that can be restored later without affecting the VM. What should you create?

Accepted Answer

Snapshot. A snapshot captures a point-in-time, read-only copy of a managed or unmanaged disk. It can be used to create a new disk or restore the original disk without affecting the running VM, making it the correct choice for a non-disruptive backup before a data disk change.

Answer

Availability set

Answer

Azure Policy assignment

Answer

Virtual network peering

Question 15

A container group must run an image from a private Azure Container Registry without embedding registry credentials in the deployment. The same authentication method should be reusable by future container groups, and the application must continue to work if the container group is recreated. Which identity approach should the administrator use?

Accepted Answer

A user-assigned managed identity assigned to the container group.. A user-assigned managed identity (B) is the correct approach because it is a persistent Azure AD identity that can be pre-created and assigned to any number of container groups. It decouples the identity from the container group's lifecycle, so if the container group is recreated, the same identity can be reassigned without reconfiguration. The container group uses this identity to authenticate to ACR via Azure AD token-based authentication, eliminating the need to embed registry credentials.

Answer

A system-assigned managed identity for the container group.

Answer

An ACR admin username and password stored in the container image.

Answer

A shared access signature token passed as an environment variable.

Question 16

Three application VMs in separate resource groups must use the same identity to read a configuration endpoint. The identity must keep working if any one VM is deleted and later recreated. Which three actions should the administrator take? Select three.

Accepted Answer

Create a user-assigned managed identity that can exist independently of any single VM.. A user-assigned managed identity is an Azure resource that exists independently of any VM, unlike a system-assigned identity which is tied to the VM lifecycle. This independence ensures the identity persists even when a VM is deleted and recreated, maintaining continuous access to the configuration endpoint. By creating a user-assigned managed identity, the administrator decouples the identity from any single VM, satisfying the requirement that the identity must keep working after VM deletion and recreation.

Answer

Use a system-assigned managed identity on only one VM and copy its access token to the other two VMs.

Answer

Store one application password locally on each VM and use it instead of Azure-managed identities.

Question 17

Based on the exhibit, the business wants two Azure VMs to stay available if a host is patched or fails. A full datacenter outage is not part of the requirement. What should you use?

Accepted Answer

Deploy the VMs in an availability set.. An availability set protects against failures within a single datacenter by distributing VMs across multiple fault domains (physical racks with separate power and network) and update domains (groups that are patched sequentially). This ensures that during host patching or a host failure, at least one VM remains available, meeting the requirement without needing to survive a full datacenter outage.

Answer

Deploy the VMs in the same availability zone.

Answer

Use a virtual machine scale set with autoscale only.

Answer

Place both VMs on a dedicated host.

Question 18

The platform team wants to block deployment of virtual machines that use any size except a small approved list. Operators already have Contributor access and should keep that access for other tasks. Which Azure control should the administrator use to enforce the size restriction?

Accepted Answer

Assign an Azure Policy with an allowed virtual machine size rule and the Deny effect at the subscription scope.. Azure Policy with the 'allowed virtual machine sizes' built-in policy and the Deny effect is the correct control because it enforces a deny action at the resource creation or update level, preventing any VM deployment that does not match the approved size list. This works independently of RBAC permissions, so operators retain their Contributor role for other tasks while the policy blocks non-compliant VM sizes. The policy is assigned at the subscription scope to cover all resource groups, ensuring consistent enforcement across the environment.

Answer

Create a custom RBAC role that excludes unsupported VM sizes from the Contributor role.

Answer

Apply a CanNotDelete lock to the resource group that contains the virtual machines.

Answer

Assign Reader permissions to the operators and rely on Azure portal validation.

Question 19

The team already exports subscription activity logs to a Log Analytics workspace and wants an alert that can ignore delete operations performed by a known automation account. What should they create?

Accepted Answer

A scheduled query alert in Log Analytics using the AzureActivity table. A scheduled query alert in Log Analytics can query the AzureActivity table to filter out delete operations performed by a specific automation account. This allows the alert to ignore those operations by excluding them in the query logic, which is not possible with activity log alerts that lack such granular filtering.

Answer

An activity log alert at the subscription scope

Answer

A metric alert on the subscription

Answer

A diagnostic setting on the resource group

Question 20

Your company has two subscriptions named Dev-Sub and Prod-Sub. A new administrator must be able to create resource groups only in Dev-Sub and must not have any permissions in Prod-Sub. What should you do?

Accepted Answer

Assign Contributor to the administrator at the Dev-Sub scope.. Assigning the Contributor role at the Dev-Sub scope grants the administrator full permissions to create and manage resource groups within that subscription, while the role assignment is scoped exclusively to Dev-Sub, ensuring no permissions in Prod-Sub. Azure RBAC is hierarchical, so a role assigned at a subscription scope applies to all resource groups within it, but does not cross subscription boundaries. This meets the requirement of allowing resource group creation only in Dev-Sub with no access to Prod-Sub.

Answer

Assign Contributor to the administrator at the management group scope.

Answer

Assign Owner to the administrator at the resource group scope in Dev-Sub.

Answer

Assign Reader to the administrator at the Prod-Sub scope and Contributor at the tenant root group.