AZ-104 Practice Exam 4 — 20 Questions

Question 1

An operations team wants to label resources by Department and Environment so they can search and report on ownership across many resource groups. Which two statements are correct? Select two.

Accepted Answer

Tags are key-value pairs that can be applied to resources and resource groups.. Azure tags are indeed key-value pairs that can be applied to resources and resource groups. This allows the operations team to label resources with metadata like Department and Environment, enabling efficient searching, filtering, and reporting across multiple resource groups without affecting resource functionality.

Answer

A ReadOnly lock is the best way to record department ownership.

Answer

Tags automatically encrypt the data in a resource.

Answer

Tags replace Azure Policy when compliance must be enforced.

Question 2

A platform team has a hardened Windows Server VM that was generalized after patching, agent installation, and baseline configuration. They must deploy the same build to development, test, and production subscriptions, and they want a controlled way to publish newer versions later without rebuilding the image each time. What should they create first?

Accepted Answer

An Azure Compute Gallery image version based on the generalized VM image.. An Azure Compute Gallery (formerly Shared Image Gallery) allows you to store and manage multiple versions of a generalized VM image, enabling controlled, incremental publishing of image updates across subscriptions. By creating an image version in a gallery, the team can deploy the same build to dev, test, and prod subscriptions while maintaining versioning and replication control, avoiding the need to rebuild the image from scratch for each update.

Answer

An availability set for the source VM so new virtual machines inherit the same configuration.

Answer

A managed disk snapshot of the OS disk so new VMs can be created from the captured state.

Answer

A proximity placement group so all future VMs land close to the current server.

Question 3

A web tier and an app tier run in separate subnets. Each VM NIC is placed in an application security group named WebASG or AppASG. The administrator must allow only the web tier to reach the app tier on TCP port 8443 and block all other inbound traffic to the app tier. Which NSG rule should be created on the app subnet?

Accepted Answer

Allow TCP 8443 from WebASG to AppASG with a priority lower number than the deny rule.. NSG rules are evaluated in priority order, with lower numbers having higher priority. By placing an Allow rule for TCP 8443 from WebASG to AppASG with a lower priority number than a subsequent Deny-All rule, only traffic from the web tier is permitted, and all other inbound traffic to the app subnet is blocked. This leverages application security groups (ASGs) to define fine-grained, role-based network security policies without relying on IP addresses.

Answer

Allow TCP 8443 from the entire virtual network to the app subnet with a lower priority than the deny rule.

Answer

Allow UDP 8443 from WebASG to AppASG with any priority below 65000.

Answer

Allow TCP 8443 from WebASG to AppASG with a priority higher number than the deny rule.

Question 4

A storage account must be reachable only from resources in one Azure subnet, and public network access should not be used. Which configuration best meets this requirement?

Accepted Answer

Create a private endpoint for the storage account in the subnet. A private endpoint assigns the storage account a private IP address from the specified Azure subnet, effectively bringing the storage account into the virtual network. This ensures that all traffic to the storage account stays within the Microsoft Azure backbone network and never traverses the public internet, meeting the requirement to restrict access exclusively to resources in that subnet while disabling public network access.

Answer

Enable blob versioning on the storage account

Answer

Assign a ReadOnly lock to the storage account

Answer

Enable a shared access signature

Question 5

A new Windows VM must be deployed with an application installed, a configuration file copied from a storage account, and a bootstrap script run automatically after the operating system is provisioned. The operations team does not want to log in manually after deployment. What should they use?

Accepted Answer

A Custom Script Extension attached to the VM during provisioning.. The Custom Script Extension (CSE) is the correct choice because it allows you to run a PowerShell or Bash script automatically after the VM is provisioned. This script can install applications, download configuration files from Azure Storage using a managed identity or SAS token, and execute bootstrap commands—all without any manual login. CSE is the standard Azure mechanism for post-deployment configuration automation on both Windows and Linux VMs.

Answer

Azure Bastion to connect through the browser and complete setup interactively.

Answer

A managed identity assigned to the VM without any extensions.

Answer

An availability set so the VM comes online faster during provisioning.

Question 6

A hub-and-spoke environment uses a DNS server VM in the hub VNet at 10.8.0.4 to resolve internal names such as app01.corp.local. The spoke VNet can reach hub VMs by IP after peering, but name resolution still fails from the spoke. What should the administrator configure so VMs in the spoke use the hub DNS server?

Accepted Answer

Configure the spoke VNet to use 10.8.0.4 as a custom DNS server.. In Azure, a spoke VNet must explicitly be configured with a custom DNS server address to use a non-default DNS resolver. By setting the spoke VNet's DNS server to 10.8.0.4, all VMs in the spoke will send their DNS queries to that hub VM, resolving internal names like app01.corp.local. Without this configuration, the spoke VNet uses Azure-provided DNS, which cannot resolve custom private DNS zones hosted on the hub VM.

Answer

Add an inbound NSG rule on the spoke subnet to allow UDP and TCP 53 to 10.8.0.4.

Answer

Create a service endpoint for Microsoft.Storage on the spoke subnet.

Answer

Add a user-defined route for 10.8.0.4/32 pointing to the virtual network gateway.

Question 7

A contractor needs temporary access to upload files into one Azure Blob container for six hours. The administrator does not want to share the storage account key. What should the administrator create?

Accepted Answer

A shared access signature scoped to the container and expiration time. A shared access signature (SAS) scoped to the container provides time-limited, delegated access to specific operations (e.g., upload) without exposing the storage account key. By setting an expiration time of six hours, the administrator ensures the contractor can upload files only during that window, after which the token becomes invalid. This meets the requirement for temporary, secure access.

Answer

A new storage account access key

Answer

A management group assignment

Answer

A private endpoint for the contractor

Question 8

A platform team must deploy the same group of Azure VMs every month from source control and wants the deployment to be repeatable and reviewable. Which approach should they use?

Accepted Answer

A Bicep template in source control. Bicep is a domain-specific language (DSL) for deploying Azure resources declaratively. Storing a Bicep template in source control ensures the VM deployment is repeatable (same parameters produce identical infrastructure) and reviewable (changes are tracked via pull requests and commit history), meeting the team's requirements for infrastructure as code (IaC).

Answer

Manual portal deployment each month

Answer

A temporary virtual machine snapshot

Answer

A network security group rule collection

Question 9

An administrator needs two non-overlapping VNets in the same region to communicate directly over private IP addresses without deploying a gateway. What should be configured?

Accepted Answer

VNet peering between the two virtual networks.. VNet peering enables direct connectivity between two Azure virtual networks using private IP addresses across the Microsoft backbone, without requiring a gateway or public internet. It supports non-overlapping address spaces in the same region and provides low-latency, high-bandwidth communication. This matches the requirement exactly.

Answer

A site-to-site VPN gateway connection.

Answer

A service endpoint on both subnets.

Answer

A route table with default routes to each VNet.

Question 10

The operations team wants 3 to 8 identical Linux VM instances, with more instances added when average CPU stays above 70 percent for 10 minutes and removed when load falls. Which three settings should be configured? Select three.

Accepted Answer

Use a virtual machine scale set for the identical application instances.. A virtual machine scale set (VMSS) is the correct Azure service for deploying and managing a group of identical, load-balanced Linux VMs that can automatically scale in and out based on demand. It supports autoscaling rules that adjust the instance count within a defined range, meeting the requirement for 3 to 8 identical instances with automatic addition when average CPU exceeds 70% for 10 minutes and removal when load falls.

Answer

Place the VMs in an availability set instead of using a scale set.

Answer

Clone the VM manually whenever CPU rises and remove clones by hand later.

Question 11

Based on the exhibit, where should you assign the Reader role so the Auditors group can read every current and future resource in the Sales subscription, including resource groups created later, while not granting access to the Research subscription?

Accepted Answer

Assign Reader to the Sales subscription, because subscription-level scope includes all current and future resource groups and resources in that subscription.. Assigning the Reader role at the Sales subscription scope grants the Auditors group read access to all current and future resource groups and resources within that subscription. This is because Azure RBAC roles assigned at a subscription level are inherited by all child resource groups and resources, including those created later. The requirement explicitly excludes the Research subscription, so a subscription-level assignment is the correct and most efficient approach.

Answer

Assign Reader to RG-Web, because the group can then inherit access to resources in that resource group only.

Answer

Assign Reader to the Corp management group, because that is the only scope that can cover multiple subscriptions.

Answer

Assign Reader to each resource individually, because that avoids inheritance and limits visibility to selected items.

Question 12

A contractor needs temporary access to upload and download files in only one blob container for 8 hours. You do not want to share the storage account key, and you want to revoke access later without affecting other containers. What should you create?

Accepted Answer

A container-level SAS token backed by a stored access policy, so you can limit and revoke access.. A container-level SAS token backed by a stored access policy is the correct solution because it allows you to grant temporary, scoped access to a single blob container without exposing the storage account key. The stored access policy enables you to revoke the SAS token at any time by modifying or deleting the policy, which immediately invalidates all tokens associated with it, without affecting other containers.

Answer

A storage account access key, because it can be limited to one container by policy.

Answer

Anonymous public access on the container, because it is the easiest way to time-limit access.

Answer

Azure RBAC on the storage account only, because RBAC automatically expires after a few hours.

Question 13

A web app running in Azure App Service must upload images to a blob container without storing any account keys, passwords, or connection strings in configuration. The app uses only one Azure resource. What should the administrator configure?

Accepted Answer

A system-assigned managed identity on the App Service and an Azure RBAC role on the storage account.. A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any credentials in configuration. By assigning the RBAC role (e.g., Storage Blob Data Contributor) to that identity, the app can securely upload images using Microsoft Entra ID authentication, meeting the requirement of no account keys, passwords, or connection strings.

Answer

The storage account key, because it is the simplest way to authenticate an application securely.

Answer

A shared access signature embedded in the app settings, because SAS is the same as managed identity.

Answer

An anonymous public container with write access disabled on the account.

Question 14

A VM in a virtual network must access an Azure Storage account over a private IP address, and the storage account's public endpoint must be disabled. Name resolution from the VM should resolve the storage name to the private IP. Which configuration should you use?

Accepted Answer

Private endpoint with a private DNS zone linked to the virtual network.. A private endpoint assigns a private IP from the virtual network to the storage account, effectively bringing the service into the VNet. By linking a private DNS zone to the virtual network, the VM's DNS resolution for the storage account name returns the private IP instead of the public endpoint, satisfying both the private connectivity and public endpoint disablement requirements.

Answer

Service endpoint on the subnet plus public DNS, because the storage account will expose a private IP automatically.

Answer

Network security group rules only, because they can force traffic to use private addressing.

Answer

Storage account firewall rules with Allow trusted Microsoft services, because that gives a private address path.

Question 15

A build agent VM is recreated from image every night. The OS can be lost on reimage, but build caches and artifacts must persist across rebuilds. The team also wants the cheapest OS storage option that supports this pattern. Which two choices should you make? Select two.

Accepted Answer

Use an ephemeral OS disk.. An ephemeral OS disk uses the local VM storage or temp SSD, which is destroyed when the VM is deallocated or reimaged. This matches the requirement that the OS can be lost on reimage. Option B is correct because placing build caches and artifacts on a separate managed data disk ensures they persist independently of the OS disk lifecycle; data disks are not affected by OS reimaging and can be reattached to the new VM instance.

Answer

Use a Premium SSD OS disk so the reimage is preserved.

Answer

Store the caches only on the temporary resource disk.

Answer

Use an availability set to make the OS disk persistent.

Question 16

You need to deploy 30 identical Azure virtual machines for a web application and scale the instance count automatically based on CPU demand. Which Azure compute feature should you use?

Accepted Answer

A Virtual Machine Scale Set. Virtual Machine Scale Sets (VMSS) are designed specifically to deploy and manage a group of identical, load-balanced VMs that can automatically scale in or out based on CPU demand or other metrics. This matches the requirement for 30 identical VMs and autoscaling, making B the correct choice.

Answer

An availability set

Answer

A Recovery Services vault

Answer

Boot diagnostics

Question 17

Based on the exhibit, which OS disk option best fits a development VM that is rebuilt often and does not need the disk contents to survive deallocation?

Accepted Answer

An ephemeral OS disk.. An ephemeral OS disk is created on the local VM host and not stored in Azure Storage, so it provides lower latency and is automatically deleted when the VM is deallocated. This makes it ideal for development VMs that are rebuilt often and do not require disk persistence across deallocations.

Answer

A Standard HDD managed OS disk.

Answer

A premium managed data disk used as the OS disk.

Answer

A shared disk attached to multiple VMs.

Question 18

Based on the exhibit, a shared resource group contains a production virtual machine and a storage account. Administrators must be able to update settings, but they must not be able to delete either resource by mistake. Which lock should be applied at the resource group scope?

Accepted Answer

CanNotDelete lock, because it allows updates but blocks deletion.. The CanNotDelete lock (option B) is correct because it allows administrators to update settings on the production VM and storage account while preventing accidental deletion of either resource. This lock operates at the resource group scope, applying to all resources within it, and is the appropriate choice for the stated requirement of allowing updates but blocking deletions.

Answer

ReadOnly lock, because it prevents all changes and keeps resources fully protected.

Answer

No lock is needed because Azure RBAC already prevents deletion by default.

Answer

Management group lock, because all changes in the tenant must be blocked centrally.

Question 19

Based on the exhibit, a compliance dashboard shows that several storage accounts are marked noncompliant because they do not have the required tag. The policy itself is correct, but one business unit needs a temporary exception for a single resource group during a merger. What should the administrator configure?

Accepted Answer

A policy exemption at the rg-merger01 resource group scope.. A policy exemption at the rg-merger01 resource group scope is the correct solution because it allows the administrator to temporarily exclude a specific resource group from the policy's enforcement or compliance evaluation without modifying or deleting the original policy assignment. This is designed for scenarios like mergers where a short-term exception is needed, and it maintains the policy's integrity for all other scopes.

Answer

Delete the policy assignment from corp-root and recreate it later.

Answer

Move rg-merger01 to a separate subscription so the policy no longer applies.

Answer

Change the policy effect to Audit so the resources can remain noncompliant.

Question 20

A company wants to group several subscriptions for Finance, HR, and Engineering so that the same governance settings can be applied above the subscription level. What should the administrator create?

Accepted Answer

A management group. A management group is the correct choice because it allows you to organize multiple Azure subscriptions into a hierarchy and apply governance policies, role-based access control (RBAC), and compliance settings at a scope above the subscription level. By creating a management group for Finance, HR, and Engineering, the administrator can enforce consistent Azure Policy initiatives and RBAC assignments across all three subscriptions, ensuring uniform governance without needing to configure each subscription individually.

Answer

A resource group

Answer

A tag

Answer

A resource lock