AZ-104 Practice Test 21 — 15 Questions

Question 1

An administrator accidentally stopped protection for a critical VM and then deleted its backup item. The mistake was discovered a day later, and the organization wants deleted backup data to remain recoverable for a grace period. Which feature should be enabled on the Recovery Services vault?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Soft delete on the Recovery Services vault.. Soft delete on the Recovery Services vault provides a grace period (default 14 days) during which deleted backup data is retained in a soft-deleted state, allowing recovery even after a backup item is deleted. This feature is specifically designed to protect against accidental deletion, as it prevents permanent removal of backup data until the soft-delete period expires or is manually purged.

Answer

An action group attached to the vault alerts.

Answer

Diagnostic settings that export vault events to Log Analytics.

Answer

Cross-region restore for the vault.

Question 2

Based on the exhibit, the administrator needs to deploy a VM quickly using a preapproved hardened operating system image. Which source should be used when creating the VM?

Accepted Answer

An approved custom image in an Azure Compute Gallery.. An approved custom image in an Azure Compute Gallery (formerly Shared Image Gallery) is the correct source because it allows the administrator to deploy a VM quickly using a preapproved, hardened operating system image. The Azure Compute Gallery provides versioning, replication, and regional distribution of custom images, ensuring that the hardened OS is readily available for rapid deployment across multiple regions. This aligns with the requirement for a preapproved image that meets security and compliance standards.

Answer

A temporary public IP address.

Answer

A network security group rule.

Answer

An Azure Monitor alert rule.

Question 3

A web app in a subnet must access a storage account through the storage account's public FQDN. Access must be limited to that single subnet, and the team does not want to deploy a private endpoint or manage private DNS records. Which configuration should you use?

Accepted Answer

Enable a service endpoint on the subnet and allow that subnet in the storage account network rules.. A service endpoint on the subnet allows the web app to access the storage account via its public FQDN while restricting access to that specific subnet. By enabling the Microsoft.Storage service endpoint on the subnet and adding the subnet's virtual network rule to the storage account's network rules, traffic from the subnet to the storage account's public endpoint is routed through the Azure backbone network, and only traffic from that subnet is permitted. This meets the requirement of limiting access without deploying a private endpoint or managing private DNS records.

Answer

Deploy a private endpoint and private DNS zone.

Answer

Add a route table that sends storage traffic to an NVA.

Answer

Place the storage account behind a public load balancer.

Question 4

Based on the exhibit, which Network Watcher tool should the administrator use to identify the exact NSG rule that is blocking TCP 1433 traffic?

Accepted Answer

IP flow verify. IP flow verify is the correct Network Watcher tool because it tests whether a packet is allowed or denied to or from a specific virtual machine based on a 5-tuple (source IP, destination IP, source port, destination port, and protocol). By specifying TCP 1433 as the destination port, the tool evaluates all effective security rules (NSG and ASG) and returns the exact rule name and direction that is blocking the traffic.

Answer

Connection troubleshoot

Answer

Next hop

Answer

Packet capture

Question 5

A storage account must be reachable only from resources in a specific Azure subnet, and connections must not use the public endpoint. Which option should the administrator configure?

Accepted Answer

A private endpoint for the storage account in the subnet.. A private endpoint assigns the storage account a private IP address from the subnet, effectively bringing the service into the virtual network. This ensures all traffic to the storage account stays within the Microsoft Azure backbone and never traverses the public internet, meeting the requirement that connections must not use the public endpoint.

Answer

A service endpoint on the subnet, because it keeps traffic on the Azure backbone.

Answer

A NAT gateway attached to the subnet.

Answer

A storage firewall rule that allows all Azure services.

Question 6

After a private endpoint for an Azure Blob Storage account is created, VMs in the same VNet still resolve the storage name to the public IP address. The administrator wants the name to resolve to the private endpoint address instead. What should be configured?

Accepted Answer

Link the private DNS zone for blob storage to the virtual network.. When a private endpoint is created for Azure Blob Storage, the private DNS zone (privatelink.blob.core.windows.net) must be linked to the virtual network to enable automatic resolution of the storage account's FQDN to the private endpoint's private IP address. Without this link, VMs in the VNet continue to use public DNS resolution, which returns the public IP. Linking the private DNS zone to the VNet ensures that DNS queries from VMs resolve to the private endpoint address via Azure's DNS infrastructure.

Answer

Create a route table that sends storage traffic to the private endpoint subnet.

Answer

Enable a service endpoint on the subnet that hosts the VMs.

Answer

Assign a public IP address to the private endpoint subnet.

Question 7

Based on the exhibit, which image source should the administrator use to deploy the same approved server build again?

Accepted Answer

A custom image stored in Azure Compute Gallery.. A custom image stored in Azure Compute Gallery (formerly Shared Image Gallery) is the correct choice because it allows the administrator to capture a generalized VM image that includes the exact OS configuration, applications, and settings of the approved server build. This image can then be used repeatedly to deploy identical VMs, ensuring consistency across deployments. Azure Compute Gallery supports versioning and replication across regions, making it the ideal solution for maintaining and distributing a standardized server build.

Answer

A public marketplace Windows Server image.

Answer

A snapshot of the VM operating system disk.

Answer

A temporary disk attached to the VM.

Question 8

A storage account must stay reachable through its public endpoint, but only Azure workloads in AppSubnet should be allowed to access it. No private IP is required. What should you configure?

Accepted Answer

A service endpoint on AppSubnet and a storage firewall VNet rule.. A service endpoint on AppSubnet extends the Azure backbone network to the subnet, allowing traffic to the storage account's public endpoint without a private IP. The storage firewall VNet rule then restricts access to only traffic originating from that specific subnet, meeting the requirement of public endpoint reachability with Azure workload-only access.

Answer

A private endpoint in AppSubnet.

Answer

A VPN gateway between AppSubnet and the storage account.

Answer

A public IP address on the storage account.

Question 9

You deploy a private endpoint for an Azure Storage account. Virtual machines in VNet-App must resolve the storage account name to the private IP address of the endpoint instead of the public endpoint. What should you configure?

Accepted Answer

A private DNS zone linked to VNet-App.. A private endpoint requires DNS resolution to map the storage account's fully qualified domain name (FQDN) to its private IP address. By creating a private DNS zone (privatelink.blob.core.windows.net) and linking it to VNet-App, Azure automatically creates an A-record pointing to the private endpoint's IP, ensuring VMs resolve the storage account name privately instead of via the public endpoint.

Answer

A network security group on the subnet.

Answer

A public DNS zone for the storage account name.

Answer

A user-defined route table on the subnet.

Question 10

A developer wants to publish an internet-facing application from source code. Required capabilities include built-in HTTPS, deployment slots, and autoscale, but the team does not want to manage the operating system. Which Azure service should the administrator choose?

Accepted Answer

Azure App Service. Azure App Service is the correct choice because it provides a fully managed platform for hosting web applications with built-in HTTPS support, deployment slots for staging and swapping, and autoscale capabilities. It abstracts the underlying operating system, allowing the team to focus on code without managing infrastructure.

Answer

Azure Container Instances

Answer

Azure Virtual Machines

Answer

Azure Kubernetes Service

Question 11

An administrator accidentally deletes a VM backup item from a Recovery Services vault. The company wants a built-in protection feature that helps recover the deleted backup item during the retention window. Which feature is this?

Accepted Answer

Soft delete. Soft delete is a built-in protection feature for Azure Recovery Services vaults that preserves deleted backup data for an additional 14 days (default retention period) after deletion. When a backup item is accidentally deleted, soft delete retains the data in a 'soft deleted' state, allowing administrators to recover it within the retention window before permanent deletion occurs. This feature is enabled by default for new vaults and helps prevent data loss from accidental or malicious deletions.

Answer

Archive tier

Answer

Availability zones

Answer

Private endpoint

Question 12

A line-of-business application must keep running even if one datacenter in an Azure region has an outage. Which deployment option should you choose for the VMs?

Accepted Answer

Availability zones. Availability zones (Option C) are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across two or more zones ensures that if one datacenter fails, the application continues running in the other zone, meeting the requirement for resilience against a single datacenter outage.

Answer

An availability set

Answer

A single virtual machine with Premium SSD

Answer

A proximity placement group

Question 13

A platform team created a BlobStorage account for application logs. Later they discovered the same account must also host an Azure Files share for a Linux automation server, and lifecycle rules must continue to manage blob tiers. Standard performance is sufficient. What should they do?

Accepted Answer

Recreate the storage as a StorageV2 general-purpose v2 account. A BlobStorage account is a specialized storage account that supports only block blobs and append blobs, not Azure Files shares. To host both blobs and Azure Files, you need a general-purpose v2 (StorageV2) account, which supports all Azure Storage services including blobs, files, queues, and tables, while also allowing lifecycle management policies for blob tiering. Recreating the account as StorageV2 meets both requirements without sacrificing blob lifecycle rules.

Answer

Keep the BlobStorage account and add a private endpoint

Answer

Convert the account to Premium Block Blob storage

Answer

Create a separate file server VM and keep the BlobStorage account unchanged

Question 14

An external consultant from another company needs read-only access to a resource group and must sign in with their own work account. What should be created in Microsoft Entra ID?

Accepted Answer

A guest user account. B is correct because a guest user account in Microsoft Entra ID (formerly Azure AD) allows an external user from another organization to sign in using their own work account (via B2B collaboration) and be granted read-only access to a specific resource group. This leverages the existing identity provider of the external consultant, eliminating the need to create a separate identity in the company tenant.

Answer

A member user account in the company tenant

Answer

A Microsoft 365 group

Answer

A service principal

Question 15

An on-premises application connected through a site-to-site VPN must read data from an Azure Storage account. Public network access is disabled on the storage account, and the storage service must be reachable only by a private IP address inside Azure. Which solution should the administrator implement?

Accepted Answer

Create a private endpoint for the storage account in an Azure VNet.. A private endpoint assigns the storage account a private IP address from an Azure VNet, allowing the on-premises application to connect over the site-to-site VPN using that private IP. This ensures the storage service is reachable only within Azure's private network, even with public network access disabled. The private endpoint uses Azure Private Link to securely expose the storage account into the VNet, making it accessible via the VPN without traversing the public internet.

Answer

Enable a service endpoint on the on-premises network.

Answer

Peer the on-premises network directly to the storage account.

Answer

Use a shared access signature and leave public network access enabled.