AZ-104 Practice Test 22 — 15 Questions

Question 1

A security team requires all outbound traffic from a subnet to pass through an Azure Firewall at 10.1.0.4, including internet-bound traffic from the VMs. What should the administrator configure?

Accepted Answer

Create a route table with a 0.0.0.0/0 route to 10.1.0.4 and associate it with the subnet.. Creating a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP (10.1.0.4) and associating it with the subnet forces all outbound traffic, including internet-bound traffic, to be routed through the firewall. This ensures the firewall can inspect and control all egress traffic as required by the security team.

Answer

Assign a NAT gateway to the subnet and leave the default routing in place.

Answer

Enable service endpoints for the subnet so outbound traffic stays private.

Answer

Deploy a public IP on each VM and use NSG rules to inspect the traffic.

Question 2

Two app VMs must stay available during planned host maintenance in the same region. Datacenter-level redundancy is not required, but the VMs should be spread across update domains. What should you configure?

Accepted Answer

Availability set. An availability set logically groups VMs to protect against planned maintenance events by distributing them across up to 3 fault domains and 20 update domains. This ensures that during host maintenance, only one update domain is taken offline at a time, keeping the other VMs available. Since datacenter-level redundancy is not required, an availability set is the correct choice.

Answer

Availability zone

Answer

Azure Backup

Answer

Managed disk

Question 3

You need to ensure that a finance analyst can view all resources in the Finance-Sub subscription and also view spending details, but cannot create, modify, or delete any resources. Which built-in Azure RBAC role should you assign?

Accepted Answer

Reader. The Reader role is the correct choice because it provides read-only access to all resources in a subscription, including the ability to view resource properties and deployment history, but it does not allow any create, modify, or delete operations. Additionally, the Reader role includes the 'Microsoft.CostManagement/views/read' permission, which enables viewing spending details (cost data) in the Azure portal. This aligns exactly with the requirement to view resources and spending without making changes.

Answer

Owner

Answer

Contributor

Answer

Virtual Machine Contributor

Question 4

A production virtual machine is experiencing intermittent performance spikes. The operations team wants an alert when average CPU usage stays above 80 percent for 10 minutes and wants email and SMS notifications sent automatically. What should the administrator configure in Azure Monitor?

Accepted Answer

Create a metric alert on Percentage CPU and associate an action group with email and SMS receivers.. Azure Monitor metric alerts can evaluate real-time performance counters like Percentage CPU against a threshold (e.g., 80%) over a specified duration (e.g., 10 minutes). By associating an action group with email and SMS receivers, the alert automatically triggers the desired notifications without requiring log ingestion or complex queries.

Answer

Create a log search alert on the VM performance data and attach a resource lock.

Answer

Assign an Azure Policy definition to the VM to stop it when CPU exceeds the threshold.

Answer

Enable diagnostic settings on the VM and send the data only to a storage account.

Question 5

You want to send a storage account's read, write, and delete events to a Log Analytics workspace for later investigation. Which feature should you configure?

Accepted Answer

Diagnostic settings for the storage account. Diagnostic settings on a storage account allow you to stream resource logs, including read, write, and delete operations (stored in the StorageRead, StorageWrite, and StorageDelete log categories), to a Log Analytics workspace. This is the correct feature for capturing and analyzing these events for later investigation.

Answer

An action group

Answer

A metric alert rule

Answer

A Recovery Services vault

Question 6

Based on the exhibit, two development virtual networks must be peered so the workloads can exchange traffic directly. What should the administrator do first?

Accepted Answer

Change one VNet to a non-overlapping address space before creating the peering.. Azure Virtual Network peering requires that the address spaces of the peered VNets do not overlap. Overlapping address spaces cause routing conflicts because Azure cannot determine which VNet should receive traffic destined for the overlapping range. Therefore, the administrator must first change one VNet to a non-overlapping address space before creating the peering.

Answer

Create a VPN gateway in each VNet before attempting peering.

Answer

Add a user-defined route to each subnet so the VNets can ignore the overlap.

Answer

Enable service endpoints on both VNets to allow cross-network communication.

Question 7

A VM-based application needs to read from Azure Storage without storing a password, access key, or other secret in code or configuration. The identity should also be removed automatically if the VM is deleted. What should you enable?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is the correct choice because it is tied directly to the lifecycle of the Azure VM: when the VM is deleted, the identity is automatically removed. It allows the VM to authenticate to Azure Storage without storing any secrets in code or configuration, using Microsoft Entra ID tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254.

Answer

A user-assigned managed identity

Answer

A storage account access key

Answer

A shared access signature

Question 8

A storage account is accessed from a VM in VNet A through a private endpoint. A VM in peered VNet B can connect to the storage account by IP, but when it uses the storage account name, it resolves to the public endpoint. What should the administrator configure?

Accepted Answer

Link the private DNS zone for the storage account to VNet B.. The VM in VNet B can reach the storage account by IP because the private endpoint is accessible over the VNet peering, but DNS resolution still returns the public IP because the private DNS zone (privatelink.blob.core.windows.net) is not linked to VNet B. By linking the private DNS zone to VNet B, the VM will resolve the storage account name to the private endpoint IP, ensuring connectivity over the Microsoft backbone instead of the public internet.

Answer

Enable a service endpoint on VNet B for Microsoft.Storage.

Answer

Assign the VM in VNet B a managed identity.

Answer

Create a route table that points storage traffic to the private endpoint subnet.

Question 9

A VM in VNet B can reach a blob storage account through a private endpoint that was created in peered VNet A. The storage FQDN still resolves to the public IP when queried from VNet B, so the VM does not use the private path. What should the administrator change?

Accepted Answer

Link the private DNS zone used by the private endpoint to VNet B. The private endpoint in VNet A creates a private IP for the storage account, but DNS resolution in VNet B still returns the public IP because the private DNS zone (privatelink.blob.core.windows.net) is not linked to VNet B. By linking the private DNS zone to VNet B, the VM will resolve the storage FQDN to the private IP, ensuring traffic uses the private endpoint path through the VNet peering.

Answer

Add a service endpoint for Microsoft.Storage to VNet B

Answer

Disable the storage account firewall completely

Answer

Move the storage account into VNet B

Question 10

A compliance team wants to identify all resources in a department that are missing an Environment tag, but they do not want to stop users from creating or changing resources. Which two choices should the administrator make? Select two.

Accepted Answer

Use an Azure Policy assignment with the Audit effect.. The Audit effect in Azure Policy allows the compliance team to identify resources missing an Environment tag without blocking resource creation or modification. This effect logs non-compliant resources to the activity log, enabling visibility without enforcement. Option B is correct because assigning the policy at the management group scope ensures it applies to all subscriptions within that department, covering all resources under a single governance boundary.

Answer

Use the Deny effect.

Answer

Grant Reader on the subscription to the compliance team.

Answer

Apply a ReadOnly lock to all resource groups.

Question 11

A developer already has permission to create resource groups. The company wants to allow deployments only in the East US and West US regions. Which service should enforce this rule?

Accepted Answer

Azure Policy, because it can restrict which regions are allowed for deployments.. Azure Policy is the correct service because it enforces organizational rules by evaluating resource configurations against policy definitions. In this scenario, a built-in or custom policy can restrict allowed regions for all resources, ensuring deployments only occur in East US and West US. Unlike RBAC, which controls who can perform actions, Azure Policy controls what resource configurations are permitted, making it the appropriate tool for region restriction.

Answer

Azure RBAC, because region selection is part of user permissions.

Answer

A network security group, because it can block unsupported regions.

Answer

A read-only lock, because it limits changes to approved regions.

Question 12

An organization has one Azure subscription with separate resource groups for Development and Operations. A contractor must start, stop, and read the properties of virtual machines only in RG-Operations. The contractor must not have access to virtual machines in RG-Development. Where should the role assignment be created?

Accepted Answer

At the RG-Operations resource group scope. Role assignments in Azure are inherited from higher scopes (management group, subscription, resource group) down to lower scopes. To grant the contractor the Virtual Machine Contributor role (or a custom role with start/stop/read permissions) only on VMs in RG-Operations and explicitly deny access to RG-Development, the assignment must be scoped to the RG-Operations resource group. Assigning at a higher scope (subscription or management group) would grant access to all resource groups, including RG-Development, violating the requirement.

Answer

At the subscription scope

Answer

At the management group scope

Answer

At an individual virtual machine scope

Question 13

Based on the exhibit, a user deleted one file from a Windows Azure VM. The VM is still running, and the administrator wants to restore only that file instead of recovering the full machine. Which restore approach should be used?

Accepted Answer

Mount the recovery point and copy the file back to the VM.. Azure VM backup allows you to mount a recovery point as a disk on another VM or the same VM, enabling file-level restore without overwriting the entire VM. This approach uses the 'File Recovery' feature of Azure Backup, which presents the recovery point as an iSCSI target that can be mounted and browsed to copy individual files back to the running VM.

Answer

Use the VM restore option and overwrite the entire VM.

Answer

Increase the VM size and redeploy the workload.

Answer

Enable a diagnostic setting on the VM and recover the file from logs.

Question 14

An administrator wants to send a virtual machine's guest logs to a central workspace so they can search them later with queries. Which configuration should be created on the VM or its resource provider first?

Accepted Answer

A diagnostic setting. A diagnostic setting is the correct configuration because it enables the streaming of guest OS logs (e.g., System, Application, Security event logs) from an Azure virtual machine to a Log Analytics workspace. This is done by installing the Azure Monitor Agent (AMA) or legacy Log Analytics agent on the VM and then configuring a data collection rule or diagnostic setting to specify which logs to send and the destination workspace. Without this setting, the VM's guest logs remain local and cannot be queried centrally.

Answer

A role assignment at the subscription scope

Answer

A private endpoint

Answer

A lock on the VM resource group

Question 15

You are deploying a new Windows VM and want it to start with the same custom software and configuration that already exist on an approved production VM. What should you use as the source for the new VM?

Accepted Answer

A custom image. A custom image captures the exact OS configuration, installed software, and settings from a source VM, allowing you to deploy new VMs with identical customizations. Unlike a marketplace image, which provides only a generic OS, a custom image preserves all modifications made to the approved production VM, including applications and system tweaks.

Answer

A marketplace image

Answer

A snapshot of the OS disk

Answer

An availability set