AZ-104 Practice Test 23 — 15 Questions

Question 1

A workload subnet must send all outbound internet traffic through a network virtual appliance at 10.4.2.4. What should the administrator configure?

Accepted Answer

A route table with a user-defined route sending 0.0.0.0/0 to 10.4.2.4.. A user-defined route (UDR) with a destination of 0.0.0.0/0 and a next hop of Virtual Appliance (10.4.2.4) overrides the default system route for internet traffic, forcing all outbound traffic from the subnet to be forwarded to the network virtual appliance (NVA) for inspection or NAT. This is the standard method to implement forced tunneling or centralized internet egress in Azure.

Answer

An NSG rule that allows outbound traffic to 10.4.2.4.

Answer

A private DNS zone for the subnet.

Answer

A service endpoint for the virtual network.

Question 2

After enabling Azure VM backup, an administrator wants to confirm whether the nightly backup succeeded. Where should the administrator check the backup status?

Accepted Answer

In the Recovery Services vault backup jobs. The correct place to check backup status is the Recovery Services vault backup jobs. When Azure VM backup is enabled, each backup operation creates a job entry in the associated Recovery Services vault. The 'Backup Jobs' blade within the vault lists all backup jobs, their status (e.g., Completed, Failed, In Progress), and details like start time and error messages. This is the centralized monitoring point for backup operations, as defined by Azure Backup's job-based monitoring model.

Answer

In the VM's network security group

Answer

In the VM's availability set

Answer

In the subscription activity log only

Question 3

A contractor needs temporary read-only access to a single blob container for three hours. The contractor does not have an Azure user account in your tenant. Which method is the best fit?

Accepted Answer

Issue a shared access signature with read-only permissions and an expiration time. A shared access signature (SAS) is the best fit because it provides time-limited, delegated access to a specific resource (a blob container) without requiring an Microsoft Entra ID identity. The contractor can use the SAS URL to access the container with read-only permissions for exactly three hours, after which the token expires automatically. This meets the requirement of temporary access for an external user who does not have an Azure account in your tenant.

Answer

Create a new managed identity for the contractor

Answer

Give the contractor the storage account access key

Answer

Enable anonymous public access on the container

Question 4

A team wants one Azure Files share to be used by both Windows and Linux virtual machines. Which two mounting approaches are valid? Select two.

Accepted Answer

Map the share on Windows by using the built-in SMB client.. Windows includes a built-in SMB client that can directly map an Azure Files share using its UNC path (e.g., \storageaccount.file.core.windows.net\sharename). This leverages the SMB 3.0 protocol, which Azure Files supports over the public internet with encryption, requiring no additional gateway or VPN.

Answer

Mount the share on Linux by using the Azure Blob service endpoint.

Answer

Use an Azure VPN gateway to make the file share mount possible.

Answer

Use an Azure load balancer to present the share to both VMs.

Question 5

An Azure virtual machine was moved to a host that is experiencing intermittent issues. You need to move the VM to a different Azure host while keeping the existing managed disks and configuration. Which action should you perform?

Accepted Answer

Redeploy. Redeploying the VM (Option C) is the correct action because it moves the VM to a new Azure host node while preserving the existing managed disks, virtual network, and configuration. The Azure platform automatically selects a healthy host, resolves transient hardware issues, and maintains the VM's identity and associated resources.

Answer

Stop

Answer

Restart

Answer

Capture

Question 6

A Windows file server VM must mount an Azure file share by using domain credentials instead of a storage account key. The organization already manages users in Active Directory Domain Services. Which authentication option should be configured for Azure Files?

Accepted Answer

Identity-based authentication with Active Directory Domain Services.. Azure Files supports identity-based authentication using Active Directory Domain Services (AD DS), which allows domain-joined Windows VMs to mount Azure file shares using their existing domain credentials instead of a storage account key. This enables Kerberos-based authentication and preserves NTFS permissions, meeting the requirement to avoid shared key access.

Answer

Shared key authentication, because it is the default for Azure file shares.

Answer

A service SAS created for the share and mapped as a network drive.

Answer

Anonymous access with public network restrictions disabled.

Question 7

A web tier and API tier run in different subnets. The API subnet NSG currently has Deny-8443 from Any at priority 200 and Allow-8443-WebToApi from ASG-Web to ASG-Api at priority 300. Web requests on TCP 8443 are failing. Which two changes should the administrator make? Select two.

Accepted Answer

Move the allow rule to a lower priority number than 200.. B is correct because NSG rules are evaluated in priority order, with lower numbers having higher priority. The Deny-8443 rule at priority 200 is evaluated before the Allow-8443-WebToApi rule at priority 300, so the deny rule blocks the traffic. Moving the allow rule to a lower priority number (e.g., 100) ensures it is evaluated first, allowing the traffic. C is correct because the allow rule uses application security groups (ASGs); if the web and API NICs are not assigned to the respective ASGs, the rule will not match any traffic, effectively making it a no-op.

Answer

Move the allow rule to a higher priority number than 200.

Answer

Change the rule protocol from TCP to Any.

Answer

Attach a route table to the API subnet to override the deny behavior.

Question 8

A development VM is rebuilt often and does not need its operating system disk contents to survive deallocation. The team wants the lowest practical disk latency for the OS. Which disk option should the administrator choose?

Accepted Answer

Ephemeral OS disk. Ephemeral OS disks use the local VM storage (SSD) rather than Azure managed disks, providing the lowest latency for OS read/write operations. Since the VM is rebuilt often and disk persistence is not required, the ephemeral disk is ideal because its contents are lost when the VM is deallocated, eliminating the need for a separate managed disk.

Answer

Standard HDD managed disk

Answer

Geo-redundant storage for the OS disk

Answer

A data disk formatted as the boot disk

Question 9

A VM in a spoke subnet must send all traffic destined for 172.16.0.0/12 to a firewall appliance at 10.1.1.4. All other destinations should continue to use Azure system routes. Which user-defined route should the administrator add to the subnet route table?

Accepted Answer

Destination 172.16.0.0/12 with next hop Virtual appliance and next hop address 10.1.1.4.. A user-defined route (UDR) with destination 172.16.0.0/12 and next hop type 'Virtual appliance' (with IP 10.1.1.4) overrides the default Azure system route for that prefix, forcing all traffic to the 172.16.0.0/12 range through the firewall at 10.1.1.4. This satisfies the requirement while leaving all other destinations (including 0.0.0.0/0) to be handled by Azure's default system routes.

Answer

Destination 0.0.0.0/0 with next hop Internet.

Answer

Destination 172.16.0.0/12 with next hop Virtual network gateway.

Answer

Destination 172.16.0.0/12 with next hop None.

Question 10

A single Azure virtual machine must read blobs from a storage account without storing any passwords, keys, or connection strings. The identity should be removed automatically if the VM is deleted. Which option should you use?

Accepted Answer

System-assigned managed identity, because it is tied to that VM.. System-assigned managed identity is tied directly to the lifecycle of the Azure VM. When the VM is deleted, the identity is automatically removed. It allows the VM to authenticate to Azure Storage without storing any credentials, using Microsoft Entra ID tokens obtained via the Azure Instance Metadata Service (IMDS).

Answer

Storage account access key, because it is the simplest authentication method.

Answer

Shared access signature, because it always removes the need for identity management.

Answer

User-assigned managed identity, because it is deleted automatically with the VM.

Question 11

A company wants development and production workloads for the same application to have separate budgets, separate subscription administrators, and different access controls. The central IT team still wants to apply the same security policies to both environments. What is the best design?

Accepted Answer

Create a separate subscription for dev and prod, then place both subscriptions under the same management group. It uses separate subscriptions for development and production, which provides independent budget tracking, subscription-level role assignments, and separate administrators. Placing both subscriptions under the same management group allows the central IT team to apply consistent Azure Policy and RBAC security policies across both environments via the management group hierarchy, ensuring governance without compromising isolation.

Answer

Use one subscription and separate the environments with tags only

Answer

Use one management group and two resource groups, one for dev and one for prod

Answer

Put production in a management group and development in a resource group

Question 12

A company wants to enable backup for an Azure virtual machine and later restore the VM if needed. Which Azure service should the administrator use to manage the backup plan and restores?

Accepted Answer

Recovery Services vault. The Recovery Services vault is the correct Azure service for managing backup plans and restores for Azure virtual machines. It provides a centralized management interface for configuring backup policies, performing on-demand backups, and initiating restore operations to recover VMs to a specific point in time.

Answer

Azure Monitor

Answer

Log Analytics workspace

Answer

Azure Front Door

Question 13

Two application VNets are deployed in different Azure regions. Each VNet uses a unique, non-overlapping address space. The application teams want private IP connectivity over the Microsoft backbone with the lowest possible latency between the regions. Which design should the administrator choose?

Accepted Answer

Global VNet peering.. Global VNet peering provides direct, private IP connectivity between two VNets in different Azure regions over the Microsoft backbone, ensuring the lowest possible latency by bypassing the public internet and any intermediate gateways. It uses the Azure infrastructure to route traffic efficiently between the peered VNets, meeting the requirement for private, low-latency communication.

Answer

A site-to-site VPN between the two VNets.

Answer

Azure Traffic Manager with two public endpoints.

Answer

A service endpoint for each application subnet.

Question 14

Based on the exhibit, what should the administrator configure so storage logs can be queried later with KQL?

Accepted Answer

Configure diagnostic settings to send logs to a Log Analytics workspace.. Diagnostic settings in Azure allow you to stream platform logs, including storage logs, to a Log Analytics workspace. Once the logs are in Log Analytics, you can query them using Kusto Query Language (KQL) to analyze storage operations, errors, and metrics. This is the only option that directly enables querying storage logs with KQL.

Answer

Create a backup policy for the storage account so the logs are retained automatically.

Answer

Enable a resource lock on the storage account so no logs are lost.

Answer

Turn on blob versioning so every change to the storage account is searchable.

Question 15

A company has 12 subscriptions under one management group. An external auditor needs Reader access to resources in every current and future subscription under that management group. Where should you assign the role?

Accepted Answer

At the management group scope. Assigning the Reader role at the management group scope ensures that the external auditor inherits read-only access to all current and future subscriptions under that management group. Role assignments at the management group scope are inherited by all child subscriptions and resource groups, making it the single, scalable solution for the requirement.

Answer

At each resource group in each subscription

Answer

At one subscription scope only

Answer

At one resource scope in the first subscription