AZ-104 Practice Test 23 — 15 Questions

Question 1

After applying a custom image, a Linux VM stops at a black screen before the sign-in prompt. The administrator cannot use RDP or SSH and needs the fastest way to inspect the boot process. Which two actions should they take? Select two.

Accepted Answer

Enable Boot diagnostics on the virtual machine.. Enabling Boot diagnostics on the virtual machine allows the administrator to capture serial console output and screenshots of the VM during boot. This is the fastest way to inspect the boot process without requiring network connectivity (RDP/SSH), as the serial log provides kernel-level messages and the screenshot shows the display state at the point of failure.

Answer

Reimage the VM immediately to a clean managed disk.

Answer

Increase the VM size to a larger SKU.

Answer

Reset the network interface configuration from the portal.

Question 2

A compliance team wants to bundle three policy definitions—allowed locations, required cost center tags, and approved VM sizes—so they can assign them together to a management group and review compliance in one place. Later they want to exempt one pilot subscription from the entire set for 60 days. What should they use?

Accepted Answer

A policy initiative at the management group scope.. A policy initiative (also called a policy set) allows you to group multiple policy definitions into a single, reusable bundle. By assigning the initiative at the management group scope, all three policies apply together to every subscription under that group. When the pilot subscription needs an exemption, you can create an exemption resource on that subscription for the entire initiative, specifying a 60-day expiration, which temporarily excludes it from all bundled policies while keeping compliance reporting unified.

Answer

A custom RBAC role with resource permissions for policy management.

Answer

A resource lock on the pilot subscription.

Answer

A separate management group for each of the three policy definitions.

Question 3

A 180-GB blob is in the Archive tier. A legal team needs the file available later today and expects to open it several times during review. Which two actions should the administrator take? Select two.

Accepted Answer

Initiate rehydration of the blob to the Hot tier.. Rehydrating the blob from Archive to Hot tier makes it immediately accessible for frequent reads, as the Hot tier is optimized for high access rates. The legal team needs to open the file several times later today, so Hot tier is appropriate. Option A is correct because it explicitly initiates the rehydration process to a tier that supports frequent access.

Answer

Leave the blob in Archive and rely on first access to trigger rehydration.

Answer

Copy the blob to a new container and keep it in Archive.

Answer

Apply a lifecycle rule that moves the blob to Cool after rehydration completes.

Question 4

A build pipeline needs to run a Linux container for 10 to 15 minutes at a time. The team does not want to manage servers, clusters, or an always-on VM. Which Azure service should be used?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice because it allows you to run a Linux container directly on Azure without provisioning or managing any underlying infrastructure. ACI is ideal for short-lived, burstable workloads like a build pipeline that runs for 10–15 minutes, as it supports per-second billing and automatic startup/shutdown without the overhead of a cluster or VM.

Answer

Azure Kubernetes Service

Answer

Azure Virtual Machine

Answer

Azure App Service

Question 5

Based on the exhibit, what should the administrator configure so the container group can pull the private image without storing registry credentials?

Accepted Answer

Assign a managed identity to the container group and grant it AcrPull on the registry.. Option A is correct because Azure Container Groups support managed identities, which allow the container group to authenticate to Azure Container Registry (ACR) without storing any credentials. By assigning a system-assigned or user-assigned managed identity to the container group and granting it the AcrPull role on the registry, the container runtime can use Azure AD authentication to pull the private image. This eliminates the need to store registry admin credentials or SAS tokens in the container configuration.

Answer

Store the ACR admin account password in a container environment variable.

Answer

Use a SAS token for the container image reference.

Answer

Place the registry in the same resource group as the container group.

Question 6

An administrator creates a route table with a UDR for 10.20.0.0/16 and next hop type Virtual appliance. A VM in the subnet still does not send that traffic to the appliance. The route table contents are correct. What should be checked first?

Accepted Answer

Whether the route table is associated with the correct subnet.. The most common reason a UDR fails to take effect is that the route table is not associated with the subnet containing the VM. Even if the route table contents are correct, the VM's traffic will follow default system routes unless the route table is explicitly linked to the subnet. Association is a required step to override Azure's default routing behavior.

Answer

Whether the NSG has an outbound deny rule for port 80.

Answer

Whether the VM uses a managed identity.

Answer

Whether the virtual machine is in an availability set.

Question 7

A route table contains these entries: 10.0.0.0/8 with next hop Virtual appliance, and 10.1.1.0/24 with next hop Virtual network gateway. Which next hop will Azure use for traffic to 10.1.1.5?

Accepted Answer

Virtual network gateway, because the /24 route is more specific than the /8 route.. Azure uses the most specific route prefix (longest prefix match) to determine the next hop for traffic. For destination 10.1.1.5, the route 10.1.1.0/24 (prefix length 24) is more specific than 10.0.0.0/8 (prefix length 8), so the next hop Virtual network gateway is selected, regardless of the order in which routes were created.

Answer

Virtual appliance, because the broader 10.0.0.0/8 route was created first.

Answer

Internet, because Azure always prefers the default system route for public addresses.

Answer

None, because Azure ignores overlapping route entries in the same table.

Question 8

A VM in a spoke subnet must send all traffic destined for 172.16.0.0/12 to a firewall appliance at 10.1.1.4. All other destinations should continue to use Azure system routes. Which user-defined route should the administrator add to the subnet route table?

Accepted Answer

Destination 172.16.0.0/12 with next hop Virtual appliance and next hop address 10.1.1.4.. Option B is correct because a user-defined route (UDR) with destination 172.16.0.0/12 and next hop type 'Virtual appliance' (with IP 10.1.1.4) overrides the default Azure system route for that prefix, forcing all traffic to the 172.16.0.0/12 range through the firewall at 10.1.1.4. This satisfies the requirement while leaving all other destinations (including 0.0.0.0/0) to be handled by Azure's default system routes.

Answer

Destination 0.0.0.0/0 with next hop Internet.

Answer

Destination 172.16.0.0/12 with next hop Virtual network gateway.

Answer

Destination 172.16.0.0/12 with next hop None.

Question 9

Frontend VMs in one subnet must reach backend VMs on TCP 8443. The backend VMs are rebuilt frequently, so their private IP addresses change often. The administrator wants to avoid updating NSG rules every time the backend IPs change. What should be used in the NSG rule?

Accepted Answer

Application Security Groups for the frontend and backend tiers.. Application Security Groups (ASGs) allow you to group VMs logically by function (e.g., frontend, backend) and reference those groups in NSG rules. Since the backend VMs are rebuilt frequently and their private IPs change, using ASGs in the NSG rule (source = frontend ASG, destination = backend ASG, port = 8443) eliminates the need to update IP addresses manually. The NSG rule remains valid as long as the VMs are assigned to the correct ASG, regardless of IP changes.

Answer

A service endpoint on the backend subnet.

Answer

A route table with a next hop of Virtual network gateway.

Answer

A private endpoint for each backend VM.

Question 10

A bootstrap script must install software on three VMs, then download configuration files from Blob Storage. Security forbids secrets in templates or scripts, and the same authentication method must work after the VMs are rebuilt. Which two choices should you make? Select two.

Accepted Answer

Assign a user-assigned managed identity and attach it to each VM.. Option A is correct because a user-assigned managed identity provides a secure, credential-free authentication method that persists across VM rebuilds. Unlike system-assigned managed identities, which are tied to a specific VM lifecycle and are lost when the VM is deleted, a user-assigned identity is a standalone Azure resource that can be reassigned to new VMs. This allows the bootstrap script to authenticate to Azure Blob Storage via Azure AD without storing any secrets, satisfying the security constraint.

Answer

Store the storage account access key in a script variable.

Answer

Create a separate local administrator account for the script to use.

Answer

Embed a SAS token directly in the Bicep parameters file.

Question 11

A team needs to deploy 25 identical Ubuntu VMs every month from source control. The deployment must be repeatable, and each VM must include a system-assigned managed identity at creation time. Which approach should be used?

Accepted Answer

A Bicep template deployment.. A Bicep template is an Infrastructure as Code (IaC) solution that declaratively defines Azure resources, including VMs with system-assigned managed identities. It ensures repeatable, version-controlled deployments of 25 identical Ubuntu VMs every month, meeting the requirements for automation and identity assignment at creation time.

Answer

Azure portal manual creation of each VM.

Answer

An Azure Policy assignment at the subscription level.

Answer

An Azure Monitor alert rule that triggers VM creation.

Question 12

A team needs to run a Linux container for 15 to 20 minutes at a time, triggered by an external system. They do not want to manage servers, clusters, or a web framework. Which Azure service is the best fit?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the best fit because it allows you to run a container directly in Azure without managing any underlying servers or orchestrators. The service is designed for short-lived, burst workloads (like 15–20 minutes) and can be triggered on-demand via an external system (e.g., HTTP request, Azure Logic Apps, or SDK). ACI automatically starts the container, runs it, and then stops and deallocates resources when the task completes, matching the exact requirement of no server, cluster, or web framework management.

Answer

Azure App Service

Answer

Azure Kubernetes Service

Answer

A virtual machine

Question 13

A finance application stores monthly invoice PDFs in Azure Blob Storage. The data must survive a single availability zone outage in the region, and the storage account must be reachable only through a private IP from AppSubnet. Public network access must not be available. Which three actions should the administrator take? Select three.

Accepted Answer

Create the storage account with zone-redundant storage (ZRS).. Option A is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the same region, ensuring data durability even if one entire zone fails. This meets the requirement to survive a single availability zone outage.

Answer

Use locally redundant storage (LRS) because it stays inside one datacenter.

Answer

Enable a service endpoint on AppSubnet instead of using a private endpoint.

Question 14

A backend VM must accept TCP 8443 only from the web tier. The subnet NSG already has a deny-all inbound rule at priority 200. The administrator adds an allow rule for the web tier at priority 300, but the connection still fails. What should be changed?

Accepted Answer

Change the allow rule to a lower priority number than 200.. Azure Network Security Groups (NSGs) process rules in priority order, with lower numbers evaluated first. The existing deny-all inbound rule at priority 200 is evaluated before the new allow rule at priority 300, so the deny rule blocks the traffic before the allow rule can be considered. To permit TCP 8443 from the web tier, the allow rule must have a priority number lower than 200 (e.g., 100) so it is evaluated first and allows the traffic.

Answer

Change the allow rule protocol from TCP to Any.

Answer

Move the VM to a different subnet so the rule can apply.

Answer

Add a route table entry for TCP 8443 to bypass the NSG.

Question 15

A team is creating a subnet for 48 small Linux VMs, two internal load balancer frontend IPs, and one Azure Bastion host. Azure reserves five IP addresses in every subnet. Which subnet prefix is the smallest that will still meet the requirement?

Accepted Answer

/26. The correct answer is /26 because it provides 64 total IP addresses, of which Azure reserves 5, leaving 59 usable IPs. This is the smallest prefix that accommodates the 48 VMs, 2 load balancer frontend IPs, and 1 Bastion host (total 51 required IPs). A /27 would only yield 32 total IPs (27 usable), which is insufficient.

Answer

/27

Answer

/25

Answer

/28