AZ-104 Practice Test 23 — 15 Questions

Question 1

A developer already has permission to create resource groups. The company wants to allow deployments only in the East US and West US regions. Which service should enforce this rule?

Accepted Answer

Azure Policy, because it can restrict which regions are allowed for deployments.. Azure Policy is the correct service because it enforces organizational rules by evaluating resource configurations against policy definitions. In this scenario, a built-in or custom policy can restrict allowed regions for all resources, ensuring deployments only occur in East US and West US. Unlike RBAC, which controls who can perform actions, Azure Policy controls what resource configurations are permitted, making it the appropriate tool for region restriction.

Answer

Azure RBAC, because region selection is part of user permissions.

Answer

A network security group, because it can block unsupported regions.

Answer

A read-only lock, because it limits changes to approved regions.

Question 2

An organization has one Azure subscription with separate resource groups for Development and Operations. A contractor must start, stop, and read the properties of virtual machines only in RG-Operations. The contractor must not have access to virtual machines in RG-Development. Where should the role assignment be created?

Accepted Answer

At the RG-Operations resource group scope. Role assignments in Azure are inherited from higher scopes (management group, subscription, resource group) down to lower scopes. To grant the contractor the Virtual Machine Contributor role (or a custom role with start/stop/read permissions) only on VMs in RG-Operations and explicitly deny access to RG-Development, the assignment must be scoped to the RG-Operations resource group. Assigning at a higher scope (subscription or management group) would grant access to all resource groups, including RG-Development, violating the requirement.

Answer

At the subscription scope

Answer

At the management group scope

Answer

At an individual virtual machine scope

Question 3

Based on the exhibit, a user deleted one file from a Windows Azure VM. The VM is still running, and the administrator wants to restore only that file instead of recovering the full machine. Which restore approach should be used?

Accepted Answer

Mount the recovery point and copy the file back to the VM.. Azure VM backup allows you to mount a recovery point as a disk on another VM or the same VM, enabling file-level restore without overwriting the entire VM. This approach uses the 'File Recovery' feature of Azure Backup, which presents the recovery point as an iSCSI target that can be mounted and browsed to copy individual files back to the running VM.

Answer

Use the VM restore option and overwrite the entire VM.

Answer

Increase the VM size and redeploy the workload.

Answer

Enable a diagnostic setting on the VM and recover the file from logs.

Question 4

An administrator wants to send a virtual machine's guest logs to a central workspace so they can search them later with queries. Which configuration should be created on the VM or its resource provider first?

Accepted Answer

A diagnostic setting. A diagnostic setting is the correct configuration because it enables the streaming of guest OS logs (e.g., System, Application, Security event logs) from an Azure virtual machine to a Log Analytics workspace. This is done by installing the Azure Monitor Agent (AMA) or legacy Log Analytics agent on the VM and then configuring a data collection rule or diagnostic setting to specify which logs to send and the destination workspace. Without this setting, the VM's guest logs remain local and cannot be queried centrally.

Answer

A role assignment at the subscription scope

Answer

A private endpoint

Answer

A lock on the VM resource group

Question 5

You are deploying a new Windows VM and want it to start with the same custom software and configuration that already exist on an approved production VM. What should you use as the source for the new VM?

Accepted Answer

A custom image. A custom image captures the exact OS configuration, installed software, and settings from a source VM, allowing you to deploy new VMs with identical customizations. Unlike a marketplace image, which provides only a generic OS, a custom image preserves all modifications made to the approved production VM, including applications and system tweaks.

Answer

A marketplace image

Answer

A snapshot of the OS disk

Answer

An availability set

Question 6

A workload subnet must send all outbound internet traffic through a network virtual appliance at 10.4.2.4. What should the administrator configure?

Accepted Answer

A route table with a user-defined route sending 0.0.0.0/0 to 10.4.2.4.. A user-defined route (UDR) with a destination of 0.0.0.0/0 and a next hop of Virtual Appliance (10.4.2.4) overrides the default system route for internet traffic, forcing all outbound traffic from the subnet to be forwarded to the network virtual appliance (NVA) for inspection or NAT. This is the standard method to implement forced tunneling or centralized internet egress in Azure.

Answer

An NSG rule that allows outbound traffic to 10.4.2.4.

Answer

A private DNS zone for the subnet.

Answer

A service endpoint for the virtual network.

Question 7

After enabling Azure VM backup, an administrator wants to confirm whether the nightly backup succeeded. Where should the administrator check the backup status?

Accepted Answer

In the Recovery Services vault backup jobs. The correct place to check backup status is the Recovery Services vault backup jobs. When Azure VM backup is enabled, each backup operation creates a job entry in the associated Recovery Services vault. The 'Backup Jobs' blade within the vault lists all backup jobs, their status (e.g., Completed, Failed, In Progress), and details like start time and error messages. This is the centralized monitoring point for backup operations, as defined by Azure Backup's job-based monitoring model.

Answer

In the VM's network security group

Answer

In the VM's availability set

Answer

In the subscription activity log only

Question 8

A contractor needs temporary read-only access to a single blob container for three hours. The contractor does not have an Azure user account in your tenant. Which method is the best fit?

Accepted Answer

Issue a shared access signature with read-only permissions and an expiration time. A shared access signature (SAS) is the best fit because it provides time-limited, delegated access to a specific resource (a blob container) without requiring an Azure AD identity. The contractor can use the SAS URL to access the container with read-only permissions for exactly three hours, after which the token expires automatically. This meets the requirement of temporary access for an external user who does not have an Azure account in your tenant.

Answer

Create a new managed identity for the contractor

Answer

Give the contractor the storage account access key

Answer

Enable anonymous public access on the container

Question 9

A team wants one Azure Files share to be used by both Windows and Linux virtual machines. Which two mounting approaches are valid? Select two.

Accepted Answer

Map the share on Windows by using the built-in SMB client.. Windows includes a built-in SMB client that can directly map an Azure Files share using its UNC path (e.g., \storageaccount.file.core.windows.net\sharename). This leverages the SMB 3.0 protocol, which Azure Files supports over the public internet with encryption, requiring no additional gateway or VPN.

Answer

Mount the share on Linux by using the Azure Blob service endpoint.

Answer

Use an Azure VPN gateway to make the file share mount possible.

Answer

Use an Azure load balancer to present the share to both VMs.

Question 10

An Azure virtual machine was moved to a host that is experiencing intermittent issues. You need to move the VM to a different Azure host while keeping the existing managed disks and configuration. Which action should you perform?

Accepted Answer

Redeploy. Redeploying the VM (Option C) is the correct action because it moves the VM to a new Azure host node while preserving the existing managed disks, virtual network, and configuration. The Azure platform automatically selects a healthy host, resolves transient hardware issues, and maintains the VM's identity and associated resources.

Answer

Stop

Answer

Restart

Answer

Capture

Question 11

A Windows file server VM must mount an Azure file share by using domain credentials instead of a storage account key. The organization already manages users in Active Directory Domain Services. Which authentication option should be configured for Azure Files?

Accepted Answer

Identity-based authentication with Active Directory Domain Services.. Azure Files supports identity-based authentication using Active Directory Domain Services (AD DS), which allows domain-joined Windows VMs to mount Azure file shares using their existing domain credentials instead of a storage account key. This enables Kerberos-based authentication and preserves NTFS permissions, meeting the requirement to avoid shared key access.

Answer

Shared key authentication, because it is the default for Azure file shares.

Answer

A service SAS created for the share and mapped as a network drive.

Answer

Anonymous access with public network restrictions disabled.

Question 12

A web tier and API tier run in different subnets. The API subnet NSG currently has Deny-8443 from Any at priority 200 and Allow-8443-WebToApi from ASG-Web to ASG-Api at priority 300. Web requests on TCP 8443 are failing. Which two changes should the administrator make? Select two.

Accepted Answer

Move the allow rule to a lower priority number than 200.. B is correct because NSG rules are evaluated in priority order, with lower numbers having higher priority. The Deny-8443 rule at priority 200 is evaluated before the Allow-8443-WebToApi rule at priority 300, so the deny rule blocks the traffic. Moving the allow rule to a lower priority number (e.g., 100) ensures it is evaluated first, allowing the traffic. C is correct because the allow rule uses application security groups (ASGs); if the web and API NICs are not assigned to the respective ASGs, the rule will not match any traffic, effectively making it a no-op.

Answer

Move the allow rule to a higher priority number than 200.

Answer

Change the rule protocol from TCP to Any.

Answer

Attach a route table to the API subnet to override the deny behavior.

Question 13

A development VM is rebuilt often and does not need its operating system disk contents to survive deallocation. The team wants the lowest practical disk latency for the OS. Which disk option should the administrator choose?

Accepted Answer

Ephemeral OS disk. Ephemeral OS disks use the local VM storage (SSD) rather than Azure managed disks, providing the lowest latency for OS read/write operations. Since the VM is rebuilt often and disk persistence is not required, the ephemeral disk is ideal because its contents are lost when the VM is deallocated, eliminating the need for a separate managed disk.

Answer

Standard HDD managed disk

Answer

Geo-redundant storage for the OS disk

Answer

A data disk formatted as the boot disk

Question 14

A VM in a spoke subnet must send all traffic destined for 172.16.0.0/12 to a firewall appliance at 10.1.1.4. All other destinations should continue to use Azure system routes. Which user-defined route should the administrator add to the subnet route table?

Accepted Answer

Destination 172.16.0.0/12 with next hop Virtual appliance and next hop address 10.1.1.4.. A user-defined route (UDR) with destination 172.16.0.0/12 and next hop type 'Virtual appliance' (with IP 10.1.1.4) overrides the default Azure system route for that prefix, forcing all traffic to the 172.16.0.0/12 range through the firewall at 10.1.1.4. This satisfies the requirement while leaving all other destinations (including 0.0.0.0/0) to be handled by Azure's default system routes.

Answer

Destination 0.0.0.0/0 with next hop Internet.

Answer

Destination 172.16.0.0/12 with next hop Virtual network gateway.

Answer

Destination 172.16.0.0/12 with next hop None.

Question 15

A single Azure virtual machine must read blobs from a storage account without storing any passwords, keys, or connection strings. The identity should be removed automatically if the VM is deleted. Which option should you use?

Accepted Answer

System-assigned managed identity, because it is tied to that VM.. System-assigned managed identity is tied directly to the lifecycle of the Azure VM. When the VM is deleted, the identity is automatically removed. It allows the VM to authenticate to Azure Storage without storing any credentials, using Azure AD tokens obtained via the Azure Instance Metadata Service (IMDS).

Answer

Storage account access key, because it is the simplest authentication method.

Answer

Shared access signature, because it always removes the need for identity management.

Answer

User-assigned managed identity, because it is deleted automatically with the VM.