AZ-104 Practice Test 24 — 15 Questions

Question 1

A VM has both a default route from a VPN gateway and a user-defined route to an on-premises firewall. Traffic is still not reaching the expected next hop. The administrator wants to see the exact routes currently applied to the VM NIC. Which tool should be used?

Accepted Answer

Effective routes. Effective routes is the correct tool because it displays the actual, consolidated routing table applied to a specific network interface, including user-defined routes (UDRs), BGP routes from the VPN gateway, and system default routes. When traffic fails to reach the expected next hop despite having both a VPN default route and a UDR, the administrator must verify which route is actually active and has the highest priority (based on prefix length and route preference). Effective routes shows the exact next-hop IP and route source for each prefix, allowing the administrator to confirm whether the UDR to the on-premises firewall is being honored or overridden.

Answer

IP flow verify

Answer

Packet capture

Answer

Connection troubleshoot

Question 2

A developer has the Contributor role on a resource group. A Bicep deployment that creates a VM with a public IP fails with a policy denial, but the same template succeeds after the public IP resource is removed. Which two statements are true? Select two.

Accepted Answer

The Contributor role allows deployments in the resource group, but it cannot override a deny policy inherited from a higher scope.. Option A is correct because the Contributor role grants full management access to resources within the resource group, but it cannot override Azure Policy effects such as 'deny'. Policy inheritance flows from higher scopes (management group, subscription) down to the resource group, and even a Contributor cannot bypass a deny policy assigned at a higher scope. The Bicep deployment fails specifically because the public IP resource violates a policy rule, not because of a lack of permissions on the role itself.

Answer

A CanNotDelete lock is the reason the public IP resource cannot be created.

Answer

Assigning Owner on the resource group would automatically bypass the policy denial and allow the template to deploy unchanged.

Answer

Moving the VM to another subnet in the same virtual network would remove the inherited policy effect.

Question 3

A developer wants to publish an internet-facing web application from source code. The solution must support built-in HTTPS, deployment slots for testing, and autoscale. The team does not want to manage servers. Which Azure service should the administrator recommend?

Accepted Answer

Azure App Service. Azure App Service is the correct choice because it provides a fully managed platform for hosting web applications from source code, with built-in support for HTTPS via TLS/SSL certificates, deployment slots for staging and testing, and autoscale capabilities. It eliminates server management, aligning with the requirement for a PaaS (Platform as a Service) solution that handles infrastructure, patching, and scaling automatically.

Answer

Azure Container Instances

Answer

Azure Virtual Machine Scale Sets

Answer

Azure Bastion

Question 4

A developer has the Reader role assigned at the subscription scope. Later, the developer is assigned Contributor at the RG-Web resource group scope. Which permission is inherited by a storage account inside RG-Web?

Accepted Answer

The Contributor role from RG-Web is inherited by the storage account.. In Azure RBAC, permissions are inherited from higher scopes to lower scopes. The Contributor role assigned at the RG-Web resource group scope is inherited by all resources within that resource group, including the storage account. The Reader role from the subscription scope is also inherited, but the more permissive Contributor role at the resource group scope takes precedence for actions allowed by Contributor. Therefore, the storage account effectively has Contributor permissions.

Answer

Only the Reader role from the subscription scope is inherited by the storage account.

Answer

Neither role is inherited because storage accounts require a direct assignment.

Answer

Both roles are merged into a new custom role automatically.

Question 5

Which two statements about Azure route tables and user-defined routes are correct? Select two.

Accepted Answer

You can associate a route table with a subnet.. Option A is correct because route tables in Azure are associated at the subnet level, not directly to a virtual machine. This association allows the route table's user-defined routes (UDRs) to override system default routes for traffic leaving that subnet. The subnet must be in the same region as the route table, and a single route table can be associated with multiple subnets.

Answer

Route tables can be associated directly to a single virtual machine without using its subnet.

Answer

A user-defined route automatically overrides a network security group deny rule.

Answer

System routes are never used when a route table exists.

Question 6

A company stores contract PDFs in Azure Blob Storage. The application must keep working if one datacenter in the primary region has an outage, and auditors also want read-only access to the replicated data from the secondary region during a regional outage. Which redundancy option should the administrator choose?

Accepted Answer

RA-GZRS. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it combines zone-redundant storage (ZRS) across availability zones in the primary region with geo-replication to a secondary region, and crucially enables read access to the secondary region data during a regional outage. This ensures the application remains available if one datacenter fails (via ZRS) and satisfies the auditors' requirement for read-only access to replicated data during a regional outage (via the read-access flag).

Answer

LRS

Answer

ZRS

Answer

GZRS

Question 7

A build pipeline starts a Linux container once per request. Each run lasts about 12 minutes, never needs inbound connections, and should not leave an always-on server running afterward. Which two configuration choices best fit Azure Container Instances? Select two.

Accepted Answer

Use Azure Container Instances for the workload.. Azure Container Instances (ACI) is the correct choice because it is a serverless container platform that starts containers on demand, runs them for the duration of the workload (here ~12 minutes), and automatically stops and deallocates resources when the container exits. It requires no always-on infrastructure, supports Linux containers, and does not need inbound connections, making it ideal for ephemeral build pipeline tasks.

Answer

Create an App Service plan with deployment slots.

Answer

Use a virtual machine scale set to host the container.

Answer

Place the workload in an availability set for host protection.

Question 8

A container group runs a one-time import task and should stop after the task completes successfully. Which restart policy should you use?

Accepted Answer

Never. The 'Never' restart policy is correct because the container group is designed to run a one-time import task and should stop after successful completion. In Azure Container Instances (ACI), the 'Never' policy ensures the container runs exactly once and does not restart, regardless of the exit code. This is ideal for batch jobs or import tasks that should not be retried automatically.

Answer

Always

Answer

OnFailure

Answer

Manual

Question 9

You need to monitor CPU on a small set of VMs while keeping ingestion costs low. Which two actions are the best choices? Select two.

Accepted Answer

Use Azure Monitor platform metrics for CPU instead of collecting guest logs. Azure Monitor platform metrics for CPU are collected automatically from the Azure VM host at no additional cost, providing basic CPU utilization data without requiring the Log Analytics agent or incurring data ingestion charges. This approach keeps costs low because platform metrics are included in the Azure Monitor pricing, whereas guest-level metrics require log ingestion and storage fees. For a small set of VMs where only CPU monitoring is needed, platform metrics are sufficient and cost-effective.

Answer

Collect all Windows event logs from every VM

Answer

Create a separate workspace for each VM

Answer

Enable verbose guest logging on every server

Question 10

A company wants to enforce three controls across all current and future subscriptions under a management group: allowed Azure regions, a required cost center tag, and approved VM SKUs. Central IT wants a single assignment and consolidated compliance reporting. What should they use?

Accepted Answer

One initiative assignment at the management group scope.. An initiative (policy set) at the management group scope allows you to bundle multiple policy definitions (allowed regions, required tag, approved VM SKUs) into a single assignment. This ensures the controls apply to all current and future subscriptions under that management group, and Azure Policy provides consolidated compliance reporting at the management group level, meeting the requirement for a single assignment and unified view.

Answer

Three separate policy assignments at each subscription scope.

Answer

A resource lock on the management group to prevent noncompliant deployments.

Answer

A custom RBAC role assigned to the management group.

Question 11

A company wants encrypted connectivity between its on-premises network and an Azure VNet. The organization has one edge VPN device at headquarters, and the Azure design must support a classic site-to-site tunnel rather than individual user VPN connections. Which three prerequisites are required? Select three.

Accepted Answer

Deploy a virtual network gateway in a dedicated GatewaySubnet.. A virtual network gateway must be deployed in a dedicated subnet called GatewaySubnet to host the VPN gateway resources. This subnet is required for the gateway to function and must be named exactly 'GatewaySubnet' to be recognized by Azure when creating a site-to-site VPN connection.

Answer

Create a private endpoint for the headquarters network.

Answer

Enable Microsoft peering on the virtual network gateway.

Question 12

A modify policy that appends a CostCenter tag was assigned to a management group. The policy shows as assigned, but older virtual machines still lack the tag. What must the administrator do to update those existing resources?

Accepted Answer

Create a remediation task for the policy assignment.. The 'modify' policy effect appends the CostCenter tag to new or updated resources automatically, but it does not retroactively apply to existing resources. To update older virtual machines that lack the tag, the administrator must create a remediation task for the policy assignment. This task uses Azure Policy's 'deployIfNotExists' or 'modify' effect to trigger a deployment that evaluates and corrects non-compliant existing resources.

Answer

Reassign the policy at a lower scope so it applies more quickly.

Answer

Change the policy effect from modify to audit.

Answer

Add a CanNotDelete lock to the virtual machines.

Question 13

A branch office with a fixed public IP needs encrypted access to private Azure virtual machines and internal services in a VNet. Traffic must travel across the public internet in an encrypted tunnel, and the connection should use a route-based design. What should the administrator deploy in Azure?

Accepted Answer

A VPN gateway with a site-to-site connection.. A VPN gateway with a site-to-site connection is the correct choice because it establishes an encrypted IPSec tunnel over the public internet between the branch office's fixed public IP and Azure, using a route-based (IKEv2) configuration. This allows the branch office to securely access private Azure VMs and internal services in the VNet, meeting the requirement for encrypted traffic across the internet.

Answer

An Azure Virtual Network peering connection to the branch office network.

Answer

A service endpoint on the target subnet.

Answer

An Azure private endpoint for the virtual machines.

Question 14

A hub VNet is peered to two spoke VNets. The spokes can reach the hub, but they cannot communicate with each other through the hub. The administrator wants centralized inspection in the hub. What should be deployed and configured?

Accepted Answer

An Azure Firewall or other NVA in the hub, plus user-defined routes and forwarding support.. Option A is correct because Azure Firewall or an NVA in the hub can inspect traffic between spokes, but by default, Azure routing does not forward spoke-to-spoke traffic through the hub. To force this traffic through the firewall, you must configure user-defined routes (UDRs) on the spoke subnets with a next hop of the firewall's private IP, and enable IP forwarding on the NVA. This setup enables centralized inspection and transitive routing through the hub.

Answer

Only additional peering links between the hub and both spokes.

Answer

A private endpoint in the hub for each spoke subnet.

Answer

A service endpoint on each spoke subnet to the hub VNet.

Question 15

A data disk on VM-Data01 was corrupted after a bad patch, and you already have a snapshot taken last night. The OS disk should remain unchanged. Which two actions should you take to restore only the data disk? Select two.

Accepted Answer

Create a managed disk from the snapshot.. Option A is correct because a snapshot is a point-in-time copy of a disk that can be used to create a new managed disk. Since you have a snapshot of the corrupted data disk from last night, creating a managed disk from that snapshot restores the data to its state at the time of the snapshot, leaving the OS disk untouched.

Answer

Redeploy the VM and expect the data disk to revert automatically.

Answer

Generalize the VM and redeploy it from the snapshot.

Answer

Replace the snapshot with the current data disk to roll back the VM.