AZ-104 Practice Test 24 — 15 Questions

Question 1

A company wants development and production workloads for the same application to have separate budgets, separate subscription administrators, and different access controls. The central IT team still wants to apply the same security policies to both environments. What is the best design?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a separate subscription for dev and prod, then place both subscriptions under the same management group. It uses separate subscriptions for development and production, which provides independent budget tracking, subscription-level role assignments, and separate administrators. Placing both subscriptions under the same management group allows the central IT team to apply consistent Azure Policy and RBAC security policies across both environments via the management group hierarchy, ensuring governance without compromising isolation.

Answer

Use one subscription and separate the environments with tags only

Answer

Use one management group and two resource groups, one for dev and one for prod

Answer

Put production in a management group and development in a resource group

Question 2

A company wants to enable backup for an Azure virtual machine and later restore the VM if needed. Which Azure service should the administrator use to manage the backup plan and restores?

Accepted Answer

Recovery Services vault. The Recovery Services vault is the correct Azure service for managing backup plans and restores for Azure virtual machines. It provides a centralized management interface for configuring backup policies, performing on-demand backups, and initiating restore operations to recover VMs to a specific point in time.

Answer

Azure Monitor

Answer

Log Analytics workspace

Answer

Azure Front Door

Question 3

Two application VNets are deployed in different Azure regions. Each VNet uses a unique, non-overlapping address space. The application teams want private IP connectivity over the Microsoft backbone with the lowest possible latency between the regions. Which design should the administrator choose?

Accepted Answer

Global VNet peering.. Global VNet peering provides direct, private IP connectivity between two VNets in different Azure regions over the Microsoft backbone, ensuring the lowest possible latency by bypassing the public internet and any intermediate gateways. It uses the Azure infrastructure to route traffic efficiently between the peered VNets, meeting the requirement for private, low-latency communication.

Answer

A site-to-site VPN between the two VNets.

Answer

Azure Traffic Manager with two public endpoints.

Answer

A service endpoint for each application subnet.

Question 4

Based on the exhibit, what should the administrator configure so storage logs can be queried later with KQL?

Accepted Answer

Configure diagnostic settings to send logs to a Log Analytics workspace.. Diagnostic settings in Azure allow you to stream platform logs, including storage logs, to a Log Analytics workspace. Once the logs are in Log Analytics, you can query them using Kusto Query Language (KQL) to analyze storage operations, errors, and metrics. This is the only option that directly enables querying storage logs with KQL.

Answer

Create a backup policy for the storage account so the logs are retained automatically.

Answer

Enable a resource lock on the storage account so no logs are lost.

Answer

Turn on blob versioning so every change to the storage account is searchable.

Question 5

A storage account should accept traffic only from one subnet, but the team does not want to create a private IP address for the service in the virtual network. What should they enable?

Accepted Answer

Service endpoint, because it allows the subnet to access the storage service securely over the Azure backbone.. Service endpoints allow a subnet to access Azure PaaS services (like Storage) over the Azure backbone without requiring a private IP address. By enabling a Microsoft.Storage service endpoint on the subnet and configuring the storage account firewall to allow traffic only from that subnet, the team meets the requirement securely and cost-effectively.

Answer

Private endpoint, because it is the only way to allow one subnet.

Answer

User-assigned managed identity, because it controls subnet access.

Answer

Blob soft delete, because it helps restrict where traffic comes from.

Question 6

A company has 12 subscriptions under one management group. An external auditor needs Reader access to resources in every current and future subscription under that management group. Where should you assign the role?

Accepted Answer

At the management group scope. Assigning the Reader role at the management group scope ensures that the external auditor inherits read-only access to all current and future subscriptions under that management group. Role assignments at the management group scope are inherited by all child subscriptions and resource groups, making it the single, scalable solution for the requirement.

Answer

At each resource group in each subscription

Answer

At one subscription scope only

Answer

At one resource scope in the first subscription

Question 7

An enterprise wants to enforce three governance controls for all subscriptions under a management group: allowed locations, required tags, and permitted VM sizes. The team wants a single place to assign and track compliance for all three controls. What should the administrator use?

Accepted Answer

One policy initiative assigned at the management group. A policy initiative (also known as a policy set) allows you to group multiple policy definitions (e.g., allowed locations, required tags, permitted VM sizes) into a single, reusable package. Assigning this initiative at the management group level enforces all three governance controls across every subscription under that management group, providing a single place to assign and track compliance via Azure Policy's compliance dashboard.

Answer

Three separate policy assignments at each subscription

Answer

A custom RBAC role assigned to each subscription

Answer

A resource lock on each subscription

Question 8

Based on the exhibit, which deployment change best meets the resilience requirement for the application VMs?

Accepted Answer

Place each VM in a different availability zone and keep the load balancer in front.. Deploying each VM into a different availability zone ensures that the VMs are physically separated across distinct data centers within an Azure region, protecting against zone-level failures. The load balancer in front distributes traffic across the VMs, providing high availability even if one zone goes offline. This meets the resilience requirement by eliminating a single point of failure at the data center level.

Answer

Keep both VMs in the same availability set to spread them across update domains only.

Answer

Deploy both VMs into a proximity placement group to reduce latency between them.

Answer

Move the VMs into a single availability set and add more managed disks for redundancy.

Question 9

A backend VM must accept TCP 8443 only from the web tier. The subnet NSG already has a deny-all inbound rule at priority 200. The administrator adds an allow rule for the web tier at priority 300, but the connection still fails. What should be changed?

Accepted Answer

Change the allow rule to a lower priority number than 200.. Azure Network Security Groups (NSGs) process rules in priority order, with lower numbers evaluated first. The existing deny-all inbound rule at priority 200 is evaluated before the new allow rule at priority 300, so the deny rule blocks the traffic before the allow rule can be considered. To permit TCP 8443 from the web tier, the allow rule must have a priority number lower than 200 (e.g., 100) so it is evaluated first and allows the traffic.

Answer

Change the allow rule protocol from TCP to Any.

Answer

Move the VM to a different subnet so the rule can apply.

Answer

Add a route table entry for TCP 8443 to bypass the NSG.

Question 10

A backend VM belongs to AppASG and listens on TCP 8443. The subnet NSG has a deny rule at priority 200 that blocks TCP 8443 from VirtualNetwork to any destination. The backend VM's NIC NSG has an allow rule at priority 100 for TCP 8443 from WebASG to AppASG. Web VMs in WebASG still cannot connect. What should you change to allow only the web tier while keeping other virtual network traffic blocked?

Accepted Answer

Add an allow rule in the subnet NSG at priority 150 for TCP 8443 from WebASG to AppASG.. In Azure, network security group (NSG) rules are evaluated in priority order, and subnet NSG rules are evaluated before NIC NSG rules for inbound traffic. The subnet NSG has a deny rule at priority 200 that blocks TCP 8443 from VirtualNetwork to any destination, which overrides the NIC NSG allow rule because the subnet deny is evaluated first. To allow traffic from WebASG to AppASG while still blocking other virtual network traffic, you must add an allow rule in the subnet NSG at a higher priority (e.g., 150) than the deny rule, explicitly permitting TCP 8443 from WebASG to AppASG.

Answer

Move the NIC NSG allow rule to priority 50.

Answer

Replace the subnet deny rule with a rule for the AzureLoadBalancer service tag.

Answer

Remove the backend VM from AppASG and allow traffic by subnet only.

Question 11

A virtual machine is already protected by Azure Backup. The business wants the VM backed up every day at 11:00 PM and wants daily recovery points retained for 30 days, without re-onboarding the VM. What should the administrator modify?

Accepted Answer

Modify the backup policy associated with the protected VM. Azure Backup uses backup policies to define the backup schedule and retention rules for protected resources. By modifying the existing policy associated with the VM, you can change the backup time to 11:00 PM and set daily recovery point retention to 30 days without needing to re-onboard the VM or create a new vault.

Answer

Create a new Recovery Services vault and re-register the VM

Answer

Install a new VM extension to change retention behavior

Answer

Take a manual snapshot of the VM disk every night

Question 12

You deploy a Windows VM with an ARM template. During the first boot, it must install IIS, copy application files from storage, and run a bootstrap script. Which Azure feature should you add to the deployment?

Accepted Answer

A VM extension such as Custom Script Extension. The Custom Script Extension (CSE) is the correct Azure feature to use because it allows you to execute PowerShell or Bash scripts on a Windows or Linux VM during first boot. By adding the CSE to your ARM template, you can automate the installation of IIS, copy application files from Azure Storage (using the `fileUris` property), and run a bootstrap script after the OS is provisioned, ensuring the VM is fully configured without manual intervention.

Answer

An availability set

Answer

A managed disk snapshot

Answer

A public IP address

Question 13

A shared resource group contains a VM and a storage account used by payroll. Administrators still need to modify configuration and apply patches, but accidental deletion of either resource must be prevented. What should the administrator apply?

Accepted Answer

A CanNotDelete lock on each resource.. A CanNotDelete lock prevents the deletion of a resource while still allowing all other operations, including configuration modifications and patching. This meets the requirement of protecting the VM and storage account from accidental deletion while preserving administrative access for updates.

Answer

A ReadOnly lock on the entire resource group.

Answer

A policy assignment that denies delete operations on the resource group.

Answer

A management group with a deny assignment.

Question 14

A partner organization needs write access to a single blob container for 24 hours. You want to avoid sharing the storage account key and minimize access scope. Which access mechanism should you provide?

Accepted Answer

A user delegation SAS. A user delegation SAS is the correct choice because it provides time-limited, delegated access to a specific blob container using Azure AD credentials, without exposing the storage account key. It allows you to grant write access for exactly 24 hours to a single container, minimizing the access scope as required.

Answer

A storage account key

Answer

A container stored access policy without a token

Answer

An Azure Policy assignment

Question 15

A VM in a subnet must send traffic to 172.16.0.0/16 through a network virtual appliance, but all other destinations should continue using the default Azure system routes. What should the administrator add to the subnet route table?

Accepted Answer

A route for 172.16.0.0/16 with next hop Virtual appliance.. The requirement is to route traffic destined for 172.16.0.0/16 through a network virtual appliance (NVA) while leaving all other traffic to use the default Azure system routes. Adding a user-defined route (UDR) with destination 172.16.0.0/16 and next hop Virtual appliance overrides the default system route for that specific prefix, ensuring traffic to that range is forwarded to the NVA. All other destinations remain unaffected because the 0.0.0.0/0 default route is not modified.

Answer

A route for 0.0.0.0/0 with next hop Virtual appliance.

Answer

An NSG deny rule for all other destinations.

Answer

A service endpoint for the 172.16.0.0/16 network.