AZ-104 Practice Test 25 — 15 Questions

Question 1

A company is creating a new spoke virtual network that will be peered to an existing hub VNet. The hub uses 10.40.0.0/16, and an on-premises network already uses 10.41.0.0/16. The spoke must support about 120 endpoints now and should allow room for growth. Which address space should you assign to the new spoke VNet?

Accepted Answer

10.42.0.0/24. Option B (10.42.0.0/24) is correct because it provides 256 IP addresses (251 usable) for the spoke, which exceeds the requirement of ~120 endpoints with room for growth, and it does not overlap with the hub VNet (10.40.0.0/16) or the on-premises network (10.41.0.0/16). This ensures successful VNet peering without IP address conflicts.

Answer

10.40.64.0/25

Answer

10.41.128.0/24

Answer

192.168.10.0/26

Question 2

A company already uses the address space 10.20.0.0/16 for a hub virtual network and 10.21.0.0/16 on-premises. A new spoke virtual network will be peered to the hub and may later connect to the on-premises network. Which address space should the administrator choose for the spoke to avoid future routing conflicts?

Accepted Answer

10.22.0.0/16. Option C (10.22.0.0/16) is correct because it is a unique, non-overlapping address space that does not conflict with the existing hub VNet (10.20.0.0/16) or the on-premises network (10.21.0.0/16). When a spoke VNet is peered to the hub and later connected to on-premises via VPN or ExpressRoute, Azure requires that all peered and connected address spaces be unique to avoid routing conflicts. Choosing a completely separate /16 ensures no future overlap.

Answer

10.20.64.0/19

Answer

10.21.0.0/16

Answer

10.20.128.0/17

Question 3

A production VM is using too much CPU. You want Azure to notify the operations team by email when Average Percentage CPU stays above 80 percent for 5 minutes. What should you configure?

Accepted Answer

A metric alert rule linked to an action group. A metric alert rule monitors a specific metric (e.g., Percentage CPU) and triggers when a condition (e.g., above 80% for 5 minutes) is met. Linking the alert to an action group allows Azure to send email notifications to the operations team. This is the correct Azure Monitor feature for threshold-based, metric-driven notifications.

Answer

A diagnostic setting on the VM

Answer

A Log Analytics workspace only

Answer

An Azure Policy assignment

Question 4

A company has 18 subscriptions under a management group named Corp. The audit team needs Reader access to all current and future subscriptions in Corp without creating one assignment per subscription. Which two statements are correct? Select two.

Accepted Answer

Assign Reader at the Corp management group scope.. Assigning the Reader role at the Corp management group scope is correct because Azure RBAC allows role assignments to be inherited by all child resources, including all current and future subscriptions under that management group. This eliminates the need to create a separate assignment per subscription, as the single assignment at the management group level applies to all subscriptions within it.

Answer

Assign Reader separately at each subscription scope.

Answer

Assign Reader at one resource group in each subscription.

Answer

Create a lock on each subscription to provide Reader access.

Question 5

A development environment uses temporary test VMs that can be rebuilt at any time. The administrator wants the operating system disk to provide the lowest practical latency and does not need the disk data to survive a deallocate operation. Which OS disk option should be selected?

Accepted Answer

Ephemeral OS disk.. Ephemeral OS disks use the local VM storage (temporary disk) rather than remote managed storage, which provides the lowest possible latency because data is stored directly on the host node. Since the test VMs can be rebuilt at any time and the disk data does not need to survive a deallocate operation, the ephemeral disk is ideal—it is automatically deleted when the VM is deallocated or deleted, and it avoids the cost and performance overhead of managed disks.

Answer

Standard HDD managed disk.

Answer

Premium SSD managed disk.

Answer

Ultra Disk managed disk.

Question 6

A company merged with another business, and two Azure virtual networks need to be peered for shared application access. One VNet uses 10.20.0.0/16 and the other uses 10.20.128.0/17. The administrator must make the peering work with minimal operational complexity. What should be done first?

Accepted Answer

Renumber one VNet to a non-overlapping address range before creating the peering.. Azure VNet peering requires non-overlapping address spaces. The two VNets (10.20.0.0/16 and 10.20.128.0/17) overlap because 10.20.128.0/17 is a subset of 10.20.0.0/16. Peering will fail with an error about overlapping address ranges. Renumbering one VNet to a non-overlapping range (e.g., 10.21.0.0/16) is the only way to satisfy the prerequisite for peering with minimal operational complexity.

Answer

Create a route table on both VNets and point the overlapping prefixes to a virtual appliance.

Answer

Enable gateway transit on both VNets so overlapping ranges can be routed around.

Answer

Create a private endpoint in each VNet for the applications that need access.

Question 7

A production resource group must not be deleted accidentally, but administrators still need to update resources inside it. Which lock should you apply to the resource group?

Accepted Answer

CanNotDelete lock. The CanNotDelete lock (option B) is correct because it prevents deletion of the resource group while still allowing all other operations, including updates to resources within it. This lock type is specifically designed to protect against accidental deletion without blocking read, write, or modify actions, which aligns perfectly with the requirement that administrators need to update resources inside the group.

Answer

ReadOnly lock

Answer

Contributor role

Answer

Azure Policy deny assignment

Question 8

A customer-facing application runs on two Azure VMs. The business wants the application to stay available even if one datacenter in the Azure region has an outage. Which availability option should the administrator use?

Accepted Answer

Availability zones. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. By deploying the two VMs into different zones, the application remains available if one entire datacenter fails, meeting the requirement for datacenter-level fault tolerance.

Answer

Availability set

Answer

Proximity placement group

Answer

Azure Load Balancer

Question 9

A line-of-business application must keep running even if one datacenter in an Azure region has an outage. Which deployment option should you choose for the VMs?

Accepted Answer

Availability zones. Availability zones (Option C) are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across two or more zones ensures that if one datacenter fails, the application continues running in the other zone, meeting the requirement for resilience against a single datacenter outage.

Answer

An availability set

Answer

A single virtual machine with Premium SSD

Answer

A proximity placement group

Question 10

A reporting server VM will run an analytics engine that uses a large in-memory cache. Required minimums are 8 vCPUs and 64 GiB of RAM, and the workload benefits more from memory than from extra compute. Which Azure VM series is the best fit?

Accepted Answer

E-series, because it provides memory-optimized sizing for data-intensive workloads. The E-series (specifically Ev3, Esv3, or Ebsv5) is memory-optimized, offering the highest memory-to-vCPU ratio among Azure general-purpose families. With a requirement of 64 GiB RAM and only 8 vCPUs, the workload benefits more from memory than compute, making the E-series the best fit. D-series provides balanced ratios but not the memory density needed, while F-series and B-series are compute- or burst-oriented and lack sufficient memory per vCPU.

Answer

B-series, because burstable credits handle temporary spikes economically

Answer

D-series, because it balances general-purpose CPU and memory

Answer

F-series, because it is optimized for high CPU throughput

Question 11

A contractor needs temporary read-only access to a single blob container for three hours. The contractor does not have an Azure user account in your tenant. Which method is the best fit?

Accepted Answer

Issue a shared access signature with read-only permissions and an expiration time. A shared access signature (SAS) is the best fit because it provides time-limited, delegated access to a specific resource (a blob container) without requiring an Azure AD identity. The contractor can use the SAS URL to access the container with read-only permissions for exactly three hours, after which the token expires automatically. This meets the requirement of temporary access for an external user who does not have an Azure account in your tenant.

Answer

Create a new managed identity for the contractor

Answer

Give the contractor the storage account access key

Answer

Enable anonymous public access on the container

Question 12

A company uses Azure Blob Storage for legal documents. The documents must not be modified or deleted for seven years after upload, even by administrators. What should you configure?

Accepted Answer

Immutable blob storage with a time-based retention policy. Immutable blob storage with a time-based retention policy (WORM – Write Once, Read Many) ensures that blobs cannot be modified or deleted for a specified retention period, even by administrators. This is the only Azure storage feature that provides legal hold or regulatory compliance for fixed records, such as legal documents that must remain unaltered for seven years.

Answer

Blob soft delete

Answer

Lifecycle management to move blobs to Archive

Answer

Blob versioning

Question 13

A subnet is associated with a NAT gateway, but its route table also contains a 0.0.0.0/0 route to a virtual appliance at 10.2.0.4. The business wants all outbound internet traffic from the VMs to use one static public IP, and inspection by the appliance is no longer required. What should the administrator change?

Accepted Answer

Remove the 0.0.0.0/0 user-defined route from the subnet.. The correct answer is B because removing the 0.0.0.0/0 user-defined route (UDR) from the subnet's route table will allow the NAT gateway to handle all outbound internet traffic. The NAT gateway provides a single static public IP for outbound traffic, and since inspection by the virtual appliance is no longer required, the conflicting UDR that directs traffic to the appliance must be deleted. This ensures that the subnet's default route points to the NAT gateway, which uses Source Network Address Translation (SNAT) to translate private IPs to the static public IP.

Answer

Add a public IP address directly to each virtual machine NIC.

Answer

Enable service endpoints for the subnet.

Answer

Change the NAT gateway to a zone-redundant SKU.

Question 14

A subnet has an NSG with these inbound rules: priority 200 DenyAllInbound and priority 300 AllowHTTPSFromInternet. A VM in the subnet is still unreachable on TCP 443 from the internet. What should you do to make HTTPS work while keeping the deny rule in place?

Accepted Answer

Move the allow HTTPS rule to a lower priority number such as 100 so it is evaluated before the deny rule.. Option A is correct because NSG rules are evaluated in priority order, with lower numbers evaluated first. Moving the allow HTTPS rule to priority 100 ensures it is processed before the DenyAllInbound rule at priority 200, allowing TCP 443 traffic from the internet while the deny rule remains in place for all other inbound traffic.

Answer

Create the same allow rule on the NIC-level NSG at priority 300 and leave the subnet NSG unchanged.

Answer

Change the deny rule to protocol Any and keep the same priority so Azure evaluates the allow rule first.

Answer

Add a route table entry for TCP 443 traffic so Azure sends it directly to the VM.

Question 15

A help desk analyst needs a KQL query that identifies each VM's most recent heartbeat so computers can be flagged if their last check-in is older than 20 minutes. Which two KQL elements should be used? Select two.

Accepted Answer

Query the Heartbeat table, because it stores the heartbeat records for Azure VMs.. Option A is correct because the Heartbeat table in Azure Monitor Logs (Log Analytics) is specifically designed to store heartbeat records from Azure Monitor Agent (AMA) or the legacy Log Analytics agent. Each heartbeat record contains a TimeGenerated timestamp, making it the authoritative source for determining when a VM last reported its health status.

Answer

Join the results to AzureActivity to calculate service health.

Answer

Filter where TimeGenerated is older than 20 minutes before summarizing.

Answer

Use the Perf table because it stores heartbeat timestamps.