AZ-104 Practice Test 25 — 15 Questions

Question 1

Based on the exhibit, an Azure Policy with the Modify effect was assigned to add Environment=Prod to resources in RG-Prod. New resources get the tag, but existing virtual machines still do not have it. What should the administrator do next?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a remediation task for the policy assignment.. The Modify effect in Azure Policy automatically applies to new resources during creation or update, but it does not retroactively fix existing non-compliant resources. To apply the tag to existing virtual machines, the administrator must create a remediation task for the policy assignment, which triggers a deployment to modify those resources.

Answer

Move the policy assignment to the subscription scope.

Answer

Change the policy effect from Modify to Deny.

Answer

Add a CanNotDelete lock to RG-Prod.

Question 2

A partner must upload files to one blob container for 12 hours. You do not want to share the storage account key, and the access should expire automatically. Which access method should you use?

Accepted Answer

Shared access signature (SAS). A shared access signature (SAS) is the correct choice because it provides time-limited, delegated access to a specific blob container without exposing the storage account key. You can set an expiry time of 12 hours, and the SAS token can be generated with only the permissions needed (e.g., write). Once the token expires, access is automatically revoked, meeting the requirement for automatic expiration.

Answer

Role assignment in Azure RBAC

Answer

Private endpoint

Answer

Storage account lock

Question 3

Two application teams created separate VNets for independent workloads. VNet-A uses 10.40.0.0/16 and VNet-B uses 10.40.128.0/17. The teams want to peer the VNets so both apps can communicate privately. What should the administrator do first?

Accepted Answer

Renumber one VNet so its address space no longer overlaps before creating the peering.. B is correct because Azure VNet peering requires non-overlapping address spaces. VNet-A (10.40.0.0/16) and VNet-B (10.40.128.0/17) overlap, as 10.40.128.0/17 is a subset of 10.40.0.0/16. Before peering can be established, one VNet must be renumbered to eliminate the overlap; otherwise, the peering creation will fail with an error indicating overlapping address spaces.

Answer

Create the peering now and add a route table to one VNet later.

Answer

Add an NSG rule that allows traffic between the two address ranges.

Answer

Enable gateway transit on both VNets so overlapping ranges can route through a shared gateway.

Question 4

Three Azure VMs in different resource groups need to access the same Azure resources using one identity. The identity must keep working if any VM is deleted and recreated. What should the administrator assign to the VMs?

Accepted Answer

A user-assigned managed identity.. A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource and can be assigned to multiple VMs, even across different resource groups. If a VM is deleted and recreated, the user-assigned identity persists independently and can be reassigned to the new VM, ensuring continuous access to Azure resources without reconfiguration.

Answer

A system-assigned managed identity on each VM.

Answer

A local administrator account.

Answer

An Azure Blueprint assignment.

Question 5

Two virtual networks were created in different subscriptions. VNet-A uses 10.4.0.0/16 and VNet-B uses 10.4.128.0/17. You try to create peering between them, but Azure rejects the request. What is the best fix?

Accepted Answer

Change one VNet to a non-overlapping address range, then create the peering again.. VNet peering requires that the address spaces of the two virtual networks do not overlap. VNet-A uses 10.4.0.0/16, which covers 10.4.0.0 to 10.4.255.255, and VNet-B uses 10.4.128.0/17, which falls entirely within that range (10.4.128.0 to 10.4.255.255). Azure rejects the peering because overlapping address spaces would cause routing conflicts. The only correct fix is to change one VNet's address space to a non-overlapping range, then recreate the peering.

Answer

Enable gateway transit on both VNets before creating the peering.

Answer

Add a route table to one VNet so the address spaces no longer overlap.

Answer

Create a private endpoint between the two VNets instead of peering.

Question 6

After a bad script ran, one file at C:\Finance\Q4.xlsx was deleted from a Windows VM. The VM is still running, and the team wants only that file restored without replacing the operating system disk or restarting the VM. What should the administrator use from Azure Backup?

Accepted Answer

Perform a file-level restore from the recovery point and copy only the missing file back.. Azure Backup for Azure VMs supports file-level restore (FLR) from recovery points without requiring a full VM restore or disk replacement. This allows you to mount the recovery point as a drive on the running VM, browse the file system, and copy only the missing file (C:\Finance\Q4.xlsx) back to its original location. The VM remains online and no OS disk replacement or restart is needed.

Answer

Restore the entire VM to a new instance so the deleted file comes back automatically.

Answer

Restore the managed disks and replace the existing disks on the running VM.

Answer

Use Azure Monitor logs to reconstruct the file because the backup vault stores telemetry.

Question 7

A user accidentally deleted a file from an Azure VM. The administrator wants to recover only the deleted file from the most recent backup instead of restoring the entire VM. What should the administrator use?

Accepted Answer

File recovery from the Azure Backup restore process. Azure Backup's file-level recovery (also known as item-level restore) allows you to recover individual files or folders from a VM backup point without restoring the entire VM. This is achieved by mounting the recovery point as a drive on the same or another VM, enabling direct file copy. Option A is correct because this feature is specifically designed for granular recovery of deleted files from the most recent backup.

Answer

A new VM image

Answer

A metric alert

Answer

An NSG flow log

Question 8

A company stores contract PDFs in Azure Blob Storage. The application must keep working if one datacenter in the primary region has an outage, and auditors also want read-only access to the replicated data from the secondary region during a regional outage. Which redundancy option should the administrator choose?

Accepted Answer

RA-GZRS. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it combines zone-redundant storage (ZRS) across availability zones in the primary region with geo-replication to a secondary region, and crucially enables read access to the secondary region data during a regional outage. This ensures the application remains available if one datacenter fails (via ZRS) and satisfies the auditors' requirement for read-only access to replicated data during a regional outage (via the read-access flag).

Answer

LRS

Answer

ZRS

Answer

GZRS

Question 9

An administrator assigned a modify policy at the subscription scope to add a CostCenter tag to new virtual machines. New VMs now have the tag, but older VMs in the subscription still do not. What must the administrator do to bring the existing VMs into compliance?

Accepted Answer

Create a remediation task for the noncompliant resources.. The modify effect policy assigned at the subscription scope automatically applies the CostCenter tag to new resources during creation, but it does not retroactively update existing noncompliant resources. To bring older VMs into compliance, the administrator must create a remediation task, which triggers Azure Policy's deployment engine to evaluate and apply the defined modify effect (e.g., adding the missing tag) to existing noncompliant resources using a managed identity.

Answer

Reassign the policy at the resource group scope.

Answer

Add a resource lock to the subscription.

Answer

Move the VMs to another resource group and back again.

Question 10

A web app uses a managed identity to read blobs from a storage account. Security now wants to ensure no future requests can authenticate with shared keys and the app should continue to use secretless access. Which two changes should the administrator make? Select two.

Accepted Answer

Assign the Storage Blob Data Reader role to the managed identity on the storage account or container.. Assigning the Storage Blob Data Reader role to the managed identity enables Azure RBAC-based, secretless access to blobs. This aligns with the requirement to use managed identities for authentication, eliminating the need for keys or SAS tokens. Option B is correct because disabling shared key access on the storage account enforces the security policy that no future requests can authenticate using shared keys, while the managed identity continues to work via Azure AD authentication.

Answer

Generate a service SAS and place it in an app setting.

Answer

Rotate the storage account keys weekly.

Answer

Grant Reader access to the resource group because it includes the storage account.

Question 11

Based on the exhibit, which Azure service is preventing deployment because the resource is missing a required tag?

Accepted Answer

Azure Policy. Azure Policy is the correct answer because it enforces organizational standards and compliance rules, such as requiring specific tags on resources. When a policy is defined to require a tag (e.g., 'CostCenter') and a deployment attempts to create a resource without that tag, Azure Policy evaluates the request against the policy assignment and denies the deployment. This is a built-in capability of Azure Policy, not a permission or lock mechanism.

Answer

Azure RBAC

Answer

Resource locks

Answer

Azure Monitor

Question 12

An administrator is deploying an Azure VPN gateway for a site-to-site connection. The deployment fails because required network resources are missing. Which configuration is required before the gateway can be created?

Accepted Answer

A subnet named GatewaySubnet and a public IP address for the VPN gateway.. A VPN gateway in Azure requires a dedicated subnet named 'GatewaySubnet' to host the gateway instances, and a public IP address resource must be allocated to the gateway to establish the site-to-site VPN tunnel over the internet. Without these two prerequisites, the deployment will fail because the gateway cannot be provisioned or addressed externally.

Answer

A subnet named AzureBastionSubnet and a static private IP address.

Answer

A network security group attached directly to the virtual network gateway.

Answer

A load balancer with a public frontend to terminate the VPN connection.

Question 13

An administrator is deploying a new VPN gateway in an existing VNet. The GatewaySubnet currently uses a /28 range, and the deployment fails because the selected gateway configuration does not have enough available IP addresses. What is the best action?

Accepted Answer

Expand GatewaySubnet to a larger range, such as /27, and redeploy the VPN gateway.. The GatewaySubnet requires a minimum /27 range to support most VPN gateway SKUs, as Azure reserves several IP addresses for internal use and the gateway instances need at least 3–6 usable IPs depending on the SKU. Expanding the subnet to /27 provides enough addresses (32 total, minus reserved) to satisfy the gateway's allocation requirements, allowing the deployment to succeed.

Answer

Move one of the gateway's NICs into a normal workload subnet.

Answer

Create a private endpoint inside GatewaySubnet to reserve extra addresses.

Answer

Enable BGP so the gateway needs fewer IP addresses.

Question 14

You need to deploy 25 identical Azure virtual machines for a web application and scale the number of instances automatically based on CPU demand. Which Azure compute feature should you use?

Accepted Answer

A Virtual Machine Scale Set. A Virtual Machine Scale Set (VMSS) is the correct Azure compute feature because it allows you to deploy and manage a group of identical, load-balanced VMs whose number can automatically increase or decrease in response to CPU demand using autoscale rules. This directly meets the requirement for 25 identical VMs with automatic scaling based on CPU metrics.

Answer

An availability set

Answer

A Recovery Services vault

Answer

Boot diagnostics

Question 15

You need one assignment that requires a cost-center tag and also allows only approved locations. What should you use?

Accepted Answer

A policy initiative. A policy initiative is the correct choice because it allows you to group multiple Azure Policy definitions (such as 'Require a cost-center tag' and 'Allowed locations') into a single, reusable assignment. This ensures both conditions are enforced simultaneously at a scope like a subscription or resource group, meeting the requirement for a cost-center tag and location restriction.

Answer

A role assignment

Answer

A resource lock

Answer

A management group