AZ-104 Practice Test 25 — 15 Questions

Question 1

A company stores contract PDFs in Azure Blob Storage. The application must keep working if one datacenter in the primary region has an outage, and auditors also want read-only access to the replicated data from the secondary region during a regional outage. Which redundancy option should the administrator choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

RA-GZRS. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it combines zone-redundant storage (ZRS) across availability zones in the primary region with geo-replication to a secondary region, and crucially enables read access to the secondary region data during a regional outage. This ensures the application remains available if one datacenter fails (via ZRS) and satisfies the auditors' requirement for read-only access to replicated data during a regional outage (via the read-access flag).

Answer

LRS

Answer

ZRS

Answer

GZRS

Question 2

Your company wants every subscription under the Corp-MG management group to block the creation of resource groups unless the deployment includes the tags CostCenter and Environment. You need a centralized solution that is inherited by child subscriptions. What should you configure?

Accepted Answer

An Azure Policy assignment at the management group scope. Azure Policy at the management group scope is the correct centralized solution because it enforces a policy (e.g., requiring tags) that is inherited by all child subscriptions and resource groups. This ensures that any deployment without the required tags is denied, meeting the requirement for a governance rule that applies across the entire Corp-MG hierarchy.

Answer

A custom RBAC role at the tenant root

Answer

A CanNotDelete lock on each subscription

Answer

A subscription budget alert

Question 3

An administrator assigned a modify policy at the subscription scope to add a CostCenter tag to new virtual machines. New VMs now have the tag, but older VMs in the subscription still do not. What must the administrator do to bring the existing VMs into compliance?

Accepted Answer

Create a remediation task for the noncompliant resources.. The modify effect policy assigned at the subscription scope automatically applies the CostCenter tag to new resources during creation, but it does not retroactively update existing noncompliant resources. To bring older VMs into compliance, the administrator must create a remediation task, which triggers Azure Policy's deployment engine to evaluate and apply the defined modify effect (e.g., adding the missing tag) to existing noncompliant resources using a managed identity.

Answer

Reassign the policy at the resource group scope.

Answer

Add a resource lock to the subscription.

Answer

Move the VMs to another resource group and back again.

Question 4

A web app uses a managed identity to read blobs from a storage account. Security now wants to ensure no future requests can authenticate with shared keys and the app should continue to use secretless access. Which two changes should the administrator make? Select two.

Accepted Answer

Assign the Storage Blob Data Reader role to the managed identity on the storage account or container.. Assigning the Storage Blob Data Reader role to the managed identity enables Azure RBAC-based, secretless access to blobs. This aligns with the requirement to use managed identities for authentication, eliminating the need for keys or SAS tokens. Option B is correct because disabling shared key access on the storage account enforces the security policy that no future requests can authenticate using shared keys, while the managed identity continues to work via Microsoft Entra ID authentication.

Answer

Generate a service SAS and place it in an app setting.

Answer

Rotate the storage account keys weekly.

Answer

Grant Reader access to the resource group because it includes the storage account.

Question 5

Based on the exhibit, which Azure service is preventing deployment because the resource is missing a required tag?

Accepted Answer

Azure Policy. Azure Policy is the correct answer because it enforces organizational standards and compliance rules, such as requiring specific tags on resources. When a policy is defined to require a tag (e.g., 'CostCenter') and a deployment attempts to create a resource without that tag, Azure Policy evaluates the request against the policy assignment and denies the deployment. This is a built-in capability of Azure Policy, not a permission or lock mechanism.

Answer

Azure RBAC

Answer

Resource locks

Answer

Azure Monitor

Question 6

An administrator is deploying an Azure VPN gateway for a site-to-site connection. The deployment fails because required network resources are missing. Which configuration is required before the gateway can be created?

Accepted Answer

A subnet named GatewaySubnet and a public IP address for the VPN gateway.. A VPN gateway in Azure requires a dedicated subnet named 'GatewaySubnet' to host the gateway instances, and a public IP address resource must be allocated to the gateway to establish the site-to-site VPN tunnel over the internet. Without these two prerequisites, the deployment will fail because the gateway cannot be provisioned or addressed externally.

Answer

A subnet named AzureBastionSubnet and a static private IP address.

Answer

A network security group attached directly to the virtual network gateway.

Answer

A load balancer with a public frontend to terminate the VPN connection.

Question 7

An administrator is deploying a new VPN gateway in an existing VNet. The GatewaySubnet currently uses a /28 range, and the deployment fails because the selected gateway configuration does not have enough available IP addresses. What is the best action?

Accepted Answer

Expand GatewaySubnet to a larger range, such as /27, and redeploy the VPN gateway.. The GatewaySubnet requires a minimum /27 range to support most VPN gateway SKUs, as Azure reserves several IP addresses for internal use and the gateway instances need at least 3–6 usable IPs depending on the SKU. Expanding the subnet to /27 provides enough addresses (32 total, minus reserved) to satisfy the gateway's allocation requirements, allowing the deployment to succeed.

Answer

Move one of the gateway's NICs into a normal workload subnet.

Answer

Create a private endpoint inside GatewaySubnet to reserve extra addresses.

Answer

Enable BGP so the gateway needs fewer IP addresses.

Question 8

You need to deploy 25 identical Azure virtual machines for a web application and scale the number of instances automatically based on CPU demand. Which Azure compute feature should you use?

Accepted Answer

A Virtual Machine Scale Set. A Virtual Machine Scale Set (VMSS) is the correct Azure compute feature because it allows you to deploy and manage a group of identical, load-balanced VMs whose number can automatically increase or decrease in response to CPU demand using autoscale rules. This directly meets the requirement for 25 identical VMs with automatic scaling based on CPU metrics.

Answer

An availability set

Answer

A Recovery Services vault

Answer

Boot diagnostics

Question 9

You need one assignment that requires a cost-center tag and also allows only approved locations. What should you use?

Accepted Answer

A policy initiative. A policy initiative is the correct choice because it allows you to group multiple Azure Policy definitions (such as 'Require a cost-center tag' and 'Allowed locations') into a single, reusable assignment. This ensures both conditions are enforced simultaneously at a scope like a subscription or resource group, meeting the requirement for a cost-center tag and location restriction.

Answer

A role assignment

Answer

A resource lock

Answer

A management group

Question 10

Your company needs to retain Azure Activity Log data longer than the built-in retention period and make it available for future analysis. What should you configure?

Accepted Answer

Diagnostic settings for the Activity Log. Azure Activity Log has a default retention period of 30 days for Standard tier subscriptions and 90 days for others. To retain data longer, you must configure diagnostic settings to stream the Activity Log to a Log Analytics workspace (for long-term querying) or to an Azure Storage account (for archival). Diagnostic settings allow you to define the retention duration beyond the built-in limit, enabling future analysis.

Answer

A CanNotDelete lock on the subscription

Answer

An availability set

Answer

An NSG flow log only

Question 11

An online transaction app uses two identical VMs in an Azure region that supports availability zones. The business wants the app to stay available if an entire datacenter in the region fails. What should the administrator deploy?

Accepted Answer

Two VMs placed in different availability zones within the region.. Deploying VMs in different availability zones protects against an entire datacenter failure. Each availability zone is a physically separate datacenter within an Azure region, with independent power, cooling, and networking. If one zone fails, the VM in the other zone remains available, ensuring business continuity for the app.

Answer

An availability set with the VMs placed in different update domains.

Answer

A proximity placement group so both VMs stay physically close together.

Answer

A single VM with Premium SSD storage and automatic restart.

Question 12

You have two virtual networks in the same Azure region named VNet-App and VNet-DB. Resources in the two networks must communicate privately over the Azure backbone without using VPN gateways. What should you configure?

Accepted Answer

Virtual network peering. Virtual network peering connects two Azure virtual networks in the same region via the Microsoft backbone infrastructure, enabling private IP communication without a VPN gateway or public internet. This is the correct solution because it meets the requirement for private, low-latency connectivity between VNet-App and VNet-DB using Azure's high-speed backbone.

Answer

A site-to-site VPN

Answer

A network security group

Answer

An Azure Firewall policy only

Question 13

The Azure portal shows that a storage service in the region is experiencing an outage that affects several Microsoft customers. The administrator wants to view official Azure status updates for that issue. Which Azure Monitor feature should be used?

Accepted Answer

Service Health. Service Health is the correct Azure Monitor feature because it provides a personalized view of the health of Azure services, regions, and resources, including real-time and historical information about service-impacting events such as outages. It also surfaces official root cause analyses and planned maintenance, making it the appropriate tool for an administrator to view official Azure status updates for a regional outage affecting multiple customers.

Answer

Activity log

Answer

Azure Advisor

Answer

Metrics explorer

Question 14

You need to be notified whenever the average CPU usage of VM-App01 exceeds 80 percent for 10 minutes. The solution must send an email to the operations team automatically. What should you configure?

Accepted Answer

Create an Azure Monitor metric alert and link it to an action group.. Azure Monitor metric alerts can evaluate performance counters like CPU usage over a specified time window (e.g., 10 minutes) and trigger an action group when the threshold (80%) is exceeded. The action group can be configured with an email notification to the operations team, meeting the requirement automatically.

Answer

Create an Azure Advisor recommendation alert.

Answer

Create an activity log alert for the virtual machine.

Answer

Create a subscription budget alert.

Question 15

A company plans a new spoke virtual network that must be peered to an existing hub VNet using 10.0.0.0/16. The spoke will need two subnets: one sized for about 120 VMs and another for about 40 VMs. The new address space must not overlap the hub or the on-premises range 10.1.0.0/16. Which VNet address space is the best choice?

Accepted Answer

10.2.0.0/22. (10.2.0.0/22) is correct because it provides a non-overlapping address space with the hub VNet (10.0.0.0/16) and on-premises (10.1.0.0/16). The /22 prefix offers 1024 IP addresses, which is sufficient for subnets supporting 120 VMs and 40 VMs, while avoiding any overlap with the existing ranges.

Answer

10.0.1.0/24

Answer

10.1.0.0/22

Answer

10.0.0.0/24