AZ-104 Practice Test 2 — 25 Questions

Question 1

You need to prevent accidental deletion of a resource group while still allowing administrators to create and modify resources inside it. Which Azure lock should you apply?

Accepted Answer

CanNotDelete. The CanNotDelete lock prevents deletion of the resource group while still allowing all operations (read, write, modify) on resources within it. This lock type is designed specifically to protect against accidental deletion without restricting administrative actions like creating or updating resources.

Answer

ReadOnly

Answer

Delete lock

Answer

No lock and a budget alert

Question 2

A storage account has public network access disabled. A VM in VNet-App can reach a private endpoint for the account, but the storage name still resolves to the public IP address from the VM, and connections are denied. What should the administrator configure?

Accepted Answer

A private DNS zone for the storage blob endpoint linked to VNet-App.. When public network access is disabled on a storage account and a private endpoint is configured, the storage account's public DNS name must resolve to the private endpoint's private IP address within the virtual network. By default, the DNS name continues to resolve to the public IP address, causing connection failures. Linking a private DNS zone (privatelink.blob.core.windows.net) to VNet-App enables automatic resolution of the storage blob endpoint to the private IP address, allowing the VM to connect successfully.

Answer

A service endpoint on the subnet so the storage account uses a private IP address.

Answer

A storage account access key on the VM so the public endpoint will accept the connection.

Answer

A user-defined route sending storage traffic to the virtual network gateway.

Question 3

Based on the exhibit, what should you do so the report can open the file tomorrow morning?

Accepted Answer

Change the blob to the Hot access tier and allow it to rehydrate before the report runs.. The blob is currently in the Archive access tier, which requires manual rehydration (changing the tier to Hot or Cool) before it can be read. Rehydration can take up to 15 hours, so changing the blob to the Hot access tier now and allowing it to complete rehydration before the report runs tomorrow ensures the file is available for reading.

Answer

Change the blob to the Cool access tier only, because Cool is always immediately readable.

Answer

Create a snapshot of the archived blob and use the snapshot instead.

Answer

Enable versioning on the storage account so the file becomes readable again.

Question 4

A storage account should accept traffic only from one subnet, but the team does not want to create a private IP address for the service in the virtual network. What should they enable?

Accepted Answer

Service endpoint, because it allows the subnet to access the storage service securely over the Azure backbone.. Service endpoints allow a subnet to access Azure PaaS services (like Storage) over the Azure backbone without requiring a private IP address. By enabling a Microsoft.Storage service endpoint on the subnet and configuring the storage account firewall to allow traffic only from that subnet, the team meets the requirement securely and cost-effectively.

Answer

Private endpoint, because it is the only way to allow one subnet.

Answer

User-assigned managed identity, because it controls subnet access.

Answer

Blob soft delete, because it helps restrict where traffic comes from.

Question 5

A department has 10 subscriptions and wants the same two governance rules applied to all current and future subscriptions. One rule audits missing tags, and the other denies unapproved locations. Which two actions should the administrator take? Select two.

Accepted Answer

Create an Azure Policy initiative that contains both policy definitions.. Azure Policy Initiative allows grouping multiple policy definitions (like audit for missing tags and deny for unapproved locations) into a single set for coordinated enforcement. Assigning the initiative at the management group scope ensures it applies to all current and future subscriptions under that management group, meeting the requirement for consistent governance across all 10 subscriptions and any new ones added later.

Answer

Assign each policy only to one resource group.

Answer

Use Azure RBAC instead of Policy for both requirements.

Answer

Create a read-only lock on each subscription.

Question 6

A VM suffered corruption and an auditor also needs one missing file. Match each Azure Backup restore workflow to the recovery outcome it provides.

Accepted Answer

Restore VM: Creates a new VM. Azure Backup restore workflows: 'Restore VM' creates a new VM, 'Restore files' recovers individual files, 'Restore as unmanaged/managed disks' recovers disks, 'Replace existing VM' overwrites the original, and 'Cross-region restore' restores to another region.

Answer

Restore VM: Recovers individual files

Answer

Restore files: Overwrites the original VM

Question 7

A company uses Azure Blob Storage for legal documents. The documents must not be modified or deleted for seven years after upload, even by administrators. What should you configure?

Accepted Answer

Immutable blob storage with a time-based retention policy. Immutable blob storage with a time-based retention policy (WORM – Write Once, Read Many) ensures that blobs cannot be modified or deleted for a specified retention period, even by administrators. This is the only Azure storage feature that provides legal hold or regulatory compliance for fixed records, such as legal documents that must remain unaltered for seven years.

Answer

Blob soft delete

Answer

Lifecycle management to move blobs to Archive

Answer

Blob versioning

Question 8

An operations team maintains a hardened Windows Server image with application prerequisites and monitoring tools already installed. They want to deploy future VMs from the same versioned image in multiple subscriptions and promote a new build only after testing. Which Azure feature should they use?

Accepted Answer

An Azure Compute Gallery image version. An Azure Compute Gallery (formerly Shared Image Gallery) allows you to store and manage multiple versions of a custom VM image, replicate them across regions, and share them across subscriptions. This enables the team to maintain a hardened, versioned image, deploy VMs from it in multiple subscriptions, and promote a new build only after testing by creating a new image version.

Answer

A managed disk snapshot created from one of the VMs

Answer

A custom script extension installed during VM provisioning

Answer

An availability set containing the VMs

Question 9

A stateless web application needs a group of identical Azure VMs that can automatically add more instances during the workday and remove them at night based on CPU usage. What should the administrator deploy?

Accepted Answer

A virtual machine scale set with autoscale rules. A virtual machine scale set (VMSS) with autoscale rules is the correct solution because it provides a group of identical, load-balanced VMs that can automatically scale out (add instances) during high CPU usage in the workday and scale in (remove instances) at night based on CPU thresholds. This matches the stateless, elastic requirement perfectly, as VMSS is designed for horizontal scaling of identical instances with autoscale policies tied to metrics like CPU percentage.

Answer

An availability set with two VMs

Answer

A single VM with a larger disk

Answer

An Azure Policy assignment to increase CPU capacity

Question 10

A web tier and an app tier run on separate Azure VMs in the same region. Each VM's NIC is added to an application security group named WebASG or AppASG. The administrator must allow only the web tier to connect to the app tier on TCP 8443, and future VM scale-outs must be included automatically. Which NSG rule should be created?

Accepted Answer

An inbound rule with source WebASG, destination AppASG, protocol TCP, and destination port 8443.. Application security groups (ASGs) allow you to configure network security as a natural extension of an application's structure, enabling you to group VMs by their roles (e.g., web tier, app tier) and define rules based on those groups. By creating an inbound NSG rule with source WebASG and destination AppASG on TCP port 8443, any VM added to WebASG can initiate traffic to any VM in AppASG, and future scale-outs are automatically included without manual IP updates. This approach is dynamic, scalable, and aligns with the requirement for automatic inclusion of new VMs.

Answer

An inbound rule that uses the current web VM's private IP as the source and the current app VM's private IP as the destination.

Answer

A route table that sends TCP 8443 traffic from the web subnet to the app subnet.

Answer

An Azure Firewall application rule collection that permits all traffic between the two subnets.

Question 11

A legal department stores project video assets in Azure Blob Storage. The files are reviewed only during quarterly audits, but when someone needs a file it must open immediately without waiting for rehydration. Which access tier should the administrator use for the blobs?

Accepted Answer

Cool, because it is for infrequent access while still keeping blobs online and immediately available.. The Cool access tier is designed for data that is infrequently accessed but must remain immediately available (online) without any rehydration delay. Since the legal department needs instant access during quarterly audits, Cool meets the requirement of low retrieval cost while keeping blobs online, unlike Archive which requires hours-long rehydration.

Answer

Hot, because it is optimized for frequent access and always costs the least to retrieve.

Answer

Archive, because it is the cheapest choice for data that is rarely used and can be restored instantly.

Answer

Premium, because it is intended for workload bursts and gives the best long-term storage economics.

Question 12

You need an alert that emails administrators when CPU on VM-DB01 exceeds a threshold. Which two Azure Monitor components work together to achieve this?

Accepted Answer

A metric alert and an action group. A metric alert monitors a specific performance metric (like CPU percentage) on a target resource (VM-DB01) and triggers when the value crosses a defined threshold. An action group defines the notification actions (e.g., sending an email to administrators) that execute when the alert fires. Together, they form the core alerting workflow in Azure Monitor: the metric alert evaluates the condition, and the action group delivers the response.

Answer

A budget alert and a private DNS zone

Answer

A Recovery Services vault and a route table

Answer

An activity log export and a lock

Question 13

A media archive stores large video files that must survive a zone failure in the primary region and also be replicated to a paired region for disaster recovery. The archive team does not want anyone to read from the secondary region during normal operations, and cost should be lower than the read-access variant. Which redundancy option should you configure?

Accepted Answer

GZRS, because it adds zone redundancy and geo-replication without enabling secondary read access.. GZRS (Geo-Zone-Redundant Storage) is correct because it combines zone redundancy (three copies across availability zones in the primary region) with geo-replication to a paired secondary region, but crucially does not enable read access to the secondary region by default. This satisfies the requirement to survive a zone failure, provide disaster recovery to a paired region, and prevent reads from the secondary during normal operations, all at a lower cost than RA-GRS which includes secondary read access.

Answer

LRS, because it keeps copies in a single datacenter and is the lowest-cost option.

Answer

ZRS, because it protects against zone failures but not regional outages.

Answer

RA-GRS, because the read-access copy is needed whenever data is replicated to another region.

Question 14

A storage account must stay online for applications, but administrators have a temporary freeze on configuration changes. Users can still view the account, but attempts to change the access tier, create a container, or update networking all fail. What most likely caused the behavior?

Accepted Answer

A ReadOnly lock was applied to the storage account.. A ReadOnly lock (Azure Resource Manager lock) prevents any modification to the storage account, including changing the access tier, creating containers, or updating networking settings, while still allowing read operations like viewing the account. This matches the described behavior exactly because the lock is applied at the resource scope and blocks all write/delete operations, but does not affect read access.

Answer

A CanNotDelete lock was applied to the storage account.

Answer

An Azure Policy audit assignment was applied to the storage account.

Answer

The account was moved to a different subscription.

Question 15

An administrator wants to let a help desk group start, stop, and restart virtual machines in one resource group, but the group must not be able to delete the VMs or any other resource in the group. Which two actions should the administrator take? Select two.

Accepted Answer

Create a custom RBAC role with only VM start, stop, restart, and read actions.. Option A is correct because Azure RBAC's built-in Virtual Machine Contributor role also grants delete permissions, so the administrator must create a custom role scoped to only the required actions, such as Microsoft.Compute/virtualMachines/start/action, powerOff/action, restart/action, and read. Option B is correct because assigning that custom role at the resource group scope grants the help desk group the needed permissions on all VMs in that group while keeping the role limited to that boundary. Option C is incorrect because Virtual Machine Contributor includes Microsoft.Compute/virtualMachines/delete, which violates the requirement that the group must not delete VMs. Option D is incorrect because a CanNotDelete lock prevents deletion for everyone, including administrators, and does not grant start/stop/restart permissions. Option E is incorrect because Azure Policy can deny deletion but does not grant the start, stop, and restart permissions the help desk group needs.

Answer

Assign Virtual Machine Contributor to the help desk group.

Answer

Apply a CanNotDelete lock to the resource group.

Answer

Use Azure Policy to block VM deletion and leave RBAC unchanged.

Question 16

Order the steps to set up Azure Site Recovery for on-premises to Azure.

Accepted Answer

Step 1: Create a Recovery Services vault, Step 2: Configure source and target settings, Step 3: Install the Mobility service agent on on-premises machines, Step 4: Enable replication, Step 5: Test failover. The correct sequence for setting up Azure Site Recovery for on-premises to Azure is: create a Recovery Services vault, configure source and target settings, install the Mobility service agent on on-premises machines, enable replication, and then test failover. This order ensures prerequisites are met and replication is active before testing.

Answer

Step 1: Install the Mobility service agent on on-premises machines, Step 2: Create a Recovery Services vault, Step 3: Configure source and target settings, Step 4: Enable replication, Step 5: Test failover

Answer

Step 1: Create a Recovery Services vault, Step 2: Configure source and target settings, Step 3: Enable replication, Step 4: Install the Mobility service agent on on-premises machines, Step 5: Test failover

Answer

Step 1: Create a Recovery Services vault, Step 2: Configure source and target settings, Step 3: Install the Mobility service agent on on-premises machines, Step 4: Test failover, Step 5: Enable replication

Question 17

Arrange the steps to create an Azure Storage account with a container and upload a blob.

Accepted Answer

Create storage account → Create container → Set access level → Upload blob → Generate SAS. Create storage account, create container, set access, upload blob, generate SAS.

Answer

Create container → Create storage account → Set access level → Upload blob → Generate SAS

Answer

Create storage account → Upload blob → Create container → Set access level → Generate SAS

Answer

Create storage account → Create container → Upload blob → Set access level → Generate SAS

Question 18

Based on the exhibit, what should the administrator do so VM-B resolves the storage account name to the private IP address?

Accepted Answer

Link the private DNS zone to VNet-B.. The private DNS zone for the storage account must be linked to VNet-B so that VM-B can resolve the storage account's fully qualified domain name (FQDN) to the private IP address of the private endpoint. Without this link, the DNS resolution will fall back to the public endpoint, bypassing the private connectivity. Linking the zone ensures Azure's default DNS servers return the private IP for the storage account within VNet-B.

Answer

Create a service endpoint on VNet-B and leave DNS unchanged.

Answer

Assign a public IP address to the private endpoint.

Answer

Add a route table with a next hop to the storage account.

Question 19

Based on the exhibit, a policy assigned at the subscription denies storage accounts that allow public network access. One existing storage account in RG-Legacy must remain publicly reachable for 30 days while a migration is completed. What should the administrator use?

Accepted Answer

Create a policy exemption for stlegacy01 at the resource scope.. A policy exemption at the resource scope is the correct approach because it allows the administrator to selectively exclude the specific storage account (stlegacy01) from the subscription-level policy that denies public network access. This exemption can be configured with an expiration date of 30 days, ensuring the legacy account remains publicly reachable during the migration while the policy continues to apply to all other resources. Policy exemptions are designed for exactly this scenario—temporary exceptions for compliance or migration needs—without altering the policy definition or assignment.

Answer

Remove the policy assignment from the subscription until the migration finishes.

Answer

Change the policy effect from Deny to Audit.

Answer

Move the legacy storage account to a separate subscription and assign the policy there.

Question 20

A customer-facing service needs to survive a single datacenter outage in a zone-supported region. You do not need cross-region failover, but you do need Azure to spread instances without manual placement errors. Which two deployment choices satisfy that goal? Select two.

Accepted Answer

Place the VMs in different availability zones within the same region.. Availability zones are physically separate datacenters within a region, each with independent power, cooling, and networking. Placing VMs in different zones ensures that a single datacenter outage does not affect all instances, meeting the survivability requirement without manual placement errors. Azure automatically distributes VMs across selected zones, eliminating human error in instance placement.

Answer

Use an availability set and expect it to cover a zone outage.

Answer

Keep all instances in one zone and rely on the load balancer.

Answer

Use a paired region for automatic in-region zone balancing.