AZ-104 Practice Test 2 — 25 Questions

Question 1

An Azure virtual machine was moved to a host that is experiencing intermittent issues. You need to move the VM to a different Azure host while keeping the existing managed disks and configuration. Which action should you perform?

Accepted Answer

Redeploy. Redeploying the VM (Option C) is the correct action because it moves the VM to a new Azure host node while preserving the existing managed disks, virtual network, and configuration. The Azure platform automatically selects a healthy host, resolves transient hardware issues, and maintains the VM's identity and associated resources.

Answer

Stop

Answer

Restart

Answer

Capture

Question 2

You need to view recommendations about underutilized virtual machines, security improvements, and cost-saving opportunities in Azure. Which service should you use?

Accepted Answer

Azure Advisor. Azure Advisor provides personalized best-practice recommendations related to reliability, security, performance, operational excellence, and cost.

Answer

Azure Policy

Answer

Network Watcher

Answer

Azure Backup

Question 3

The platform team wants to block deployment of Azure resources in any region except East US and West US. What should they configure?

Accepted Answer

An Azure Policy assignment that uses an allowed locations policy. Azure Policy's 'allowed locations' built-in policy definition enables you to restrict the regions where resources can be deployed. By assigning this policy at a management group or subscription scope with a parameter list containing only 'East US' and 'West US', any attempt to deploy resources in other regions will be denied at the Azure Resource Manager level, effectively blocking non-compliant deployments.

Answer

A Reader role assignment at the management group

Answer

A CanNotDelete lock on the subscription

Answer

A tag requirement enforced only by resource group naming

Question 4

A user accidentally deleted a file from an Azure VM. The administrator wants to recover only the deleted file from the most recent backup instead of restoring the entire VM. What should the administrator use?

Accepted Answer

File recovery from the Azure Backup restore process. Azure Backup's file-level recovery (also known as item-level restore) allows you to recover individual files or folders from a VM backup point without restoring the entire VM. This is achieved by mounting the recovery point as a drive on the same or another VM, enabling direct file copy. Option A is correct because this feature is specifically designed for granular recovery of deleted files from the most recent backup.

Answer

A new VM image

Answer

A metric alert

Answer

An NSG flow log

Question 5

A user deleted several files from an Azure VM, and the administrator wants to use Azure Backup file recovery. Which two items are needed to start the recovery process? Select two.

Accepted Answer

A recovery point. Azure Backup file recovery requires a recovery point (A) because it represents the snapshot of the VM's data at a specific time from which files can be restored. The file recovery script (C) is downloaded from the Recovery Services vault and mounts the recovery point as a drive on the VM, enabling file-level access. Without both, the recovery process cannot proceed.

Answer

An application security group

Answer

A metric alert rule

Answer

A user-assigned managed identity

Question 6

A virtual machine scale set must increase instance count when average CPU exceeds 75 percent and decrease when it stays below 30 percent. What Azure feature should you configure?

Accepted Answer

Autoscale settings. Autoscale settings are the correct feature because they allow you to define scale-out and scale-in rules based on performance metrics like average CPU percentage. In this scenario, you would configure a scale-out rule to increase the instance count when average CPU exceeds 75% and a scale-in rule to decrease it when CPU stays below 30%.

Answer

Availability zones

Answer

Azure Policy

Answer

Update management

Question 7

After a private endpoint for an Azure Blob Storage account is created, VMs in the same VNet still resolve the storage name to the public IP address. The administrator wants the name to resolve to the private endpoint address instead. What should be configured?

Accepted Answer

Link the private DNS zone for blob storage to the virtual network.. When a private endpoint is created for Azure Blob Storage, the private DNS zone (privatelink.blob.core.windows.net) must be linked to the virtual network to enable automatic resolution of the storage account's FQDN to the private endpoint's private IP address. Without this link, VMs in the VNet continue to use public DNS resolution, which returns the public IP. Linking the private DNS zone to the VNet ensures that DNS queries from VMs resolve to the private endpoint address via Azure's DNS infrastructure.

Answer

Create a route table that sends storage traffic to the private endpoint subnet.

Answer

Enable a service endpoint on the subnet that hosts the VMs.

Answer

Assign a public IP address to the private endpoint subnet.

Question 8

An administrator added a user to an Entra security group that already has Contributor on a resource group. The role assignment is correct, but the user still gets 'You do not have access' in the Azure portal 5 minutes later. What is the most likely next step?

Accepted Answer

Have the user sign out and sign back in to refresh the access token.. When a user is added to a security group that already has a role assignment, the new permissions take effect immediately in Azure RBAC, but the user's existing access token (which is cached by the Azure portal) does not include the new group membership claims. The token must be refreshed by signing out and signing back in, or by closing and reopening the browser, to force a new token acquisition that includes the updated role assignments.

Answer

Change the role assignment from the group to the subscription.

Answer

Delete and recreate the resource group.

Answer

Assign Owner directly to the user.

Question 9

An administrator moved a blob to the Archive tier last month. A user needs to open it tomorrow. What must happen before the file can be read?

Accepted Answer

Change the blob to Hot or Cool and wait for rehydration to complete. To read a blob in the Archive tier, it must first be rehydrated to the Hot or Cool tier. This process, called rehydration, changes the blob's tier and makes it accessible for reading. Until rehydration completes, the blob remains offline and cannot be read.

Answer

Create a snapshot of the archived blob

Answer

Enable versioning on the storage account

Answer

Move the storage account to LRS redundancy

Question 10

An Azure subscription contains several resource groups. You need to ensure that users can create virtual machines only in regions approved by the security team. Existing noncompliant VMs can remain unchanged. What should you do?

Accepted Answer

Assign a policy that denies resources in disallowed locations.. Azure Policy can enforce organizational standards by evaluating resources for compliance. The built-in 'Not allowed locations' policy denies the creation of resources in specified regions, ensuring users can only deploy VMs in approved regions. Since the requirement is to allow existing noncompliant VMs to remain unchanged, a deny effect policy (without a 'DeployIfNotExists' or 'Modify' effect) will only affect new deployments, leaving existing resources untouched.

Answer

Apply a ReadOnly lock to each resource group.

Answer

Create an action group in Azure Monitor.

Answer

Move all existing VMs to approved regions.

Question 11

An administrator wants to deploy the same set of Azure VMs every sprint from source control and make code reviews capture every infrastructure change. Which three approaches meet this requirement? Select three.

Accepted Answer

Store a Bicep file in source control and use it as the deployment definition.. Option A is correct because Bicep is a domain-specific language (DSL) for deploying Azure resources declaratively. Storing a Bicep file in source control allows you to version infrastructure as code, and code reviews can capture every change before deployment, ensuring consistency across sprints.

Answer

Create the VMs manually in the Azure portal each sprint and document the clicks afterward.

Answer

Export the resources after deployment and treat the export as the only authoritative source.

Question 12

A storage account should accept requests only from a specific virtual network subnet in Azure. The team does not want traffic to reach the public endpoint from the internet. What should the administrator configure?

Accepted Answer

Add a storage network rule for the subnet or use a private endpoint. Option B is correct because Azure storage accounts can restrict access to specific virtual network subnets using service endpoints or private endpoints. A storage network rule for the subnet allows traffic only from that subnet, while a private endpoint maps the storage account to a private IP in the VNet, completely bypassing the public endpoint. This ensures no internet traffic reaches the public endpoint, meeting the requirement.

Answer

Enable anonymous blob access

Answer

Move the container to the Archive tier

Answer

Assign the Contributor role to the subnet

Question 13

An administrator is preparing an Azure site-to-site VPN gateway deployment for an existing VNet. Which two prerequisites must be in place for the gateway to deploy successfully? Select two.

Accepted Answer

A dedicated GatewaySubnet must exist in the VNet.. Option A is correct because a dedicated GatewaySubnet is a mandatory requirement for deploying any Azure VPN gateway. This subnet must be named 'GatewaySubnet' and must have a minimum address prefix of /29 (though /27 is recommended) to accommodate the gateway VMs and future scaling. Without this subnet, the gateway creation will fail as Azure uses it to host the gateway VMs and route traffic.

Answer

The VNet must already contain a private endpoint for on-premises connectivity.

Answer

A network security group must be attached to the GatewaySubnet.

Answer

The VNet must use a service endpoint for Microsoft.Network.

Question 14

An application running on a VM in a subnet must access an Azure Storage account. The security team wants the storage account to accept traffic only from that subnet, but they do not want a private IP address in the VNet and they do not want to change DNS records. What should the administrator configure?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and restrict the storage firewall to that subnet.. Option B is correct because a service endpoint for Microsoft.Storage allows the subnet to send traffic to the storage account over the Azure backbone network using the storage account's public endpoint, without requiring a private IP address or DNS changes. The storage firewall then restricts access to only that subnet's traffic, meeting the security team's requirements.

Answer

Create a private endpoint and a private DNS zone for the storage account.

Answer

Allow access only from the VM public IP address.

Answer

Place the storage account in the same resource group as the VM.

Question 15

An operations team wants an email notification when the average CPU percentage on a VM stays above 85 percent for 10 minutes. Which two Azure Monitor components should they configure? Select two.

Accepted Answer

A metric alert rule. A metric alert rule is correct because it monitors a specific VM performance metric (e.g., Percentage CPU) and triggers when the average value exceeds 85% for a duration of 10 minutes, as defined by the aggregation granularity and evaluation frequency. This rule evaluates the metric data at regular intervals and fires an alert when the condition is met, enabling automated notification.

Answer

Azure Bastion

Answer

A Recovery Services vault

Answer

A resource lock

Question 16

An operations team wants device-generated log messages collected centrally so engineers can review interface changes, warnings, and errors from one place. Which technology is most directly associated with that goal?

Accepted Answer

Syslog. Syslog (A) is the standard protocol for collecting and centralizing log messages from network devices, servers, and other infrastructure. It allows engineers to forward interface changes, warnings, and errors to a central syslog server, enabling unified review and alerting. This directly matches the goal of centralized device-generated log collection.

Answer

NetFlow

Answer

DHCP relay

Answer

Port security

Question 17

An external consultant must access a resource group in your tenant using the consultant's existing work account. You want to avoid creating a separate username and password pair. Which two actions should the administrator take? Select two.

Accepted Answer

Invite the consultant as a guest user in Microsoft Entra ID.. Option A is correct because inviting the consultant as a guest user in Microsoft Entra ID (formerly Azure AD) allows the consultant to use their existing work account (external identity) without creating a new username/password. This leverages B2B collaboration, which uses the consultant's home directory for authentication, and the guest user object is created in your tenant to represent them.

Answer

Create a new member user account with an internal password.

Answer

Add the consultant to the Global Administrator role.

Answer

Share the subscription ID and tenant ID only.

Question 18

An application subnet has an NSG outbound rule Deny-HTTPS at priority 200 for TCP 443 to Any. A second outbound rule Allow-HTTPS-API at priority 300 permits TCP 443 from ASG-Web to ASG-Api. Web servers can reach other ports but not the API. What change should the administrator make?

Accepted Answer

Change the allow rule to a higher priority than 200, such as 100.. Option B is correct because NSG rules are evaluated in priority order, with lower numbers having higher precedence. The Deny-HTTPS rule at priority 200 blocks all outbound TCP 443 traffic, including traffic from ASG-Web to ASG-Api. To allow the specific traffic, the Allow-HTTPS-API rule must have a lower priority number (e.g., 100) so it is evaluated before the deny rule, permitting the desired traffic while the deny rule still blocks other outbound HTTPS traffic.

Answer

Delete the deny rule so the allow rule can be evaluated.

Answer

Change the destination from ASG-Api to the entire subnet address range.

Answer

Change the protocol from TCP to Any so the rule matches more traffic.

Question 19

An Azure Automation account runs PowerShell runbooks that must authenticate to Azure resources without embedded secrets. The automation account is recreated periodically during deployment, and the identity must continue to work after recreation without reissuing credentials. Which identity should you use?

Accepted Answer

A user-assigned managed identity.. A user-assigned managed identity (B) is the correct choice because it is an independent Azure resource that persists even when the Automation account is recreated. Unlike a system-assigned managed identity, which is tied to the lifecycle of the Automation account and is deleted when the account is deleted, a user-assigned managed identity can be reassigned to the new Automation account after recreation without requiring new credentials. This allows the runbooks to authenticate seamlessly using the same identity, avoiding embedded secrets.

Answer

A system-assigned managed identity.

Answer

A service principal with a client secret stored in Key Vault.

Answer

A shared access signature token.

Question 20

An enterprise has a management group named Corp that contains all production and sandbox subscriptions. An Entra ID group named Auditors must be able to read resources in every current subscription under Corp and in any subscription added later. Which two actions should the administrator take? Select two.

Accepted Answer

Assign the Reader role to the Auditors group at the Corp management group scope.. Assigning the Reader role at the Corp management group scope ensures that the Auditors group inherits read permissions to all current and future subscriptions under Corp, because Azure RBAC permissions assigned at a management group are inherited by all child subscriptions and resource groups. This meets the requirement for both existing and future subscriptions without manual updates.

Answer

Assign the Reader role directly to every subscription under Corp.

Answer

Assign the Reader role to the Auditors group at one resource group scope.

Answer

Create an Azure Policy assignment to grant read access to all subscriptions.