AZ-104 Practice Test 3 — 25 Questions

Question 1

Based on the exhibit, the administrator needs to deploy a VM quickly using a preapproved hardened operating system image. Which source should be used when creating the VM?

Accepted Answer

An approved custom image in an Azure Compute Gallery.. An approved custom image in an Azure Compute Gallery (formerly Shared Image Gallery) is the correct source because it allows the administrator to deploy a VM quickly using a preapproved, hardened operating system image. The Azure Compute Gallery provides versioning, replication, and regional distribution of custom images, ensuring that the hardened OS is readily available for rapid deployment across multiple regions. This aligns with the requirement for a preapproved image that meets security and compliance standards.

Answer

A temporary public IP address.

Answer

A network security group rule.

Answer

An Azure Monitor alert rule.

Question 2

Why is centralized logging especially useful during security investigations?

Accepted Answer

It makes related events from multiple devices easier to review and correlate.. Centralized logging aggregates logs from multiple sources (e.g., firewalls, servers, Azure Network Watcher) into a single repository, such as Azure Log Analytics. During security investigations, this enables security analysts to correlate events across devices (e.g., matching a suspicious IP address in firewall logs with authentication failures in domain controller logs) without manually connecting to each device. This correlation is critical for reconstructing attack timelines and identifying lateral movement, which is impossible with siloed logs.

Answer

It guarantees that attacks cannot succeed.

Answer

It replaces the need for authentication and authorization.

Answer

It forces all devices to use the same VLAN.

Question 3

A business wants a line-of-business VM workload to keep running if one Azure datacenter in the region goes offline. Which two deployment choices should the administrator use? Select two.

Accepted Answer

Deploy the VMs in different availability zones.. Option A is correct because deploying VMs across different availability zones protects against a single datacenter failure. Each availability zone is a physically separate datacenter within an Azure region, with independent power, cooling, and networking. If one zone goes offline, the VM in the other zone remains operational, ensuring business continuity for the line-of-business workload.

Answer

Place the VMs in the same availability set.

Answer

Use a proximity placement group for the VMs.

Answer

Use a snapshot of the operating system disk.

Question 4

A subnet has a user-defined route for 10.0.0.0/8 with next hop Virtual appliance 10.1.1.4. The VNet is peered with VNet-Shared, whose address space is 10.12.0.0/16. A VM in the subnet sends traffic to 10.12.4.25. Which next hop will Azure use?

Accepted Answer

VNet peering, because the peered VNet prefix is more specific than the broader UDR.. Azure uses the most specific matching route to determine next hop. The user-defined route (UDR) for 10.0.0.0/8 has a broader prefix length (/8) than the VNet peering route for 10.12.0.0/16 (/16). Since 10.12.4.25 falls within the peered VNet's address space, the more specific /16 route from VNet peering takes precedence over the UDR, directing traffic through the peering connection.

Answer

Virtual appliance 10.1.1.4, because the user-defined route controls all 10.x.x.x traffic.

Answer

Internet, because traffic not explicitly matched by the UDR leaves through the default route.

Answer

None, because Azure cannot route to peered VNets when a UDR exists on the subnet.

Question 5

A subnet NSG contains a deny inbound rule for TCP 3389 from Any at priority 100 and an allow inbound rule for TCP 3389 from 10.4.1.0/24 at priority 200. Admin workstations in 10.4.1.0/24 cannot connect by RDP. What change should the administrator make?

Accepted Answer

Lower the allow rule priority number so it is evaluated before the deny rule.. The correct answer is C because NSG rules are evaluated in priority order, with lower numbers having higher priority. The deny rule at priority 100 blocks all TCP 3389 traffic from Any, and the allow rule at priority 200 is never reached. Lowering the allow rule's priority number (e.g., to 90) ensures it is evaluated before the deny rule, allowing RDP traffic from 10.4.1.0/24.

Answer

Replace the source IP range with an application security group in the allow rule.

Answer

Change the protocol from TCP to Any in the allow rule.

Answer

Add a user-defined route to the subnet so RDP traffic bypasses the NSG.

Question 6

Based on the exhibit, a workload must remain available even if one datacenter in an Azure region becomes unavailable. The region supports zone deployment. What should the administrator configure?

Accepted Answer

Availability zones.. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying the workload across two or more zones ensures that if one datacenter fails, the other zones continue to operate, maintaining availability. This directly meets the requirement of surviving a single datacenter outage within a region that supports zone deployment.

Answer

An availability set.

Answer

A resource lock.

Answer

A user-defined route.

Question 7

Based on the exhibit, HTTPS traffic from the admin workstation is still being blocked. What change should the administrator make?

Accepted Answer

Change Allow-HTTPS-Admin to priority 100.. The Deny-All-Inbound rule has a default priority of 65000, which is higher (lower priority) than the Allow-HTTPS-Admin rule at priority 200. Since Azure Network Security Group (NSG) rules are evaluated in priority order (lowest number = highest priority), the Deny-All-Inbound rule is evaluated first and blocks all traffic, including HTTPS from the admin workstation. By changing Allow-HTTPS-Admin to priority 100, it will be evaluated before the Deny-All-Inbound rule, allowing HTTPS traffic to pass.

Answer

Delete the Deny-All-Inbound rule.

Answer

Change Allow-HTTPS-Admin protocol from TCP to Any.

Answer

Move the allow rule to outbound traffic.

Question 8

Based on the exhibit, what does the query return?

Accepted Answer

Failed deallocate operations on virtual machines during the last 24 hours.. The query filters for 'Status' equal to 'Failed' and 'Operation' equal to 'Deallocate Virtual Machines', returning only failed deallocate operations. The time filter restricts results to the last 24 hours. Therefore, the query returns failed deallocate operations on virtual machines during the last 24 hours.

Answer

All successful deallocate operations on virtual machines during the last 24 hours.

Answer

Any operations related to starting or restarting virtual machines in the last 24 hours.

Answer

Administrative changes made only from the Azure portal in the last 24 hours.

Question 9

Based on the exhibit, the workload must keep running if an entire datacenter in the region becomes unavailable. The region supports availability zones. What should you deploy?

Accepted Answer

Availability zones with the VMs distributed across zones.. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across multiple zones ensures that if one entire datacenter fails, the workload continues running in the other zone(s), meeting the requirement for regional datacenter-level resilience.

Answer

An availability set with one update domain per VM.

Answer

A single VM with a premium SSD data disk.

Answer

An Azure proximity placement group.

Question 10

Based on the exhibit, help desk staff must restart virtual machines only in RG-App. What is the narrowest scope where you should assign the role?

Accepted Answer

Assign the role at the RG-App resource group scope.. The narrowest scope that grants the necessary permissions to restart VMs only in RG-App is the resource group scope. Assigning the Virtual Machine Contributor role at the RG-App resource group level ensures that help desk staff can restart VMs within that specific resource group without having permissions to any other resources in the subscription or management group. This follows the principle of least privilege, limiting access to only what is required.

Answer

Assign the role at the subscription scope for Sub-IT-01.

Answer

Assign the role at the management group scope above the subscription.

Answer

Assign the role at the individual VM scope only.

Question 11

Based on the exhibit, the team wants a readable, repeatable deployment definition stored in source control. Which approach should they use for the Azure resources?

Accepted Answer

Bicep because it provides a concise declarative syntax for Azure deployments.. Bicep is a domain-specific language (DSL) that provides a concise, declarative syntax for deploying Azure resources. It is designed to be more readable than ARM templates and can be stored in source control, enabling repeatable, version-controlled deployments. This directly meets the team's requirement for a readable, repeatable deployment definition.

Answer

Azure Policy because it enforces the deployment automatically.

Answer

A runbook in Azure Automation because it is always easier to read than templates.

Answer

A resource lock because it prevents unauthorized changes to the deployment.

Question 12

Based on the exhibit, what should the administrator create to let Alex restart one VM and read its properties without giving broader permissions?

Accepted Answer

Create a custom role that includes only the required VM read and restart actions.. Option A is correct because Azure custom roles allow you to define granular permissions by specifying only the required actions in the `Actions` field of the role definition. For Alex to restart a VM (`Microsoft.Compute/virtualMachines/restart/action`) and read its properties (`Microsoft.Compute/virtualMachines/read`), a custom role with exactly these two actions provides the least-privilege access without granting broader permissions like VM write or delete.

Answer

Create an Azure Policy assignment that allows restart operations on the VM.

Answer

Apply a CanNotDelete lock to the VM resource.

Answer

Move the VM to a management group so the permissions become more specific.

Question 13

The subscription admin wants to receive an alert whenever anyone deletes a resource group, regardless of which resource type was inside it. Which alert type should be used?

Accepted Answer

An activity log alert targeting the delete resource group operation. Option C is correct because the 'Delete Resource Group' operation is an Azure Resource Manager control-plane action that is automatically logged in the Azure Activity Log. An activity log alert can be configured to fire whenever this specific operation is recorded, regardless of the resource types inside the group. This is the only alert type that directly monitors management-plane events like resource group deletion.

Answer

A metric alert on the deleted resource group's CPU

Answer

A log alert on a custom KQL query in a workspace only

Answer

A backup alert from a Recovery Services vault

Question 14

Based on the exhibit, which KQL query should you use in a scheduled query alert to trigger only when five or more failed events occur within any 15-minute window?

Accepted Answer

CustomAppLogs_CL | where TimeGenerated >= ago(1h) | where Status_s == 'Failed' | summarize FailedCount=count() by bin(TimeGenerated, 15m) | where FailedCount >= 5. Option B is correct because it filters for 'Failed' events in the last hour, groups them into 15-minute bins using `bin(TimeGenerated, 15m)`, and then counts them. The `where FailedCount >= 5` condition triggers the alert only when five or more failed events occur within any single 15-minute window, matching the requirement exactly.

Answer

CustomAppLogs_CL | where TimeGenerated >= ago(15m) | where Status_s == 'Failed' | summarize FailedCount=count() by bin(TimeGenerated, 1h) | where FailedCount >= 5

Answer

CustomAppLogs_CL | where TimeGenerated >= ago(1h) | summarize FailedCount=count() by bin(TimeGenerated, 15m) | where FailedCount >= 5

Answer

CustomAppLogs_CL | where TimeGenerated >= ago(1h) | where Status_s == 'Failed' | summarize FailedCount=count() by bin(TimeGenerated, 15m) | where FailedCount > 0

Question 15

Based on the exhibit, what should the administrator do so the hub and spoke can be peered successfully?

Accepted Answer

Change the spoke VNet to a non-overlapping address space.. VNet peering requires that the address spaces of the peered VNets do not overlap. Overlapping IP ranges cause routing conflicts and prevent successful peering. Changing the spoke VNet to a non-overlapping address space resolves this issue and allows the peering to be established.

Answer

Keep the current ranges and enable gateway transit on the peering.

Answer

Add another subnet inside the spoke VNet and reuse the current address space.

Answer

Create a network security group on the spoke subnet before peering.

Question 16

Why is centralized logging valuable during security incident response?

Accepted Answer

It makes related events from many devices easier to collect and correlate.. Centralized logging aggregates logs from multiple sources (e.g., Azure VMs, network security groups, Azure Firewall) into a single repository like Azure Log Analytics or Azure Sentinel. This correlation enables security analysts to identify patterns across devices, such as a chain of events from an initial breach to lateral movement, which is critical for incident response. Without centralization, manually correlating timestamps and log formats from disparate systems would be impractical during an active attack.

Answer

It guarantees that attacks cannot succeed.

Answer

It replaces access control mechanisms.

Answer

It forces all systems to use one VLAN.

Question 17

Before changing a managed data disk attached to a VM, you want a point-in-time copy that can be restored later if the change fails. What should you create?

Accepted Answer

Managed disk snapshot. A managed disk snapshot is a point-in-time, read-only copy of a managed disk that can be used to restore the disk to that exact state if a change fails. Snapshots are incremental, capturing only the changes since the last snapshot, and they exist independently of the source disk, allowing you to create a new disk from the snapshot for recovery.

Answer

Availability set

Answer

Image

Answer

Resource lock

Question 18

Based on the exhibit, which Azure Policy effect should be used so new resources without an Environment tag are blocked at deployment time?

Accepted Answer

Deny. The Deny effect (Option C) is the correct choice because it actively blocks any deployment that does not meet the policy rule—in this case, resources lacking an Environment tag. When a policy with Deny is assigned, Azure Resource Manager evaluates the request during deployment and rejects it with a 403 (Forbidden) status if the condition is not satisfied, preventing the resource from being created entirely.

Answer

Audit

Answer

Append

Answer

Disabled

Question 19

You create a private endpoint for an Azure Storage account. Virtual machines in VNet-App must resolve the storage account name to the private IP address of the endpoint. What should you configure?

Accepted Answer

A private DNS zone linked to VNet-App. A private DNS zone linked to VNet-App is required because Azure Private Endpoint uses a private IP address from the virtual network, but the storage account's fully qualified domain name (FQDN) must resolve to that private IP within the VNet. By linking a private DNS zone (e.g., `privatelink.blob.core.windows.net`) to VNet-App and configuring an A record for the endpoint's private IP, VMs can resolve the storage account name to the correct private address. Without this, DNS resolution would fall back to the public IP, defeating the purpose of the private endpoint.

Answer

A user-defined route on the subnet

Answer

An additional public IP address

Answer

An Azure Firewall policy

Question 20

Based on the exhibit, which method should the administrator use to grant the partner time-limited access to one container?

Accepted Answer

Generate a user delegation SAS after authenticating with Microsoft Entra ID.. A user delegation SAS is secured with Microsoft Entra ID credentials and can be scoped to a specific container with a time-limited expiry, meeting the requirement for time-limited access to one container. Unlike a service SAS, which uses the storage account key and grants broader permissions, the user delegation SAS provides finer-grained control and does not expose the account key. This method is the recommended approach for granting delegated, time-bound access to Azure Storage resources.

Answer

Generate a service SAS by using the storage account key and email the URL to the partner.

Answer

Make the container public and remove the SAS requirement from the partner workflow.

Answer

Assign the partner Storage Blob Data Contributor on the storage account and let them sign in interactively.

AZ-104 Practice Test 3 — 25 Questions

Exhibit

AZ-104 Practice Test 3 — 25 Questions

Exhibit