AZ-104 Practice Test 5 — 25 Questions

Question 1

A contractor needs Contributor on only VM1 and VM2 in rg-prod. Other resources in rg-prod must remain untouched, and the contractor must not gain access to any other resource groups or subscriptions. Which two role-assignment scopes meet the requirement? Select two.

Accepted Answer

Assign the role at the VM1 resource scope.. Option A is correct because assigning the Contributor role at the VM1 resource scope grants the contractor permissions exclusively to that virtual machine, leaving all other resources in rg-prod and other scopes untouched. This meets the requirement of limiting access to only VM1 and VM2 within rg-prod.

Answer

Assign the role at the rg-prod resource group scope.

Answer

Assign the role at the subscription scope.

Answer

Assign the role at the management group scope.

Question 2

A company wants to prevent users from creating storage accounts unless the resources include a costCenter tag. Which Azure feature should be used?

Accepted Answer

Azure Policy, because it can evaluate and enforce required resource properties.. Azure Policy is correct because it can enforce organizational standards by evaluating resource properties during creation and modification. By defining a policy that requires a 'costCenter' tag on all storage accounts, Azure Policy will deny creation of any storage account that does not include that tag, ensuring compliance without manual intervention.

Answer

Azure RBAC, because it controls whether users can create resources.

Answer

A resource lock, because it can force resources to use tags.

Answer

A service endpoint, because it can filter which resources are allowed in a subscription.

Question 3

A contractor must import data into one blob container for six hours. The contractor should not receive the storage account key, and access must be limited to that container only. Which credential should the administrator generate?

Accepted Answer

A user delegation SAS, because it is signed with Microsoft Entra credentials and is time limited.. A user delegation SAS is signed with Microsoft Entra credentials (formerly Azure AD) and can be scoped to a specific blob container with a time limit. This meets the requirement of granting the contractor access only to that container for six hours without exposing the storage account key.

Answer

A storage account access key, because it can be copied into the import tool.

Answer

A shared key connection string, because it works with any tool that needs blob access.

Answer

A managed identity token, because the contractor can use it outside Azure directly.

Question 4

A company stores customer documents in Azure Blob Storage. The business requires the data to stay available if one availability zone in the region has an outage. Which redundancy option should the administrator choose?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones within a primary region, ensuring data remains accessible if one zone fails. This meets the requirement for intra-region zone-level fault tolerance without the cost or complexity of geo-replication.

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 5

A developer deleted a single configuration file on a Windows Azure VM. The administrator wants to restore only that file from the latest backup without replacing the entire VM. Which restore workflow should be used?

Accepted Answer

Use file recovery from the backup item. Option B is correct because Azure Backup provides file-level recovery for Azure VMs using the 'File Recovery' feature. This allows you to mount the recovery point as a drive on the VM (or another machine) and copy individual files without restoring the entire VM. It uses iSCSI to present the backup snapshot directly to the VM for granular file access.

Answer

Restore the entire VM to a new instance

Answer

Create a new storage account and copy the file from there

Answer

Enable a resource lock on the VM

Question 6

Based on the exhibit, a backup administrator accidentally stopped protection for a critical VM and then deleted its backup item. The team wants Azure Backup to retain the deleted item long enough to recover it after the mistake is discovered the next day. What should be enabled on the vault?

Accepted Answer

Soft delete for backup data. Soft delete for backup data is the correct answer because it provides a safety net for accidentally deleted backup items. When enabled, Azure Backup retains deleted backup data for an additional 14 days (default) in a soft-deleted state, allowing administrators to recover the data before it is permanently purged. This directly addresses the scenario where protection was stopped and the backup item was deleted, as the data remains recoverable within the retention period.

Answer

A read-only resource lock on the VM

Answer

A network security group rule allowing port 445

Answer

Instant restore snapshots set to 30 days

Question 7

A container group runs a one-time import job in Azure Container Instances. After the job finishes successfully, it should not restart. Which restart policy should you choose?

Accepted Answer

Never. The 'Never' restart policy ensures that the container group does not restart after the job completes, which is ideal for a one-time import job that should run exactly once. Azure Container Instances supports three restart policies: Always, OnFailure, and Never. For a job that must not restart after successful completion, 'Never' is the correct choice because it prevents any automatic restart regardless of the exit code.

Answer

Always

Answer

OnFailure

Answer

Manual

Question 8

A development VM is recreated from scratch every week. The team wants the operating system disk to boot as quickly as possible and does not need the OS disk contents to survive deallocation. Which disk choice should the administrator make?

Accepted Answer

An ephemeral OS disk. An ephemeral OS disk is created on the local VM host storage, not on Azure managed storage, which eliminates network latency and provides significantly faster boot times. Since the team does not need the OS disk contents to survive deallocation and recreates the VM weekly, ephemeral disks are ideal as they are reset to the original image state on each deployment.

Answer

A Premium SSD managed OS disk

Answer

A Standard SSD managed OS disk

Answer

The VM temporary disk as the operating system disk

Question 9

A finance team stores documents in Azure Storage. The account must survive a failure of one availability zone in the primary region and also remain available if the primary region becomes unavailable. Which two replication options meet this requirement? Select two.

Accepted Answer

GZRS, because it combines zone redundancy in the primary region with geo-replication to a secondary region.. Option C (GZRS) is correct because it provides both zone-redundant storage (ZRS) within the primary region, ensuring survival of an availability zone failure, and geo-replication (GRS) to a secondary region, ensuring availability if the entire primary region becomes unavailable. This meets both requirements of the question.

Answer

LRS, because it keeps copies only within one datacenter and does not provide zone or geo protection.

Answer

ZRS, because it replicates across zones in one region but does not add secondary-region replication.

Answer

RA-GRS, because it allows reading from the secondary region but does not use zone-redundant storage in the primary region.

Question 10

A hub-and-spoke environment uses a DNS server VM in the hub VNet at 10.8.0.4 to resolve internal names such as app01.corp.local. The spoke VNet can reach hub VMs by IP after peering, but name resolution still fails from the spoke. What should the administrator configure so VMs in the spoke use the hub DNS server?

Accepted Answer

Configure the spoke VNet to use 10.8.0.4 as a custom DNS server.. Option B is correct because in Azure, a spoke VNet must explicitly be configured with a custom DNS server address to use a non-default DNS resolver. By setting the spoke VNet's DNS server to 10.8.0.4, all VMs in the spoke will send their DNS queries to that hub VM, resolving internal names like app01.corp.local. Without this configuration, the spoke VNet uses Azure-provided DNS, which cannot resolve custom private DNS zones hosted on the hub VM.

Answer

Add an inbound NSG rule on the spoke subnet to allow UDP and TCP 53 to 10.8.0.4.

Answer

Create a service endpoint for Microsoft.Storage on the spoke subnet.

Answer

Add a user-defined route for 10.8.0.4/32 pointing to the virtual network gateway.

Question 11

A help desk team must be able to reset passwords for cloud users in Microsoft Entra ID, but they must not be able to create or delete users. Which built-in role should you assign?

Accepted Answer

User Administrator. The User Administrator role in Microsoft Entra ID (formerly Azure AD) grants permissions to reset passwords for cloud users, but explicitly excludes the ability to create or delete users. This makes it the correct choice for a help desk team that needs password reset capabilities without broader user management rights.

Answer

Global Administrator

Answer

Reader

Answer

Billing Administrator

Question 12

A developer packages an internal web app as a Linux container. The app must be published with built-in HTTPS, deployment slots, and autoscale, and the team does not want to manage OS patching or container hosts. Which Azure service should the administrator choose?

Accepted Answer

Azure App Service. Azure App Service is the correct choice because it natively supports Linux containers, built-in HTTPS via TLS/SSL, deployment slots for staging and production swaps, and autoscale based on metrics or schedules. It also abstracts OS patching and container host management, meeting the team's requirement to avoid managing infrastructure.

Answer

Azure Container Instances

Answer

Azure Virtual Machines

Answer

Azure Kubernetes Service

Question 13

A file server VM is corrupted after a bad change. The team needs to recover the whole machine to the latest recovery point, not just one file. Which restore workflow should they use?

Accepted Answer

Restore virtual machine. Option A is correct because Azure Backup's 'Restore virtual machine' workflow creates a new VM from the latest recovery point, restoring the entire machine state including OS, applications, and data. This is the appropriate method when the goal is to recover the full VM after corruption, as it uses the VM-level restore point stored in the Recovery Services vault.

Answer

File and folder recovery

Answer

Modify the backup policy

Answer

Create an action group

Question 14

A partner company needs write access to a single blob container for 24 hours. The partner does not have an Azure subscription in your tenant, and the team does not want to share the storage account key. Which access method is the best choice?

Accepted Answer

Create a user delegation SAS with write permission and a short expiration time. A user delegation SAS is the best choice because it provides time-limited, scoped write access to a specific blob container without exposing the storage account key. It is secured with Azure AD credentials and can be configured with a short expiration time (e.g., 24 hours), meeting the partner's requirement for temporary access. This method ensures the partner does not need an Azure subscription in your tenant and avoids sharing the account key.

Answer

Grant the partner Contributor access on the storage account

Answer

Share the storage account access key and let the partner create their own token

Answer

Enable anonymous public write access on the container

Question 15

A line-of-business app runs on a single Azure VM in a region that supports availability zones. The business wants the VM to keep running if one datacenter in the region becomes unavailable. Which deployment choice best meets this requirement?

Accepted Answer

Availability zone. An availability zone is a physically separate datacenter within an Azure region, with independent power, cooling, and networking. Deploying the VM to a specific zone ensures it remains operational if another zone's datacenter fails, meeting the requirement for single-VM resilience against a datacenter outage.

Answer

Availability set

Answer

Proximity placement group

Answer

Virtual machine scale set

Question 16

A help desk engineer needs a Log Analytics query that returns each computer whose most recent heartbeat is older than 20 minutes. Which query should they use?

Accepted Answer

Heartbeat | summarize LastSeen = max(TimeGenerated) by Computer | where LastSeen < ago(20m). Option B is correct because it first summarizes the most recent heartbeat timestamp for each computer using `max(TimeGenerated)`, then filters for computers where that latest heartbeat is older than 20 minutes with `where LastSeen < ago(20m)`. This ensures only computers that have not sent a heartbeat in the last 20 minutes are returned, which is the exact requirement.

Answer

Heartbeat | where TimeGenerated < ago(20m) | summarize LastSeen = max(TimeGenerated) by Computer

Answer

Heartbeat | summarize count() by Computer | where count_ < 20

Answer

Heartbeat | where TimeGenerated > ago(20m) | summarize LastSeen = max(TimeGenerated) by Computer

Question 17

A production resource group contains web and data resources. Administrators must be able to update, scale, and restart resources, but they must not delete the resource group or any resource inside it during maintenance windows. Which two actions should the administrator take? Select two.

Accepted Answer

Apply a CanNotDelete lock to the resource group.. Option A is correct because applying a CanNotDelete lock to the resource group prevents the deletion of the resource group and all resources within it, while still allowing administrators to update, scale, and restart resources. This lock type blocks delete operations but permits read and update operations, which aligns with the requirement to perform maintenance actions without risking deletion. The lock is inherited by all child resources in the resource group, ensuring comprehensive protection.

Answer

Apply a ReadOnly lock to the resource group.

Answer

Apply a CanNotDelete lock only to the individual virtual machines.

Answer

Use tags to mark the resources as production and prevent deletion.

Question 18

A legal team archived a 200-GB blob last quarter. They now need to open it repeatedly later today for review, and waiting more than a day would delay the case. Which two actions should the administrator take? Select two.

Accepted Answer

Start a rehydration request and target the Hot tier.. Option A is correct because rehydrating a blob from the Archive tier to the Hot tier makes it accessible for frequent reads. The Hot tier is optimized for high-frequency access, which matches the legal team's need to open the blob repeatedly later today. Rehydration is the only way to change the blob's tier from Archive to an online tier like Hot.

Answer

Copy the blob directly while it remains in the Archive tier.

Answer

Change the blob back to the Archive tier after the request starts.

Answer

Take a snapshot first and expect it to make the archived blob readable immediately.

Question 19

A network team centralizes DHCP in a data center. Users in a remote branch stop receiving addresses after the branch router is replaced. Which missing configuration on the branch gateway is the strongest suspect?

Accepted Answer

DHCP relay or helper configuration on the client-facing gateway interface. When a DHCP server is centralized in a data center, remote clients rely on the branch gateway to forward their broadcast DHCP requests as unicast to the server. This is achieved by configuring a DHCP relay agent (ip helper-address) on the client-facing interface of the branch router. Without this configuration, DHCP broadcasts are dropped at the router, and clients never receive IP addresses.

Answer

A spanning-tree priority change on the branch switch

Answer

A CAPWAP tunnel from the branch PCs to the data center

Answer

A voice VLAN configuration on the WAN interface

Question 20

A line-of-business app requires protection against a datacenter outage in a region that supports zones. You want the strongest placement resilience available for the VMs. What should you choose?

Accepted Answer

Availability zone. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across zones provides the strongest resilience against a datacenter outage because if one zone fails, the other zones remain operational. This is the highest level of protection available within a single region for IaaS VMs.

Answer

Availability set

Answer

Virtual machine scale set

Answer

Resource lock