AZ-104 Practice Test 5 — 25 Questions

Question 1

An administrator wants a script running on an Azure VM to create a resource in Azure without storing any passwords or client secrets on the VM. What should the administrator configure first?

Accepted Answer

A system-assigned managed identity on the VM. A system-assigned managed identity enables an Azure VM to authenticate to Azure services (e.g., Azure Resource Manager) without storing any credentials in the VM. The identity is automatically created and managed by Azure, and the VM can obtain an access token from Azure AD via the Instance Metadata Service (IMDS) endpoint (169.254.169.254) using a simple HTTP call. This allows the script to securely create resources without hardcoding passwords or client secrets.

Answer

A shared local account on the VM

Answer

An Azure Policy exemption

Answer

A public IP address on the VM

Question 2

A contractor is a member of an Entra security group that has the Contributor role on a resource group. When the contractor tries to deploy, the portal says the role is not active. The activation request requires approver approval, and the previous activation window has expired. What should the contractor do?

Accepted Answer

Activate the eligible role through Privileged Identity Management and obtain approval if required.. The contractor has an eligible role assignment that requires activation through Privileged Identity Management (PIM). Since the previous activation window has expired, the role is no longer active, and the contractor must initiate a new activation request, which may require approver approval. Option D correctly describes this process, as PIM is the Azure service designed for just-in-time access to privileged roles.

Answer

Wait for the role assignment to propagate to Azure.

Answer

Create a new security group and assign Contributor directly.

Answer

Sign out of the portal and sign back in only.

Question 3

Based on the exhibit, where should the administrator go next to review the failed backup job details?

Accepted Answer

Jobs, because it contains the backup job status and error details.. The Jobs blade in Azure Backup is the central location for reviewing the status, progress, and detailed error messages of all backup jobs, including failed ones. It provides a filtered view of backup, restore, and other operations, allowing the administrator to drill into specific job failures to see error codes and recommended actions.

Answer

Backup policy, because it shows the retention and schedule configuration.

Answer

Backup items, because it lists protected resources and recovery points.

Answer

Properties, because it contains the general vault settings.

Question 4

Based on the exhibit, the Prod management group contains three subscriptions that host application workloads. An operations group must be able to read all current and future resources in those Prod subscriptions, but it must not have access to Sandbox. Where should you assign the Reader role?

Accepted Answer

Assign Reader to OpsGroup at the Prod management group.. Assigning the Reader role at the Prod management group scope ensures that OpsGroup inherits read permissions to all current and future subscriptions and resources within that management group, while excluding the Sandbox subscription which is outside the Prod hierarchy. This leverages Azure RBAC inheritance, where roles assigned at a management group propagate to all child subscriptions and resource groups, meeting the requirement for a single assignment that covers all Prod workloads without granting access to Sandbox.

Answer

Assign Reader to OpsGroup at the Corp management group.

Answer

Assign Reader to OpsGroup at one application resource group in AppSub1.

Answer

Assign Reader to OpsGroup at each subscription individually.

Question 5

A legal department archived a 120-GB blob three weeks ago. They now need the file available for review later today, and waiting more than a day would delay a court filing. What should the administrator do to make the blob readable as quickly as possible?

Accepted Answer

Start rehydration from Archive and choose High priority.. Rehydrating a blob from the Archive tier with High priority typically makes the blob readable within 1 hour, meeting the urgent same-day requirement. The Archive tier is offline, so the blob must be rehydrated (changed to an online tier like Hot or Cool) before it can be accessed. High-priority rehydration is designed for time-sensitive scenarios like this court filing deadline.

Answer

Copy the blob to a new container and leave it in the Archive tier until the users need it.

Answer

Change the access tier from Archive directly to Cool and then download the blob immediately.

Answer

Enable soft delete on the container and restore the blob from deleted items.

Question 6

A contractor pool changes every month. The operations team wants Azure role access to stay the same when people join or leave, without editing role assignments for each person. Which two actions should the administrator take? Select two.

Accepted Answer

Create a security group in Microsoft Entra ID for the contractor pool.. Creating a security group in Microsoft Entra ID (formerly Azure AD) allows the administrator to manage membership dynamically or manually as contractors join or leave. By assigning the Azure role to this security group (Option D), role assignments remain constant; only group membership changes, eliminating the need to edit individual role assignments. This approach leverages Azure RBAC's support for security groups as assignable principals, ensuring consistent access control.

Answer

Assign the Azure role directly to each contractor account.

Answer

Create a Microsoft 365 group and use it for VM sign-in.

Answer

Use a user-assigned managed identity for each contractor.

Question 7

A company has 15 branch Windows file servers that must show the same shared drive content. Users should keep working during short WAN outages, and local servers should cache frequently used files. Which Azure feature should you deploy?

Accepted Answer

Azure File Sync, because it synchronizes on-premises file servers with an Azure file share and supports cloud tiering.. Azure File Sync is the correct choice because it synchronizes on-premises Windows file servers with an Azure file share, enabling multi-site file server consolidation. It supports cloud tiering, which caches frequently accessed files locally on each branch server while freeing up space by tiering cold data to the cloud. This ensures users can continue working during short WAN outages, as local caches provide access to synced files even when connectivity is lost.

Answer

Azure Blob Storage with lifecycle rules, because it can present files to multiple branches.

Answer

A private endpoint to Blob Storage, because it provides local caching for SMB file shares.

Answer

A managed disk shared across the branch servers, because it gives the same content to all locations.

Question 8

Based on the exhibit, why is the administrator's HTTPS test still being denied, and what should be changed?

Accepted Answer

Move Allow-HTTPS-Admin to a priority lower than 200.. The administrator's HTTPS test is denied because Azure Network Security Groups (NSGs) process rules in priority order, from lowest to highest numeric value. The deny rule at priority 200 is evaluated before the allow rule at priority 300, so the HTTPS traffic is blocked. To allow HTTPS traffic, the allow rule must have a lower priority number (e.g., 100) than the deny rule, ensuring it is evaluated first. Option B correctly identifies that moving Allow-HTTPS-Admin to a priority lower than 200 (i.e., a smaller number) will allow the traffic before the deny rule is applied.

Answer

Increase the deny rule priority number from 200 to 300.

Answer

Change Allow-HTTPS-Admin to use protocol Any.

Answer

Assign a public IP address to the VM.

Question 9

Based on the exhibit, the VPN gateway deployment fails during validation. What resource is missing?

Accepted Answer

A public IP address resource associated with the VPN gateway.. A VPN gateway requires a dedicated public IP address resource to establish the IPsec tunnel with the on-premises VPN device. During validation, Azure checks that a public IP address is associated with the gateway; if missing, the deployment fails because the gateway cannot route traffic over the internet or terminate the VPN connection.

Answer

A network security group attached to GatewaySubnet.

Answer

A route table with a default route to the on-premises network.

Answer

A private endpoint for the on-premises VPN device.

Question 10

A lifecycle rule moves blobs to the archive tier after 90 days. A file was archived 2 weeks ago, and a reporting job now needs to read it tomorrow morning. What should you expect?

Accepted Answer

The file must be rehydrated to an online tier before it can be read, so access is delayed.. Blobs in the Azure Archive tier are offline and cannot be read directly. To access the data, you must first rehydrate the blob to an online tier (Hot, Cool, or Cold) using a copy or change-tier operation, which introduces a delay (typically up to 15 hours for standard priority rehydration). The file was archived only 2 weeks ago, so it is still in the Archive tier and requires rehydration before the reporting job can read it tomorrow morning.

Answer

The file is immediately readable, but only through the archive endpoint and at a higher request rate.

Answer

The file is permanently deleted when it enters archive, so the job must use a backup restore.

Answer

The file can be read immediately if the account has read-access geo-redundancy enabled.

Question 11

A company wants to stop users from creating resources in regions that are not approved and also require a Department tag on new resources. Which two tasks are best handled by Azure Policy? Select two.

Accepted Answer

Restrict allowed deployment locations.. Azure Policy can enforce organizational standards by evaluating resource properties against business rules. Option A is correct because the 'Allowed Locations' policy definition restricts users from deploying resources to any region not explicitly permitted, directly addressing the requirement to block unapproved regions. Option B is correct because the 'Require a tag and its value on resources' policy definition can enforce that a Department tag must exist on all new resources, ensuring compliance with tagging requirements.

Answer

Give users Contributor access to the subscription.

Answer

Create Microsoft Entra ID users for contractors.

Answer

Place a CanNotDelete lock on every resource group.

Question 12

A VM cannot connect to another VM on TCP 1433. You need to determine whether an NSG is blocking the flow and identify which rule applies. Which Network Watcher tool should you use?

Accepted Answer

IP flow verify. IP flow verify is the correct Network Watcher tool because it tests whether a packet is allowed or denied to or from a specific VM, based on a 5-tuple (source IP, destination IP, protocol, source port, destination port). For TCP 1433 (SQL Server), you can specify the exact flow parameters, and IP flow verify will evaluate all effective security rules, including NSG rules, and return the specific rule that allowed or denied the traffic.

Answer

Packet capture

Answer

Connection troubleshoot

Answer

Effective routes

Question 13

A team manages three backend servers in one subnet. The servers are replaced periodically, so their private IP addresses change. The NSG must allow inbound traffic from the web tier without updating individual IP addresses each time. Which destination object should be used in the NSG rule?

Accepted Answer

Application security group. An Application Security Group (ASG) allows you to group backend servers logically, regardless of their private IP addresses, and reference that group as the destination in an NSG rule. When servers are replaced and their IPs change, the ASG membership is automatically updated, so the NSG rule continues to apply without manual intervention. This is the correct approach for dynamic workloads where IP addresses are not static.

Answer

Service tag

Answer

Route table

Answer

Private endpoint

Question 14

An application uses two Azure VMs in the same datacenter and must continue through planned maintenance and a single hardware host failure. The administrator does not need separate datacenter protection. Which option should be used?

Accepted Answer

Availability set. An availability set distributes VMs across multiple fault domains (hardware hosts) and update domains within a single Azure datacenter. This ensures that during planned maintenance (update domains) or a single hardware host failure (fault domains), at least one VM remains available. Since the requirement does not include separate datacenter protection, an availability set is the correct choice.

Answer

Availability zones

Answer

Proximity placement group

Answer

Virtual machine scale set

Question 15

Backend virtual machines are rebuilt frequently and often receive different private IP addresses. An administrator must allow the frontend tier to reach the backend tier on TCP 8443 without editing NSG rules every time the backend IP changes. What should the administrator use in the NSG rule?

Accepted Answer

An Application Security Group that contains the backend VMs.. An Application Security Group (ASG) allows you to group backend VMs logically and reference that group in a Network Security Group (NSG) rule. When backend VMs are rebuilt and receive new private IPs, you simply add the new VMs to the same ASG, and the existing NSG rule (which references the ASG as the destination) automatically applies to the new IPs without any manual rule edits. This decouples security policy from dynamic IP addresses, making it the ideal solution for frequently changing backend IPs.

Answer

A static private IP address for each backend VM.

Answer

A user-defined route pointing frontend traffic to the backend subnet.

Answer

A private endpoint for the backend tier.

Question 16

An application on a VM in subnet AppSubnet must access a storage account over the public endpoint. The security team wants to allow traffic only from AppSubnet and does not want to deploy a private endpoint. What should the administrator configure?

Accepted Answer

Enable the Microsoft.Storage service endpoint on AppSubnet and allow that virtual network in the storage account firewall.. Enabling a Microsoft.Storage service endpoint on AppSubnet allows traffic from that subnet to the storage account over the Azure backbone network, while still using the public endpoint. Then, configuring the storage account firewall to allow that virtual network restricts access exclusively to AppSubnet, meeting the security requirement without deploying a private endpoint.

Answer

Disable the storage account firewall and rely on the VM's source IP address.

Answer

Create a private endpoint and leave the firewall set to allow all networks.

Answer

Grant the VM Contributor access to the storage account and the network rule will be enforced automatically.

Question 17

A reporting server must be resized from 4 vCPU to 8 vCPU for a four-hour batch window. The VM name, NIC, private IP, and attached managed disks must stay the same, and the team accepts a brief outage during the change. Which two actions should you choose? Select two.

Accepted Answer

Deallocate the VM before changing its size.. Deallocating the VM (stopping it in the Azure portal) releases the underlying hardware reservation, which is required before changing the VM size to a different SKU. This ensures the VM can be resized to a supported size without conflicts, and the brief outage is acceptable as stated in the scenario.

Answer

Delete the VM and recreate it with a new size.

Answer

Generalize the VM first to preserve the existing configuration.

Answer

Take a snapshot of the OS disk instead of resizing.

Question 18

A VM in VNet A can reach a storage account through a private endpoint, but when the VM resolves the storage account name it still gets the public IP address. What should you configure so name resolution returns the private endpoint address?

Accepted Answer

The private DNS zone linked to the VNet. When a private endpoint is created for a storage account, the DNS configuration must be updated so that the storage account's fully qualified domain name resolves to the private endpoint's private IP address instead of the public IP. Linking a private DNS zone (privatelink.blob.core.windows.net) to the virtual network and configuring a virtual network link ensures that the VM's DNS queries for the storage account are answered with the private endpoint IP. Without this, the VM continues to use the public IP from public DNS.

Answer

A user-defined route to the storage private endpoint

Answer

A resource lock on the storage account

Answer

A managed identity for the VM

Question 19

A business-critical storage account must survive a zone outage in the primary region and also keep a read-only copy in the paired region for reporting if the primary region becomes unavailable. Which redundancy option should you choose?

Accepted Answer

RA-GZRS because it provides zone redundancy and read access to the secondary region.. (RA-GZRS) is correct because it combines zone-redundant storage (ZRS) within the primary region, ensuring data survives a zone outage, with read-access geo-redundant storage (RA-GRS) to the paired region, providing a readable secondary copy for reporting if the primary region becomes unavailable. This meets both requirements: zone-level fault tolerance and read-only access to the secondary region during a primary outage.

Answer

ZRS because it protects against a single datacenter failure.

Answer

GZRS because it provides a readable secondary region by default.

Answer

RA-GRS because it provides zone redundancy and read access to the secondary region.

Question 20

A security team requires all outbound internet traffic from a workload subnet to pass through an NVA at 10.1.4.4. The subnet is already associated with an NSG that allows the traffic. Which UDR should the administrator add to the route table for that subnet?

Accepted Answer

Destination 0.0.0.0/0 with next hop type Virtual appliance and next hop IP 10.1.4.4.. A User Defined Route (UDR) with destination 0.0.0.0/0 and next hop type 'Virtual appliance' forces all outbound internet traffic from the subnet to be forwarded to the NVA at 10.1.4.4 for inspection. The 0.0.0.0/0 prefix matches all internet-bound traffic, and the 'Virtual appliance' next hop type enables routing to a private IP address within the virtual network, overriding the default system route that would otherwise send traffic directly to the Internet.

Answer

Destination 10.1.4.4/32 with next hop type Internet.

Answer

Destination 0.0.0.0/0 with next hop type Virtual network gateway.

Answer

Destination 10.1.4.0/24 with next hop type None.