AZ-104 Practice Test 26 — 15 Questions

Question 1

Your company needs to retain Azure Activity Log data longer than the built-in retention period and make it available for future analysis. What should you configure?

Accepted Answer

Diagnostic settings for the Activity Log. Azure Activity Log has a default retention period of 30 days for Standard tier subscriptions and 90 days for others. To retain data longer, you must configure diagnostic settings to stream the Activity Log to a Log Analytics workspace (for long-term querying) or to an Azure Storage account (for archival). Diagnostic settings allow you to define the retention duration beyond the built-in limit, enabling future analysis.

Answer

A CanNotDelete lock on the subscription

Answer

An availability set

Answer

An NSG flow log only

Question 2

An online transaction app uses two identical VMs in an Azure region that supports availability zones. The business wants the app to stay available if an entire datacenter in the region fails. What should the administrator deploy?

Accepted Answer

Two VMs placed in different availability zones within the region.. Deploying VMs in different availability zones protects against an entire datacenter failure. Each availability zone is a physically separate datacenter within an Azure region, with independent power, cooling, and networking. If one zone fails, the VM in the other zone remains available, ensuring business continuity for the app.

Answer

An availability set with the VMs placed in different update domains.

Answer

A proximity placement group so both VMs stay physically close together.

Answer

A single VM with Premium SSD storage and automatic restart.

Question 3

You have two virtual networks in the same Azure region named VNet-App and VNet-DB. Resources in the two networks must communicate privately over the Azure backbone without using VPN gateways. What should you configure?

Accepted Answer

Virtual network peering. Virtual network peering connects two Azure virtual networks in the same region via the Microsoft backbone infrastructure, enabling private IP communication without a VPN gateway or public internet. This is the correct solution because it meets the requirement for private, low-latency connectivity between VNet-App and VNet-DB using Azure's high-speed backbone.

Answer

A site-to-site VPN

Answer

A network security group

Answer

An Azure Firewall policy only

Question 4

The Azure portal shows that a storage service in the region is experiencing an outage that affects several Microsoft customers. The administrator wants to view official Azure status updates for that issue. Which Azure Monitor feature should be used?

Accepted Answer

Service Health. Service Health is the correct Azure Monitor feature because it provides a personalized view of the health of Azure services, regions, and resources, including real-time and historical information about service-impacting events such as outages. It also surfaces official root cause analyses and planned maintenance, making it the appropriate tool for an administrator to view official Azure status updates for a regional outage affecting multiple customers.

Answer

Activity log

Answer

Azure Advisor

Answer

Metrics explorer

Question 5

You need to be notified whenever the average CPU usage of VM-App01 exceeds 80 percent for 10 minutes. The solution must send an email to the operations team automatically. What should you configure?

Accepted Answer

Create an Azure Monitor metric alert and link it to an action group.. Azure Monitor metric alerts can evaluate performance counters like CPU usage over a specified time window (e.g., 10 minutes) and trigger an action group when the threshold (80%) is exceeded. The action group can be configured with an email notification to the operations team, meeting the requirement automatically.

Answer

Create an Azure Advisor recommendation alert.

Answer

Create an activity log alert for the virtual machine.

Answer

Create a subscription budget alert.

Question 6

A company plans a new spoke virtual network that must be peered to an existing hub VNet using 10.0.0.0/16. The spoke will need two subnets: one sized for about 120 VMs and another for about 40 VMs. The new address space must not overlap the hub or the on-premises range 10.1.0.0/16. Which VNet address space is the best choice?

Accepted Answer

10.2.0.0/22. (10.2.0.0/22) is correct because it provides a non-overlapping address space with the hub VNet (10.0.0.0/16) and on-premises (10.1.0.0/16). The /22 prefix offers 1024 IP addresses, which is sufficient for subnets supporting 120 VMs and 40 VMs, while avoiding any overlap with the existing ranges.

Answer

10.0.1.0/24

Answer

10.1.0.0/22

Answer

10.0.0.0/24

Question 7

An on-premises datacenter must reach private IP addresses in Azure over an encrypted site-to-site tunnel. The Azure VMs must not have public IP addresses, and the connection should use the company's existing edge device. Which Azure component should be deployed?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway is the correct component because it provides an encrypted site-to-site IPsec/IKE tunnel between an on-premises network and Azure virtual networks. It supports policy-based or route-based VPNs, works with existing edge devices, and allows Azure VMs to remain without public IP addresses by routing traffic through the gateway's private IP space.

Answer

Azure Bastion

Answer

Azure Route Server

Answer

A network security group with inbound allow rules

Question 8

Based on the exhibit, which KQL operator should replace the blank to return only those columns?

Accepted Answer

project, because it returns only the named columns in the result.. The `project` operator in Kusto Query Language (KQL) is specifically designed to select a subset of columns from the input table, returning only the named columns in the result set. This matches the requirement to 'return only those columns,' making option C correct.

Answer

where, because it filters rows and also selects the visible columns.

Answer

summarize, because it groups the failed records into a smaller result set.

Answer

extend, because it creates new output columns for the selected fields.

Question 9

You have an Azure load balancer in front of two virtual machines. The load balancer reports both instances as unavailable even though the VMs are running. What is the most likely cause?

Accepted Answer

The health probe is failing.. The health probe is the mechanism by which the Azure Load Balancer determines the availability of backend instances. If the probe is misconfigured (e.g., wrong port, protocol, path, or interval) or the backend VMs are not responding to the probe requests (e.g., firewall blocking the probe traffic or the application not listening on the specified port), the load balancer marks both instances as 'Unavailable' even though the VMs are running. This is the most common cause of backend pool unavailability.

Answer

The VMs are in an availability set.

Answer

The storage account uses the Cool tier.

Answer

The subscription has a budget alert.

Question 10

Your company deploys a network virtual appliance (NVA) in a hub subnet. All outbound internet traffic from Subnet-App in a spoke VNet must pass through the NVA for inspection. What should you configure on Subnet-App?

Accepted Answer

A user-defined route with a next hop of Virtual Appliance. A user-defined route (UDR) with a next hop of Virtual Appliance forces all outbound traffic from Subnet-App to be forwarded to the NVA for inspection. This overrides Azure's default system route for 0.0.0.0/0, which normally sends internet-bound traffic directly to the internet. By specifying the NVA's private IP as the next hop, you ensure traffic is routed through the hub subnet for inspection before leaving the network.

Answer

A private DNS zone

Answer

A service endpoint for Microsoft.Storage

Answer

A NAT gateway on the NVA subnet only

Question 11

A healthcare application stores files that must be protected against a single datacenter outage in the region. The team does not need a secondary region for read access, and they want the simplest resilient option. Which storage redundancy should they choose?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones within a single region, protecting against a complete datacenter outage without requiring a secondary region. This meets the requirement for the simplest resilient option that guards against a single datacenter failure while avoiding the complexity and cost of geo-replication.

Answer

Locally redundant storage (LRS)

Answer

Geo-zone-redundant storage (GZRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 12

An application uploads documents by using one of the storage account access keys. The team wants to rotate keys without interrupting uploads. Which process should the administrator follow?

Accepted Answer

Switch the app to the secondary key, regenerate the primary key, and then update the app back later.. It follows the safe key rotation pattern: switch the application to use the secondary key, regenerate the primary key (which invalidates the old primary key), and then later update the application back to the primary key if desired. This ensures the application never loses access during the rotation, as it always has a valid key in use.

Answer

Regenerate both keys at the same time so the account is fully refreshed.

Answer

Disable shared key authorization before rotating the keys.

Answer

Delete the storage account and create a new one with the same name.

Question 13

A central audit team needs Reader access on every current and future subscription under the company hierarchy. Which scope should you use for the role assignment?

Accepted Answer

Management group scope. A management group scope allows role assignments to be inherited by all subscriptions and resource groups within that management group hierarchy. By assigning the Reader role at the management group level, the central audit team automatically gains read access to every current subscription and any future subscription added under that management group, ensuring consistent governance without manual updates.

Answer

Subscription scope

Answer

Resource group scope

Answer

Resource scope

Question 14

A team needs to deploy 25 identical Ubuntu VMs every month from source control. The deployment must be repeatable, and each VM must include a system-assigned managed identity at creation time. Which approach should be used?

Accepted Answer

A Bicep template deployment.. A Bicep template is an Infrastructure as Code (IaC) solution that declaratively defines Azure resources, including VMs with system-assigned managed identities. It ensures repeatable, version-controlled deployments of 25 identical Ubuntu VMs every month, meeting the requirements for automation and identity assignment at creation time.

Answer

Azure portal manual creation of each VM.

Answer

An Azure Policy assignment at the subscription level.

Answer

An Azure Monitor alert rule that triggers VM creation.

Question 15

A contractor working from home needs temporary access to internal Azure resources. There is no on-premises network to connect, and you do not want to expose the resources publicly. Which connectivity option should you deploy?

Accepted Answer

Point-to-site VPN, because it connects an individual client to the virtual network.. A Point-to-Site (P2S) VPN is the correct choice because it allows an individual client computer to establish a secure, encrypted connection to an Azure virtual network over the public internet using SSTP, IKEv2, or OpenVPN protocols. This meets the requirement of temporary remote access without exposing resources publicly, as the connection is initiated from the client and authenticated via certificates or Azure AD.

Answer

Site-to-site VPN, because it is the standard option for any remote access.

Answer

VNet peering, because it can securely connect any remote device to Azure.

Answer

ExpressRoute, because it is the simplest option for temporary contractor access.