AZ-104 Practice Test 27 — 15 Questions

Question 1

A legal department archived a 120-GB blob three weeks ago. They now need the file available for review later today, and waiting more than a day would delay a court filing. What should the administrator do to make the blob readable as quickly as possible?

Accepted Answer

Start rehydration from Archive and choose High priority.. Option B is correct because rehydrating a blob from the Archive tier with High priority typically makes the blob readable within 1 hour, meeting the urgent same-day requirement. The Archive tier is offline, so the blob must be rehydrated (changed to an online tier like Hot or Cool) before it can be accessed. High-priority rehydration is designed for time-sensitive scenarios like this court filing deadline.

Answer

Copy the blob to a new container and leave it in the Archive tier until the users need it.

Answer

Change the access tier from Archive directly to Cool and then download the blob immediately.

Answer

Enable soft delete on the container and restore the blob from deleted items.

Question 2

A finance team stores monthly reports in Azure Blob Storage. The data must remain available if one datacenter in the Azure region fails, but the company does not need read access from a secondary region. Which redundancy option should the administrator choose?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones within a single region, ensuring durability even if one datacenter (zone) fails. Since the requirement specifies no need for read access from a secondary region, ZRS meets the high-availability need without the cost or complexity of geo-replication.

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 3

A production storage account must remain available for updates, but administrators want to prevent accidental deletion during maintenance windows. Which lock should be applied to the storage account?

Accepted Answer

CanNotDelete lock at the storage account scope.. The CanNotDelete lock at the storage account scope prevents the storage account from being deleted while still allowing all read and update operations. This meets the requirement of keeping the storage account available for updates while preventing accidental deletion during maintenance windows.

Answer

ReadOnly lock at the storage account scope.

Answer

CanNotDelete lock at the subscription scope.

Answer

Azure Policy deny assignment on all storage account operations.

Question 4

A public web application runs on two Windows Server VMs in Azure. Users connect through a single public IP on TCP 443, and the solution must distribute traffic only to healthy VMs without requiring Layer 7 features such as URL-based routing. Which Azure service should the administrator deploy?

Accepted Answer

Azure Load Balancer Standard.. Azure Load Balancer Standard is the correct choice because it operates at Layer 4 (TCP/UDP) and distributes incoming traffic across healthy VM instances based on a single public IP address and port (TCP 443). It performs health probes to ensure traffic is only sent to healthy backend VMs, and it does not require any Layer 7 features like URL-based routing, making it ideal for this scenario.

Answer

Azure Application Gateway.

Answer

Azure Traffic Manager.

Answer

Azure Front Door.

Question 5

A policy at the management group denies storage accounts that allow public network access. One legacy storage account in RG-Legacy must stay public for 30 days while a migration runs, and the team does not want to change the policy for everyone else. What should the administrator create?

Accepted Answer

A policy exemption for that storage account. A policy exemption allows specific resources to be excluded from the effect of a policy initiative without modifying the original policy definition. In this scenario, the management group policy denies storage accounts with public network access, but the legacy account needs to remain public temporarily. By creating a policy exemption (with 'exempt' category) for that specific storage account, the administrator can bypass the deny effect for 30 days while the policy continues to apply to all other resources.

Answer

A resource lock on the storage account

Answer

A second policy assignment with higher priority

Answer

A custom RBAC role for the migration team

Question 6

A scheduled script runs on several Azure VMs. The VMs are rebuilt often, and the script must always use the same Azure identity across every rebuild without storing secrets on disk. Which two steps should the administrator take? Select two.

Accepted Answer

Create a user-assigned managed identity.. A user-assigned managed identity is the correct choice because it is an Azure identity that exists independently of any VM and can be assigned to multiple VMs. When a VM is rebuilt, you simply assign the same user-assigned identity to the new VM, and the script can authenticate using the identity's client ID without storing any secrets on disk. This ensures the script always uses the same identity across rebuilds, as the identity's credentials are managed entirely by Azure and rotated automatically.

Answer

Use a system-assigned managed identity on one VM and clone it.

Answer

Store a service principal secret in the script configuration.

Answer

Use a shared access signature to authenticate to Azure Resource Manager.

Question 7

A scheduled script runs on several Azure virtual machines that are created and replaced over time. The script must use the same Azure identity on every VM, and the identity should continue to exist even if one VM is deleted and recreated. What should the administrator use?

Accepted Answer

A user-assigned managed identity attached to the VMs.. A user-assigned managed identity is the correct choice because it is an Azure resource that exists independently of any VM, and it can be attached to multiple VMs. When a VM is deleted and recreated, the same user-assigned managed identity can be reattached, ensuring the script uses the same identity consistently. This decouples the identity lifecycle from the VM lifecycle, meeting the requirement for persistence across VM replacements.

Answer

A system-assigned managed identity on each VM.

Answer

A service principal with a client secret stored in each VM.

Answer

A shared access signature stored in the VM registry.

Question 8

A subnet has a user-defined route for 0.0.0.0/0 that sends traffic to a network virtual appliance at 10.10.1.4. The VM in the subnet still reaches an Azure Storage account using the public endpoint, but the administrator expected all outbound traffic to go through the NVA. What is the most likely reason?

Accepted Answer

The storage account traffic is using a more specific route than the 0.0.0.0/0 route.. The most likely reason is that the storage account traffic is using a more specific route than the 0.0.0.0/0 route. Azure uses longest prefix match routing, so a route with a smaller prefix (e.g., a specific public IP range for Azure Storage) will take precedence over the default route. The 0.0.0.0/0 route only applies when no more specific route exists, and Azure automatically adds platform routes for Azure services like Storage, which can override user-defined routes.

Answer

Azure always ignores user-defined routes for storage traffic.

Answer

NSG outbound rules override user-defined routes in Azure.

Answer

The subnet needs a public IP address assigned to each VM for the route to take effect.

Question 9

A storage account experiences a brief regional platform issue. The team wants an alert whenever Azure marks the resource as unavailable, even if no custom metric changes are detected. What should the administrator use?

Accepted Answer

A Resource Health alert for the storage account.. A Resource Health alert is designed to monitor the health of Azure resources and trigger notifications when Azure detects that the resource is unavailable due to platform issues, even if no custom metric thresholds are breached. This alert uses signals from the Azure Resource Health service, which tracks the current and historical health status of resources, making it the correct choice for detecting regional platform unavailability without relying on custom metrics.

Answer

A metric alert on the account's transaction count.

Answer

A diagnostic setting that sends logs only to a storage account.

Answer

An Azure Policy assignment that denies writes to the storage account.

Question 10

A web app already reads blobs by using a managed identity. Security now requires blocking any future requests that use shared key authorization, while the app must continue to work without storing secrets. Which two changes should the administrator make? Select two.

Accepted Answer

Disable shared key access on the storage account.. Option A is correct because disabling shared key access on the storage account enforces the security requirement to block future requests that use shared key authorization. This setting, when enabled, rejects any request that does not use Azure AD authentication, such as those signed with storage account keys or SAS tokens. Since the web app already uses a managed identity, it can continue to authenticate via Azure AD without storing secrets, ensuring the app works seamlessly after the change.

Answer

Replace the managed identity with a storage account key in the app settings.

Answer

Remove all network rules from the storage account.

Answer

Create a service SAS and embed it in the code.

Question 11

A subnet contains 15 backend VMs that only need outbound internet access for patching and package downloads. Security wants all outbound connections to use one static public IP address, and no VM should have a public IP assigned directly. What should you configure?

Accepted Answer

A NAT gateway associated with the subnet.. A NAT gateway is the correct choice because it provides outbound internet connectivity for all VMs in a subnet using a single static public IP address, without assigning public IPs to the VMs themselves. It handles source network address translation (SNAT) for outbound traffic, ensuring that all connections appear to originate from the configured public IP. This meets the security requirement of a single static IP for patching and package downloads.

Answer

A public Standard Load Balancer with outbound rules for the backend pool.

Answer

A public IP address on each virtual machine so all outbound traffic is traceable.

Answer

An internal load balancer with a private frontend IP.

Question 12

A security admin wants Key Vault audit logs and metrics sent to a Log Analytics workspace for later search. Which Azure setting should be configured on the vault?

Accepted Answer

Diagnostic settings. Diagnostic settings in Azure Key Vault allow you to stream platform logs and metrics to various destinations, including a Log Analytics workspace. By configuring diagnostic settings on the vault, you can send audit logs (e.g., AuditEvent) and metrics (e.g., ServiceApiLatency) to Log Analytics for querying with KQL, enabling security analysis and monitoring.

Answer

Azure Policy assignment

Answer

Network security group

Answer

Action group

Question 13

A subscription must block creation of resources in any region except East US and West US, and the security team also wants a nonblocking report of existing resources that are missing a CostCenter tag. Which two Azure Policy effects should you use? Select two.

Accepted Answer

Deny. Deny is correct because it actively blocks resource creation in regions outside East US and West US by evaluating the location property against an allowed list and rejecting non-compliant requests at deployment time. Audit is correct because it logs a compliance event for existing resources missing the CostCenter tag without blocking any operations, providing a nonblocking report for the security team.

Answer

Modify

Answer

DeployIfNotExists

Answer

Disabled

Question 14

A VM sends traffic to 172.16.5.10, but the administrator suspects the traffic is taking an unexpected next hop. They want to see the effective route table applied to the VM NIC, including system routes, user-defined routes, and propagated routes. Which Network Watcher tool should be used?

Accepted Answer

Effective routes. Effective routes is the correct Network Watcher tool because it displays the complete route table applied to a VM NIC, including system routes, user-defined routes (UDRs), and BGP-propagated routes from virtual network gateways. This allows the administrator to see exactly which next hop is selected for traffic to 172.16.5.10 based on the longest prefix match, identifying any unexpected routing behavior.

Answer

IP flow verify

Answer

Packet capture

Answer

Connection troubleshoot

Question 15

A production VM needs an email and SMS notification when CPU percentage stays above 80 percent for five minutes. Which two Azure Monitor components should the administrator configure? Select two.

Accepted Answer

Action group. A Metric alert rule monitors the VM’s CPU percentage metric and triggers when the condition (above 80% for 5 minutes) is met. An Action group defines the notification actions (email and SMS) that are executed when the alert fires. Together, they enable the required notification workflow.

Answer

Azure Policy assignment

Answer

Recovery Services vault

Answer

Log Analytics workspace