AZ-104 Practice Test 27 — 15 Questions

Question 1

An enterprise wants one governance package to be applied automatically to every production subscription that is added in the future. The package contains several policy definitions that should be managed together. Which two actions are required? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create or use a production management group and assign the governance package at that scope.. Assigning the governance package (policy initiative) at the management group scope ensures that all child subscriptions, including future ones, automatically inherit the policies. Management groups provide hierarchical governance, and any subscription added under that management group will inherit the assigned policies without manual intervention.

Answer

Assign each policy separately to every resource group so the settings are inherited upward.

Answer

Use tags on resources to make policy definitions automatically apply to new subscriptions.

Answer

Apply a resource lock to the management group so all child subscriptions inherit the policies.

Question 2

Users in Branch01 access an Azure file share over SMB. Performance is poor because frequently used files are downloaded repeatedly across the WAN. You need to keep a local cache on a Windows Server in Branch01 while keeping Azure Files as the central file share. What should you deploy?

Accepted Answer

Azure File Sync. Azure File Sync is the correct solution because it enables caching of Azure file shares on a Windows Server at the branch location, providing local access to frequently used files while keeping Azure Files as the central authoritative store. It uses a sync engine to maintain a local cache and leverages the SMB protocol for access, reducing WAN latency by serving files from the local server.

Answer

Blob versioning

Answer

Share snapshots

Answer

A private endpoint

Question 3

A support engineer needs to restart only one virtual machine named VM-App01. The engineer must not gain access to any other VM, storage account, or network resource in the resource group. At which scope should you assign the required RBAC role?

Accepted Answer

At the specific virtual machine resource scope. Assigning the Virtual Machine Contributor role at the specific VM resource scope (VM-App01) grants the engineer permissions to restart only that VM, with no access to other VMs, storage accounts, or network resources in the same resource group. RBAC roles applied at a narrower scope (resource level) override broader scopes and limit permissions to that exact resource.

Answer

At the management group scope that contains the subscription

Answer

At the resource group scope that contains the virtual machine

Answer

At the subscription scope that contains the resource group

Question 4

A helpdesk engineer wants to determine whether a VM issue is caused by a Microsoft platform problem or a problem limited to one specific VM. Which two Azure features should they use? Select two.

Accepted Answer

Resource Health. Resource Health (C) provides a personalized dashboard showing the health of your individual Azure resources, including VMs, and can indicate whether an issue is specific to that resource. Service Health (D) provides a global view of Azure service availability across regions and can identify platform-wide outages or planned maintenance. Together, they allow the engineer to differentiate between a problem limited to one VM and a broader Azure platform problem.

Answer

Azure Advisor

Answer

Backup center

Answer

Log Analytics workspace

Question 5

A virtual machine named VM-App01 hosts a critical internal application. You need to protect the VM so that it can be restored if the VM is deleted or corrupted. The solution must provide centralized backup management and retention policies. What should you use?

Accepted Answer

Azure Backup with a Recovery Services vault.. Azure Backup with a Recovery Services vault is the correct choice because it provides centralized backup management, configurable retention policies, and the ability to restore a VM even if it is deleted or corrupted. Unlike snapshots, Azure Backup stores backups in a separate vault, supports application-consistent backups via the Volume Shadow Copy Service (VSS), and offers long-term retention with backup policies.

Answer

Managed disk snapshots only.

Answer

Azure Site Recovery only.

Answer

Boot diagnostics.

Question 6

A VM suddenly stops responding, and the operations team needs to determine whether the issue is caused by a Microsoft platform problem or is isolated to that specific VM. Which two Azure portal features should be reviewed? Select two.

Accepted Answer

Service Health. Service Health (A) provides a global view of Azure platform-wide issues, such as regional outages or service degradation, that could affect multiple resources. Resource Health (B) reports the health of a specific VM instance, indicating whether the VM is available, degraded, or unavailable, and whether the issue is due to a platform event or a user-initiated action. Together, these two features allow the operations team to differentiate between a Microsoft platform problem and an isolated VM issue.

Answer

Azure Advisor

Answer

Diagnostic setting

Answer

Action group

Question 7

A web API runs on a single Azure VM and must access Azure Key Vault without storing any credentials on the VM. The identity should be tied to that VM and removed when the VM is deleted. What should you enable?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is tied directly to the lifecycle of the Azure VM — it is created when the VM is provisioned and automatically deleted when the VM is deleted. This identity can be used to authenticate to Azure Key Vault without storing any credentials on the VM, using the Azure Instance Metadata Service (IMDS) endpoint to obtain tokens. This matches the requirement that the identity be removed when the VM is deleted.

Answer

A user-assigned managed identity

Answer

A storage account shared access signature

Answer

A local administrator account with a strong password

Question 8

A VM-hosted app must read blobs from Azure Storage without storing a shared key, SAS token, or password. Which two configuration steps should the administrator take? Select two.

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity on the VM allows Azure to automatically manage a service principal for the VM, eliminating the need for any stored credentials. By assigning the Storage Blob Data Reader role to that identity on the storage account, the VM can authenticate to Azure Storage using Azure AD tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint, without ever storing a shared key, SAS token, or password.

Answer

Store the storage account access key in the app configuration.

Answer

Generate a SAS token and embed it in the application code.

Answer

Move the VM into a different subnet.

Question 9

A team wants an email and SMS notification whenever the average CPU on a production VM stays above 85% for 10 minutes. The same notification setup may be reused by other alerts later. Which Azure feature should you configure?

Accepted Answer

Action group. B is correct because an Action Group is the Azure component that defines the notification actions (email, SMS, webhook, etc.) to be triggered when an alert fires. The question specifies that the same notification setup should be reusable by other alerts later, which is exactly the purpose of an Action Group: it decouples the notification configuration from the alert rule itself. You would create a Metric Alert Rule to monitor the CPU metric, but that rule references an Action Group to send the email and SMS.

Answer

Metric alert rule

Answer

Diagnostic setting

Answer

Resource lock

Question 10

A VM named VM01 stopped sending Heartbeat records to Log Analytics 15 minutes ago. Which KQL query should you run to confirm the VM's recent heartbeat entries?

Accepted Answer

Heartbeat | where Computer == "VM01" and TimeGenerated > ago(15m). The Heartbeat table in Log Analytics stores records sent by the Azure Monitor Agent (AMA) or Log Analytics agent every 5 minutes by default. Querying Heartbeat with a filter for Computer == 'VM01' and TimeGenerated > ago(15m) directly checks if any heartbeat records were generated in the last 15 minutes, confirming whether the VM is still reporting. This is the correct approach because Heartbeat is the dedicated table for agent health, and the time filter matches the 15-minute window specified in the question.

Answer

AzureActivity | where ResourceProviderValue == "Microsoft.Compute/virtualMachines"

Answer

Heartbeat | summarize count() by Computer

Answer

Perf | where CounterName == "% Processor Time"

Question 11

You need to ensure engineers cannot delete a production resource group, but they must still be able to start and stop VMs and change network rules during maintenance. Which resource lock should you apply to the resource group?

Accepted Answer

CanNotDelete. The CanNotDelete lock prevents deletion of the resource group while allowing all other operations, including starting/stopping VMs and modifying network rules. This meets the requirement because engineers retain full management capabilities except for deletion, which is explicitly blocked at the resource group scope.

Answer

No lock

Answer

ReadOnly

Answer

Azure Policy deny assignment

Question 12

A finance department stores spreadsheets in an Azure file share. Yesterday a user deleted a subfolder tree, but other folders were modified after that point and must not be rolled back. The administrator wants to restore only the deleted subfolder tree to its state from yesterday. What should the administrator use?

Accepted Answer

Use the Azure Files snapshot taken before the deletion and copy back only the required folders.. Azure Files supports snapshot-based restore at the share level. By taking a snapshot before the deletion, the administrator can mount that snapshot as a read-only copy of the share, then copy back only the deleted subfolder tree without affecting any modifications made to other folders after the snapshot was taken. This meets the requirement of restoring only the deleted content while preserving later changes.

Answer

Restore the entire share from Azure Backup to the yesterday recovery point.

Answer

Enable blob soft delete on the storage account and then recover the folders.

Answer

Create a new file share and use synchronization to merge the deleted content.

Question 13

A monthly report file must automatically move to a cheaper online tier after 90 days in Azure Blob Storage. Which feature should the administrator configure?

Accepted Answer

Blob lifecycle management. Blob lifecycle management is the correct feature because it allows administrators to define rules that automatically transition blobs to a cheaper access tier (e.g., from Hot to Cool) after a specified number of days. This policy operates at the storage account or container level and can move data to the Cool or Archive tier based on age, meeting the requirement of moving the report file after 90 days without manual intervention.

Answer

Archive rehydration policy

Answer

Snapshot retention

Answer

Storage account failover

Question 14

The subscription activity log is being sent to a Log Analytics workspace. An alert must fire when any resource group is deleted, but delete operations initiated by the automation account rg-cleaner@contoso.com must be ignored. Which query should be used in the alert rule?

Accepted Answer

AzureActivity | where OperationNameValue == "Microsoft.Resources/subscriptions/resourceGroups/delete" | where ActivityStatusValue == "Succeeded" | where Caller != "rg-cleaner@contoso.com" | summarize Count = count(). It filters for the exact operation that deletes a resource group (Microsoft.Resources/subscriptions/resourceGroups/delete), ensures the deletion succeeded, and excludes the caller 'rg-cleaner@contoso.com'. This meets the requirement to fire an alert only when a resource group is deleted by any user except the automation account.

Answer

AzureActivity | where ResourceProviderValue == "Microsoft.Resources" | where OperationName contains "delete"

Answer

Heartbeat | where Computer == "rg-cleaner@contoso.com" | where TimeGenerated > ago(1d)

Answer

SecurityEvent | where EventID == 4688 | where Account == "rg-cleaner@contoso.com"

Question 15

You store long-term financial statements in Azure Blob Storage. The files are almost never accessed, but when they are needed they must be readable immediately without waiting for rehydration. You need to minimize cost. Which access tier should you use?

Accepted Answer

Cool. The Cool access tier is optimal for data that is infrequently accessed but must be available immediately when needed, offering lower storage costs than Hot while maintaining low-latency read access. Archive would require rehydration (taking hours) before reading, violating the requirement for immediate readability. Hot is more expensive for long-term storage of rarely accessed data, and Premium is designed for high-performance workloads, not cost-efficient archival.

Answer

Hot

Answer