AZ-104 Practice Test 28 — 15 Questions

Question 1

A stateless web service must handle traffic spikes by adding or removing instances automatically based on CPU usage. Which Azure service fits best?

Accepted Answer

Virtual machine scale set with autoscale. A Virtual Machine Scale Set (VMSS) with autoscale is the correct choice because it automatically adjusts the number of VM instances based on CPU utilization metrics, enabling the stateless web service to handle traffic spikes by scaling out (adding instances) and scaling in (removing instances) as needed. This aligns with the requirement for a stateless, elastic, and automated scaling solution.

Answer

One larger standalone VM

Answer

Availability set with two VMs

Answer

Recovery Services vault backup

Question 2

You need to allow or deny traffic to and from resources in an Azure subnet based on source IP address, destination port, and protocol. Which Azure feature should you use?

Accepted Answer

A network security group. A network security group (NSG) is the correct Azure feature because it acts as a stateful, distributed firewall that filters traffic to and from Azure resources in a virtual network. NSGs contain security rules that allow or deny inbound and outbound traffic based on source/destination IP address, port, and protocol (TCP, UDP, or ICMP). This directly matches the requirement to control traffic based on source IP, destination port, and protocol.

Answer

A route table

Answer

A private DNS zone

Answer

Azure Advisor

Question 3

A subnet has a route table with these user-defined routes: 10.10.0.0/16 to Virtual appliance, 10.10.5.0/24 to Virtual network gateway, and 10.10.5.128/25 to Virtual network. The subnet is attached to a VM that sends traffic to several destinations. Which three next-hop decisions are correct? Select three.

Accepted Answer

Traffic to 10.10.5.9 uses Virtual network gateway.. The route table uses longest prefix match. The destination 10.10.5.9 falls within the 10.10.5.0/24 range, which has a more specific prefix (24 bits) than 10.10.0.0/16 (16 bits). The user-defined route for 10.10.5.0/24 specifies a next hop of Virtual network gateway, so traffic to 10.10.5.9 is forwarded to the gateway.

Answer

Traffic to 10.10.5.9 uses Virtual appliance.

Answer

Traffic to 8.8.8.8 uses Virtual appliance.

Question 4

A legal team archived a 200-GB blob last quarter. They now need to open it repeatedly later today for review, and waiting more than a day would delay the case. Which two actions should the administrator take? Select two.

Accepted Answer

Start a rehydration request and target the Hot tier.. Rehydrating a blob from the Archive tier to the Hot tier makes it accessible for frequent reads. The Hot tier is optimized for high-frequency access, which matches the legal team's need to open the blob repeatedly later today. Rehydration is the only way to change the blob's tier from Archive to an online tier like Hot.

Answer

Copy the blob directly while it remains in the Archive tier.

Answer

Change the blob back to the Archive tier after the request starts.

Answer

Take a snapshot first and expect it to make the archived blob readable immediately.

Question 5

A managed data disk on a VM was deleted by mistake. You have a snapshot from before the deletion and want to restore the data with minimal impact to the VM's operating system disk. What should you do?

Accepted Answer

Create a new managed disk from the snapshot and attach it to the VM. You can create a new managed disk from the snapshot and attach it as a data disk to the existing VM. This restores the data without affecting the OS disk or requiring a VM redeployment, minimizing downtime and impact.

Answer

Redeploy the VM from the marketplace image

Answer

Convert the snapshot directly into an OS disk and boot from it

Answer

Resize the VM to a larger size and the deleted disk will reappear

Question 6

A finance department wants several Windows virtual machines to map the same shared drive letter and work with the same files at the same time. Which Azure Storage service should you configure?

Accepted Answer

Azure Files share. Azure Files provides fully managed file shares in the cloud that support the SMB protocol, allowing multiple Windows VMs to mount the same share with a consistent drive letter (e.g., Z:) and access the same files concurrently. This meets the finance department's requirement for shared access with a mapped drive letter, which Azure Blob storage cannot provide because it uses REST APIs rather than SMB.

Answer

Azure Blob container

Answer

Archive blob tier

Answer

Storage account access key only

Question 7

A help desk engineer must be able to start, stop, and resize only VM-App01. The engineer must not gain access to any other virtual machines or resource groups in the subscription. What scope should you use for the Azure RBAC role assignment?

Accepted Answer

Assign the role at the virtual machine scope for VM-App01 only.. Azure RBAC allows you to assign a role at the virtual machine scope, which restricts permissions to that specific resource only. By assigning a role like 'Virtual Machine Contributor' at the scope of VM-App01, the help desk engineer can start, stop, and resize only that VM without gaining access to any other VMs or resource groups in the subscription.

Answer

Assign the role at the subscription scope so the engineer can manage any VM in the subscription.

Answer

Assign the role at the resource group scope that contains VM-App01.

Answer

Assign the role at a management group scope so the team can standardize access.

Question 8

A partner company needs a developer to access resources in your tenant by using the developer's existing work account. You do not want to create a new separate username and password for that person. What should you create in Microsoft Entra ID?

Accepted Answer

A guest user account. B is correct because Microsoft Entra ID B2B collaboration allows you to invite an external user's existing work account as a guest user. This grants access to resources without creating a new username and password, as the developer authenticates using their home tenant credentials. Guest users are managed in Entra ID and can be assigned permissions via Azure RBAC or group membership.

Answer

A local user account in each resource group

Answer

A managed identity

Answer

A new service principal

Question 9

A developer has the Contributor role on a subscription. Their ARM deployment of a virtual machine with a public IP fails, and the error message says the request is denied by policy. The developer can create other resources successfully. What should you change to allow this deployment while keeping the Contributor role unchanged?

Accepted Answer

Modify or exempt the Azure Policy assignment that blocks public IP addresses.. The error indicates that an Azure Policy is denying the deployment of a virtual machine with a public IP address. Since the developer has the Contributor role, they have sufficient permissions to create resources, but Azure Policy overrides permissions by enforcing rules. Modifying or creating an exemption for the specific policy that blocks public IP addresses will allow the deployment without changing the developer's role.

Answer

Assign the developer the Owner role on the subscription.

Answer

Remove any lock from the virtual machine's resource group.

Answer

Move the virtual machine to another management group.

Question 10

Two backend VMs must remain available if an Azure host is patched or fails. A full datacenter outage is not part of the requirement, and the team wants the VMs to stay in the same region with predictable east-west latency. Which placement option should the administrator choose?

Accepted Answer

An availability set. An availability set distributes VMs across multiple fault domains (separate physical racks with independent power, cooling, and network) within a single Azure datacenter. This protects against host patching and hardware failures while keeping VMs in the same datacenter, ensuring predictable east-west latency. The requirement explicitly excludes a full datacenter outage, so availability zones (which span separate datacenters) are unnecessary.

Answer

Availability zones in separate datacenters

Answer

A proximity placement group

Answer

A single VM scale set instance

Question 11

A business wants a line-of-business VM workload to keep running if one Azure datacenter in the region goes offline. Which two deployment choices should the administrator use? Select two.

Accepted Answer

Deploy the VMs in different availability zones.. Deploying VMs across different availability zones protects against a single datacenter failure. Each availability zone is a physically separate datacenter within an Azure region, with independent power, cooling, and networking. If one zone goes offline, the VM in the other zone remains operational, ensuring business continuity for the line-of-business workload.

Answer

Place the VMs in the same availability set.

Answer

Use a proximity placement group for the VMs.

Answer

Use a snapshot of the operating system disk.

Question 12

A storage account must be reachable only from resources in a single VNet. The team wants the storage service to use a private IP address inside that VNet and wants to disable public network access. Which feature should be configured?

Accepted Answer

A private endpoint. A private endpoint assigns the storage account a private IP address from the VNet's address space, effectively bringing the service into the VNet. It also disables public network access by default when configured with the 'Deny public network access' setting, ensuring the storage account is reachable only from within that VNet.

Answer

A service endpoint

Answer

A network security group rule on the subnet

Answer

A storage account firewall IP allow rule

Question 13

A subnet contains two NSGs: one associated with the subnet and one associated with the NIC of VM-App03. You need to determine whether inbound TCP 3389 from the internet is allowed. What is the correct interpretation?

Accepted Answer

The effective rules are determined by evaluating both NSGs together, and a deny in either applicable path can block access.. When a subnet NSG and a NIC NSG are both applied, Azure evaluates the effective rules by combining both NSGs. Inbound traffic must be allowed by both NSGs along the traffic path; if either NSG has a deny rule that matches the traffic (e.g., a default deny rule for inbound internet traffic), the traffic is blocked. Option C correctly states that a deny in either applicable path can block access, which is the fundamental behavior of NSG evaluation in Azure.

Answer

The NIC NSG always overrides the subnet NSG.

Answer

Inbound traffic is allowed as long as one NSG has an allow rule.

Answer

Subnet NSGs apply only to outbound traffic.

Question 14

A system-assigned managed identity is attached to an Azure VM to call Key Vault. The VM is frequently reimaged and sometimes redeployed to a different name during scale events, but the application must keep the same identity and secretless access. What should the administrator use instead?

Accepted Answer

A user-assigned managed identity associated with the workload.. A user-assigned managed identity is decoupled from the VM lifecycle, so it persists independently when VMs are reimaged or redeployed with different names. This allows the application to retain the same identity and secretless access to Key Vault without requiring manual reconfiguration or credential rotation.

Answer

A system-assigned managed identity on each newly deployed VM.

Answer

A shared storage account key placed in the VM custom script.

Answer

A policy exemption for the Key Vault access policy.

Question 15

A team wants one subnet to access an existing Storage account over its public endpoint. They do not want a private IP for the account or any DNS changes, but they want to block access from all other subnets. What should the administrator configure?

Accepted Answer

Enable a service endpoint on the subnet and add a virtual network rule on the storage account.. A service endpoint extends the virtual network's identity to the Azure Storage service, allowing the subnet to access the storage account over its public endpoint without requiring a private IP or DNS changes. By enabling a service endpoint on the subnet and adding a virtual network rule on the storage account, you restrict access to only that subnet while blocking all other subnets, meeting the team's requirements.

Answer

Create a private endpoint and disable public network access on the storage account.

Answer

Assign the Storage Blob Data Reader role to the subnet.

Answer

Associate a route table with a default route to the storage account private IP.