AZ-104 Practice Test 28 — 15 Questions

Question 1

An administrator plans to peer VNet-A with VNet-B so two application tiers can communicate over private IPs. VNet-A uses 10.20.0.0/16. VNet-B currently uses 10.20.1.0/24, and both VNets already contain subnets that must remain intact. The peering operation fails. What should the administrator do first?

Accepted Answer

Change VNet-B to a non-overlapping address space before creating the peering.. VNet peering in Azure requires that the address spaces of the peered VNets do not overlap. VNet-A uses 10.20.0.0/16 and VNet-B uses 10.20.1.0/24, which is a subset of VNet-A's range, creating a direct overlap. The peering operation fails because Azure cannot route traffic correctly when address spaces conflict. The first step must be to change VNet-B's address space to a non-overlapping range (e.g., 10.21.0.0/16) before attempting to create the peering.

Answer

Add a route table to VNet-B so traffic can bypass the overlap.

Answer

Create a network security group rule to allow all traffic between the VNets.

Answer

Enable gateway transit on VNet-A so the address conflict is ignored.

Question 2

A support engineer must download a blob that was moved to the Archive tier by a lifecycle rule. The file must be available as soon as possible for an investigation. What should the engineer do first?

Accepted Answer

Change the blob's tier to Hot or Cool and wait for rehydration to complete.. Option B is correct because blobs in the Archive tier are offline and must be rehydrated to a Hot or Cool tier before they can be accessed. Rehydration can take up to 15 hours, but setting the tier to Hot or Cool initiates the process, making the blob available as soon as possible for investigation.

Answer

Download the blob directly from the Archive tier because archived blobs are always online.

Answer

Move the blob to a different container in the same account to make it downloadable immediately.

Answer

Disable the lifecycle rule so the blob becomes immediately readable again.

Question 3

A support desk needs to reset the local administrator password on specific virtual machines by using the VMAccess extension and restart those VMs. They must not be able to resize the machines, change networking, or manage disks. What should the administrator create?

Accepted Answer

Create a custom role with only the required VM actions and assign it at the virtual machine scope. Option C is correct because the support desk needs only specific actions (reset local admin password via VMAccess extension and restart VMs) without permissions to resize, change networking, or manage disks. A custom role at the VM scope allows you to grant precisely the required Microsoft.Compute/virtualMachines/runCommand/action and Microsoft.Compute/virtualMachines/restart/action, while excluding broader management actions. This follows the principle of least privilege and prevents unintended modifications to other resources.

Answer

Assign the Virtual Machine Contributor built-in role at the subscription scope

Answer

Assign the Contributor role at the resource group scope

Answer

Use an Azure Policy assignment to allow the VMAccess extension

Question 4

A system-assigned managed identity is attached to an Azure VM to call Key Vault. The VM is frequently reimaged and sometimes redeployed to a different name during scale events, but the application must keep the same identity and secretless access. What should the administrator use instead?

Accepted Answer

A user-assigned managed identity associated with the workload.. A user-assigned managed identity is decoupled from the VM lifecycle, so it persists independently when VMs are reimaged or redeployed with different names. This allows the application to retain the same identity and secretless access to Key Vault without requiring manual reconfiguration or credential rotation.

Answer

A system-assigned managed identity on each newly deployed VM.

Answer

A shared storage account key placed in the VM custom script.

Answer

A policy exemption for the Key Vault access policy.

Question 5

A support engineer needs to search a Log Analytics workspace for only failed sign-in records. Which KQL query should they use?

Accepted Answer

SigninLogs | where ResultType != 0. Option B is correct because in Azure AD sign-in logs, a `ResultType` of 0 indicates a successful sign-in, while any non-zero value (e.g., 50125, 53003) indicates a failure. The KQL query `SigninLogs | where ResultType != 0` filters for all records where the result type is not zero, thus returning only failed sign-in records.

Answer

SigninLogs | where ResultType == 0

Answer

SigninLogs | summarize count()

Answer

SigninLogs | project UserPrincipalName

Question 6

A subnet uses a route table with gateway route propagation disabled so internet-bound traffic can be forced through a network virtual appliance. After the change, VMs in the subnet can no longer reach servers in the on-premises network 172.16.0.0/16 over the VPN gateway. What should the administrator add to the route table?

Accepted Answer

A user-defined route for 172.16.0.0/16 with next hop type Virtual network gateway.. When gateway route propagation is disabled on a route table, the subnet no longer receives the default system routes that include the VPN gateway route for on-premises networks. To restore connectivity to 172.16.0.0/16, you must add a user-defined route (UDR) with next hop type 'Virtual network gateway', which explicitly directs traffic for that prefix through the VPN gateway. This overrides the missing propagated route and forces the traffic to the on-premises network correctly.

Answer

A user-defined route for 172.16.0.0/16 with next hop type Internet.

Answer

An NSG allow rule for TCP 172.16.0.0/16.

Answer

A service endpoint for the on-premises network range.

Question 7

Based on the exhibit, a compliance team must read all current and future resources in every subscription under the Corp management group. Where should you assign the Reader role?

Accepted Answer

Assign Reader at the Corp management group scope.. Assigning the Reader role at the Corp management group scope applies the role to all current and future subscriptions and resource groups within that management group hierarchy. This is because Azure RBAC roles assigned at a management group scope are inherited by all child management groups, subscriptions, and resources, ensuring the compliance team can read all resources across the entire Corp hierarchy without needing separate assignments.

Answer

Assign Reader at the RG-Finance resource group scope.

Answer

Assign Reader separately at each subscription scope.

Answer

Assign Reader only at the individual resource scope.

Question 8

Based on the exhibit, three VMs in different resource groups must use the same Azure identity, and the identity must continue working if one VM is deleted and recreated. What should you use?

Accepted Answer

A user-assigned managed identity attached to all three VMs.. A user-assigned managed identity is an Azure resource that can be created independently and then assigned to multiple VMs. Because it persists as a separate resource in Azure, deleting and recreating a VM does not affect the identity; you simply reattach the same user-assigned identity to the new VM. This ensures the identity continues working across VM lifecycle changes, meeting the requirement for a shared, resilient identity.

Answer

A system-assigned managed identity on each VM.

Answer

A service principal stored in the VM image.

Answer

A shared access signature assigned to the resource group.

Question 9

An Azure Policy that appends the Environment tag is assigned to a subscription. New virtual machines get the tag, but existing VMs do not. What should the administrator do next?

Accepted Answer

Create a remediation task for the policy assignment. Azure Policy assignments with 'deployIfNotExists' or 'append' effects only apply to new resources by default. To bring existing non-compliant resources into compliance, a remediation task must be triggered, which uses a managed identity to modify the resource. Option B is correct because creating a remediation task for the policy assignment will evaluate and append the missing Environment tag to existing VMs.

Answer

Remove the policy and reassign it at the resource group scope

Answer

Grant the policy assignment Reader access

Answer

Apply a CanNotDelete lock to the subscription

Question 10

A team can already deploy virtual machines, but they want to prevent users from creating VMs unless the deployment includes an approved tag. They also want to see which existing resources do not meet the rule. What should the administrator use?

Accepted Answer

An Azure Policy assignment with a deny or audit effect for the tag requirement.. Azure Policy with a 'deny' effect prevents creation of VMs that lack the required tag, while the 'audit' effect identifies non-compliant existing resources without blocking them. This directly addresses both requirements: enforcing the tag on new deployments and discovering which existing resources violate the rule.

Answer

A custom RBAC role that removes the create action for virtual machines.

Answer

A resource lock on the resource group.

Answer

An Entra ID dynamic group for the VM creators.

Question 11

A web app running on an Azure VM must connect to an Azure SQL Database instance. The security team requires the database to be reachable through a private IP inside the VNet, and the application should keep using the normal SQL server name without any connection string change. What should the administrator implement?

Accepted Answer

A private endpoint for Azure SQL and the corresponding private DNS zone linked to the VNet.. Option B is correct because a private endpoint assigns Azure SQL Database a private IP from the VNet, making it reachable via a private IP while preserving the normal SQL server FQDN. The corresponding private DNS zone (privatelink.database.windows.net) linked to the VNet ensures that DNS resolution of the SQL server name resolves to the private IP, so no connection string changes are needed. This meets the security requirement of private IP reachability and the application requirement of unchanged connection strings.

Answer

A service endpoint on the subnet and a firewall rule on the SQL server.

Answer

A public endpoint with selected network access and a network security group on the VM subnet.

Answer

A virtual network peering connection to the SQL service subnet.

Question 12

A web tier and an app tier run in separate subnets. Each VM NIC is placed in an application security group named WebASG or AppASG. The administrator must allow only the web tier to reach the app tier on TCP port 8443 and block all other inbound traffic to the app tier. Which NSG rule should be created on the app subnet?

Accepted Answer

Allow TCP 8443 from WebASG to AppASG with a priority lower number than the deny rule.. Option A is correct because NSG rules are evaluated in priority order, with lower numbers having higher priority. By placing an Allow rule for TCP 8443 from WebASG to AppASG with a lower priority number than a subsequent Deny-All rule, only traffic from the web tier is permitted, and all other inbound traffic to the app subnet is blocked. This leverages application security groups (ASGs) to define fine-grained, role-based network security policies without relying on IP addresses.

Answer

Allow TCP 8443 from the entire virtual network to the app subnet with a lower priority than the deny rule.

Answer

Allow UDP 8443 from WebASG to AppASG with any priority below 65000.

Answer

Allow TCP 8443 from WebASG to AppASG with a priority higher number than the deny rule.

Question 13

A team wants one subnet to access an existing Storage account over its public endpoint. They do not want a private IP for the account or any DNS changes, but they want to block access from all other subnets. What should the administrator configure?

Accepted Answer

Enable a service endpoint on the subnet and add a virtual network rule on the storage account.. Option B is correct because a service endpoint extends the virtual network's identity to the Azure Storage service, allowing the subnet to access the storage account over its public endpoint without requiring a private IP or DNS changes. By enabling a service endpoint on the subnet and adding a virtual network rule on the storage account, you restrict access to only that subnet while blocking all other subnets, meeting the team's requirements.

Answer

Create a private endpoint and disable public network access on the storage account.

Answer

Assign the Storage Blob Data Reader role to the subnet.

Answer

Associate a route table with a default route to the storage account private IP.

Question 14

A VM in a subnet must send traffic to 10.50.0.0/16 through an on-premises VPN gateway, while all other destinations should use the Internet. Which route should be added to the subnet's route table?

Accepted Answer

Destination 10.50.0.0/16 with next hop type Virtual network gateway.. Option A is correct because the VM needs to send traffic destined for 10.50.0.0/16 through the on-premises VPN gateway. Adding a user-defined route (UDR) with destination 10.50.0.0/16 and next hop type 'Virtual network gateway' forces that specific traffic to be routed over the VPN tunnel, while the default route (0.0.0.0/0) to the Internet remains unchanged, allowing all other traffic to egress via the Internet.

Answer

Destination 0.0.0.0/0 with next hop type Virtual network gateway.

Answer

Destination 10.50.0.0/16 with next hop type Service endpoint.

Answer

Destination 10.50.0.0/16 with next hop type Internet.

Question 15

A VM was corrupted and the team wants to recover it from Azure Backup without using the original damaged disks. Which two restore targets are supported? Select two.

Accepted Answer

Create a new virtual machine. Option A is correct because Azure Backup supports restoring a VM to a new virtual machine directly from the recovery point, which creates a new VM with the same configuration and data without using the original damaged disks. This is a common restore workflow when the original VM is corrupted or inaccessible.

Answer

Change the subscription automatically

Answer

Replace the Recovery Services vault name

Answer

Rebuild the virtual network