AZ-104 Practice Test 28 — 15 Questions

Question 1

A help desk engineer must be able to start, stop, and resize only VM-App01. The engineer must not gain access to any other virtual machines or resource groups in the subscription. What scope should you use for the Azure RBAC role assignment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign the role at the virtual machine scope for VM-App01 only.. Azure RBAC allows you to assign a role at the virtual machine scope, which restricts permissions to that specific resource only. By assigning a role like 'Virtual Machine Contributor' at the scope of VM-App01, the help desk engineer can start, stop, and resize only that VM without gaining access to any other VMs or resource groups in the subscription.

Answer

Assign the role at the subscription scope so the engineer can manage any VM in the subscription.

Answer

Assign the role at the resource group scope that contains VM-App01.

Answer

Assign the role at a management group scope so the team can standardize access.

Question 2

A partner company needs a developer to access resources in your tenant by using the developer's existing work account. You do not want to create a new separate username and password for that person. What should you create in Microsoft Entra ID?

Accepted Answer

A guest user account. B is correct because Microsoft Entra ID B2B collaboration allows you to invite an external user's existing work account as a guest user. This grants access to resources without creating a new username and password, as the developer authenticates using their home tenant credentials. Guest users are managed in Entra ID and can be assigned permissions via Azure RBAC or group membership.

Answer

A local user account in each resource group

Answer

A managed identity

Answer

A new service principal

Question 3

A developer has the Contributor role on a subscription. Their ARM deployment of a virtual machine with a public IP fails, and the error message says the request is denied by policy. The developer can create other resources successfully. What should you change to allow this deployment while keeping the Contributor role unchanged?

Accepted Answer

Modify or exempt the Azure Policy assignment that blocks public IP addresses.. The error indicates that an Azure Policy is denying the deployment of a virtual machine with a public IP address. Since the developer has the Contributor role, they have sufficient permissions to create resources, but Azure Policy overrides permissions by enforcing rules. Modifying or creating an exemption for the specific policy that blocks public IP addresses will allow the deployment without changing the developer's role.

Answer

Assign the developer the Owner role on the subscription.

Answer

Remove any lock from the virtual machine's resource group.

Answer

Move the virtual machine to another management group.

Question 4

Two backend VMs must remain available if an Azure host is patched or fails. A full datacenter outage is not part of the requirement, and the team wants the VMs to stay in the same region with predictable east-west latency. Which placement option should the administrator choose?

Accepted Answer

An availability set. An availability set distributes VMs across multiple fault domains (separate physical racks with independent power, cooling, and network) within a single Azure datacenter. This protects against host patching and hardware failures while keeping VMs in the same datacenter, ensuring predictable east-west latency. The requirement explicitly excludes a full datacenter outage, so availability zones (which span separate datacenters) are unnecessary.

Answer

Availability zones in separate datacenters

Answer

A proximity placement group

Answer

A single VM scale set instance

Question 5

A business wants a line-of-business VM workload to keep running if one Azure datacenter in the region goes offline. Which two deployment choices should the administrator use? Select two.

Accepted Answer

Deploy the VMs in different availability zones.. Deploying VMs across different availability zones protects against a single datacenter failure. Each availability zone is a physically separate datacenter within an Azure region, with independent power, cooling, and networking. If one zone goes offline, the VM in the other zone remains operational, ensuring business continuity for the line-of-business workload.

Answer

Place the VMs in the same availability set.

Answer

Use a proximity placement group for the VMs.

Answer

Use a snapshot of the operating system disk.

Question 6

A storage account must be reachable only from resources in a single VNet. The team wants the storage service to use a private IP address inside that VNet and wants to disable public network access. Which feature should be configured?

Accepted Answer

A private endpoint. A private endpoint assigns the storage account a private IP address from the VNet's address space, effectively bringing the service into the VNet. It also disables public network access by default when configured with the 'Deny public network access' setting, ensuring the storage account is reachable only from within that VNet.

Answer

A service endpoint

Answer

A network security group rule on the subnet

Answer

A storage account firewall IP allow rule

Question 7

A subnet contains two NSGs: one associated with the subnet and one associated with the NIC of VM-App03. You need to determine whether inbound TCP 3389 from the internet is allowed. What is the correct interpretation?

Accepted Answer

The effective rules are determined by evaluating both NSGs together, and a deny in either applicable path can block access.. When a subnet NSG and a NIC NSG are both applied, Azure evaluates the effective rules by combining both NSGs. Inbound traffic must be allowed by both NSGs along the traffic path; if either NSG has a deny rule that matches the traffic (e.g., a default deny rule for inbound internet traffic), the traffic is blocked. Option C correctly states that a deny in either applicable path can block access, which is the fundamental behavior of NSG evaluation in Azure.

Answer

The NIC NSG always overrides the subnet NSG.

Answer

Inbound traffic is allowed as long as one NSG has an allow rule.

Answer

Subnet NSGs apply only to outbound traffic.

Question 8

A system-assigned managed identity is attached to an Azure VM to call Key Vault. The VM is frequently reimaged and sometimes redeployed to a different name during scale events, but the application must keep the same identity and secretless access. What should the administrator use instead?

Accepted Answer

A user-assigned managed identity associated with the workload.. A user-assigned managed identity is decoupled from the VM lifecycle, so it persists independently when VMs are reimaged or redeployed with different names. This allows the application to retain the same identity and secretless access to Key Vault without requiring manual reconfiguration or credential rotation.

Answer

A system-assigned managed identity on each newly deployed VM.

Answer

A shared storage account key placed in the VM custom script.

Answer

A policy exemption for the Key Vault access policy.

Question 9

A team wants one subnet to access an existing Storage account over its public endpoint. They do not want a private IP for the account or any DNS changes, but they want to block access from all other subnets. What should the administrator configure?

Accepted Answer

Enable a service endpoint on the subnet and add a virtual network rule on the storage account.. A service endpoint extends the virtual network's identity to the Azure Storage service, allowing the subnet to access the storage account over its public endpoint without requiring a private IP or DNS changes. By enabling a service endpoint on the subnet and adding a virtual network rule on the storage account, you restrict access to only that subnet while blocking all other subnets, meeting the team's requirements.

Answer

Create a private endpoint and disable public network access on the storage account.

Answer

Assign the Storage Blob Data Reader role to the subnet.

Answer

Associate a route table with a default route to the storage account private IP.

Question 10

An Azure administrator deploys a Linux VM that runs an application needing to read secrets from Azure Key Vault. The security policy forbids storing passwords, certificates, or access tokens on the VM. The application will run only on this single VM. What should be enabled on the VM?

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity enables the VM to authenticate to Azure Key Vault without storing any credentials on the VM. Azure automatically creates a service principal in Microsoft Entra ID for the VM, and the application can obtain an access token from the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) using that identity. This satisfies the security policy forbidding stored secrets because the identity is managed entirely by Azure and no passwords, certificates, or tokens are stored locally.

Answer

Store a service principal secret in a protected file and use it at startup.

Answer

Create a user-assigned managed identity and avoid assigning it to the VM.

Answer

Use an SSH certificate to authenticate the app to Key Vault.

Question 11

A web API running in an Azure App Service needs to read and write blobs in a storage account. The operations team does not want to store secrets in app settings or rotate credentials manually. What should they enable on the App Service?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any secrets. The identity is automatically managed by Microsoft Entra ID, and the App Service can use it to obtain an OAuth 2.0 token for accessing blob storage via RBAC. This eliminates the need for manual credential rotation and secret storage.

Answer

A storage account access key stored in Key Vault

Answer

A shared access signature embedded in the application settings

Answer

A service endpoint on the App Service integration subnet

Question 12

A scheduled script runs on several Azure VMs. The VMs are rebuilt often, and the script must always use the same Azure identity across every rebuild without storing secrets on disk. Which two steps should the administrator take? Select two.

Accepted Answer

Create a user-assigned managed identity.. A user-assigned managed identity is the correct choice because it is an Azure identity that exists independently of any VM and can be assigned to multiple VMs. When a VM is rebuilt, you simply assign the same user-assigned identity to the new VM, and the script can authenticate using the identity's client ID without storing any secrets on disk. This ensures the script always uses the same identity across rebuilds, as the identity's credentials are managed entirely by Azure and rotated automatically.

Answer

Use a system-assigned managed identity on one VM and clone it.

Answer

Store a service principal secret in the script configuration.

Answer

Use a shared access signature to authenticate to Azure Resource Manager.

Question 13

A team wants every resource in a subscription to include a Department tag. New resources that do not have the tag should be blocked from being created. Which Azure Policy effect should you use?

Accepted Answer

Deny. The Deny effect is correct because it actively blocks any resource creation or update request that does not include the required Department tag, enforcing compliance at the time of the operation. Unlike Audit, which only logs non-compliant resources, Deny prevents the non-compliant resource from being provisioned, directly meeting the requirement to block new resources without the tag.

Answer

Audit

Answer

Append

Answer

Disabled

Question 14

A management group named Corp contains subscription Sales. RG-App is in Sales and contains several virtual machines. The Auditors group must read every resource in Sales, including resources in future resource groups created under that subscription. The ServerOps group must be able to start, stop, and restart only the virtual machines in RG-App. Which two role assignments should the administrator configure? Select two.

Accepted Answer

Assign Reader to Auditors at the Sales subscription scope.. Assigning the Reader role to the Auditors group at the Sales subscription scope grants read access to all resources within that subscription, including any future resource groups and resources created under it. This meets the requirement that Auditors must read every resource in Sales, including those in future resource groups.

Answer

Assign Reader to Auditors at the RG-App resource group scope.

Answer

Assign Virtual Machine Contributor to ServerOps at the Sales subscription scope.

Answer

Assign Owner to ServerOps at the RG-App resource group scope.

Question 15

An Azure application and an Azure Automation account need Azure access without any stored secrets. The same identity should be reusable and should not require manual secret rotation. Which two identity choices meet the requirement? Select two.

Accepted Answer

System-assigned managed identity attached to the resource that needs access.. System-assigned managed identity (Option A) is correct because it is automatically created and tied to a specific Azure resource, such as a virtual machine or App Service, and provides an Microsoft Entra ID identity that can be used to authenticate to any service supporting Microsoft Entra ID authentication without storing any secrets. The identity is managed by Azure, eliminating the need for manual secret rotation, and it is automatically deleted when the resource is deleted, ensuring no orphaned secrets.

Answer

Service principal with a client secret stored in an app setting.

Answer

Shared administrator username and password stored in a Key Vault secret.

Answer

SAS token generated once and reused indefinitely by both resources.