AZ-104 Practice Test 29 — 15 Questions

Question 1

An Azure administrator deploys a Linux VM that runs an application needing to read secrets from Azure Key Vault. The security policy forbids storing passwords, certificates, or access tokens on the VM. The application will run only on this single VM. What should be enabled on the VM?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity enables the VM to authenticate to Azure Key Vault without storing any credentials on the VM. Azure automatically creates a service principal in Azure AD for the VM, and the application can obtain an access token from the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) using that identity. This satisfies the security policy forbidding stored secrets because the identity is managed entirely by Azure and no passwords, certificates, or tokens are stored locally.

Answer

Store a service principal secret in a protected file and use it at startup.

Answer

Create a user-assigned managed identity and avoid assigning it to the VM.

Answer

Use an SSH certificate to authenticate the app to Key Vault.

Question 2

A web API running in an Azure App Service needs to read and write blobs in a storage account. The operations team does not want to store secrets in app settings or rotate credentials manually. What should they enable on the App Service?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any secrets. The identity is automatically managed by Azure AD, and the App Service can use it to obtain an OAuth 2.0 token for accessing blob storage via RBAC. This eliminates the need for manual credential rotation and secret storage.

Answer

A storage account access key stored in Key Vault

Answer

A shared access signature embedded in the application settings

Answer

A service endpoint on the App Service integration subnet

Question 3

A scheduled script runs on several Azure VMs. The VMs are rebuilt often, and the script must always use the same Azure identity across every rebuild without storing secrets on disk. Which two steps should the administrator take? Select two.

Accepted Answer

Create a user-assigned managed identity.. A user-assigned managed identity is the correct choice because it is an Azure identity that exists independently of any VM and can be assigned to multiple VMs. When a VM is rebuilt, you simply assign the same user-assigned identity to the new VM, and the script can authenticate using the identity's client ID without storing any secrets on disk. This ensures the script always uses the same identity across rebuilds, as the identity's credentials are managed entirely by Azure and rotated automatically.

Answer

Use a system-assigned managed identity on one VM and clone it.

Answer

Store a service principal secret in the script configuration.

Answer

Use a shared access signature to authenticate to Azure Resource Manager.

Question 4

A team wants every resource in a subscription to include a Department tag. New resources that do not have the tag should be blocked from being created. Which Azure Policy effect should you use?

Accepted Answer

Deny. The Deny effect is correct because it actively blocks any resource creation or update request that does not include the required Department tag, enforcing compliance at the time of the operation. Unlike Audit, which only logs non-compliant resources, Deny prevents the non-compliant resource from being provisioned, directly meeting the requirement to block new resources without the tag.

Answer

Audit

Answer

Append

Answer

Disabled

Question 5

A management group named Corp contains subscription Sales. RG-App is in Sales and contains several virtual machines. The Auditors group must read every resource in Sales, including resources in future resource groups created under that subscription. The ServerOps group must be able to start, stop, and restart only the virtual machines in RG-App. Which two role assignments should the administrator configure? Select two.

Accepted Answer

Assign Reader to Auditors at the Sales subscription scope.. Assigning the Reader role to the Auditors group at the Sales subscription scope grants read access to all resources within that subscription, including any future resource groups and resources created under it. This meets the requirement that Auditors must read every resource in Sales, including those in future resource groups.

Answer

Assign Reader to Auditors at the RG-App resource group scope.

Answer

Assign Virtual Machine Contributor to ServerOps at the Sales subscription scope.

Answer

Assign Owner to ServerOps at the RG-App resource group scope.

Question 6

An Azure application and an Azure Automation account need Azure access without any stored secrets. The same identity should be reusable and should not require manual secret rotation. Which two identity choices meet the requirement? Select two.

Accepted Answer

System-assigned managed identity attached to the resource that needs access.. System-assigned managed identity (Option A) is correct because it is automatically created and tied to a specific Azure resource, such as a virtual machine or App Service, and provides an Azure AD identity that can be used to authenticate to any service supporting Azure AD authentication without storing any secrets. The identity is managed by Azure, eliminating the need for manual secret rotation, and it is automatically deleted when the resource is deleted, ensuring no orphaned secrets.

Answer

Service principal with a client secret stored in an app setting.

Answer

Shared administrator username and password stored in a Key Vault secret.

Answer

SAS token generated once and reused indefinitely by both resources.

Question 7

A web tier must use identical VMs, keep the desired instance count if one instance becomes unhealthy, and allow future horizontal expansion without creating VMs one by one. What should the administrator deploy?

Accepted Answer

A virtual machine scale set with health-based instance management.. A virtual machine scale set with health-based instance management is correct because it automatically maintains a desired number of identical VM instances, replaces unhealthy instances based on health probes, and supports horizontal scaling without manual VM creation. This aligns with the requirements for identical VMs, automatic instance replacement, and future expansion.

Answer

An availability set because it automatically replaces unhealthy instances.

Answer

An Azure Dedicated Host to keep the VMs on one physical server.

Answer

A proximity placement group to ensure the VMs are distributed evenly.

Question 8

An NSG on a subnet has these inbound rules: Deny-All-Inbound at priority 100 and Allow-RDP-from-AdminSubnet at priority 200. Administrators on AdminSubnet still cannot RDP to a VM in the subnet. What should the network administrator change?

Accepted Answer

Move the allow rule to a lower priority number than 100.. The NSG rules are evaluated in priority order, with lower numbers having higher precedence. The Deny-All-Inbound rule at priority 100 blocks all traffic, including RDP from AdminSubnet, before the Allow-RDP-from-AdminSubnet rule at priority 200 is evaluated. To allow RDP traffic, the allow rule must have a lower priority number (e.g., 90) than the deny rule (100), ensuring it is evaluated first and permits the traffic before the deny rule blocks it.

Answer

Delete the deny rule so only the allow rule remains.

Answer

Change the VM to a different availability zone.

Answer

Create a private endpoint for the VM.

Question 9

A change-freeze requires that no one can modify the settings of a subscription's resource group for six hours. Deletion is not the main concern; the priority is to block changes to existing resources during the freeze. Which lock should you apply?

Accepted Answer

ReadOnly. The ReadOnly lock prevents any modification to existing resources, including configuration changes, while still allowing read operations. This directly satisfies the change-freeze requirement to block changes for six hours, as it denies all write operations at the resource group scope.

Answer

CanNotDelete

Answer

Reader

Answer

DeployIfNotExists

Question 10

An App Service application needs to read secrets from Azure Key Vault. The security team does not want any password, certificate, or client secret stored in application settings, and they want the identity removed automatically if the app is deleted. What should the administrator enable?

Accepted Answer

A system-assigned managed identity on the App Service.. A system-assigned managed identity (Option B) is the correct choice because it provides an identity for the App Service that is automatically managed by Azure, tied to the lifecycle of the resource (deleted when the app is deleted), and requires no credentials to be stored in application settings. This allows the app to authenticate to Key Vault using Azure AD tokens without any secrets, satisfying the security team's requirements.

Answer

A service principal with a client secret stored in App Service configuration.

Answer

A user-assigned managed identity shared by all applications.

Answer

A shared access signature stored in Key Vault.

Question 11

An administrator wants future VMs to start from the same approved server build as an existing generalized VM. Which two image sources can be used to create the new VM? Select two.

Accepted Answer

A managed image created from the approved server build.. A managed image captures the exact configuration of a generalized VM, including the OS and data disks, and can be used to deploy multiple identical VMs. This ensures that future VMs start from the same approved server build without needing to recreate the image each time.

Answer

A Marketplace image from the operating system vendor.

Answer

A single managed disk snapshot.

Answer

A public IP address assigned to the VM.

Question 12

A web app running in Azure App Service must upload files to a blob container. The team wants to avoid storing any secrets in application settings and wants the app to authenticate without a password or access key. What should the administrator configure?

Accepted Answer

Enable a system-assigned managed identity for the app and grant it a storage data role. A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any secrets. By granting the identity the 'Storage Blob Data Contributor' role via Azure RBAC, the app can upload files using Azure AD authentication, eliminating the need for passwords or access keys.

Answer

Store the storage account key in the app configuration and use it from the application

Answer

Create an anonymous public container so the app can upload without authentication

Answer

Use a shared access signature generated from the storage account root key

Question 13

Three Azure VMs run the same scheduled script and must access both Storage and Key Vault. The team wants one identity that can be reused if a VM is rebuilt, and they do not want the identity tied to a single machine. What should the administrator create?

Accepted Answer

A user-assigned managed identity attached to all three virtual machines.. A user-assigned managed identity is the correct choice because it is an independent Azure resource that can be assigned to multiple VMs, persists independently of any single VM's lifecycle, and can be reused when a VM is rebuilt. This identity provides seamless authentication to both Storage and Key Vault without managing credentials, meeting the requirement for a reusable, non-machine-tied identity.

Answer

A system-assigned managed identity on each virtual machine.

Answer

A service principal with a certificate file copied to each VM.

Answer

A shared access signature for each storage account and Key Vault access policy.

Question 14

Your company wants to query performance and event data from multiple Azure virtual machines by using Kusto Query Language. The operations team also wants to centralize retention and analysis of this data. What should you deploy?

Accepted Answer

A Log Analytics workspace.. A Log Analytics workspace is the correct choice because it is the central repository in Azure Monitor for collecting telemetry and log data from Azure virtual machines. It supports Kusto Query Language (KQL) for querying performance and event data, and it provides centralized retention, analysis, and alerting capabilities, meeting both requirements.

Answer

Azure Advisor.

Answer

Azure Network Watcher only.

Answer

A network security group.

Question 15

Several Azure VMs need the same Azure identity so they can access a shared resource without storing passwords. The identity should be reusable across VMs and removable centrally. Which identity type should the administrator use?

Accepted Answer

User-assigned managed identity. A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource, can be assigned to multiple VMs simultaneously, and can be centrally removed or updated without affecting the VMs themselves. This identity is reusable across VMs and eliminates the need to store passwords or secrets in code or configuration.

Answer

System-assigned managed identity

Answer

Service principal with a client secret

Answer

Local administrator account