AZ-104 Practice Test 29 — 15 Questions

Question 1

A VM in subnet S1 must accept RDP only from the administrator workstation at 203.0.113.25. The subnet NSG has a custom inbound deny-all rule at priority 200 and a custom allow-RDP rule at priority 300 for source 203.0.113.25, destination Any, TCP 3389. RDP is still blocked from the workstation. What should the administrator change?

Accepted Answer

Move the allow-RDP rule to a lower priority number than 200.. Network Security Group (NSG) rules are evaluated in priority order, with lower numbers having higher precedence. The deny-all rule at priority 200 is evaluated before the allow-RDP rule at priority 300, so the deny rule blocks the RDP traffic before the allow rule can be applied. To allow RDP from the workstation, the allow-RDP rule must have a lower priority number (e.g., 100) than the deny-all rule, ensuring it is evaluated first.

Answer

Change the allow rule from inbound to outbound traffic.

Answer

Change the protocol from TCP to Any on the deny-all rule.

Answer

Attach a user-defined route so the workstation can reach the VM directly.

Question 2

A team wants an Azure Storage account to be reachable only from one subnet, but they do not want to use a private endpoint. Which two configurations should they use? Select two.

Accepted Answer

Enable a Microsoft.Storage service endpoint on the subnet so the subnet can reach the storage service privately over the Azure backbone.. Option A is correct because enabling a Microsoft.Storage service endpoint on the subnet extends the virtual network identity to the storage service, allowing traffic from that subnet to reach the storage account over the Azure backbone network without using a public IP. This ensures private connectivity from the subnet to the storage account while keeping the storage account's public endpoint enabled but restricted.

Answer

Create a private endpoint and leave the firewall open to all networks so the subnet can be filtered later.

Answer

Assign Contributor on the storage account to the subnet, because Azure roles control which networks can connect.

Answer

Disable the public endpoint and rely on Internet routing, because that is the only way to limit access to one subnet.

Question 3

A Windows VM must run a bootstrap script during provisioning to install a monitoring agent and write configuration files. The administrator does not want to log in interactively, and the script must be runnable again after the VM is rebuilt. Which two Azure compute components should be used? Select two.

Accepted Answer

Azure VM Agent. The Azure VM Agent (A) is required because it enables the VM to run extensions, including the Custom Script Extension. The Custom Script Extension (B) is the correct mechanism to execute the bootstrap script during provisioning without interactive login, and it can be reapplied to a rebuilt VM by redeploying the same ARM template or CLI command.

Answer

Boot diagnostics

Answer

Availability zone

Answer

Ephemeral OS disk

Question 4

A VM in Azure cannot accept RDP connections from your office public IP. The subnet NSG already has an inbound deny-all rule at priority 200, and you added an allow rule for TCP 3389 from 198.51.100.25/32 at priority 300. What should you do to allow the connection?

Accepted Answer

Create or move the allow rule to priority 100 so it is evaluated before the deny rule.. Network Security Group (NSG) rules are evaluated in priority order, with lower numbers having higher precedence. Since the deny-all rule at priority 200 is evaluated before the allow rule at priority 300, the deny rule blocks the RDP traffic. To allow the connection, the allow rule must be created or moved to a priority lower than 200 (e.g., 100) so it is evaluated first, permitting traffic from 198.51.100.25/32 on TCP 3389 before the deny rule is reached.

Answer

Change the source to Internet so the allow rule matches more traffic.

Answer

Change the protocol from TCP to Any to bypass the deny rule.

Answer

Assign a public IP directly to the VM to override the subnet NSG behavior.

Question 5

A VM in a virtual network must access an Azure Storage account over a private IP address, and the storage account's public endpoint must be disabled. Name resolution from the VM should resolve the storage name to the private IP. Which configuration should you use?

Accepted Answer

Private endpoint with a private DNS zone linked to the virtual network.. Option B is correct because a private endpoint assigns a private IP from the virtual network to the storage account, effectively bringing the service into the VNet. By linking a private DNS zone to the virtual network, the VM's DNS resolution for the storage account name returns the private IP instead of the public endpoint, satisfying both the private connectivity and public endpoint disablement requirements.

Answer

Service endpoint on the subnet plus public DNS, because the storage account will expose a private IP automatically.

Answer

Network security group rules only, because they can force traffic to use private addressing.

Answer

Storage account firewall rules with Allow trusted Microsoft services, because that gives a private address path.

Question 6

A Windows Azure VM must download configuration data from Azure Key Vault during first boot. Security policy forbids storing passwords, certificates, or client secrets on the VM. What should the administrator configure?

Accepted Answer

Enable a system-assigned managed identity on the VM and grant it Key Vault access.. A system-assigned managed identity provides an automatically managed service principal in Entra ID, tied to the VM's lifecycle. Granting this identity the appropriate Key Vault access policy (e.g., Get, List secrets) allows the VM to authenticate to Key Vault without any stored credentials, satisfying the security policy. The VM can then retrieve configuration data during first boot using the Azure Instance Metadata Service (IMDS) endpoint.

Answer

Create a service principal and place its secret in the VM's startup script.

Answer

Attach a custom script extension that embeds the Key Vault password in plain text.

Answer

Use an Entra ID user account and sign in interactively after deployment.

Question 7

A web app running in Azure App Service must upload files to a blob container. The team wants to avoid storing any secrets in application settings and wants the app to authenticate without a password or access key. What should the administrator configure?

Accepted Answer

Enable a system-assigned managed identity for the app and grant it a storage data role. Option B is correct because a system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any secrets. By granting the identity the 'Storage Blob Data Contributor' role via Azure RBAC, the app can upload files using Azure AD authentication, eliminating the need for passwords or access keys.

Answer

Store the storage account key in the app configuration and use it from the application

Answer

Create an anonymous public container so the app can upload without authentication

Answer

Use a shared access signature generated from the storage account root key

Question 8

A Windows VM runs an application that uploads files to a blob container every hour. Security forbids storing storage account keys or long-lived SAS tokens on the VM. The application must be able to write only to that container and nothing else. What should the administrator configure?

Accepted Answer

Assign Storage Blob Data Contributor to the VM's managed identity at the container scope. Option C is correct because it uses Azure RBAC to grant the VM's managed identity the Storage Blob Data Contributor role at the container scope. This allows the application to write only to that specific container without requiring any storage account keys or SAS tokens on the VM, satisfying the security requirement. Managed identities provide an automatically managed service principal in Azure AD, enabling secure authentication to Azure services without storing credentials.

Answer

Store the storage account key in an environment variable on the VM

Answer

Create a service SAS with write permission on the storage account

Answer

Assign Contributor on the storage account to the VM's system-assigned identity

Question 9

A web app uses a managed identity to read blobs from a storage account. Security now wants to ensure no future requests can authenticate with shared keys and the app should continue to use secretless access. Which two changes should the administrator make? Select two.

Accepted Answer

Assign the Storage Blob Data Reader role to the managed identity on the storage account or container.. Option A is correct because assigning the Storage Blob Data Reader role to the managed identity enables Azure RBAC-based, secretless access to blobs. This aligns with the requirement to use managed identities for authentication, eliminating the need for keys or SAS tokens. Option B is correct because disabling shared key access on the storage account enforces the security policy that no future requests can authenticate using shared keys, while the managed identity continues to work via Azure AD authentication.

Answer

Generate a service SAS and place it in an app setting.

Answer

Rotate the storage account keys weekly.

Answer

Grant Reader access to the resource group because it includes the storage account.

Question 10

A web app running in Azure App Service must upload images to a blob container without storing any account keys, passwords, or connection strings in configuration. The app uses only one Azure resource. What should the administrator configure?

Accepted Answer

A system-assigned managed identity on the App Service and an Azure RBAC role on the storage account.. A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any credentials in configuration. By assigning the RBAC role (e.g., Storage Blob Data Contributor) to that identity, the app can securely upload images using Azure AD authentication, meeting the requirement of no account keys, passwords, or connection strings.

Answer

The storage account key, because it is the simplest way to authenticate an application securely.

Answer

A shared access signature embedded in the app settings, because SAS is the same as managed identity.

Answer

An anonymous public container with write access disabled on the account.

Question 11

Based on the exhibit, the team must prevent accidental deletion of a resource group, but administrators still need to update settings on resources inside it. Which lock should you apply?

Accepted Answer

Apply a CanNotDelete lock to RG-Prod.. Option C is correct because applying a CanNotDelete lock to RG-Prod prevents the resource group from being deleted while still allowing administrators to update settings on resources inside it. This lock type blocks delete operations but permits read and update operations, which aligns with the requirement to prevent accidental deletion without restricting management changes.

Answer

Apply no lock and rely on RBAC alone.

Answer

Apply a ReadOnly lock to RG-Prod.

Answer

Apply a Contributor role assignment to RG-Prod.

Question 12

Based on the exhibit, where should the administrator go to see which resources are non-compliant with the assigned policy?

Accepted Answer

Azure Policy compliance view.. The Azure Policy compliance view is the correct place to see which resources are non-compliant with assigned policies. This view aggregates compliance states across all policies and initiatives, showing a per-resource breakdown of compliant, non-compliant, and exempt statuses. It directly reflects the evaluation results from the Azure Policy engine, which runs periodic scans and on-demand evaluations.

Answer

Entra ID users and groups.

Answer

Azure Activity log only.

Answer

Resource locks blade.

Question 13

Based on the exhibit, the support team needs a searchable 90-day history of who deleted Azure resources and when. The current workspace only contains VM guest logs. Which configuration should you add?

Accepted Answer

Configure a diagnostic setting at the subscription scope to send the Azure Activity log to Log Analytics and retain it for 90 days.. The Azure Activity log records all control-plane events, including resource deletions, at the subscription level. By configuring a diagnostic setting to stream the Activity log to a Log Analytics workspace, you can retain the data for up to 90 days (or longer with data export rules) and make it searchable via KQL queries. The current workspace only contains VM guest logs, so adding this setting directly meets the requirement without relying on guest-level or network-level logs.

Answer

Enable guest-level diagnostics on each VM so deletion events are captured.

Answer

Turn on NSG flow logs for all subnets to capture resource deletions.

Answer

Store VM backups in the vault and use restore points as an audit trail.

Question 14

An administrator must centralize Azure Activity log events and diagnostic logs from several storage accounts into a single workspace so the team can query them with KQL. What should be configured on each resource?

Accepted Answer

Diagnostic settings to send logs to a Log Analytics workspace.. Diagnostic settings are the Azure mechanism for streaming resource logs and metrics to various destinations, including Log Analytics workspaces. By configuring diagnostic settings on each storage account to send its Activity Log and diagnostic logs to a single Log Analytics workspace, the administrator centralizes the logs for KQL querying. This is the only option that directly enables log ingestion into the workspace.

Answer

A backup policy in Recovery Services vault to copy logs into the workspace.

Answer

A private endpoint for each storage account so the logs remain internal to Azure.

Answer

A management group lock to prevent log deletion.

Question 15

Based on the exhibit, a user accidentally deleted one file from the VM and you need to restore only that file without recovering the entire virtual machine. What should you use?

Accepted Answer

Run file recovery from the available recovery point.. Azure Backup for Azure VMs supports file-level recovery from VM backup snapshots without restoring the entire VM. By selecting 'File Recovery' from the backup item's recovery point, you can mount the backup as a drive on the VM or a recovery machine, browse the file system, and copy the deleted file back to its original location. This avoids the overhead and downtime of a full VM restore.

Answer

Restore the entire VM to the original resource group.

Answer

Create a new backup policy with longer retention and wait for the next backup.

Answer

Use Azure Monitor alerts to trigger an automatic file restore.