AZ-104 Practice Test 29 — 15 Questions

Question 1

A web tier must use identical VMs, keep the desired instance count if one instance becomes unhealthy, and allow future horizontal expansion without creating VMs one by one. What should the administrator deploy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A virtual machine scale set with health-based instance management.. A virtual machine scale set with health-based instance management is correct because it automatically maintains a desired number of identical VM instances, replaces unhealthy instances based on health probes, and supports horizontal scaling without manual VM creation. This aligns with the requirements for identical VMs, automatic instance replacement, and future expansion.

Answer

An availability set because it automatically replaces unhealthy instances.

Answer

An Azure Dedicated Host to keep the VMs on one physical server.

Answer

A proximity placement group to ensure the VMs are distributed evenly.

Question 2

An NSG on a subnet has these inbound rules: Deny-All-Inbound at priority 100 and Allow-RDP-from-AdminSubnet at priority 200. Administrators on AdminSubnet still cannot RDP to a VM in the subnet. What should the network administrator change?

Accepted Answer

Move the allow rule to a lower priority number than 100.. The NSG rules are evaluated in priority order, with lower numbers having higher precedence. The Deny-All-Inbound rule at priority 100 blocks all traffic, including RDP from AdminSubnet, before the Allow-RDP-from-AdminSubnet rule at priority 200 is evaluated. To allow RDP traffic, the allow rule must have a lower priority number (e.g., 90) than the deny rule (100), ensuring it is evaluated first and permits the traffic before the deny rule blocks it.

Answer

Delete the deny rule so only the allow rule remains.

Answer

Change the VM to a different availability zone.

Answer

Create a private endpoint for the VM.

Question 3

A change-freeze requires that no one can modify the settings of a subscription's resource group for six hours. Deletion is not the main concern; the priority is to block changes to existing resources during the freeze. Which lock should you apply?

Accepted Answer

ReadOnly. The ReadOnly lock prevents any modification to existing resources, including configuration changes, while still allowing read operations. This directly satisfies the change-freeze requirement to block changes for six hours, as it denies all write operations at the resource group scope.

Answer

CanNotDelete

Answer

Reader

Answer

DeployIfNotExists

Question 4

An App Service application needs to read secrets from Azure Key Vault. The security team does not want any password, certificate, or client secret stored in application settings, and they want the identity removed automatically if the app is deleted. What should the administrator enable?

Accepted Answer

A system-assigned managed identity on the App Service.. A system-assigned managed identity (Option B) is the correct choice because it provides an identity for the App Service that is automatically managed by Azure, tied to the lifecycle of the resource (deleted when the app is deleted), and requires no credentials to be stored in application settings. This allows the app to authenticate to Key Vault using Microsoft Entra ID tokens without any secrets, satisfying the security team's requirements.

Answer

A service principal with a client secret stored in App Service configuration.

Answer

A user-assigned managed identity shared by all applications.

Answer

A shared access signature stored in Key Vault.

Question 5

An administrator wants future VMs to start from the same approved server build as an existing generalized VM. Which two image sources can be used to create the new VM? Select two.

Accepted Answer

A managed image created from the approved server build.. A managed image captures the exact configuration of a generalized VM, including the OS and data disks, and can be used to deploy multiple identical VMs. This ensures that future VMs start from the same approved server build without needing to recreate the image each time.

Answer

A Marketplace image from the operating system vendor.

Answer

A single managed disk snapshot.

Answer

A public IP address assigned to the VM.

Question 6

A web app running in Azure App Service must upload files to a blob container. The team wants to avoid storing any secrets in application settings and wants the app to authenticate without a password or access key. What should the administrator configure?

Accepted Answer

Enable a system-assigned managed identity for the app and grant it a storage data role. A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any secrets. By granting the identity the 'Storage Blob Data Contributor' role via Azure RBAC, the app can upload files using Microsoft Entra ID authentication, eliminating the need for passwords or access keys.

Answer

Store the storage account key in the app configuration and use it from the application

Answer

Create an anonymous public container so the app can upload without authentication

Answer

Use a shared access signature generated from the storage account root key

Question 7

Three Azure VMs run the same scheduled script and must access both Storage and Key Vault. The team wants one identity that can be reused if a VM is rebuilt, and they do not want the identity tied to a single machine. What should the administrator create?

Accepted Answer

A user-assigned managed identity attached to all three virtual machines.. A user-assigned managed identity is the correct choice because it is an independent Azure resource that can be assigned to multiple VMs, persists independently of any single VM's lifecycle, and can be reused when a VM is rebuilt. This identity provides seamless authentication to both Storage and Key Vault without managing credentials, meeting the requirement for a reusable, non-machine-tied identity.

Answer

A system-assigned managed identity on each virtual machine.

Answer

A service principal with a certificate file copied to each VM.

Answer

A shared access signature for each storage account and Key Vault access policy.

Question 8

Your company wants to query performance and event data from multiple Azure virtual machines by using Kusto Query Language. The operations team also wants to centralize retention and analysis of this data. What should you deploy?

Accepted Answer

A Log Analytics workspace.. A Log Analytics workspace is the correct choice because it is the central repository in Azure Monitor for collecting telemetry and log data from Azure virtual machines. It supports Kusto Query Language (KQL) for querying performance and event data, and it provides centralized retention, analysis, and alerting capabilities, meeting both requirements.

Answer

Azure Advisor.

Answer

Azure Network Watcher only.

Answer

A network security group.

Question 9

Several Azure VMs need the same Azure identity so they can access a shared resource without storing passwords. The identity should be reusable across VMs and removable centrally. Which identity type should the administrator use?

Accepted Answer

User-assigned managed identity. A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource, can be assigned to multiple VMs simultaneously, and can be centrally removed or updated without affecting the VMs themselves. This identity is reusable across VMs and eliminates the need to store passwords or secrets in code or configuration.

Answer

System-assigned managed identity

Answer

Service principal with a client secret

Answer

Local administrator account

Question 10

A platform team has a generalized VM image that must be published to East US and West Europe today and patched later without overwriting the original build. They want Azure to keep version history and replicate the image to both regions. Which two actions or resources should they use? Select two.

Accepted Answer

Create an Azure Compute Gallery. Azure Compute Gallery (formerly Shared Image Gallery) allows you to store and manage VM image versions, including version history, and replicate them across multiple Azure regions. By creating an image definition and image version within the gallery, you can publish the generalized VM image to East US and West Europe today, and later create a new image version for patching without overwriting the original build, preserving the version history.

Answer

Capture the VM as a single managed image and copy it manually to each region

Answer

Use an availability set to preserve the image

Answer

Take a snapshot of the OS disk and deploy VMs directly from the snapshot

Question 11

A user deleted a nested folder tree from an Azure file share yesterday. Other folders in the share were updated after the deletion and must not be rolled back. Which two actions should the administrator take? Select two.

Accepted Answer

Open a snapshot taken before the deletion.. Azure file share snapshots provide a point-in-time, read-only copy of the entire share. By opening a snapshot taken before the deletion, the administrator can browse the exact folder tree as it existed at that time. Option C is correct because the administrator can copy only the deleted folder tree from the snapshot back into the live share, leaving all other folders (including those updated after the deletion) intact.

Answer

Restore the entire file share from the latest snapshot.

Answer

Convert the file share to the Hot access tier.

Answer

Delete the newer folders so the share matches the snapshot exactly.

Question 12

You need to monitor CPU on a small set of VMs while keeping ingestion costs low. Which two actions are the best choices? Select two.

Accepted Answer

Use Azure Monitor platform metrics for CPU instead of collecting guest logs. Azure Monitor platform metrics for CPU are collected automatically from the Azure VM host at no additional cost, providing basic CPU utilization data without requiring the Log Analytics agent or incurring data ingestion charges. This approach keeps costs low because platform metrics are included in the Azure Monitor pricing, whereas guest-level metrics require log ingestion and storage fees. For a small set of VMs where only CPU monitoring is needed, platform metrics are sufficient and cost-effective.

Answer

Collect all Windows event logs from every VM

Answer

Create a separate workspace for each VM

Answer

Enable verbose guest logging on every server

Question 13

A contractor team changes every few weeks. The administrator wants Azure access to stay the same when individual contractors leave or join, without editing role assignments for each person. What should be assigned the Azure role?

Accepted Answer

A Microsoft Entra ID security group. Assigning the Azure role to a Microsoft Entra ID security group allows the administrator to manage access by adding or removing contractors from the group, rather than editing individual role assignments. This approach ensures that role assignments remain unchanged when contractors leave or join, as the group itself retains the role. It leverages Azure RBAC's support for group-based access control, which is the recommended method for dynamic teams.

Answer

Each contractor user account individually

Answer

A device group

Answer

An Azure subscription

Question 14

A production application runs on three Azure VMs in the same region. The business requires the service to stay available if one entire datacenter in the region becomes unavailable because of a power or network outage. Which configuration best meets the requirement?

Accepted Answer

Deploy the VMs across availability zones.. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. By deploying VMs across three zones, the application can survive the failure of an entire datacenter because the other zones remain operational. This meets the requirement for high availability against a full datacenter outage.

Answer

Place the VMs in the same availability set.

Answer

Use a proximity placement group for the VMs.

Answer

Attach the VMs to the same Azure Load Balancer backend pool.

Question 15

A company wants to peer two Azure virtual networks so that workloads can communicate privately. VNet-A uses 10.10.0.0/16. VNet-B is being designed now. Which address space should be chosen for VNet-B?

Accepted Answer

10.11.0.0/16, because it does not overlap and is still within a private IPv4 range.. VNet peering requires non-overlapping address spaces to enable direct private IP connectivity between resources. 10.11.0.0/16 is a unique private IPv4 range (RFC 1918) that does not overlap with VNet-A's 10.10.0.0/16, ensuring successful peering without routing conflicts.

Answer

10.10.5.0/24, because it is a smaller subnet inside the same private range.

Answer

10.10.0.0/24, because peering automatically separates overlapping subnets.

Answer

192.168.1.0/24, because peered networks must always use the 192.168.x.x range.