AZ-104 Practice Test 3 — 10 Questions

Question 1

Match each lifecycle management requirement to the blob tier transition or action that should be configured.

Accepted Answer

Move blobs not modified for 30 days: Transition to cool tier. Lifecycle management rules define actions (tier changes or deletion) based on age or access. The actions correspond to moving to cooler tiers (cool, cold, archive) or deleting, and can apply to snapshots.

Answer

Move blobs not modified for 30 days: Transition to archive tier

Answer

Move blobs not modified for 90 days: Transition to cool tier

Answer

Delete blobs after 365 days: Transition to cool tier

Question 2

Match each Azure CLI command to the action it performs for a virtual machine.

Accepted Answer

az vm create: Creates a new virtual machine.. Each Azure CLI command performs the corresponding VM lifecycle action: create, start, stop, deallocate (releases resources), delete, or list.

Answer

az vm start: Stops a running virtual machine.

Answer

az vm stop: Deallocates a virtual machine.

Question 3

Match each data-access pattern to the blob tier or required action.

Accepted Answer

Frequent read and write operations: Hot tier. Azure Blob Storage tiers are Hot (frequent access), Cool (infrequent, 30-day minimum), and Archive (rare, 180-day minimum). Rehydration is needed to access Archive blobs. Azure Files sync is used for replication.

Answer

Frequent read and write operations: Cool tier

Answer

Infrequent access with 30-day minimum storage duration: Archive tier

Question 4

Match each workload requirement to the Azure storage account kind that best fits it.

Accepted Answer

General-purpose v2: Provides support for blobs, files, queues, tables, and VM disks. Suitable for most general-purpose workloads.. Each storage kind is tailored for specific workloads: GPv2 is the default, BlockBlobStorage for high throughput, FileStorage for premium files, and others for legacy or specialized needs.

Answer

General-purpose v2: Premium performance for block blob and append blob data, with low latency.

Answer

BlockBlobStorage: Legacy blob-only account type.

Question 5

Based on the exhibit, which identity approach should be used so all three virtual machines can reuse the same Azure access without sharing secrets?

Accepted Answer

Use a user-assigned managed identity and attach it to all three VMs.. A user-assigned managed identity is a standalone Azure resource that can be assigned to multiple Azure VMs, allowing all three VMs to authenticate to Azure services (e.g., Azure Storage, Key Vault) using the same identity without sharing any secrets. This approach eliminates the need to manage or rotate credentials, as the identity is managed entirely by Microsoft Entra ID and tokens are obtained via the Azure Instance Metadata Service (IMDS) endpoint.

Answer

Assign a system-assigned managed identity to each VM.

Answer

Create a storage account access key and place it in each VM's application settings.

Answer

Create a separate SAS token for each VM and rotate it manually.

Question 6

You need to prevent accidental deletion of a resource group while still allowing administrators to create and modify resources inside it. Which Azure lock should you apply?

Accepted Answer

CanNotDelete. The CanNotDelete lock prevents deletion of the resource group while still allowing all operations (read, write, modify) on resources within it. This lock type is designed specifically to protect against accidental deletion without restricting administrative actions like creating or updating resources.

Answer

ReadOnly

Answer

Delete lock

Answer

No lock and a budget alert

Question 7

A storage account has public network access disabled. A VM in VNet-App can reach a private endpoint for the account, but the storage name still resolves to the public IP address from the VM, and connections are denied. What should the administrator configure?

Accepted Answer

A private DNS zone for the storage blob endpoint linked to VNet-App.. When public network access is disabled on a storage account and a private endpoint is configured, the storage account's public DNS name must resolve to the private endpoint's private IP address within the virtual network. By default, the DNS name continues to resolve to the public IP address, causing connection failures. Linking a private DNS zone (privatelink.blob.core.windows.net) to VNet-App enables automatic resolution of the storage blob endpoint to the private IP address, allowing the VM to connect successfully.

Answer

A service endpoint on the subnet so the storage account uses a private IP address.

Answer

A storage account access key on the VM so the public endpoint will accept the connection.

Answer

A user-defined route sending storage traffic to the virtual network gateway.

Question 8

Based on the exhibit, what should you do so the report can open the file tomorrow morning?

Accepted Answer

Change the blob to the Hot access tier and allow it to rehydrate before the report runs.. The blob is currently in the Archive access tier, which requires manual rehydration (changing the tier to Hot or Cool) before it can be read. Rehydration can take up to 15 hours, so changing the blob to the Hot access tier now and allowing it to complete rehydration before the report runs tomorrow ensures the file is available for reading.

Answer

Change the blob to the Cool access tier only, because Cool is always immediately readable.

Answer

Create a snapshot of the archived blob and use the snapshot instead.

Answer

Enable versioning on the storage account so the file becomes readable again.

Question 9

A storage account should accept traffic only from one subnet, but the team does not want to create a private IP address for the service in the virtual network. What should they enable?

Accepted Answer

Service endpoint, because it allows the subnet to access the storage service securely over the Azure backbone.. Service endpoints allow a subnet to access Azure PaaS services (like Storage) over the Azure backbone without requiring a private IP address. By enabling a Microsoft.Storage service endpoint on the subnet and configuring the storage account firewall to allow traffic only from that subnet, the team meets the requirement securely and cost-effectively.

Answer

Private endpoint, because it is the only way to allow one subnet.

Answer

User-assigned managed identity, because it controls subnet access.

Answer

Blob soft delete, because it helps restrict where traffic comes from.

Question 10

A department has 10 subscriptions and wants the same two governance rules applied to all current and future subscriptions. One rule audits missing tags, and the other denies unapproved locations. Which two actions should the administrator take? Select two.

Accepted Answer

Create an Azure Policy initiative that contains both policy definitions.. Azure Policy Initiative allows grouping multiple policy definitions (like audit for missing tags and deny for unapproved locations) into a single set for coordinated enforcement. Assigning the initiative at the management group scope ensures it applies to all current and future subscriptions under that management group, meeting the requirement for consistent governance across all 10 subscriptions and any new ones added later.

Answer

Assign each policy only to one resource group.

Answer

Use Azure RBAC instead of Policy for both requirements.

Answer

Create a read-only lock on each subscription.