AZ-104 Practice Test 30 — 15 Questions

Question 1

A workload in a VNet must connect to Azure SQL Database over a private IP address, and the database must not be reachable through its public endpoint. Users should still connect by using the normal server name. What should you configure?

Accepted Answer

A private endpoint for Azure SQL Database and a private DNS zone linked to the VNet.. Option B is correct because a private endpoint assigns Azure SQL Database a private IP address from the VNet, making it accessible over a private connection. By creating a private DNS zone linked to the VNet, the normal server name resolves to that private IP, allowing users to connect without using the public endpoint. This configuration ensures the database is not reachable via its public endpoint while maintaining name-based connectivity.

Answer

A service endpoint on the subnet and a public firewall rule on the SQL server.

Answer

A network security group rule that denies all public internet traffic to the subnet.

Answer

A NAT gateway on the subnet so the SQL connection uses a private source address.

Question 2

An application in a subnet must access an Azure Storage account over a private IP. The storage account must not be reachable through its public endpoint, and access should be limited to that subnet only. Which configuration should the administrator implement?

Accepted Answer

Create a private endpoint in the subnet and disable public network access on the storage account.. Option B is correct because a private endpoint assigns a private IP from the subnet to the storage account, effectively bringing the service into the virtual network. Disabling public network access ensures the storage account is only reachable via that private endpoint, meeting the requirement to block public endpoint access and limit access to the specific subnet.

Answer

Create a service endpoint for Microsoft.Storage on the subnet and keep the public endpoint enabled.

Answer

Use a shared access signature token and leave network settings unchanged.

Answer

Associate the storage account with a NAT gateway to control inbound access.

Question 3

An application VM in a subnet without a public IP must access Azure Blob Storage. The storage account must not be reachable from the public internet, and DNS resolution should stay inside the virtual network. What should you implement?

Accepted Answer

Create a private endpoint for the storage account and link the appropriate private DNS zone.. Option B is correct because a private endpoint assigns the storage account a private IP from the VM's virtual network, making it reachable without public internet exposure. Linking the private DNS zone ensures that DNS resolution for the storage account (e.g., `mystorageaccount.blob.core.windows.net`) resolves to the private IP within the VNet, meeting both requirements.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet and keep the public endpoint enabled.

Answer

Use a SAS token and allow access from any network for the storage account.

Answer

Assign a managed identity to the VM and remove all network restrictions from the storage account.

Question 4

An on-premises application connects to Azure through an existing site-to-site VPN. The application must access an Azure Storage account, public network access on the storage account is disabled, and the company does not want the storage account exposed through a public endpoint. Which solution should the administrator implement?

Accepted Answer

Create a private endpoint for the storage account in a VNet reachable over the VPN and configure private DNS.. A private endpoint assigns the storage account a private IP from a VNet that is reachable over the site-to-site VPN, effectively bringing the storage account into the on-premises network without exposing a public endpoint. Private DNS zones ensure that the storage account's FQDN resolves to the private IP, enabling seamless connectivity from on-premises while public network access remains disabled.

Answer

Enable a service endpoint on the on-premises network and allow the storage account firewall to trust it.

Answer

Generate a shared access signature and use it from the on-premises application.

Answer

Associate a NAT gateway with the on-premises VPN connection.

Question 5

An administrator is deploying a site-to-site VPN gateway in Azure. The GatewaySubnet already exists, but the deployment fails because no public-facing address is available for the gateway. What is required for the gateway to deploy and accept the on-premises connection?

Accepted Answer

Create and associate a public IP address with the VPN gateway.. A site-to-site VPN gateway in Azure requires a public IP address to establish the encrypted tunnel with the on-premises VPN device. The public IP address is assigned to the gateway's frontend configuration, enabling it to send and receive IPsec/IKE traffic over the internet. Without this public-facing address, the gateway cannot be provisioned or accept the on-premises connection.

Answer

Assign a standard Load Balancer to the GatewaySubnet.

Answer

Create a private endpoint for the virtual network gateway.

Answer

Delegate the GatewaySubnet to Microsoft.Network/privateEndpoints.

Question 6

An administrator added an NSG rule named Allow-Admin-HTTPS with priority 250 to permit inbound TCP 443 from a single public IP. The NSG also contains a Deny-All-Inbound rule with priority 200. The administrator still cannot connect to the VM over HTTPS from the allowed IP. What should be changed to resolve the issue?

Accepted Answer

Change the allow rule priority to a number lower than 200.. The Deny-All-Inbound rule with priority 200 is evaluated before the Allow-Admin-HTTPS rule with priority 250 because NSG rules are processed in order of ascending priority (lower numbers are evaluated first). Since the deny rule matches all inbound traffic, it blocks the HTTPS connection before the allow rule can be evaluated. To resolve this, the allow rule must have a priority lower than 200 (e.g., 150) so it is evaluated first and permits the traffic from the specified public IP.

Answer

Change the deny rule priority to 65000 so it is evaluated first.

Answer

Convert the allow rule to an outbound rule instead of inbound.

Answer

Replace the NSG with a route table so HTTPS can pass through the subnet.

Question 7

An NSG on a subnet has these inbound rules: Deny-All-Inbound at priority 100 and Allow-RDP-from-AdminSubnet at priority 200. Administrators on AdminSubnet still cannot RDP to a VM in the subnet. What should the network administrator change?

Accepted Answer

Move the allow rule to a lower priority number than 100.. The NSG rules are evaluated in priority order, with lower numbers having higher precedence. The Deny-All-Inbound rule at priority 100 blocks all traffic, including RDP from AdminSubnet, before the Allow-RDP-from-AdminSubnet rule at priority 200 is evaluated. To allow RDP traffic, the allow rule must have a lower priority number (e.g., 90) than the deny rule (100), ensuring it is evaluated first and permits the traffic before the deny rule blocks it.

Answer

Delete the deny rule so only the allow rule remains.

Answer

Change the VM to a different availability zone.

Answer

Create a private endpoint for the VM.

Question 8

Based on the exhibit, a subscription policy must add CostCenter=042 to new resources, and deployments must not fail if the tag is missing. Which policy effect should you use?

Accepted Answer

Modify. The 'Modify' effect (option D) is correct because it can add the CostCenter=042 tag to new resources without causing deployment failures if the tag is missing. Unlike 'Deny', which blocks non-compliant resources, or 'Append', which is deprecated and only works on non-tag properties, 'Modify' uses a 'merge' operation to add tags during resource creation or update, and its 'conflictEffect' can be set to 'audit' to ensure deployments succeed even when the tag is absent.

Answer

Deny

Answer

Audit

Answer

Append

Question 9

An Azure Automation account is recreated periodically during a migration project. Runbooks must authenticate to Azure resources without embedded secrets, and the identity must continue to work after the account is rebuilt. Which two choices should you make? Select two.

Accepted Answer

Use a user-assigned managed identity so the identity is independent of the Automation account lifecycle.. Option A is correct because a user-assigned managed identity exists as a standalone Azure resource independent of the Automation account's lifecycle. When the Automation account is recreated, you can reassign the same user-assigned managed identity to the new account, preserving the identity's object ID and its RBAC role assignments. This ensures that runbooks can authenticate without embedded secrets and continue to work seamlessly after the account is rebuilt.

Answer

Use a service principal with a client secret stored in an encrypted Automation variable.

Answer

Use a system-assigned managed identity attached to the Automation account because it is always reusable after recreation.

Answer

Store a storage account key in a runbook asset and retrieve it at runtime.

Question 10

Which two statements about a Log Analytics workspace are correct? Select two.

Accepted Answer

It can store logs collected from Azure resources. Option A is correct because a Log Analytics workspace is a centralized repository that can ingest and store log data from various Azure resources, including virtual machines, Azure Activity logs, and resource diagnostics, enabling monitoring and analysis. Option B is correct because Log Analytics workspaces support Kusto Query Language (KQL) queries, which allow users to perform complex searches, aggregations, and visualizations on the stored log data.

Answer

It creates backups of Azure virtual machines

Answer

It assigns permissions to Azure resources at scope

Answer

It blocks resource creation that violates a rule

Question 11

Backup protection was enabled on a new Azure VM, but every backup job fails immediately with a message indicating the guest agent is not ready. What should the administrator verify first?

Accepted Answer

That the Azure VM agent is installed, running, and up to date inside the guest operating system.. The Azure Backup extension requires the Azure VM agent to be installed, running, and up to date inside the guest OS to coordinate backup operations. When the agent is not ready, the backup job fails immediately because the extension cannot communicate with the VM to take snapshots. Verifying the agent's status is the first troubleshooting step before investigating network or configuration issues.

Answer

That the recovery vault uses GZRS storage redundancy.

Answer

That the VM has a private endpoint to the Recovery Services vault.

Answer

That a resource lock has not been applied to the VM.

Question 12

Based on the exhibit, the backup policy must support 30-day recovery for daily backups while keeping 12 months of monthly copies. Which setting should be changed?

Accepted Answer

Increase daily retention from 7 days to 30 days.. The backup policy currently has daily retention set to 7 days, which only keeps daily recovery points for a week. To meet the requirement of 30-day recovery for daily backups, you must increase the daily retention to 30 days. This ensures that each daily backup is retained for 30 days, allowing point-in-time recovery within that window.

Answer

Increase weekly retention from 4 weeks to 30 weeks.

Answer

Change the backup schedule to every 30 days.

Answer

Turn on archive tier for the backup policy.

Question 13

An application team needs Contributor access only for the resources in rg-app. They must not manage any other resources in the subscription. At what scope should you assign the role?

Accepted Answer

Resource group scope. The Contributor role assigned at the resource group scope grants the application team full management access to all resources within rg-app, but no access to resources in other resource groups or at the subscription level. This meets the requirement of restricting permissions to only that specific resource group.

Answer

Management group scope

Answer

Subscription scope

Answer

Resource scope

Question 14

An enterprise uses one management group to contain five subscriptions for a business unit. A compliance auditor in an Entra ID group needs read-only access to every current and future resource in all five subscriptions, but must not see resources in other business units. What is the best scope for the Reader role assignment?

Accepted Answer

Assign Reader at the management group that contains the five subscriptions.. Assigning the Reader role at the management group scope grants inherited read-only access to all current and future resources within every subscription under that management group, while preventing access to resources in other business units that are in separate management groups. This satisfies the auditor's requirement for a single, scalable assignment that automatically covers new subscriptions added to the management group.

Answer

Assign Reader separately at each subscription in the business unit.

Answer

Assign Reader at a single resource group within one subscription.

Answer

Assign Reader directly to each resource that the auditor should see.

Question 15

Based on the exhibit, a metric alert already exists for VM01, but the on-call team never receives an email when CPU exceeds 80% for 5 minutes. What should you configure to deliver the notification?

Accepted Answer

Add an action group to the alert rule and configure email delivery.. The alert rule exists, but no notification action is configured. An action group defines how to notify administrators (e.g., email, SMS, webhook). Adding an action group with an email action to the existing alert rule will deliver the email when the CPU threshold is breached.

Answer

Create a diagnostic setting on VM01 to export metrics to Log Analytics.

Answer

Assign the Reader role to the on-call team so they can view the alert.

Answer

Create a resource lock on VM01 to prevent accidental changes.