AZ-104 Practice Test 30 — 15 Questions

Question 1

A platform team has a generalized VM image that must be published to East US and West Europe today and patched later without overwriting the original build. They want Azure to keep version history and replicate the image to both regions. Which two actions or resources should they use? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an Azure Compute Gallery. Azure Compute Gallery (formerly Shared Image Gallery) allows you to store and manage VM image versions, including version history, and replicate them across multiple Azure regions. By creating an image definition and image version within the gallery, you can publish the generalized VM image to East US and West Europe today, and later create a new image version for patching without overwriting the original build, preserving the version history.

Answer

Capture the VM as a single managed image and copy it manually to each region

Answer

Use an availability set to preserve the image

Answer

Take a snapshot of the OS disk and deploy VMs directly from the snapshot

Question 2

A user deleted a nested folder tree from an Azure file share yesterday. Other folders in the share were updated after the deletion and must not be rolled back. Which two actions should the administrator take? Select two.

Accepted Answer

Open a snapshot taken before the deletion.. Azure file share snapshots provide a point-in-time, read-only copy of the entire share. By opening a snapshot taken before the deletion, the administrator can browse the exact folder tree as it existed at that time. Option C is correct because the administrator can copy only the deleted folder tree from the snapshot back into the live share, leaving all other folders (including those updated after the deletion) intact.

Answer

Restore the entire file share from the latest snapshot.

Answer

Convert the file share to the Hot access tier.

Answer

Delete the newer folders so the share matches the snapshot exactly.

Question 3

You need to monitor CPU on a small set of VMs while keeping ingestion costs low. Which two actions are the best choices? Select two.

Accepted Answer

Use Azure Monitor platform metrics for CPU instead of collecting guest logs. Azure Monitor platform metrics for CPU are collected automatically from the Azure VM host at no additional cost, providing basic CPU utilization data without requiring the Log Analytics agent or incurring data ingestion charges. This approach keeps costs low because platform metrics are included in the Azure Monitor pricing, whereas guest-level metrics require log ingestion and storage fees. For a small set of VMs where only CPU monitoring is needed, platform metrics are sufficient and cost-effective.

Answer

Collect all Windows event logs from every VM

Answer

Create a separate workspace for each VM

Answer

Enable verbose guest logging on every server

Question 4

A contractor team changes every few weeks. The administrator wants Azure access to stay the same when individual contractors leave or join, without editing role assignments for each person. What should be assigned the Azure role?

Accepted Answer

A Microsoft Entra ID security group. Assigning the Azure role to a Microsoft Entra ID security group allows the administrator to manage access by adding or removing contractors from the group, rather than editing individual role assignments. This approach ensures that role assignments remain unchanged when contractors leave or join, as the group itself retains the role. It leverages Azure RBAC's support for group-based access control, which is the recommended method for dynamic teams.

Answer

Each contractor user account individually

Answer

A device group

Answer

An Azure subscription

Question 5

A production application runs on three Azure VMs in the same region. The business requires the service to stay available if one entire datacenter in the region becomes unavailable because of a power or network outage. Which configuration best meets the requirement?

Accepted Answer

Deploy the VMs across availability zones.. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. By deploying VMs across three zones, the application can survive the failure of an entire datacenter because the other zones remain operational. This meets the requirement for high availability against a full datacenter outage.

Answer

Place the VMs in the same availability set.

Answer

Use a proximity placement group for the VMs.

Answer

Attach the VMs to the same Azure Load Balancer backend pool.

Question 6

A company wants to peer two Azure virtual networks so that workloads can communicate privately. VNet-A uses 10.10.0.0/16. VNet-B is being designed now. Which address space should be chosen for VNet-B?

Accepted Answer

10.11.0.0/16, because it does not overlap and is still within a private IPv4 range.. VNet peering requires non-overlapping address spaces to enable direct private IP connectivity between resources. 10.11.0.0/16 is a unique private IPv4 range (RFC 1918) that does not overlap with VNet-A's 10.10.0.0/16, ensuring successful peering without routing conflicts.

Answer

10.10.5.0/24, because it is a smaller subnet inside the same private range.

Answer

10.10.0.0/24, because peering automatically separates overlapping subnets.

Answer

192.168.1.0/24, because peered networks must always use the 192.168.x.x range.

Question 7

You need to deploy a set of identical Azure virtual machines that can automatically scale out during demand spikes and scale in when usage falls. Which Azure feature should you use?

Accepted Answer

A Virtual Machine Scale Set. A Virtual Machine Scale Set (VMSS) is the correct Azure feature because it is designed specifically to deploy and manage a set of identical, load-balanced VMs that can automatically scale out (increase instance count) during demand spikes and scale in (decrease instance count) when usage falls, using autoscale rules based on metrics like CPU or memory.

Answer

An availability set

Answer

A Recovery Services vault

Answer

Boot diagnostics

Question 8

Based on the exhibit, which address space can you assign to the new spoke virtual network so it can be peered to the hub and later connected to on-premises without an IP overlap?

Accepted Answer

10.52.0.0/16. (10.52.0.0/16) is correct because it does not overlap with the hub virtual network's address space (10.50.0.0/16) or the on-premises network (10.51.0.0/16). This allows the spoke VNet to be peered to the hub and later connected to on-premises via a gateway in the hub without IP address conflicts, which is a requirement for successful VNet peering and VPN/ExpressRoute connectivity.

Answer

10.50.128.0/17

Answer

10.51.0.0/16

Answer

10.50.0.0/24

Question 9

A company has three business units. Each business unit needs its own subscription for billing and admin delegation. Corporate security wants one policy assignment to cover all current and future subscriptions in each business unit. What structure should you implement?

Accepted Answer

Create a management group for each business unit and place that unit's subscriptions underneath it. Management groups allow you to aggregate multiple subscriptions under a single hierarchy, enabling policy assignment at the management group level that applies to all current and future subscriptions within that group. This meets the requirement for per-business-unit billing isolation (via separate subscriptions) and centralized policy enforcement across all subscriptions in each unit.

Answer

Place all resources in one subscription and separate them only by resource group

Answer

Assign the policy at each resource group because policies cannot target subscriptions

Answer

Create one resource group per business unit inside a shared subscription

Question 10

A team wants an Azure Storage account to be reachable only from a single Azure virtual network and to use a private IP address inside that network. Which option should the administrator configure?

Accepted Answer

A private endpoint for the storage account.. A private endpoint assigns a private IP address from the virtual network to the storage account, making it reachable only from that VNet over the Microsoft backbone network. This meets the requirement of exclusive access and private IP usage, unlike a service endpoint which still exposes the storage account to the public internet via its public endpoint.

Answer

A service endpoint on the subnet.

Answer

A public IP address with an NSG inbound allow rule.

Answer

A VPN gateway connection to the storage account.

Question 11

A project team expects frequent joiners and leavers. The same Azure permissions are needed for all members of the team, and you want to avoid editing role assignments for each person. Which two actions best meet the requirement? Select two.

Accepted Answer

Create a security group for the project team.. Creating a security group allows you to manage permissions collectively rather than individually. By adding or removing users from the group as joiners and leavers occur, you avoid editing role assignments for each person. This aligns with Azure AD group-based licensing and RBAC best practices for dynamic teams.

Answer

Assign the same roles directly to every user account.

Answer

Use guest accounts for all team members.

Answer

Assign the roles to a service principal shared by the team.

Question 12

Your application stores compliance records in Azure Blob Storage. The records must remain in a write-once-read-many state for three years and must not be altered or deleted during that period. What should you configure?

Accepted Answer

Immutable blob storage with a time-based retention policy. Immutable blob storage with a time-based retention policy enforces a WORM (Write-Once, Read-Many) state, preventing any modification or deletion of blobs for a specified retention period. This meets the requirement of keeping compliance records unaltered for three years, as the policy locks the data at the storage level, overriding any user permissions or delete operations.

Answer

Blob soft delete

Answer

Lifecycle management to move data to Archive

Answer

A shared access signature

Question 13

A blob was moved to the Archive tier last month. A user now needs to open the file within a few hours. What should the administrator do first?

Accepted Answer

Change the blob to Hot or Cool and wait for rehydration to complete. Blobs in the Archive tier are offline and cannot be read directly. To access the data, you must first change the blob's access tier to Hot or Cool, which initiates a rehydration process that makes the blob available for reading. Since the user needs the file within a few hours, rehydration typically completes within that timeframe (up to 15 hours for Archive to Cool/Hot).

Answer

Download the blob directly from the Archive tier

Answer

Create a snapshot of the blob and open the snapshot instead

Answer

Enable versioning on the storage account

Question 14

An administrator enabled diagnostic settings on a storage account and selected the resource-specific table format for Log Analytics. A coworker later queried AzureDiagnostics and received no rows. What should the administrator tell the coworker to do?

Accepted Answer

Query the dedicated storage resource tables created by the diagnostic setting instead of AzureDiagnostics. When diagnostic settings are configured to use the 'Resource specific' destination table format, logs are sent to dedicated tables named after the resource type (e.g., StorageBlobLogs, StorageQueueLogs) rather than the legacy AzureDiagnostics table. Querying AzureDiagnostics returns no rows because logs are not written there under this format. The coworker must query the appropriate resource-specific table instead.

Answer

Recreate the storage account because AzureDiagnostics is only populated by new resources

Answer

Change the storage account replication type to GRS so diagnostic logs are duplicated

Answer

Enable Azure Monitor metrics collection on the storage account before querying AzureDiagnostics

Question 15

A support engineer must restart and view the properties of virtual machines only in RG-Dev. The engineer must not gain access to other resource groups in the subscription. What should the administrator do?

Accepted Answer

Assign the Virtual Machine Contributor role at the RG-Dev scope.. The Virtual Machine Contributor role at the RG-Dev scope grants the engineer the necessary permissions to restart and view properties of virtual machines within that resource group, while restricting access to other resource groups. This role includes actions like Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/read, which cover the required tasks without granting broader management rights.

Answer

Assign the Reader role at the subscription scope and the Virtual Machine Contributor role at RG-Dev scope.

Answer

Assign the Contributor role at the RG-Dev scope.

Answer

Create a custom role at the subscription scope and assign it to the engineer.