AZ-104 Practice Test 30 — 15 Questions

Question 1

Based on the exhibit, which address space can you assign to the new spoke virtual network so it can be peered to the hub and later connected to on-premises without an IP overlap?

Accepted Answer

10.52.0.0/16. (10.52.0.0/16) is correct because it does not overlap with the hub virtual network's address space (10.50.0.0/16) or the on-premises network (10.51.0.0/16). This allows the spoke VNet to be peered to the hub and later connected to on-premises via a gateway in the hub without IP address conflicts, which is a requirement for successful VNet peering and VPN/ExpressRoute connectivity.

Answer

10.50.128.0/17

Answer

10.51.0.0/16

Answer

10.50.0.0/24

Question 2

A company has three business units. Each business unit needs its own subscription for billing and admin delegation. Corporate security wants one policy assignment to cover all current and future subscriptions in each business unit. What structure should you implement?

Accepted Answer

Create a management group for each business unit and place that unit's subscriptions underneath it. Management groups allow you to aggregate multiple subscriptions under a single hierarchy, enabling policy assignment at the management group level that applies to all current and future subscriptions within that group. This meets the requirement for per-business-unit billing isolation (via separate subscriptions) and centralized policy enforcement across all subscriptions in each unit.

Answer

Place all resources in one subscription and separate them only by resource group

Answer

Assign the policy at each resource group because policies cannot target subscriptions

Answer

Create one resource group per business unit inside a shared subscription

Question 3

A team wants an Azure Storage account to be reachable only from a single Azure virtual network and to use a private IP address inside that network. Which option should the administrator configure?

Accepted Answer

A private endpoint for the storage account.. A private endpoint assigns a private IP address from the virtual network to the storage account, making it reachable only from that VNet over the Microsoft backbone network. This meets the requirement of exclusive access and private IP usage, unlike a service endpoint which still exposes the storage account to the public internet via its public endpoint.

Answer

A service endpoint on the subnet.

Answer

A public IP address with an NSG inbound allow rule.

Answer

A VPN gateway connection to the storage account.

Question 4

A project team expects frequent joiners and leavers. The same Azure permissions are needed for all members of the team, and you want to avoid editing role assignments for each person. Which two actions best meet the requirement? Select two.

Accepted Answer

Create a security group for the project team.. Creating a security group allows you to manage permissions collectively rather than individually. By adding or removing users from the group as joiners and leavers occur, you avoid editing role assignments for each person. This aligns with Microsoft Entra ID group-based licensing and RBAC best practices for dynamic teams.

Answer

Assign the same roles directly to every user account.

Answer

Use guest accounts for all team members.

Answer

Assign the roles to a service principal shared by the team.

Question 5

Your application stores compliance records in Azure Blob Storage. The records must remain in a write-once-read-many state for three years and must not be altered or deleted during that period. What should you configure?

Accepted Answer

Immutable blob storage with a time-based retention policy. Immutable blob storage with a time-based retention policy enforces a WORM (Write-Once, Read-Many) state, preventing any modification or deletion of blobs for a specified retention period. This meets the requirement of keeping compliance records unaltered for three years, as the policy locks the data at the storage level, overriding any user permissions or delete operations.

Answer

Blob soft delete

Answer

Lifecycle management to move data to Archive

Answer

A shared access signature

Question 6

A blob was moved to the Archive tier last month. A user now needs to open the file within a few hours. What should the administrator do first?

Accepted Answer

Change the blob to Hot or Cool and wait for rehydration to complete. Blobs in the Archive tier are offline and cannot be read directly. To access the data, you must first change the blob's access tier to Hot or Cool, which initiates a rehydration process that makes the blob available for reading. Since the user needs the file within a few hours, rehydration typically completes within that timeframe (up to 15 hours for Archive to Cool/Hot).

Answer

Download the blob directly from the Archive tier

Answer

Create a snapshot of the blob and open the snapshot instead

Answer

Enable versioning on the storage account

Question 7

An administrator enabled diagnostic settings on a storage account and selected the resource-specific table format for Log Analytics. A coworker later queried AzureDiagnostics and received no rows. What should the administrator tell the coworker to do?

Accepted Answer

Query the dedicated storage resource tables created by the diagnostic setting instead of AzureDiagnostics. When diagnostic settings are configured to use the 'Resource specific' destination table format, logs are sent to dedicated tables named after the resource type (e.g., StorageBlobLogs, StorageQueueLogs) rather than the legacy AzureDiagnostics table. Querying AzureDiagnostics returns no rows because logs are not written there under this format. The coworker must query the appropriate resource-specific table instead.

Answer

Recreate the storage account because AzureDiagnostics is only populated by new resources

Answer

Change the storage account replication type to GRS so diagnostic logs are duplicated

Answer

Enable Azure Monitor metrics collection on the storage account before querying AzureDiagnostics

Question 8

A support engineer must restart and view the properties of virtual machines only in RG-Dev. The engineer must not gain access to other resource groups in the subscription. What should the administrator do?

Accepted Answer

Assign the Virtual Machine Contributor role at the RG-Dev scope.. The Virtual Machine Contributor role at the RG-Dev scope grants the engineer the necessary permissions to restart and view properties of virtual machines within that resource group, while restricting access to other resource groups. This role includes actions like Microsoft.Compute/virtualMachines/start/action and Microsoft.Compute/virtualMachines/read, which cover the required tasks without granting broader management rights.

Answer

Assign the Reader role at the subscription scope and the Virtual Machine Contributor role at RG-Dev scope.

Answer

Assign the Contributor role at the RG-Dev scope.

Answer

Create a custom role at the subscription scope and assign it to the engineer.

Question 9

A Windows VM fails to start after a configuration change. You need to capture screenshots and serial console output to troubleshoot the boot problem. Which feature should you use?

Accepted Answer

Boot diagnostics. Boot diagnostics captures serial console output and screenshots of a VM during boot, which is essential for troubleshooting boot failures after a configuration change. This feature provides logs and visual data from the VM's boot process, accessible via the Azure portal or CLI, without requiring guest OS access.

Answer

Azure Backup

Answer

Just-in-Time VM access

Answer

Autoscale

Question 10

A Windows VM protected by Azure Backup is missing one application file, but the VM must stay online during recovery. Which restore approach should the administrator use?

Accepted Answer

Use the file recovery option from the Recovery Services vault for the relevant recovery point. Azure Backup's file recovery option allows you to mount a recovery point as a drive on the running VM without restoring the entire VM or taking it offline. This enables you to copy the missing application file directly from the backup while the VM remains operational, meeting the requirement to stay online.

Answer

Restore the entire VM to a new deployment and then copy the file back

Answer

Trigger an Azure Site Recovery failover to a recovery region

Answer

Create a new backup policy with a shorter retention period and run the next scheduled backup

Question 11

You need to allow SSH access to only one Linux VM in a subnet that contains several application servers. The other VMs in the subnet must remain inaccessible from the internet. What is the best configuration?

Accepted Answer

Associate an NSG with the target VM's NIC and add an inbound allow rule for TCP 22 from your admin IP.. Network Security Groups (NSGs) can be associated at the subnet or NIC level. By associating an NSG directly with the target VM's NIC and adding an inbound allow rule for TCP port 22 from your admin IP address, you restrict SSH access exclusively to that VM while leaving the other VMs in the subnet unaffected by the rule. This provides granular, host-level security without impacting the broader subnet traffic.

Answer

Add an inbound allow rule on the subnet NSG for TCP 22 from your admin IP address.

Answer

Create a public load balancer in front of the subnet and forward port 22 to the VM.

Answer

Enable a service endpoint on the subnet so SSH traffic is limited to that VM.

Question 12

An operations team wants device-generated log messages collected centrally so engineers can review interface changes, warnings, and errors from one place. Which technology is most directly associated with that goal?

Accepted Answer

Syslog. Syslog (A) is the standard protocol for collecting and centralizing log messages from network devices, servers, and other infrastructure. It allows engineers to forward interface changes, warnings, and errors to a central syslog server, enabling unified review and alerting. This directly matches the goal of centralized device-generated log collection.

Answer

NetFlow

Answer

DHCP relay

Answer

Port security

Question 13

You want to preview what a Bicep deployment will change before you apply it to a resource group. Which command should you use?

Accepted Answer

az deployment group what-if. The `az deployment group what-if` command allows you to preview the changes a Bicep deployment will make to a resource group before actually applying them. It returns a list of resources that will be created, modified, or deleted, enabling you to validate the deployment's impact without committing any changes. This is the correct tool for a dry-run or validation scenario.

Answer

az vm create

Answer

az monitor metrics list

Answer

az deployment group create --mode Complete

Question 14

A release team needs to deploy the same hardened Windows image to VMs in three regions. They must keep approved versions, replicate images to each region, and be able to roll back to an earlier approved version without uploading a new VHD. What should they use as the image source?

Accepted Answer

An Azure Compute Gallery image definition with image versions. Azure Compute Gallery (formerly Shared Image Gallery) allows you to store multiple versions of a custom image definition, replicate them across regions, and manage rollbacks by simply changing which image version is referenced during deployment. This meets all requirements: hardened Windows image, multi-region replication, version control, and rollback without uploading a new VHD.

Answer

A managed disk snapshot captured from one reference VM

Answer

A single unmanaged VHD stored in a storage account

Answer

A custom script extension that installs the operating system settings after deployment

Question 15

A partner needs temporary read-only access to a single blob in a storage account for the next 24 hours. The partner must not be able to list other blobs or write data. What should you provide?

Accepted Answer

A service SAS scoped to the blob with read permission and an expiry time.. A service SAS scoped to a specific blob with read permission and an expiry time provides the exact temporary, read-only access required. It restricts access to only that blob, prevents listing other blobs, and automatically expires after 24 hours, meeting all security and functional requirements.

Answer

The storage account access key.

Answer

A private endpoint to the storage account.

Answer

Contributor access to the storage account.