AZ-104 Practice Test 31 — 15 Questions

Question 1

A Windows VM fails to start after a configuration change. You need to capture screenshots and serial console output to troubleshoot the boot problem. Which feature should you use?

Accepted Answer

Boot diagnostics. Boot diagnostics captures serial console output and screenshots of a VM during boot, which is essential for troubleshooting boot failures after a configuration change. This feature provides logs and visual data from the VM's boot process, accessible via the Azure portal or CLI, without requiring guest OS access.

Answer

Azure Backup

Answer

Just-in-Time VM access

Answer

Autoscale

Question 2

A Windows VM protected by Azure Backup is missing one application file, but the VM must stay online during recovery. Which restore approach should the administrator use?

Accepted Answer

Use the file recovery option from the Recovery Services vault for the relevant recovery point. Azure Backup's file recovery option allows you to mount a recovery point as a drive on the running VM without restoring the entire VM or taking it offline. This enables you to copy the missing application file directly from the backup while the VM remains operational, meeting the requirement to stay online.

Answer

Restore the entire VM to a new deployment and then copy the file back

Answer

Trigger an Azure Site Recovery failover to a recovery region

Answer

Create a new backup policy with a shorter retention period and run the next scheduled backup

Question 3

You need to allow SSH access to only one Linux VM in a subnet that contains several application servers. The other VMs in the subnet must remain inaccessible from the internet. What is the best configuration?

Accepted Answer

Associate an NSG with the target VM's NIC and add an inbound allow rule for TCP 22 from your admin IP.. Network Security Groups (NSGs) can be associated at the subnet or NIC level. By associating an NSG directly with the target VM's NIC and adding an inbound allow rule for TCP port 22 from your admin IP address, you restrict SSH access exclusively to that VM while leaving the other VMs in the subnet unaffected by the rule. This provides granular, host-level security without impacting the broader subnet traffic.

Answer

Add an inbound allow rule on the subnet NSG for TCP 22 from your admin IP address.

Answer

Create a public load balancer in front of the subnet and forward port 22 to the VM.

Answer

Enable a service endpoint on the subnet so SSH traffic is limited to that VM.

Question 4

An operations team wants device-generated log messages collected centrally so engineers can review interface changes, warnings, and errors from one place. Which technology is most directly associated with that goal?

Accepted Answer

Syslog. Syslog (A) is the standard protocol for collecting and centralizing log messages from network devices, servers, and other infrastructure. It allows engineers to forward interface changes, warnings, and errors to a central syslog server, enabling unified review and alerting. This directly matches the goal of centralized device-generated log collection.

Answer

NetFlow

Answer

DHCP relay

Answer

Port security

Question 5

You want to preview what a Bicep deployment will change before you apply it to a resource group. Which command should you use?

Accepted Answer

az deployment group what-if. The `az deployment group what-if` command allows you to preview the changes a Bicep deployment will make to a resource group before actually applying them. It returns a list of resources that will be created, modified, or deleted, enabling you to validate the deployment's impact without committing any changes. This is the correct tool for a dry-run or validation scenario.

Answer

az vm create

Answer

az monitor metrics list

Answer

az deployment group create --mode Complete

Question 6

A release team needs to deploy the same hardened Windows image to VMs in three regions. They must keep approved versions, replicate images to each region, and be able to roll back to an earlier approved version without uploading a new VHD. What should they use as the image source?

Accepted Answer

An Azure Compute Gallery image definition with image versions. Azure Compute Gallery (formerly Shared Image Gallery) allows you to store multiple versions of a custom image definition, replicate them across regions, and manage rollbacks by simply changing which image version is referenced during deployment. This meets all requirements: hardened Windows image, multi-region replication, version control, and rollback without uploading a new VHD.

Answer

A managed disk snapshot captured from one reference VM

Answer

A single unmanaged VHD stored in a storage account

Answer

A custom script extension that installs the operating system settings after deployment

Question 7

A partner needs temporary read-only access to a single blob in a storage account for the next 24 hours. The partner must not be able to list other blobs or write data. What should you provide?

Accepted Answer

A service SAS scoped to the blob with read permission and an expiry time.. A service SAS scoped to a specific blob with read permission and an expiry time provides the exact temporary, read-only access required. It restricts access to only that blob, prevents listing other blobs, and automatically expires after 24 hours, meeting all security and functional requirements.

Answer

The storage account access key.

Answer

A private endpoint to the storage account.

Answer

Contributor access to the storage account.

Question 8

A VM in Azure cannot accept RDP connections from your office public IP. The subnet NSG already has an inbound deny-all rule at priority 200, and you added an allow rule for TCP 3389 from 198.51.100.25/32 at priority 300. What should you do to allow the connection?

Accepted Answer

Create or move the allow rule to priority 100 so it is evaluated before the deny rule.. Network Security Group (NSG) rules are evaluated in priority order, with lower numbers having higher precedence. Since the deny-all rule at priority 200 is evaluated before the allow rule at priority 300, the deny rule blocks the RDP traffic. To allow the connection, the allow rule must be created or moved to a priority lower than 200 (e.g., 100) so it is evaluated first, permitting traffic from 198.51.100.25/32 on TCP 3389 before the deny rule is reached.

Answer

Change the source to Internet so the allow rule matches more traffic.

Answer

Change the protocol from TCP to Any to bypass the deny rule.

Answer

Assign a public IP directly to the VM to override the subnet NSG behavior.

Question 9

A policy assignment denies storage accounts unless public network access is disabled. One legacy storage account in a pilot resource group must remain publicly reachable for 60 days while the application team remediates dependencies. Compliance reporting must continue to show the policy as enforced everywhere else. What should the administrator do?

Accepted Answer

Use an Azure Policy exemption for that storage account. An Azure Policy exemption allows the administrator to exclude a specific scope (the legacy storage account) from the policy's effect while still reporting the policy as enforced on all other resources. The exemption can be set with an expiration date (60 days) to automatically remove the exception after the remediation period. This ensures compliance reporting continues to show the policy as active and enforced everywhere except the exempted resource.

Answer

Delete the policy assignment and re-create it later

Answer

Apply a read-only lock to the storage account

Answer

Assign a custom RBAC role to the application team

Question 10

Based on the exhibit, where should the administrator go to see which resources are non-compliant with the assigned policy?

Accepted Answer

Azure Policy compliance view.. The Azure Policy compliance view is the correct place to see which resources are non-compliant with assigned policies. This view aggregates compliance states across all policies and initiatives, showing a per-resource breakdown of compliant, non-compliant, and exempt statuses. It directly reflects the evaluation results from the Azure Policy engine, which runs periodic scans and on-demand evaluations.

Answer

Entra ID users and groups.

Answer

Azure Activity log only.

Answer

Resource locks blade.

Question 11

You need to collect Windows event logs and performance counters from multiple Azure virtual machines and query the data by using Kusto Query Language. Which Azure resource should you use?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the correct Azure resource for collecting Windows event logs and performance counters from Azure VMs and querying them using Kusto Query Language (KQL). It serves as the central repository where diagnostic data is ingested via the Azure Diagnostics extension or the Log Analytics agent, enabling rich log analytics and custom KQL queries.

Answer

A Recovery Services vault

Answer

Azure Network Watcher

Answer

A load balancer

Question 12

An Azure CLI script runs on a utility VM every night to create and tag resources in another subscription. The script cannot store a password or client secret, and the VM is regularly redeployed from a standard image. What is the best identity design?

Accepted Answer

Create a user-assigned managed identity and attach it to the utility VM. A user-assigned managed identity can be created once, assigned to the utility VM, and used across redeployments without storing any credentials. The script can authenticate via Azure CLI using the managed identity's client ID, and the identity persists independently of the VM's lifecycle, satisfying the requirement of no password or client secret storage.

Answer

Assign a system-assigned managed identity to the utility VM

Answer

Create a service principal and store its secret in the VM configuration

Answer

Use a shared access signature to sign the Azure CLI session

Question 13

A company has 18 Azure subscriptions. Production subscriptions must inherit stricter governance than sandbox subscriptions, and central IT wants one place to target future policy assignments to each group. What should the administrator do?

Accepted Answer

Create management groups for Prod and Sandbox, then move subscriptions into them. Management groups allow you to organize Azure subscriptions hierarchically and apply Azure Policy and role-based access control (RBAC) at the management group level, which is inherited by all subscriptions within that group. By creating separate management groups for Prod and Sandbox and moving the respective subscriptions into them, central IT can assign policy assignments once to each management group, ensuring stricter governance for production subscriptions and a lighter touch for sandbox subscriptions.

Answer

Create resource groups named Prod and Sandbox in each subscription

Answer

Use tags on subscriptions to separate production from sandbox

Answer

Apply a CanNotDelete lock to each subscription

Question 14

A storage account should use a private IP address inside a virtual network, and workloads in that VNet must resolve the storage name to the private address. Which two items are required? Select two.

Accepted Answer

Create a private endpoint for the storage account in the virtual network so the service gets a private IP.. A private endpoint assigns a private IP address from the virtual network to the storage account, enabling secure, direct connectivity over the Microsoft backbone without traversing the public internet. This is achieved by creating a network interface in the VNet that receives a private IP from the subnet range, which then routes traffic to the storage service via a private link.

Answer

Enable a service endpoint on the subnet, because service endpoints create a private IP for the storage service.

Answer

Assign a Reader role on the storage account, because RBAC determines the private address used by clients.

Answer

Disable the storage account firewall, because private endpoints only work when the public endpoint is open.

Question 15

Based on the exhibit, which action should the administrator take so Contractor01 can manage the team membership without receiving Azure resource permissions?

Accepted Answer

Add Contractor01 as an owner of the AppOps-Admins group.. Adding Contractor01 as an owner of the AppOps-Admins group grants them the ability to manage group membership (add/remove members) without inheriting any Azure resource permissions. Group ownership is an Azure AD role that controls group administration only, not access to Azure resources like VMs or storage. This meets the requirement of managing team membership without resource permissions.

Answer

Add Contractor01 as a member of the AppOps-Admins group.

Answer

Assign Contractor01 the User Administrator role at the tenant scope.

Answer

Assign Contractor01 Contributor on the subscription.