AZ-104 Practice Test 31 — 15 Questions

Question 1

Based on the exhibit, a help desk engineer cannot RDP from an approved admin subnet to a VM in Azure. What change should the administrator make so the connection is allowed?

Accepted Answer

Move Allow-RDP-Admin to a priority lower than 100.. The exhibit shows a deny rule with priority 100 that blocks all inbound traffic from the approved admin subnet, and an allow rule for RDP with a priority lower than 100 (e.g., 200). Since Azure Network Security Group (NSG) rules are evaluated in priority order (lowest number first), the deny rule at priority 100 is evaluated before the allow rule at a lower priority, thus blocking the RDP connection. To allow the RDP traffic, the administrator must move the Allow-RDP-Admin rule to a priority lower than 100 (e.g., 90) so it is evaluated before the deny rule.

Answer

Change the deny rule to use UDP instead of TCP.

Answer

Add the VM NIC to an application security group and leave the rules unchanged.

Answer

Delete the default AllowVNetInBound rule.

Question 2

An organization has an Azure Storage account that must be reachable from Azure VMs and from an on-premises application. Internet access to the storage account must be disabled, and the service should be accessible only over private IP paths. Which solution best meets the requirement?

Accepted Answer

Use a private endpoint for the storage account and connect on-premises through a site-to-site VPN or ExpressRoute path.. Option B is correct because a private endpoint assigns the storage account a private IP address from the Azure VNet, making it accessible over a private IP path. On-premises connectivity is achieved via a site-to-site VPN or ExpressRoute, which extends the private network. This configuration disables internet access by blocking the public endpoint, meeting the requirement to disable internet access.

Answer

Enable a service endpoint on the Azure VNet and keep the storage account public endpoint enabled.

Answer

Use VNet peering only and leave the storage account firewall open to selected public IPs.

Answer

Assign a public IP address to the storage account and restrict access with an NSG.

Question 3

An on-premises application connected through a site-to-site VPN must read data from an Azure Storage account. Public network access is disabled on the storage account, and the storage service must be reachable only by a private IP address inside Azure. Which solution should the administrator implement?

Accepted Answer

Create a private endpoint for the storage account in an Azure VNet.. A private endpoint assigns the storage account a private IP address from an Azure VNet, allowing the on-premises application to connect over the site-to-site VPN using that private IP. This ensures the storage service is reachable only within Azure's private network, even with public network access disabled. The private endpoint uses Azure Private Link to securely expose the storage account into the VNet, making it accessible via the VPN without traversing the public internet.

Answer

Enable a service endpoint on the on-premises network.

Answer

Peer the on-premises network directly to the storage account.

Answer

Use a shared access signature and leave public network access enabled.

Question 4

An on-premises datacenter must reach private IP addresses in Azure over an encrypted site-to-site tunnel. The Azure VMs must not have public IP addresses, and the connection should use the company's existing edge device. Which Azure component should be deployed?

Accepted Answer

Azure VPN Gateway. Azure VPN Gateway is the correct component because it provides an encrypted site-to-site IPsec/IKE tunnel between an on-premises network and Azure virtual networks. It supports policy-based or route-based VPNs, works with existing edge devices, and allows Azure VMs to remain without public IP addresses by routing traffic through the gateway's private IP space.

Answer

Azure Bastion

Answer

Azure Route Server

Answer

A network security group with inbound allow rules

Question 5

Based on the exhibit, three Azure virtual machines run the same automation script. The VMs are rebuilt often, and the team wants one identity that can be reused across all three VMs and retained even if a VM is replaced. Which identity type should the administrator use?

Accepted Answer

A user-assigned managed identity attached to all three VMs.. A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource and can be assigned to multiple VMs. Unlike system-assigned identities, which are tied to the lifecycle of a single VM, a user-assigned identity persists independently and remains available even when VMs are rebuilt or replaced. This allows the automation script to use the same identity across all three VMs without needing to reconfigure permissions after each rebuild.

Answer

System-assigned managed identity on each VM, because each VM gets the same identity automatically.

Answer

An Azure AD guest user account, because the same account can sign in from every VM.

Answer

A shared storage account key, because it can be used by multiple VMs without extra configuration.

Question 6

Two legacy application VMs must survive planned maintenance and a single host failure. The vendor requires both VMs to stay in the same region, and a datacenter outage is not part of the requirement. What should the administrator use?

Accepted Answer

An availability set that places the VMs in separate fault and update domains.. An availability set protects against planned maintenance and single host failures by placing VMs in separate fault domains (different physical hardware) and update domains (different maintenance windows). This ensures that during planned Azure maintenance, only one VM is rebooted at a time, and if a host fails, only VMs in that fault domain are affected. Since the requirement specifies a single host failure (not a datacenter outage) and both VMs must stay in the same region, an availability set is the correct choice.

Answer

Availability zones with one VM in each zone.

Answer

A virtual machine scale set in a single zone.

Answer

A proximity placement group for both VMs.

Question 7

You have a storage account named stlogs01. An application running on VM-App01 in Azure must access blobs in the account without storing account keys in code or configuration files. What should you use?

Accepted Answer

A managed identity for VM-App01 and Azure RBAC on the storage account.. Option C is correct because using a managed identity for VM-App01 allows the application to authenticate to Azure Storage without storing any credentials in code or configuration files. The managed identity is automatically managed by Azure AD, and you grant it access to the blob container using Azure RBAC (e.g., the Storage Blob Data Contributor role). This eliminates the need for account keys or shared access signatures.

Answer

A shared access signature stored in a text file on VM-App01.

Answer

The storage account access key hard-coded in the application.

Answer

Anonymous public access for the blob container.

Question 8

Based on the exhibit, a production VM must send an email and SMS notification if average CPU stays above 85% for 10 minutes. The team created the alert rule, but no one receives notifications when the condition is met. What should the administrator add to the alert rule?

Accepted Answer

Attach an action group that includes email and SMS receivers.. The alert rule is correctly configured to trigger when the average CPU exceeds 85% for 10 minutes, but notifications are not being sent because no action group is attached. An action group defines the notification channels (e.g., email, SMS, webhook) that fire when the alert is activated. Without an action group, the alert can fire silently, so the administrator must attach an action group containing the desired email and SMS receivers.

Answer

Add a diagnostic setting that sends VM metrics to a Log Analytics workspace.

Answer

Change the alert to use a log query instead of a metric condition.

Answer

Create a resource lock to prevent changes to the virtual machine.

Question 9

An operations team manages an Azure virtual machine scale set that hosts a stateless API. They already collect guest logs in Log Analytics, but they do not want to ingest extra performance data just to watch CPU. They need an alert when average CPU across the scale set stays above 80% for 10 minutes, and the notification must support email and a webhook. What should they configure?

Accepted Answer

Create an Azure Monitor metric alert on the scale set CPU metric and attach an action group.. Option B is correct because Azure Monitor metric alerts can directly evaluate the 'Percentage CPU' metric from a virtual machine scale set without ingesting additional performance data into Log Analytics. By setting the aggregation to 'Average' and the threshold to 80% for a duration of 10 minutes, the alert triggers when the condition is met. An action group attached to the alert can send notifications via email and webhook simultaneously, meeting all requirements without extra data ingestion.

Answer

Create a diagnostic setting on the scale set and build a log query alert for CPU samples.

Answer

Configure an autoscale rule and rely on its notification settings for alerting.

Answer

Install a monitoring extension that writes CPU readings to storage for later review.

Question 10

Based on the exhibit, a VM is protected by Azure Backup. The business wants daily backups at 11:00 PM, retention of daily recovery points for 30 days, and no changes to the existing vault or VM. The current policy already backs up every day but keeps recovery points for only 7 days. What should the administrator modify?

Accepted Answer

Edit the backup policy and change daily retention to 30 days.. Option B is correct because the existing backup policy already performs daily backups at 11:00 PM, but its retention setting for daily recovery points is only 7 days. By editing the policy and changing the daily retention to 30 days, the administrator meets the business requirement without creating a new VM, altering the vault, or modifying the VM itself. Azure Backup policies allow modification of retention durations independently of backup frequency, so this is a straightforward configuration change.

Answer

Create a new VM and attach the existing backup vault to it.

Answer

Enable soft delete on the vault.

Answer

Move the VM to another availability zone.

Question 11

Based on the exhibit, a security team wants to search Key Vault audit events in Log Analytics for 30 days and create alerts when secrets are accessed unexpectedly. The current diagnostic configuration is not sending the right data. What should the administrator enable?

Accepted Answer

Enable AuditEvent and send the logs to a Log Analytics workspace.. Option A is correct because the Key Vault diagnostic setting must include the AuditEvent category to capture all audit logs, including secret operations. Sending these logs to a Log Analytics workspace enables the security team to query them for 30 days and create alerts on unexpected secret access. Without AuditEvent enabled, no audit data is available for analysis.

Answer

Enable only AllMetrics and keep sending data to the storage account.

Answer

Create a private endpoint for the Key Vault.

Answer

Turn on a resource lock with the ReadOnly effect.

Question 12

A VM subnet has an NSG with these custom rules:
- Inbound priority 100: Allow TCP 443 from Internet
- Outbound priority 100: Deny Any to Internet
The VM hosts an app that must download updates from an HTTPS repository on the Internet. The downloads fail. What change should be made?

Accepted Answer

Add an outbound allow rule for TCP 443 to Internet or the repository service tag.. The VM's outbound traffic is blocked by the default outbound deny rule (priority 100). Since the app needs to download updates from an HTTPS repository (TCP 443), an outbound allow rule for TCP 443 to the Internet or the repository service tag is required. Inbound rules do not affect outbound traffic, so the existing inbound allow rule is irrelevant to the download failure.

Answer

Add another inbound allow rule for TCP 443 from the repository address.

Answer

Change the inbound allow rule to priority 50.

Answer

Remove the VM's public IP address.

Question 13

An organization wants to enforce two governance controls on all subscriptions under a management group: only approved Azure regions can be used, and every resource must have a costCenter tag. Central IT wants one assignment that can grow as more controls are added later. What should they use?

Accepted Answer

An initiative assigned at the management group scope.. An initiative (policy set) allows grouping multiple policy definitions into a single assignment, which can be assigned at the management group scope to enforce both the allowed regions and costCenter tag requirements. This approach supports future growth by simply adding new policy definitions to the initiative without creating separate assignments. Assigning at the management group scope ensures the controls cascade to all child subscriptions.

Answer

A single Azure Policy assignment that contains both requirements as separate policy rules.

Answer

A role assignment at the management group scope.

Answer

A resource lock applied to each subscription.

Question 14

An operations team needs to let helpdesk staff restart virtual machines and view their properties only in RG-Dev. The staff must not be able to manage virtual networks, disks, or delete any resources. What is the best built-in role assignment?

Accepted Answer

Assign Virtual Machine Contributor at the RG-Dev scope.. The Virtual Machine Contributor role at the RG-Dev scope grants the exact permissions needed: it allows restarting VMs and viewing their properties while explicitly preventing management of virtual networks, disks, or deletion of resources. This built-in role includes the 'Microsoft.Compute/virtualMachines/restart/action' and read permissions, but excludes write/delete on networking and storage resources, meeting all requirements.

Answer

Assign Reader at the subscription scope so the staff can view the VMs.

Answer

Assign Contributor at the RG-Dev scope.

Answer

Assign Virtual Machine Administrator Login at the RG-Dev scope.

Question 15

Based on the exhibit, the production resource group must not be deleted during a change freeze, but administrators still need to update VM sizes and tag values. Which lock should you apply?

Accepted Answer

Apply a CanNotDelete lock to RG-Prod.. A CanNotDelete lock (B) prevents deletion of the resource group while allowing all other operations, including updating VM sizes and modifying tag values. This meets the requirement of blocking deletion during a change freeze without restricting administrative updates.

Answer

Apply a ReadOnly lock to RG-Prod.

Answer

Apply a lock to the subscription instead of the resource group.

Answer

Use Azure Policy with a deny effect to block deletes.

AZ-104 Practice Test 31 — 15 Questions

Exhibit

AZ-104 Practice Test 31 — 15 Questions

Exhibit