AZ-104 Practice Test 32 — 15 Questions

Question 1

A support engineer is narrowing a Log Analytics query to only failed backup jobs and wants to show only the needed columns. Which two KQL operators should they use? Select two.

Accepted Answer

project. The `where` operator filters rows based on a condition, so it is used to narrow results to only failed backup jobs (e.g., `where Status == "Failed"`). The `project` operator selects a subset of columns, allowing the engineer to display only the needed columns (e.g., `project JobName, Status, StartTime`). Together, they achieve both row filtering and column selection in a Kusto Query Language (KQL) query.

Answer

extend

Answer

join

Answer

summarize

Question 2

A Windows VM in Azure has a public IP address, but administrators on the internet cannot connect by using Remote Desktop. You confirm that the VM is running and the guest firewall allows RDP. What is the most likely Azure-side cause?

Accepted Answer

The NSG does not allow inbound TCP 3389. The most likely Azure-side cause is that a Network Security Group (NSG) associated with the VM's subnet or network interface is blocking inbound traffic on TCP port 3389 (RDP). Even if the VM is running and the guest OS firewall allows RDP, an NSG rule must explicitly permit inbound TCP 3389 from the internet (or a specific source) for Remote Desktop connections to succeed. Without such a rule, the NSG silently drops the packets before they reach the VM.

Answer

The storage account uses LRS

Answer

Azure Advisor is not enabled

Answer

The VM is in an availability set

Question 3

A storage account hosts blobs used by a public website. You need to reduce the risk of accidental deletion by developers while allowing updates to existing blobs. What should you configure?

Accepted Answer

Enable blob soft delete.. Blob soft delete protects against accidental deletion by retaining deleted blobs for a specified retention period, allowing recovery. This meets the requirement to reduce risk from developers while still permitting updates to existing blobs, as soft delete only applies to delete operations, not overwrites.

Answer

Enable immutable storage for the container.

Answer

Move the account to premium performance.

Answer

Enable static website hosting only.

Question 4

Your company has separate subscriptions for development, test, and production. Security wants one baseline policy and one RBAC assignment to apply automatically to every production subscription now and in the future. What should you use?

Accepted Answer

A management group above the production subscriptions.. B is correct because management groups allow you to apply Azure Policy and RBAC assignments hierarchically. By placing all production subscriptions under a single management group, any policy or role assignment at that level will be inherited by every current and future production subscription, meeting the requirement for automatic application without manual intervention.

Answer

A resource group that contains all production resources.

Answer

A tag applied to each production resource.

Answer

A single production subscription with multiple resource groups.

Question 5

A route table contains these entries: 10.0.0.0/8 with next hop Virtual appliance, and 10.1.1.0/24 with next hop Virtual network gateway. Which next hop will Azure use for traffic to 10.1.1.5?

Accepted Answer

Virtual network gateway, because the /24 route is more specific than the /8 route.. Azure uses the most specific route prefix (longest prefix match) to determine the next hop for traffic. For destination 10.1.1.5, the route 10.1.1.0/24 (prefix length 24) is more specific than 10.0.0.0/8 (prefix length 8), so the next hop Virtual network gateway is selected, regardless of the order in which routes were created.

Answer

Virtual appliance, because the broader 10.0.0.0/8 route was created first.

Answer

Internet, because Azure always prefers the default system route for public addresses.

Answer

None, because Azure ignores overlapping route entries in the same table.

Question 6

Order the steps to configure Azure DNS for a custom domain.

Accepted Answer

Step 1: Create DNS zone. Step 2: Retrieve name servers. Step 3: Update registrar. Step 4: Add DNS records. Step 5: Verify.. The correct sequence for configuring Azure DNS for a custom domain is: create the DNS zone, retrieve the Azure-assigned name servers, update your domain registrar to use those name servers, add the required DNS records (e.g., A, CNAME) to the zone, and finally verify domain resolution. This order ensures that delegation is properly set before records are queried, and avoids common pitfalls such as updating the registrar without the correct name servers or trying to retrieve name servers before the zone exists.

Answer

Step 1: Create DNS zone. Step 2: Update registrar. Step 3: Retrieve name servers. Step 4: Add DNS records. Step 5: Verify.

Answer

Step 1: Create DNS zone. Step 2: Add DNS records. Step 3: Retrieve name servers. Step 4: Update registrar. Step 5: Verify.

Answer

Step 1: Retrieve name servers. Step 2: Create DNS zone. Step 3: Update registrar. Step 4: Add DNS records. Step 5: Verify.

Question 7

Traffic from VM-App01 is unexpectedly reaching the internet through a network virtual appliance. You need to determine which route is currently applied to the virtual machine network interface. Which Azure tool should you use?

Accepted Answer

Effective routes for the network interface. Effective routes for the network interface show the actual routes applied to a VM's NIC, including system routes, BGP routes, and user-defined routes (UDRs). Since traffic is unexpectedly reaching the internet through an NVA, you need to verify which route (e.g., a UDR with next hop type VirtualAppliance) is currently active. This tool directly displays the effective route table for the specific NIC, allowing you to identify the misconfigured route.

Answer

NSG flow logs

Answer

Azure Advisor recommendations

Answer

Diagnostic settings for the activity log

Question 8

You create a private endpoint for an Azure Storage account and disable public network access on the account. A VM in a peered VNet cannot reach the storage account by name. The private endpoint resides in VNet-App. What is the most likely missing configuration?

Accepted Answer

A private DNS zone linked so the relevant VNet can resolve the storage account to the private endpoint IP. When you create a private endpoint for an Azure Storage account and disable public network access, the storage account's public DNS name must resolve to the private endpoint's private IP address within the VNet. This requires a private DNS zone (privatelink.blob.core.windows.net) linked to the VNet where the VM resides. Without that DNS zone link, the VM in the peered VNet will resolve the storage account name to the public IP, which is unreachable because public access is disabled, causing the connection failure.

Answer

An NSG rule allowing outbound DNS to 8.8.8.8

Answer

A Recovery Services vault in the peered VNet

Answer

A public IP address on the private endpoint NIC

Question 9

A team is choosing the right Azure Monitor alert type for different operational signals. Match each alert type to the situation it is best suited for.

Accepted Answer

Metric alerts: Monitor numeric values. Metric alerts monitor numeric values; Activity log alerts on resource changes; Log alerts query log data; Smart detection finds anomalies; Resource health alerts on resource status; Service health alerts on Azure service issues.

Answer

Metric alerts: Track resource changes

Answer

Activity log alerts: Monitor numeric values

Question 10

An archive team stores legal exhibits in Azure Blob Storage. The files are downloaded only during quarterly audits, but when an auditor needs one, it must be readable immediately without waiting for a rehydration job. The team wants the lowest practical cost after the first 30 days and does not want to move blobs manually each quarter. What should the administrator configure?

Accepted Answer

Use a lifecycle management rule to move the blobs to Cool tier after 30 days.. Azure Blob Storage lifecycle management rules can automatically move blobs from Hot to Cool tier after 30 days, reducing storage costs while keeping data immediately accessible. Cool tier offers lower storage costs than Hot tier with the same low-latency read access, satisfying the requirement for instant auditor access without manual intervention.

Answer

Keep the blobs in Hot tier permanently and delete them manually after each audit cycle.

Answer

Move the blobs to Archive tier after 30 days and rehydrate them when audits begin.

Answer

Store the files in Premium block blob storage and use snapshots for audit recovery.

Question 11

You create a private endpoint for an Azure Storage account. Virtual machines in VNet-Prod must resolve the storage account name to the private IP address of that endpoint. Which Azure feature should you configure?

Accepted Answer

A private DNS zone linked to VNet-Prod. A private endpoint uses a private IP address from the VNet, but DNS resolution must be explicitly configured to map the storage account's FQDN to that private IP. By creating a private DNS zone (privatelink.blob.core.windows.net) linked to VNet-Prod, Azure automatically creates an A record for the private endpoint IP, enabling VMs to resolve the storage account name to the private IP instead of the public IP.

Answer

A user-defined route

Answer

An Azure Firewall policy

Answer

A Recovery Services vault

Question 12

A support engineer needs to search a Log Analytics workspace for only failed sign-in records. Which KQL query should they use?

Accepted Answer

SigninLogs | where ResultType != 0. In Azure AD sign-in logs, a `ResultType` of 0 indicates a successful sign-in, while any non-zero value (e.g., 50125, 53003) indicates a failure. The KQL query `SigninLogs | where ResultType != 0` filters for all records where the result type is not zero, thus returning only failed sign-in records.

Answer

SigninLogs | where ResultType == 0

Answer

SigninLogs | summarize count()

Answer

SigninLogs | project UserPrincipalName

Question 13

You need to move infrequently accessed blob data automatically from the Hot tier to the Cool tier after 30 days to reduce cost. What should you configure?

Accepted Answer

Lifecycle management rules. Azure Blob Storage lifecycle management rules allow you to automatically transition blobs from the Hot tier to the Cool tier based on age or other conditions. By configuring a rule that moves blobs to the Cool tier after 30 days from creation or last modification, you reduce storage costs for infrequently accessed data without manual intervention.

Answer

Blob soft delete

Answer

A private endpoint

Answer

A CanNotDelete lock

Question 14

Based on the exhibit, which KQL clause should replace the blank to show only heartbeat records from the last 30 minutes?

Accepted Answer

where TimeGenerated >= ago(30m). The KQL clause `where TimeGenerated >= ago(30m)` filters the results to include only records where the `TimeGenerated` timestamp is within the last 30 minutes. The `ago()` function calculates a datetime value relative to the current time, and the `>=` operator ensures only records from that point forward are returned. This directly satisfies the requirement to show heartbeat records from the last 30 minutes.

Answer

project Computer, TimeGenerated

Answer

extend TimeWindow = 30m

Answer

sort by TimeGenerated desc

Question 15

An organization wants to enforce two governance controls on all subscriptions under a management group: only approved Azure regions can be used, and every resource must have a costCenter tag. Central IT wants one assignment that can grow as more controls are added later. What should they use?

Accepted Answer

An initiative assigned at the management group scope.. An initiative (policy set) allows grouping multiple policy definitions into a single assignment, which can be assigned at the management group scope to enforce both the allowed regions and costCenter tag requirements. This approach supports future growth by simply adding new policy definitions to the initiative without creating separate assignments. Assigning at the management group scope ensures the controls cascade to all child subscriptions.

Answer

A single Azure Policy assignment that contains both requirements as separate policy rules.

Answer

A role assignment at the management group scope.

Answer

A resource lock applied to each subscription.