AZ-104 Practice Test 32 — 15 Questions

Question 1

A backup job from an Azure service must write to a storage account that has the network firewall set to deny all public traffic. The team does not want to create a private endpoint for this workload. What should the administrator enable?

Accepted Answer

Allow trusted Microsoft services to access the storage account. Option A is correct because Azure Storage firewalls include a special exception for 'Allow trusted Microsoft services to access this storage account'. When enabled, this exception permits Azure platform services—such as Azure Backup—to bypass the public network deny rule and write to the storage account without requiring a private endpoint. This works because the backup service runs on Microsoft-owned infrastructure that is authenticated and authorized at the control plane level, not via a public IP.

Answer

Add the backup server's public IP address to the storage firewall

Answer

Create a service endpoint on the subnet that hosts the backup job

Answer

Disable the storage account firewall temporarily during each backup window

Question 2

Based on the exhibit, the operations team wants an alert that fires when any VM has not sent a heartbeat in the last 15 minutes. Which KQL query should they use as the condition for the log alert?

Accepted Answer

Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen < ago(15m). Option B is correct because the query uses `summarize max(TimeGenerated) by Computer` to get the latest heartbeat timestamp per VM, then filters with `where LastSeen < ago(15m)` to identify VMs whose last heartbeat is older than 15 minutes. This directly matches the alert condition: any VM that has not sent a heartbeat in the last 15 minutes.

Answer

Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen > ago(15m)

Answer

Heartbeat | where TimeGenerated > ago(15m) | summarize count() by Computer | where count() == 0

Answer

Heartbeat | distinct Computer | where Computer == "VM01"

Question 3

Based on the exhibit, the team wants a single notification setup that can be reused by several alert rules across different subscriptions. What should the administrator create?

Accepted Answer

An action group. An action group is the correct choice because it is a reusable Azure Monitor resource that defines notification preferences (e.g., email, SMS, webhook, ITSM) and can be associated with multiple alert rules across different subscriptions. This allows the team to create a single notification setup once and reference it from any alert rule, ensuring consistent notification behavior without duplicating configuration.

Answer

A Log Analytics workspace with custom tables

Answer

A management group

Answer

A resource lock

Question 4

Based on the exhibit, an administrator needs to recover one deleted configuration file from a running Azure VM without replacing the VM. Which restore option should be used?

Accepted Answer

Use File Recovery to mount the recovery point and copy back the missing file.. Azure VM File Recovery (part of Azure Backup) allows you to mount a recovery point as a drive on a running VM, browse the file system, and copy specific files back without restoring the entire VM or disks. This is the only option that recovers a single deleted configuration file without replacing or rebuilding the VM.

Answer

Create a new VM from the recovery point so the deleted file returns with a clean operating system.

Answer

Restore disks and manually rebuild the VM afterward.

Answer

Replace the existing VM immediately to recover only one file.

Question 5

Based on the exhibit, which KQL operator should replace the blank to return only those columns?

Accepted Answer

project, because it returns only the named columns in the result.. The `project` operator in Kusto Query Language (KQL) is specifically designed to select a subset of columns from the input table, returning only the named columns in the result set. This matches the requirement to 'return only those columns,' making option C correct.

Answer

where, because it filters rows and also selects the visible columns.

Answer

summarize, because it groups the failed records into a smaller result set.

Answer

extend, because it creates new output columns for the selected fields.

Question 6

You removed public IP addresses from a backend subnet containing 20 VMs. The VMs still need outbound internet access for updates, and the organization wants all outbound traffic to appear from one predictable public IP. No inbound publishing is required. Which Azure service should you use?

Accepted Answer

Azure NAT Gateway associated with the subnet.. Azure NAT Gateway is the correct choice because it provides outbound-only internet connectivity for a subnet, translating all VM traffic to a single public IP address without requiring inbound NAT rules or a load balancer. It supports SNAT (Source Network Address Translation) for up to 64,000 concurrent flows per IP, meeting the requirement for predictable outbound IP and no inbound publishing.

Answer

A public load balancer with inbound NAT rules for each VM.

Answer

A private load balancer with a backend pool of the VMs.

Answer

A VPN gateway connection to a remote network.

Question 7

Your hub virtual network uses 10.40.0.0/16 and the corporate on-premises network uses 10.41.0.0/16. A new spoke VNet must be peered to the hub now and connected to on-premises later. It needs a workload subnet for about 180 hosts and a management subnet for about 50 hosts. Which address space is the best choice for the new spoke?

Accepted Answer

10.42.0.0/23. Option C (10.42.0.0/23) is correct because it provides 512 total IP addresses (510 usable), which is sufficient for the 180-host workload subnet and 50-host management subnet, while avoiding overlap with both the hub VNet (10.40.0.0/16) and the on-premises network (10.41.0.0/16). The /23 prefix allows splitting into two /24 subnets (e.g., 10.42.0.0/24 for workload and 10.42.1.0/24 for management), meeting the host requirements without wasting address space.

Answer

10.40.128.0/17

Answer

10.41.64.0/18

Answer

10.42.0.0/24

Question 8

Based on the exhibit, web servers can reach a backend VM only after it is added to a specific group. What should the administrator change to allow the traffic to match the existing NSG rule?

Accepted Answer

Add api01's NIC to ASG-Api.. The exhibit shows that the NSG rule allows traffic from ASG-Web to ASG-Api. Since web01 is in ASG-Web, traffic from web01 to api01 is only permitted if api01 is a member of ASG-Api. Adding api01's NIC to ASG-Api ensures the destination matches the NSG rule, allowing the traffic.

Answer

Move the deny rule to priority 100.

Answer

Change the source of the allow rule from ASG-Web to VirtualNetwork.

Answer

Place api01 in the same subnet as web01.

Question 9

Based on the exhibit, which Azure connectivity option should the administrator use for the branch office?

Accepted Answer

A site-to-site VPN connection to an Azure VPN gateway.. A site-to-site VPN connection to an Azure VPN gateway (Option D) is the correct choice because it provides a persistent, encrypted tunnel between the branch office's on-premises network and Azure, enabling seamless connectivity for all users and devices at the branch without requiring per-user configuration. This aligns with the typical scenario where a branch office needs constant, secure access to Azure resources, and the VPN gateway supports IPsec/IKE protocols for site-to-site connections.

Answer

Point-to-site VPN for each user laptop.

Answer

VNet peering between the branch office and Azure.

Answer

A service endpoint on the Azure subnet.

Question 10

Based on the exhibit, which image source should the administrator use to deploy the same approved server build again?

Accepted Answer

A custom image stored in Azure Compute Gallery.. A custom image stored in Azure Compute Gallery (formerly Shared Image Gallery) is the correct choice because it allows the administrator to capture a generalized VM image that includes the exact OS configuration, applications, and settings of the approved server build. This image can then be used repeatedly to deploy identical VMs, ensuring consistency across deployments. Azure Compute Gallery supports versioning and replication across regions, making it the ideal solution for maintaining and distributing a standardized server build.

Answer

A public marketplace Windows Server image.

Answer

A snapshot of the VM operating system disk.

Answer

A temporary disk attached to the VM.

Question 11

Users in Branch01 access an Azure file share over SMB. Performance is poor because frequently used files are downloaded repeatedly across the WAN. You need to keep a local cache on a Windows Server in Branch01 while keeping Azure Files as the central file share. What should you deploy?

Accepted Answer

Azure File Sync. Azure File Sync is the correct solution because it enables caching of Azure file shares on a Windows Server at the branch location, providing local access to frequently used files while keeping Azure Files as the central authoritative store. It uses a sync engine to maintain a local cache and leverages the SMB protocol for access, reducing WAN latency by serving files from the local server.

Answer

Blob versioning

Answer

Share snapshots

Answer

A private endpoint

Question 12

Based on the exhibit, the security team wants an alert whenever someone changes the configuration of a storage account, such as disabling public network access. The current rule is a metric alert on transaction count. What should you use instead?

Accepted Answer

Create an activity log alert for write operations on the storage account resource.. Activity log alerts are designed to monitor Azure resource-level operations, such as write actions that modify storage account configurations. Option D is correct because it creates an alert specifically for write operations on the storage account resource, which captures events like disabling public network access. This is the appropriate method for detecting configuration changes, unlike metric alerts which track performance data.

Answer

Keep the metric alert and lower the threshold to 10 transactions.

Answer

Create a service health alert because storage account settings affect platform status.

Answer

Use a Log Analytics query alert against VM guest logs to detect network-rule changes.

Question 13

Based on the exhibit, the VM backup item was accidentally deleted from the vault yesterday, but the VM itself still exists. What should you do to resume protection with the existing backup item?

Accepted Answer

Recover or undelete the backup item from the vault before the soft-delete retention expires.. Azure Backup uses soft-delete for backup items, which retains deleted backup data for 14 days by default. Since the backup item was accidentally deleted yesterday, it is still in the soft-delete state and can be recovered or undeleted from the vault before the retention period expires. Once recovered, protection can be resumed on the existing VM without data loss or reconfiguration.

Answer

Delete the VM and recreate it so the backup can start again.

Answer

Create a new action group so the vault can re-enable protection.

Answer

Disable diagnostic settings on the vault and then re-enable them.

Question 14

Based on the exhibit, what should the administrator change if the business wants backups to be kept for 30 days instead of 7 days?

Accepted Answer

Increase the retain daily backup points setting to 30 days.. The backup retention policy in Azure Backup is configured via the 'Retain daily backup points' setting, which specifies how many days daily recovery points are kept. To change retention from 7 to 30 days, the administrator must increase this value to 30. This directly controls the lifespan of daily backups in the Recovery Services vault.

Answer

Change the backup schedule from daily to hourly.

Answer

Increase the instant recovery snapshot retention to 30 days.

Answer

Enable a CanNotDelete lock on the Recovery Services vault.

Question 15

Based on the exhibit, the spoke virtual network must use the hub's existing VPN gateway to reach on-premises networks. Which peering setting should be enabled on the spoke-to-hub peering?

Accepted Answer

Use remote gateways on the spoke peering.. Option B is correct because the 'Use remote gateways' setting on the spoke-to-hub peering allows the spoke virtual network to use the hub's existing VPN gateway for connectivity to on-premises networks. This setting forwards traffic from the spoke through the hub's gateway, enabling transitive routing without deploying a separate gateway in the spoke. It requires the hub-to-spoke peering to have 'Allow gateway transit' enabled.

Answer

Allow forwarded traffic on the spoke peering.

Answer

Delete the peering and create a virtual network gateway in the spoke.

Answer

Enable service endpoints on the spoke subnet.