AZ-104 Practice Test 32 — 15 Questions

Question 1

Traffic from VM-App01 is unexpectedly reaching the internet through a network virtual appliance. You need to determine which route is currently applied to the virtual machine network interface. Which Azure tool should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Effective routes for the network interface. Effective routes for the network interface show the actual routes applied to a VM's NIC, including system routes, BGP routes, and user-defined routes (UDRs). Since traffic is unexpectedly reaching the internet through an NVA, you need to verify which route (e.g., a UDR with next hop type VirtualAppliance) is currently active. This tool directly displays the effective route table for the specific NIC, allowing you to identify the misconfigured route.

Answer

NSG flow logs

Answer

Azure Advisor recommendations

Answer

Diagnostic settings for the activity log

Question 2

You create a private endpoint for an Azure Storage account and disable public network access on the account. A VM in a peered VNet cannot reach the storage account by name. The private endpoint resides in VNet-App. What is the most likely missing configuration?

Accepted Answer

A private DNS zone linked so the relevant VNet can resolve the storage account to the private endpoint IP. When you create a private endpoint for an Azure Storage account and disable public network access, the storage account's public DNS name must resolve to the private endpoint's private IP address within the VNet. This requires a private DNS zone (privatelink.blob.core.windows.net) linked to the VNet where the VM resides. Without that DNS zone link, the VM in the peered VNet will resolve the storage account name to the public IP, which is unreachable because public access is disabled, causing the connection failure.

Answer

An NSG rule allowing outbound DNS to 8.8.8.8

Answer

A Recovery Services vault in the peered VNet

Answer

A public IP address on the private endpoint NIC

Question 3

A team is choosing the right Azure Monitor alert type for different operational signals. Match each alert type to the situation it is best suited for.

Accepted Answer

Metric alerts: Monitor numeric values. Metric alerts monitor numeric values; Activity log alerts on resource changes; Log alerts query log data; Smart detection finds anomalies; Resource health alerts on resource status; Service health alerts on Azure service issues.

Answer

Metric alerts: Track resource changes

Answer

Activity log alerts: Monitor numeric values

Question 4

An archive team stores legal exhibits in Azure Blob Storage. The files are downloaded only during quarterly audits, but when an auditor needs one, it must be readable immediately without waiting for a rehydration job. The team wants the lowest practical cost after the first 30 days and does not want to move blobs manually each quarter. What should the administrator configure?

Accepted Answer

Use a lifecycle management rule to move the blobs to Cool tier after 30 days.. Azure Blob Storage lifecycle management rules can automatically move blobs from Hot to Cool tier after 30 days, reducing storage costs while keeping data immediately accessible. Cool tier offers lower storage costs than Hot tier with the same low-latency read access, satisfying the requirement for instant auditor access without manual intervention.

Answer

Keep the blobs in Hot tier permanently and delete them manually after each audit cycle.

Answer

Move the blobs to Archive tier after 30 days and rehydrate them when audits begin.

Answer

Store the files in Premium block blob storage and use snapshots for audit recovery.

Question 5

You create a private endpoint for an Azure Storage account. Virtual machines in VNet-Prod must resolve the storage account name to the private IP address of that endpoint. Which Azure feature should you configure?

Accepted Answer

A private DNS zone linked to VNet-Prod. A private endpoint uses a private IP address from the VNet, but DNS resolution must be explicitly configured to map the storage account's FQDN to that private IP. By creating a private DNS zone (privatelink.blob.core.windows.net) linked to VNet-Prod, Azure automatically creates an A record for the private endpoint IP, enabling VMs to resolve the storage account name to the private IP instead of the public IP.

Answer

A user-defined route

Answer

An Azure Firewall policy

Answer

A Recovery Services vault

Question 6

A support engineer needs to search a Log Analytics workspace for only failed sign-in records. Which KQL query should they use?

Accepted Answer

SigninLogs | where ResultType != 0. In Microsoft Entra ID sign-in logs, a `ResultType` of 0 indicates a successful sign-in, while any non-zero value (e.g., 50125, 53003) indicates a failure. The KQL query `SigninLogs | where ResultType != 0` filters for all records where the result type is not zero, thus returning only failed sign-in records.

Answer

SigninLogs | where ResultType == 0

Answer

SigninLogs | summarize count()

Answer

SigninLogs | project UserPrincipalName

Question 7

You need to move infrequently accessed blob data automatically from the Hot tier to the Cool tier after 30 days to reduce cost. What should you configure?

Accepted Answer

Lifecycle management rules. Azure Blob Storage lifecycle management rules allow you to automatically transition blobs from the Hot tier to the Cool tier based on age or other conditions. By configuring a rule that moves blobs to the Cool tier after 30 days from creation or last modification, you reduce storage costs for infrequently accessed data without manual intervention.

Answer

Blob soft delete

Answer

A private endpoint

Answer

A CanNotDelete lock

Question 8

An organization wants to enforce two governance controls on all subscriptions under a management group: only approved Azure regions can be used, and every resource must have a costCenter tag. Central IT wants one assignment that can grow as more controls are added later. What should they use?

Accepted Answer

An initiative assigned at the management group scope.. An initiative (policy set) allows grouping multiple policy definitions into a single assignment, which can be assigned at the management group scope to enforce both the allowed regions and costCenter tag requirements. This approach supports future growth by simply adding new policy definitions to the initiative without creating separate assignments. Assigning at the management group scope ensures the controls cascade to all child subscriptions.

Answer

A single Azure Policy assignment that contains both requirements as separate policy rules.

Answer

A role assignment at the management group scope.

Answer

A resource lock applied to each subscription.

Question 9

Based on the exhibit, the security team wants an alert whenever someone changes the configuration of a storage account, such as disabling public network access. The current rule is a metric alert on transaction count. What should you use instead?

Accepted Answer

Create an activity log alert for write operations on the storage account resource.. Activity log alerts are designed to monitor Azure resource-level operations, such as write actions that modify storage account configurations. Option D is correct because it creates an alert specifically for write operations on the storage account resource, which captures events like disabling public network access. This is the appropriate method for detecting configuration changes, unlike metric alerts which track performance data.

Answer

Keep the metric alert and lower the threshold to 10 transactions.

Answer

Create a service health alert because storage account settings affect platform status.

Answer

Use a Log Analytics query alert against VM guest logs to detect network-rule changes.

Question 10

You plan to deploy two virtual machines that run the same line-of-business application. The VMs must remain available during planned maintenance of the Azure platform, but autoscaling is not required. What should you use?

Accepted Answer

An availability set.. An availability set ensures that VMs are distributed across multiple fault domains and update domains within an Azure datacenter. This protects against both hardware failures (fault domains) and planned Azure platform maintenance (update domains), as only one update domain is rebooted at a time. Since autoscaling is not required, an availability set is the correct choice for high availability during planned maintenance.

Answer

A Virtual Machine Scale Set.

Answer

Azure Container Apps.

Answer

A private endpoint.

Question 11

A stateless application must keep serving traffic if one datacenter in the region fails, and it must also add or remove instances during daily load spikes. Which two deployment choices should the administrator make? Select two.

Accepted Answer

Deploy the application on a virtual machine scale set.. A virtual machine scale set (VMSS) allows automatic scaling of instances in response to load spikes, meeting the requirement to add or remove instances dynamically. Combined with availability zones, which distribute instances across physically separate datacenters within a region, the application remains available even if one entire datacenter fails. This pair ensures both high availability and elastic scaling for a stateless application.

Answer

Use a single availability set with one VM to reduce complexity.

Answer

Use a proximity placement group for the workload.

Answer

Deploy one larger VM with a premium SSD instead of multiple instances.

Question 12

A Linux VM restarts after a configuration change and now stops before the sign-in prompt. The administrator cannot use SSH. Which Azure feature should be checked first to inspect the startup process?

Accepted Answer

Boot diagnostics. Boot diagnostics captures serial console output and screenshots of the VM, allowing you to view kernel messages, boot logs, and the exact point where the startup process halts. Since SSH is unavailable and the VM stops before the sign-in prompt, this is the first Azure feature to check for troubleshooting the boot sequence.

Answer

Network Watcher packet capture

Answer

Azure Advisor

Answer

Managed identity

Question 13

An operations team maintains a hardened Windows base image that includes patch baseline settings and monitoring agents. They need to publish new versions, replicate the image to another region, and deploy future VMs from the same controlled image source. What should they use?

Accepted Answer

An Azure Compute Gallery image version.. An Azure Compute Gallery (formerly Shared Image Gallery) is the correct service for managing, versioning, replicating, and deploying custom Windows images across regions. It supports multiple image versions, regional replication, and allows you to deploy VMs from a controlled, hardened base image. Snapshots alone lack versioning and cross-region replication capabilities.

Answer

A snapshot of the generalized OS disk.

Answer

A VM extension on an existing VM.

Answer

An availability set for the image resources.

Question 14

A policy assigned at the management group denies creation of storage accounts with public network access enabled. One legacy storage account in RG-Pilot must stay publicly reachable for 45 days while an application is migrated. What should the administrator configure?

Accepted Answer

Create a policy exemption for the specific storage account with an expiration date.. Azure Policy exemptions are purpose-built for this scenario: they allow a specific resource or resource group to be excluded from a policy assignment, and they support an expiration date (expiresOn) so the exemption auto-expires after the migration window. The exemption is scoped to the storage account, so the rest of the management group remains protected by the deny policy.

Answer

Remove the policy assignment from the management group until the migration is finished.

Answer

Apply a CanNotDelete lock to the storage account.

Answer

Assign a Contributor role to the migration team on the storage account.

Question 15

A storage account's platform logs must be searchable later with KQL in a central workspace. Which two actions should the administrator take? Select two.

Accepted Answer

Create a diagnostic setting on the storage account. A diagnostic setting on the storage account is required to route platform logs (e.g., storage read/write/delete operations) to a destination. Option C is correct because a Log Analytics workspace is the destination that enables KQL-based searching and analysis of those logs. Without both, the logs cannot be stored in a central, queryable repository.

Answer

Configure a NAT gateway on the storage subnet

Answer

Assign the Reader role on the subscription

Answer

Enable a VM backup policy