AZ-104 Practice Test 33 — 15 Questions

Question 1

Based on the exhibit, which change should the administrator make so the application identity remains stable across VM redeployments without reapplying RBAC assignments?

Accepted Answer

Create a user-assigned managed identity and attach it to the VM template.. A user-assigned managed identity is decoupled from the VM lifecycle, so it persists independently of VM redeployments. By attaching the same user-assigned identity to the new VM instance, the application retains its Azure AD object ID and all existing RBAC role assignments remain valid without requiring reapplication.

Answer

Keep the system-assigned identity and reapply the same RBAC roles after each rebuild.

Answer

Store a local administrator password in Key Vault and use it for Azure resource access.

Answer

Replace the identity with a shared access signature so the VM can authenticate to Azure services.

Question 2

Security wants one assignment that enforces all of these controls across several subscriptions: allowed Azure regions, required tags, and disabling public network access on specific resources. Which Azure feature should you use?

Accepted Answer

An Azure Policy initiative that contains multiple related policy definitions. An Azure Policy initiative (also called a policy set) is the correct choice because it groups multiple independent policy definitions into a single assignable unit. This allows you to enforce all three distinct controls—allowed regions, required tags, and disabling public network access—across several subscriptions in one assignment, while keeping each rule as a separate policy definition for easier management and granular effect.

Answer

A single Azure Policy definition with one rule for all three controls

Answer

A management group lock applied to the subscriptions

Answer

A custom RBAC role assigned at the management group

Question 3

Based on the exhibit, where should you assign the Reader role so the Auditors group can read every current and future resource in the Sales subscription, including resource groups created later, while not granting access to the Research subscription?

Accepted Answer

Assign Reader to the Sales subscription, because subscription-level scope includes all current and future resource groups and resources in that subscription.. Assigning the Reader role at the Sales subscription scope grants the Auditors group read access to all current and future resource groups and resources within that subscription. This is because Azure RBAC roles assigned at a subscription level are inherited by all child resource groups and resources, including those created later. The requirement explicitly excludes the Research subscription, so a subscription-level assignment is the correct and most efficient approach.

Answer

Assign Reader to RG-Web, because the group can then inherit access to resources in that resource group only.

Answer

Assign Reader to the Corp management group, because that is the only scope that can cover multiple subscriptions.

Answer

Assign Reader to each resource individually, because that avoids inheritance and limits visibility to selected items.

Question 4

You have already deployed a Windows Server VM. After provisioning, you need to run a PowerShell script once to configure an application and create a registry setting without logging in interactively. Which Azure feature should you use?

Accepted Answer

Custom Script Extension. The Custom Script Extension (CSE) is the correct choice because it allows you to run a PowerShell script on a Windows VM after provisioning, without requiring interactive logon. It executes the script as the local system account, making it ideal for one-time configuration tasks like setting registry keys or installing applications. This aligns with the requirement to run a script once non-interactively.

Answer

cloud-init

Answer

Azure Policy

Answer

Recovery Services vault

Question 5

Two application VMs are in the same Azure region. They must stay available during planned host maintenance, but the business does not require protection from a full datacenter outage. Which placement option should you use?

Accepted Answer

Availability set. An availability set distributes VMs across multiple fault domains (up to 3) and update domains (up to 20) within a single Azure datacenter. This ensures that during planned host maintenance, only one update domain is taken offline at a time, keeping the application VMs available. Since the requirement does not include protection from a full datacenter outage, an availability set is the correct and cost-effective placement option.

Answer

Availability zone

Answer

Shared disk

Answer

Snapshot set

Question 6

You need one assignment that requires a cost-center tag and also allows only approved locations. What should you use?

Accepted Answer

A policy initiative. A policy initiative is the correct choice because it allows you to group multiple Azure Policy definitions (such as 'Require a cost-center tag' and 'Allowed locations') into a single, reusable assignment. This ensures both conditions are enforced simultaneously at a scope like a subscription or resource group, meeting the requirement for a cost-center tag and location restriction.

Answer

A role assignment

Answer

A resource lock

Answer

A management group

Question 7

During a compliance review, the team must distinguish what each Azure Monitor object can and cannot do. Match each object to its primary operational scope.

Question 8

Three Azure VMs run the same scheduled script and must access both Storage and Key Vault. The team wants one identity that can be reused if a VM is rebuilt, and they do not want the identity tied to a single machine. What should the administrator create?

Accepted Answer

A user-assigned managed identity attached to all three virtual machines.. A user-assigned managed identity is the correct choice because it is an independent Azure resource that can be assigned to multiple VMs, persists independently of any single VM's lifecycle, and can be reused when a VM is rebuilt. This identity provides seamless authentication to both Storage and Key Vault without managing credentials, meeting the requirement for a reusable, non-machine-tied identity.

Answer

A system-assigned managed identity on each virtual machine.

Answer

A service principal with a certificate file copied to each VM.

Answer

A shared access signature for each storage account and Key Vault access policy.

Question 9

Your application stores compliance documents in Azure Blob Storage. The documents must be kept in a write-once-read-many state for five years and must not be altered or removed during that time. What should you configure?

Accepted Answer

Immutable blob storage with a time-based retention policy. Immutable blob storage with a time-based retention policy enforces a write-once-read-many (WORM) state, ensuring that blobs cannot be modified or deleted for a specified retention period. This directly meets the requirement of keeping compliance documents unaltered for five years, as the policy locks the data at the storage level, overriding any user permissions or delete operations.

Answer

Blob soft delete

Answer

Blob lifecycle management to move data to Cool tier

Answer

A shared access signature

Question 10

A blob was moved to the Archive tier last month. A user now needs to open the file within a few hours. What should the administrator do first?

Accepted Answer

Change the blob to Hot or Cool and wait for rehydration to complete. Blobs in the Archive tier are offline and cannot be read directly. To access the data, you must first change the blob's access tier to Hot or Cool, which initiates a rehydration process that makes the blob available for reading. Since the user needs the file within a few hours, rehydration typically completes within that timeframe (up to 15 hours for Archive to Cool/Hot).

Answer

Download the blob directly from the Archive tier

Answer

Create a snapshot of the blob and open the snapshot instead

Answer

Enable versioning on the storage account

Question 11

A batch container in Azure Container Instances should stop after a successful run and may retry only when the process fails. Which two restart policies are correct for that style of workload? Select two.

Accepted Answer

Never. Option A (Never) is correct because it ensures the container does not restart after a successful run, which aligns with the requirement to stop after completion. Option B (OnFailure) is correct because it allows the container to retry only when the process fails, meeting the condition of restarting solely on failure. In Azure Container Instances, these two restart policies directly support batch workloads that should not restart on success but may retry on failure.

Answer

Always

Answer

Manual

Answer

Scheduled

Question 12

A business-critical application runs in a region that does not support availability zones. It uses two Azure VMs and must survive planned maintenance and a single host failure, but it does not need automatic scale-out. Which two actions should the administrator take? Select two.

Accepted Answer

Place both VMs in the same availability set. Option A is correct because an availability set provides redundancy within a single region that does not support availability zones, protecting against both planned maintenance (via update domains) and host failures (via fault domains). By placing both VMs in the same availability set, Azure ensures they are distributed across multiple fault domains (up to 3) and update domains (up to 20), so a single hardware failure or planned maintenance event does not affect both VMs simultaneously.

Answer

Deploy the VMs in separate availability zones

Answer

Convert the workload to a single larger VM

Answer

Put the VMs in a proximity placement group

Question 13

A build pipeline starts a containerized data-processing job every evening. Each run finishes in under 20 minutes, does not need persistent servers, and never receives inbound traffic. Which compute service best fits this workload?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the best fit because it allows you to run a containerized job directly in Azure without provisioning or managing any underlying infrastructure. The workload is short-lived (under 20 minutes), requires no persistent servers, and has no inbound traffic, which aligns perfectly with ACI's pay-per-second billing and ability to start containers on demand from a build pipeline.

Answer

Azure App Service

Answer

Azure Virtual Machines

Answer

Azure Kubernetes Service

Question 14

Your company has separate subscriptions for development, test, and production. Security wants one baseline policy and one RBAC assignment to apply automatically to every production subscription now and in the future. What should you use?

Accepted Answer

A management group above the production subscriptions.. B is correct because management groups allow you to apply Azure Policy and RBAC assignments hierarchically. By placing all production subscriptions under a single management group, any policy or role assignment at that level will be inherited by every current and future production subscription, meeting the requirement for automatic application without manual intervention.

Answer

A resource group that contains all production resources.

Answer

A tag applied to each production resource.

Answer

A single production subscription with multiple resource groups.

Question 15

A central audit group must have Reader access for every current and future subscription in the company hierarchy. You want one assignment that will apply broadly as new subscriptions are added. Where should the role be assigned?

Accepted Answer

At the management group that contains the subscriptions. Assigning the Reader role at the management group level ensures that the central audit group inherits the role to all current and future subscriptions within that management group hierarchy. This is the most efficient and scalable approach because Azure RBAC assignments on a management group are inherited by all child subscriptions and resource groups, eliminating the need to manually update permissions as new subscriptions are added.

Answer

At one resource group in each subscription

Answer

At a single resource

Answer

At the tenant root only for one application

AZ-104 Practice Test 33 — 15 Questions

Exhibit

AZ-104 Practice Test 33 — 15 Questions

Exhibit