AZ-104 Practice Test 33 — 15 Questions

Question 1

A development team wants to publish an internet-facing application directly from source code. The solution must support built-in HTTPS, deployment slots for safe testing, and autoscale as demand changes. Which two choices should the administrator select? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Azure App Service.. Azure App Service is a fully managed platform for building, deploying, and scaling web apps. It natively supports publishing directly from source code (via continuous deployment from GitHub, Azure Repos, or Bitbucket), built-in HTTPS (with automatic certificate management), deployment slots for staging and swapping, and autoscale based on metrics or schedules. These features directly satisfy all the requirements stated in the question.

Answer

Use Azure Container Instances for the public application.

Answer

Deploy the app on a virtual machine scale set.

Answer

Use an availability set for the application instances.

Question 2

Users on the internet cannot reach an HTTPS application hosted on VM-Web01. The VM has a public IP address, the application is listening on TCP port 443, and the guest OS firewall allows the traffic. What is the most likely Azure-side cause?

Accepted Answer

The NSG blocks inbound TCP 443. The most likely Azure-side cause is that a Network Security Group (NSG) associated with the VM's subnet or NIC is blocking inbound TCP port 443. Even if the VM has a public IP, the application is listening, and the guest OS firewall allows traffic, an NSG rule denying inbound HTTPS traffic will prevent external users from reaching the application. NSGs act as a distributed firewall filtering traffic at the Azure network layer before it reaches the VM.

Answer

The VM uses Premium SSD

Answer

Azure Backup is not enabled

Answer

The storage account uses GRS

Question 3

Based on the exhibit, a metric alert already exists for VM01, but the on-call team never receives an email when CPU exceeds 80% for 5 minutes. What should you configure to deliver the notification?

Accepted Answer

Add an action group to the alert rule and configure email delivery.. The alert rule exists, but no notification action is configured. An action group defines how to notify administrators (e.g., email, SMS, webhook). Adding an action group with an email action to the existing alert rule will deliver the email when the CPU threshold is breached.

Answer

Create a diagnostic setting on VM01 to export metrics to Log Analytics.

Answer

Assign the Reader role to the on-call team so they can view the alert.

Answer

Create a resource lock on VM01 to prevent accidental changes.

Question 4

A department has 12 subscriptions under a management group named Corp. New resources must be deployed only in East US or West US and must include a CostCenter tag. A pilot subscription must be exempt from these rules during testing. Which two actions should you take? Select two.

Accepted Answer

Assign an initiative containing both policy definitions at the Corp management-group scope.. Assigning an initiative (a collection of policy definitions) at the Corp management-group scope ensures that all 12 subscriptions inherit both the location restriction and the CostCenter tag requirement. This is the most efficient and scalable way to enforce governance across multiple subscriptions without repeating assignments.

Answer

Assign the policies individually at each resource group.

Answer

Use the Owner role at the management-group scope.

Answer

Use a resource lock instead of Azure Policy.

Question 5

A Windows VM and a Linux VM in Azure must use the same shared working folder for application files. The team does not want to run a separate file server, and both VMs must be able to mount the share by using native operating system tools. What should the administrator deploy?

Accepted Answer

An Azure Files share mounted from Windows by using SMB and from Linux by using SMB or the Azure Files mount command. Azure Files provides fully managed SMB (Server Message Block) file shares that can be mounted natively from both Windows (using SMB) and Linux (using SMB or the dedicated Azure Files mount command). This meets the requirement of a shared working folder without needing a separate file server, and both operating systems can use their native tools to access the share.

Answer

An Azure Blob container mounted as a local NTFS volume on both VMs

Answer

A managed disk attached to both VMs in read-write mode

Answer

An Azure Queue storage account with application-level file synchronization

Question 6

A backend subnet contains 18 Linux VMs that must install updates from the internet. Security requires all outbound traffic to use one static public IP, and none of the VMs may have their own public IP addresses. Which two changes meet the requirement? Select two.

Accepted Answer

Associate a NAT gateway with the backend subnet and provide it with a public IP address or prefix.. A NAT gateway provides outbound internet connectivity for VMs in a subnet while using a single static public IP address. By associating a NAT gateway with the backend subnet and assigning it a public IP, all outbound traffic from the 18 Linux VMs will source NAT to that static IP, meeting the security requirement without assigning public IPs to individual VMs.

Answer

Create a public load balancer and add the VMs to its backend pool.

Answer

Use a private endpoint for internet updates so outbound traffic remains private.

Answer

Attach a route table with 0.0.0.0/0 to Virtual network gateway.

Question 7

Your operations team needs to receive a Microsoft Teams or email notification whenever a production application becomes unavailable. You have already created an availability test in Azure Monitor. What should you configure next?

Accepted Answer

A metric or log alert rule linked to an action group. An availability test in Azure Monitor detects when an application is unavailable, but it does not inherently trigger notifications. To send a Teams or email alert, you must create a metric or log alert rule that references the availability test's results and link it to an action group, which defines the notification actions (e.g., email, SMS, webhook to Teams). This is the standard Azure Monitor workflow for proactive incident response.

Answer

A management group

Answer

A resource lock

Answer

A private endpoint

Question 8

An operations team needs to start and deallocate every virtual machine in RG-App and read VM settings, but they must not be able to delete VMs or manage networking resources. What is the best Azure RBAC solution?

Accepted Answer

Create a custom role and assign it at the RG-App resource group scope. The required permissions—starting, deallocating, and reading VM settings—are not fully covered by any built-in role, and the custom role must be scoped to RG-App to avoid granting broader access. A custom role allows combining Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/read, while explicitly excluding delete and networking management actions. Assigning at the resource group scope ensures the permissions apply only to resources within RG-App.

Answer

Assign the Virtual Machine Contributor role at the subscription scope

Answer

Assign the Reader role at the resource group scope

Answer

Assign the Owner role at the resource group scope

Question 9

You need to ensure that a virtual machine is protected by Azure Backup and can be restored from centralized backup data if the VM is deleted. Which Azure resource should you configure first?

Accepted Answer

A Recovery Services vault. A Recovery Services vault is the foundational Azure resource for Azure Backup. It stores backup data and recovery points, enabling centralized backup management and restoration even if the original VM is deleted. Without first configuring a Recovery Services vault, you cannot define backup policies or initiate backups for the VM.

Answer

An availability set

Answer

A network security group

Answer

A public IP address

Question 10

You have a storage account named stlogs01. An application running on VM-App01 in Azure must access blobs in the account without storing account keys in code or configuration files. What should you use?

Accepted Answer

A managed identity for VM-App01 and Azure RBAC on the storage account.. Using a managed identity for VM-App01 allows the application to authenticate to Azure Storage without storing any credentials in code or configuration files. The managed identity is automatically managed by Microsoft Entra ID, and you grant it access to the blob container using Azure RBAC (e.g., the Storage Blob Data Contributor role). This eliminates the need for account keys or shared access signatures.

Answer

A shared access signature stored in a text file on VM-App01.

Answer

The storage account access key hard-coded in the application.

Answer

Anonymous public access for the blob container.

Question 11

A ReadOnly lock is applied to RG-App. Which two requested changes will fail because of the lock? Select two.

Accepted Answer

Resize a virtual machine to a larger SKU.. A ReadOnly lock on a resource group prevents any operations that modify existing resources or create/delete resources within that group. Resizing a VM to a larger SKU requires a write operation to the VM resource (specifically, updating the hardware profile), which is blocked by the lock. Deleting an unused public IP address is also a write operation (delete), which is blocked. Read operations, such as listing resources or viewing tags, are allowed.

Answer

List the resources currently in the resource group.

Answer

Read the current tag values on the resource group.

Answer

View the VM power state in the portal.

Question 12

A user deleted a single document from a backed-up Windows VM. Which two Azure Backup actions are appropriate if only that file must be recovered? Select two.

Accepted Answer

Use file recovery from the backup point. Azure Backup provides file-level recovery for Windows VMs via the 'File Recovery' option in the Recovery Services vault. This allows you to mount the recovery point as a drive on the VM (using iSCSI) and directly copy the deleted file back to its original location without restoring the entire VM. Option B is also correct because mounting the recovery point (via the same file recovery process) and copying the file back is the exact mechanism used; the two options describe the same action from different perspectives.

Answer

Recreate the VM in another region

Answer

Change the VM size

Answer

Disable the backup policy

Question 13

You need to allow recovery of previous versions of files stored in an Azure file share after accidental modification or deletion. Which feature should you configure?

Accepted Answer

Share snapshots for Azure Files. Share snapshots for Azure Files capture point-in-time, read-only copies of the file share, allowing you to recover previous versions of files after accidental modification or deletion. This feature is specifically designed for Azure file shares, not for blobs, and does not require any additional infrastructure.

Answer

Blob versioning

Answer

A shared access signature

Answer

Storage account failover

Question 14

An archived blob must be read tomorrow morning. Which two actions are required before the blob can be opened? Select two.

Accepted Answer

Change the blob access tier from Archive to Hot or Cool so the data becomes online again.. An archived blob is in an offline state and must be rehydrated to the Hot or Cool tier before it can be read. Changing the access tier initiates the rehydration process, which makes the blob data online and accessible.

Answer

Enable a private endpoint, because archive blobs can only be read through private connectivity.

Answer

Convert the storage account to GZRS, because geo-replication automatically restores archived blobs.

Answer

Set the container ACL to public so archived blobs can be read without rehydration.

Question 15

You need to receive an email when average CPU usage on VM-App01 exceeds 85 percent for 10 minutes. Which Azure Monitor components should you configure?

Accepted Answer

A metric alert and an action group. A metric alert monitors a specific Azure resource metric (like CPU percentage) and triggers when a condition (e.g., average > 85%) is met over a specified evaluation period (e.g., 10 minutes). An action group defines the notification actions (e.g., sending an email) when the alert fires. Together, they fulfill the requirement to receive an email based on a performance threshold.

Answer

A resource lock and Azure Advisor

Answer

An activity log alert only

Answer

A budget alert