AZ-104 Practice Test 33 — 15 Questions

Question 1

Based on the exhibit, the security team wants an alert whenever someone changes the configuration of a storage account, such as disabling public network access. The current rule is a metric alert on transaction count. What should you use instead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an activity log alert for write operations on the storage account resource.. Activity log alerts are designed to monitor Azure resource-level operations, such as write actions that modify storage account configurations. Option D is correct because it creates an alert specifically for write operations on the storage account resource, which captures events like disabling public network access. This is the appropriate method for detecting configuration changes, unlike metric alerts which track performance data.

Answer

Keep the metric alert and lower the threshold to 10 transactions.

Answer

Create a service health alert because storage account settings affect platform status.

Answer

Use a Log Analytics query alert against VM guest logs to detect network-rule changes.

Question 2

You plan to deploy two virtual machines that run the same line-of-business application. The VMs must remain available during planned maintenance of the Azure platform, but autoscaling is not required. What should you use?

Accepted Answer

An availability set.. An availability set ensures that VMs are distributed across multiple fault domains and update domains within an Azure datacenter. This protects against both hardware failures (fault domains) and planned Azure platform maintenance (update domains), as only one update domain is rebooted at a time. Since autoscaling is not required, an availability set is the correct choice for high availability during planned maintenance.

Answer

A Virtual Machine Scale Set.

Answer

Azure Container Apps.

Answer

A private endpoint.

Question 3

A stateless application must keep serving traffic if one datacenter in the region fails, and it must also add or remove instances during daily load spikes. Which two deployment choices should the administrator make? Select two.

Accepted Answer

Deploy the application on a virtual machine scale set.. A virtual machine scale set (VMSS) allows automatic scaling of instances in response to load spikes, meeting the requirement to add or remove instances dynamically. Combined with availability zones, which distribute instances across physically separate datacenters within a region, the application remains available even if one entire datacenter fails. This pair ensures both high availability and elastic scaling for a stateless application.

Answer

Use a single availability set with one VM to reduce complexity.

Answer

Use a proximity placement group for the workload.

Answer

Deploy one larger VM with a premium SSD instead of multiple instances.

Question 4

A Linux VM restarts after a configuration change and now stops before the sign-in prompt. The administrator cannot use SSH. Which Azure feature should be checked first to inspect the startup process?

Accepted Answer

Boot diagnostics. Boot diagnostics captures serial console output and screenshots of the VM, allowing you to view kernel messages, boot logs, and the exact point where the startup process halts. Since SSH is unavailable and the VM stops before the sign-in prompt, this is the first Azure feature to check for troubleshooting the boot sequence.

Answer

Network Watcher packet capture

Answer

Azure Advisor

Answer

Managed identity

Question 5

An operations team maintains a hardened Windows base image that includes patch baseline settings and monitoring agents. They need to publish new versions, replicate the image to another region, and deploy future VMs from the same controlled image source. What should they use?

Accepted Answer

An Azure Compute Gallery image version.. An Azure Compute Gallery (formerly Shared Image Gallery) is the correct service for managing, versioning, replicating, and deploying custom Windows images across regions. It supports multiple image versions, regional replication, and allows you to deploy VMs from a controlled, hardened base image. Snapshots alone lack versioning and cross-region replication capabilities.

Answer

A snapshot of the generalized OS disk.

Answer

A VM extension on an existing VM.

Answer

An availability set for the image resources.

Question 6

A storage account's platform logs must be searchable later with KQL in a central workspace. Which two actions should the administrator take? Select two.

Accepted Answer

Create a diagnostic setting on the storage account. A diagnostic setting on the storage account is required to route platform logs (e.g., storage read/write/delete operations) to a destination. Option C is correct because a Log Analytics workspace is the destination that enables KQL-based searching and analysis of those logs. Without both, the logs cannot be stored in a central, queryable repository.

Answer

Configure a NAT gateway on the storage subnet

Answer

Assign the Reader role on the subscription

Answer

Enable a VM backup policy

Question 7

A development team wants to publish an internet-facing application directly from source code. The solution must support built-in HTTPS, deployment slots for safe testing, and autoscale as demand changes. Which two choices should the administrator select? Select two.

Accepted Answer

Use Azure App Service.. Azure App Service is a fully managed platform for building, deploying, and scaling web apps. It natively supports publishing directly from source code (via continuous deployment from GitHub, Azure Repos, or Bitbucket), built-in HTTPS (with automatic certificate management), deployment slots for staging and swapping, and autoscale based on metrics or schedules. These features directly satisfy all the requirements stated in the question.

Answer

Use Azure Container Instances for the public application.

Answer

Deploy the app on a virtual machine scale set.

Answer

Use an availability set for the application instances.

Question 8

Users on the internet cannot reach an HTTPS application hosted on VM-Web01. The VM has a public IP address, the application is listening on TCP port 443, and the guest OS firewall allows the traffic. What is the most likely Azure-side cause?

Accepted Answer

The NSG blocks inbound TCP 443. The most likely Azure-side cause is that a Network Security Group (NSG) associated with the VM's subnet or NIC is blocking inbound TCP port 443. Even if the VM has a public IP, the application is listening, and the guest OS firewall allows traffic, an NSG rule denying inbound HTTPS traffic will prevent external users from reaching the application. NSGs act as a distributed firewall filtering traffic at the Azure network layer before it reaches the VM.

Answer

The VM uses Premium SSD

Answer

Azure Backup is not enabled

Answer

The storage account uses GRS

Question 9

Based on the exhibit, a metric alert already exists for VM01, but the on-call team never receives an email when CPU exceeds 80% for 5 minutes. What should you configure to deliver the notification?

Accepted Answer

Add an action group to the alert rule and configure email delivery.. The alert rule exists, but no notification action is configured. An action group defines how to notify administrators (e.g., email, SMS, webhook). Adding an action group with an email action to the existing alert rule will deliver the email when the CPU threshold is breached.

Answer

Create a diagnostic setting on VM01 to export metrics to Log Analytics.

Answer

Assign the Reader role to the on-call team so they can view the alert.

Answer

Create a resource lock on VM01 to prevent accidental changes.

Question 10

A department has 12 subscriptions under a management group named Corp. New resources must be deployed only in East US or West US and must include a CostCenter tag. A pilot subscription must be exempt from these rules during testing. Which two actions should you take? Select two.

Accepted Answer

Assign an initiative containing both policy definitions at the Corp management-group scope.. Assigning an initiative (a collection of policy definitions) at the Corp management-group scope ensures that all 12 subscriptions inherit both the location restriction and the CostCenter tag requirement. This is the most efficient and scalable way to enforce governance across multiple subscriptions without repeating assignments.

Answer

Assign the policies individually at each resource group.

Answer

Use the Owner role at the management-group scope.

Answer

Use a resource lock instead of Azure Policy.

Question 11

A Windows VM and a Linux VM in Azure must use the same shared working folder for application files. The team does not want to run a separate file server, and both VMs must be able to mount the share by using native operating system tools. What should the administrator deploy?

Accepted Answer

An Azure Files share mounted from Windows by using SMB and from Linux by using SMB or the Azure Files mount command. Azure Files provides fully managed SMB (Server Message Block) file shares that can be mounted natively from both Windows (using SMB) and Linux (using SMB or the dedicated Azure Files mount command). This meets the requirement of a shared working folder without needing a separate file server, and both operating systems can use their native tools to access the share.

Answer

An Azure Blob container mounted as a local NTFS volume on both VMs

Answer

A managed disk attached to both VMs in read-write mode

Answer

An Azure Queue storage account with application-level file synchronization

Question 12

A backend subnet contains 18 Linux VMs that must install updates from the internet. Security requires all outbound traffic to use one static public IP, and none of the VMs may have their own public IP addresses. Which two changes meet the requirement? Select two.

Accepted Answer

Associate a NAT gateway with the backend subnet and provide it with a public IP address or prefix.. A NAT gateway provides outbound internet connectivity for VMs in a subnet while using a single static public IP address. By associating a NAT gateway with the backend subnet and assigning it a public IP, all outbound traffic from the 18 Linux VMs will source NAT to that static IP, meeting the security requirement without assigning public IPs to individual VMs.

Answer

Create a public load balancer and add the VMs to its backend pool.

Answer

Use a private endpoint for internet updates so outbound traffic remains private.

Answer

Attach a route table with 0.0.0.0/0 to Virtual network gateway.

Question 13

Your operations team needs to receive a Microsoft Teams or email notification whenever a production application becomes unavailable. You have already created an availability test in Azure Monitor. What should you configure next?

Accepted Answer

A metric or log alert rule linked to an action group. An availability test in Azure Monitor detects when an application is unavailable, but it does not inherently trigger notifications. To send a Teams or email alert, you must create a metric or log alert rule that references the availability test's results and link it to an action group, which defines the notification actions (e.g., email, SMS, webhook to Teams). This is the standard Azure Monitor workflow for proactive incident response.

Answer

A management group

Answer

A resource lock

Answer

A private endpoint

Question 14

An operations team needs to start and deallocate every virtual machine in RG-App and read VM settings, but they must not be able to delete VMs or manage networking resources. What is the best Azure RBAC solution?

Accepted Answer

Create a custom role and assign it at the RG-App resource group scope. The required permissions—starting, deallocating, and reading VM settings—are not fully covered by any built-in role, and the custom role must be scoped to RG-App to avoid granting broader access. A custom role allows combining Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/read, while explicitly excluding delete and networking management actions. Assigning at the resource group scope ensures the permissions apply only to resources within RG-App.

Answer

Assign the Virtual Machine Contributor role at the subscription scope

Answer

Assign the Reader role at the resource group scope

Answer

Assign the Owner role at the resource group scope

Question 15

You need to ensure that a virtual machine is protected by Azure Backup and can be restored from centralized backup data if the VM is deleted. Which Azure resource should you configure first?

Accepted Answer

A Recovery Services vault. A Recovery Services vault is the foundational Azure resource for Azure Backup. It stores backup data and recovery points, enabling centralized backup management and restoration even if the original VM is deleted. Without first configuring a Recovery Services vault, you cannot define backup policies or initiate backups for the VM.

Answer

An availability set

Answer

A network security group

Answer

A public IP address