AZ-104 Practice Test 34 — 15 Questions

Question 1

You have a storage account named stlogs01. An application running on VM-App01 in Azure must access blobs in the account without storing account keys in code or configuration files. What should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A managed identity for VM-App01 and Azure RBAC on the storage account.. Using a managed identity for VM-App01 allows the application to authenticate to Azure Storage without storing any credentials in code or configuration files. The managed identity is automatically managed by Azure AD, and you grant it access to the blob container using Azure RBAC (e.g., the Storage Blob Data Contributor role). This eliminates the need for account keys or shared access signatures.

Answer

A shared access signature stored in a text file on VM-App01.

Answer

The storage account access key hard-coded in the application.

Answer

Anonymous public access for the blob container.

Question 2

A ReadOnly lock is applied to RG-App. Which two requested changes will fail because of the lock? Select two.

Accepted Answer

Resize a virtual machine to a larger SKU.. A ReadOnly lock on a resource group prevents any operations that modify existing resources or create/delete resources within that group. Resizing a VM to a larger SKU requires a write operation to the VM resource (specifically, updating the hardware profile), which is blocked by the lock. Deleting an unused public IP address is also a write operation (delete), which is blocked. Read operations, such as listing resources or viewing tags, are allowed.

Answer

List the resources currently in the resource group.

Answer

Read the current tag values on the resource group.

Answer

View the VM power state in the portal.

Question 3

A user deleted a single document from a backed-up Windows VM. Which two Azure Backup actions are appropriate if only that file must be recovered? Select two.

Accepted Answer

Use file recovery from the backup point. Azure Backup provides file-level recovery for Windows VMs via the 'File Recovery' option in the Recovery Services vault. This allows you to mount the recovery point as a drive on the VM (using iSCSI) and directly copy the deleted file back to its original location without restoring the entire VM. Option B is also correct because mounting the recovery point (via the same file recovery process) and copying the file back is the exact mechanism used; the two options describe the same action from different perspectives.

Answer

Recreate the VM in another region

Answer

Change the VM size

Answer

Disable the backup policy

Question 4

You need to allow recovery of previous versions of files stored in an Azure file share after accidental modification or deletion. Which feature should you configure?

Accepted Answer

Share snapshots for Azure Files. Share snapshots for Azure Files capture point-in-time, read-only copies of the file share, allowing you to recover previous versions of files after accidental modification or deletion. This feature is specifically designed for Azure file shares, not for blobs, and does not require any additional infrastructure.

Answer

Blob versioning

Answer

A shared access signature

Answer

Storage account failover

Question 5

An archived blob must be read tomorrow morning. Which two actions are required before the blob can be opened? Select two.

Accepted Answer

Change the blob access tier from Archive to Hot or Cool so the data becomes online again.. An archived blob is in an offline state and must be rehydrated to the Hot or Cool tier before it can be read. Changing the access tier initiates the rehydration process, which makes the blob data online and accessible.

Answer

Enable a private endpoint, because archive blobs can only be read through private connectivity.

Answer

Convert the storage account to GZRS, because geo-replication automatically restores archived blobs.

Answer

Set the container ACL to public so archived blobs can be read without rehydration.

Question 6

You need to receive an email when average CPU usage on VM-App01 exceeds 85 percent for 10 minutes. Which Azure Monitor components should you configure?

Accepted Answer

A metric alert and an action group. A metric alert monitors a specific Azure resource metric (like CPU percentage) and triggers when a condition (e.g., average > 85%) is met over a specified evaluation period (e.g., 10 minutes). An action group defines the notification actions (e.g., sending an email) when the alert fires. Together, they fulfill the requirement to receive an email based on a performance threshold.

Answer

A resource lock and Azure Advisor

Answer

An activity log alert only

Answer

A budget alert

Question 7

A backup operations team exports Recovery Services vault logs to Log Analytics. They need a query that returns only failed backup jobs from the last 24 hours and displays just the vault name, protected item name, and error description. Which two KQL operators should the query include? Select two.

Accepted Answer

where. The `where` operator filters the Log Analytics data to include only rows where the backup job status equals 'Failed' and the timestamp falls within the last 24 hours. This is essential for narrowing down the dataset to the specific failed jobs the team needs.

Answer

summarize

Answer

join

Answer

extend

Question 8

You need to ensure that all new resources deployed to a subscription automatically receive a CostCenter tag with a default value if the tag is omitted during deployment. Which Azure governance feature should you use?

Accepted Answer

An Azure Policy with an append or modify effect. Azure Policy with an append or modify effect can automatically add a CostCenter tag with a default value to resources that are missing it during deployment. The append effect adds the tag and value at creation time, while the modify effect (using a 'addOrReplace' operation) can also update existing resources. This ensures governance compliance without manual intervention.

Answer

A resource lock

Answer

A management group lock

Answer

A custom RBAC role

Question 9

A storage account named stfinance01 contains critical data. Administrators must still be able to read and modify the data, but no one should be able to delete the storage account accidentally. What should you configure?

Accepted Answer

A CanNotDelete lock on stfinance01.. A CanNotDelete lock on stfinance01 prevents the storage account from being deleted while still allowing administrators to read and modify data. This lock type blocks delete operations at the resource level, but does not restrict read or write access, which is exactly what the requirement specifies.

Answer

A ReadOnly lock on stfinance01.

Answer

A policy assignment that audits storage accounts.

Answer

An NSG rule denying outbound traffic from the subnet.

Question 10

A production VM needs an email and SMS notification when CPU percentage stays above 80 percent for five minutes. Which two Azure Monitor components should the administrator configure? Select two.

Accepted Answer

Action group. A Metric alert rule monitors the VM’s CPU percentage metric and triggers when the condition (above 80% for 5 minutes) is met. An Action group defines the notification actions (email and SMS) that are executed when the alert fires. Together, they enable the required notification workflow.

Answer

Azure Policy assignment

Answer

Recovery Services vault

Answer

Log Analytics workspace

Question 11

You need to assign the same RBAC role to 15 administrators so they can manage backups for several virtual machines. You want to minimize ongoing administrative effort when membership changes. What should you use?

Accepted Answer

A Microsoft Entra group and a single role assignment to the group.. Assigning a single RBAC role to a Microsoft Entra group allows you to manage permissions centrally. When membership changes, you only need to add or remove users from the group, and the role assignment automatically applies to the new members. This minimizes ongoing administrative effort compared to managing individual role assignments.

Answer

A separate custom role assignment for each administrator.

Answer

A resource lock on every virtual machine.

Answer

A policy exemption for the administrators.

Question 12

Which two statements about Azure Backup soft delete are correct? Select two.

Accepted Answer

Deleted backup data is retained for a grace period. Azure Backup soft delete ensures that deleted backup data is not immediately purged but retained for a default grace period of 14 days. This allows recovery of accidentally deleted backup items, such as Recovery Services vault backup data, without data loss. Option A is correct because the grace period is a core feature of soft delete.

Answer

It permanently deletes backups immediately

Answer

It changes the VM to a different availability zone

Answer

It only applies to Azure Policy assignments

Question 13

Match each Recovery Services vault setting or feature to the behavior an administrator should expect after changing it.

Accepted Answer

Changing replication to GRS: Replicates all existing recovery points. Changing replication to GRS replicates all existing recovery points. Soft delete retains deleted data for 14 days. Changing storage replication after backup requires reconfiguration. Custom managed identity grants specific resource access. Diagnostics settings send logs to Log Analytics. Cross Region Restore enables restore in paired region with GRS.

Answer

Cross Region Restore: Sends logs to Log Analytics

Answer

Diagnostics settings: Enables restore in paired region with GRS

Question 14

A service desk must grant and revoke access to an internal application for a changing group of employees. The service desk must not receive any Azure subscription or resource permissions. Which two actions should you take? Select two.

Accepted Answer

Use a Microsoft Entra security group to represent application access.. Using a Microsoft Entra security group creates a stable access boundary for the application, and making the service desk an owner lets them add or remove members without touching Azure RBAC. That is the least-privilege way to delegate access administration. It keeps resource permissions out of the model, avoids tenant-wide admin roles, and supports frequent employee changes cleanly through group membership updates.

Why others are wrong: Contributor on a resource group gives Azure resource control, not just membership administration. User Administrator is a directory-wide role and is too broad for one application group. Individual user assignments defeat the goal of delegated membership management and create ongoing maintenance. The correct pattern is group-based access with delegated ownership.

Answer

Assign the service desk the Contributor role on the application resource group.

Answer

Assign the service desk the User Administrator directory role to manage the application users.

Answer

Create individual user assignments for every employee instead of using group-based access.

Question 15

Match each blob tier or protection feature to the correct description.

Accepted Answer

Hot: Optimized for frequent access, low latency, highest storage cost, no access cost.. The hot, cool, and archive tiers differ in access frequency and cost structure. Soft delete, immutable storage, and point-in-time restore are protection features that prevent data loss or tampering.

Answer

Hot: Optimized for infrequent access, moderate latency.

Answer

Cool: Optimized for rare access, high latency.