AZ-104 Practice Test 35 — 15 Questions

Question 1

A response team is designing notification paths for Azure Monitor alerts. Match each action group receiver or action to the outcome it provides.

Accepted Answer

Email: Sends email notifications to specified recipients.. Email/SMS/Push/Voice are direct notifications; ITSM connector creates tickets; Automation runbook runs scripts; Webhook sends to external services like Teams; Push notifications target mobile apps.

Answer

Automation runbook: Sends HTTP POST to an external service endpoint.

Answer

Webhook: Runs a script in Azure Automation.

Question 2

During a compliance review, the team must distinguish what each Azure Monitor object can and cannot do. Match each object to its primary operational scope.

Accepted Answer

Metrics: Collects numeric time-series data for performance and health.. Metrics collect numeric time-series data; Logs collect text logs for querying; Application Insights monitors web apps; Activity Log records subscription events; Diagnostic Logs capture resource logs; Service Health provides service incident info.

Answer

Activity Log: Captures resource-level logs from Azure resources.

Answer

Diagnostic Logs: Records subscription-level events and operations.

Answer

Service Health: Monitors web applications and provides diagnostics.

Question 3

An operations lead must choose the right Azure Monitor target for each requirement. Match each requirement to the Azure component that best satisfies it.

Accepted Answer

Metrics Explorer: Shows real-time metrics. Metrics Explorer shows real-time metrics; Action Groups define notification actions; Log Analytics Workspace stores and queries logs; Alert Rules define conditions; Workbooks provide visualizations.

Answer

Log Analytics Workspace: Provides visualizations

Answer

Workbooks: Stores and queries logs

Question 4

A VM was corrupted and the team wants to recover it from Azure Backup without using the original damaged disks. Which two restore targets are supported? Select two.

Accepted Answer

Create a new virtual machine. Azure Backup supports restoring a VM to a new virtual machine directly from the recovery point, which creates a new VM with the same configuration and data without using the original damaged disks. This is a common restore workflow when the original VM is corrupted or inaccessible.

Answer

Change the subscription automatically

Answer

Replace the Recovery Services vault name

Answer

Rebuild the virtual network

Question 5

You want to group subscriptions for Finance, HR, and Engineering so you can apply governance consistently at a higher level. What should you create?

Accepted Answer

Management groups. Management groups are the correct choice because they allow you to organize Azure subscriptions into a hierarchy for applying governance policies, role-based access control (RBAC), and cost management consistently across multiple subscriptions. By creating a management group hierarchy (e.g., Finance, HR, Engineering), you can assign Azure Policy initiatives or RBAC roles at the management group level, which are inherited by all subscriptions within that group. This provides a scalable and centralized governance model without needing to configure each subscription individually.

Answer

Resource groups

Answer

Tags

Answer

Resource locks

Question 6

You deploy a Windows Server VM and need to run several PowerShell commands after deployment without signing in to the VM. Which Azure feature should you use?

Accepted Answer

Use the Custom Script Extension on the VM.. The Custom Script Extension (CSE) is the correct Azure feature because it allows you to run PowerShell or Bash scripts on a VM after deployment without requiring interactive sign-in. It executes the script via the Azure VM Agent, which runs as a local system process, making it ideal for post-deployment configuration tasks like installing software or running commands.

Answer

Put the VM in an availability zone.

Answer

Attach a managed identity and rely on Azure Policy.

Answer

Create a snapshot before startup.

Question 7

You need to run a script on VM-App02 immediately after deployment to install a custom monitoring agent. The solution should not require opening additional inbound management ports. What should you use?

Accepted Answer

Custom Script Extension. The Custom Script Extension (CSE) is the correct choice because it allows you to run a script on a VM immediately after deployment without opening any inbound management ports. CSE downloads and executes scripts on the VM via the Azure fabric, using the VM's outbound connectivity to Azure storage or GitHub, and does not require any inbound port (like RDP or WinRM) to be open. This meets the requirement of not opening additional inbound management ports while enabling post-deployment configuration.

Answer

Boot diagnostics

Answer

An inbound NSG rule for WinRM

Answer

A proximity placement group

Question 8

A security analyst is reviewing deleted-resource evidence, exported diagnostics, and heartbeat data. Match each monitoring term to the best description.

Accepted Answer

Activity Log: Records control-plane operations like creating or deleting resources.. The monitoring terms relate to Azure Monitor data sources. Deleted-resource evidence comes from activity logs, exported diagnostics are resource logs sent elsewhere, heartbeat data indicates agent health, and the other terms are standard Azure Monitor components.

Answer

Metrics: Rules that trigger actions based on conditions.

Answer

Alerts: Numerical values collected at regular intervals from resources.

Question 9

A backup administrator is learning how Azure VM backup actions map to their purpose. Match each Recovery Services or backup item to the best description.

Accepted Answer

Recovery Services vault: Stores backup data and recovery points.. Recovery Services vault stores backups; policy defines schedule; instant snapshot allows fast restore; extension is the agent; restore point is a backup copy; cross-region restore enables DR.

Answer

Extension: Stores backup data and recovery points.

Answer

Cross-region restore: Defines the backup schedule and retention rules.

Question 10

You are responsible for managing a large Azure environment with multiple subscriptions. You need to ensure compliance with company policies by auditing resource changes and enabling automated remediation for non-compliant resources. Which three of the following Azure services or features should you use? (Choose three.)

Accepted Answer

Azure Policy to define and enforce rules for resource configurations.. Azure Policy is correct because it allows you to define and enforce rules for resource configurations, ensuring compliance with company policies. The Activity Log is correct because it records all management operations, providing an audit trail for resource changes. Azure Automation with runbooks is correct because it can be triggered by Azure Policy or Activity Log alerts to automatically remediate non-compliant resources, such as stopping an unapproved VM or applying a required tag.

Answer

Azure Security Center (Defender for Cloud) to monitor for security threats.

Answer

Azure Blueprints to package and deploy environment definitions.

Answer

Azure Resource Graph to query and visualize resource properties across subscriptions.

Question 11

A support engineer is investigating a failed Azure VM backup job in Log Analytics. Match each KQL operator to the result it produces.

Accepted Answer

where: Filters rows based on a predicate. These are common KQL operators. 'where' filters, 'project' selects columns, 'extend' adds columns, 'summarize' aggregates, 'join' merges tables, and 'order by' sorts results.

Answer

where: Selects a subset of columns

Answer

extend: Aggregates groups of rows

Question 12

A production team wants to match common Azure Monitor components to the action each one performs. Match each item on the left to the best description on the right.

Accepted Answer

Log Analytics workspace: Stores log data from various sources for central querying and analysis.. Log Analytics workspace stores logs centrally; Azure Monitor Metrics handles numeric time-series data; Application Insights focuses on application performance; Activity Log tracks control plane events; Alerts send notifications; Workbooks create interactive reports.

Answer

Activity Log: Sends notifications or triggers automated actions when conditions are met.

Answer

Alerts: Tracks control plane events for subscription-level auditing.

Answer

Workbooks: Analyzes application usage and performance with detailed telemetry.

Question 13

Based on the exhibit, what should the administrator configure so the VM in the spoke VNet can resolve internal hostnames that are hosted on the DNS server in the hub VNet?

The team has already verified that IP connectivity between the spoke VM and the hub VM works.

Accepted Answer

Set the SpokeVNet DNS server list to use 10.40.0.4 so the spoke queries the hub resolver directly.. Setting the SpokeVNet DNS server list to 10.40.0.4 (the IP of the DNS server in the hub VNet) configures the spoke VNet to forward all DNS queries to that custom DNS server. Since IP connectivity between the VNets is already verified, the spoke VM can resolve internal hostnames hosted on the hub DNS server. This is the standard method for cross-VNet DNS resolution when using a custom DNS server in a hub-and-spoke topology.

Answer

Create a private endpoint for web01.corp.contoso.local in the spoke VNet so DNS resolves automatically.

Answer

Enable gateway transit on the peering so the spoke inherits the hub VNet DNS configuration.

Answer

Add inbound and outbound NSG rules allowing UDP and TCP port 53 between the two VNets.

Question 14

An Azure Automation account is recreated periodically during a migration project. Runbooks must authenticate to Azure resources without embedded secrets, and the identity must continue to work after the account is rebuilt. Which two choices should you make? Select two.

Accepted Answer

Use a user-assigned managed identity so the identity is independent of the Automation account lifecycle.. A user-assigned managed identity exists as a standalone Azure resource independent of the Automation account's lifecycle. When the Automation account is recreated, you can reassign the same user-assigned managed identity to the new account, preserving the identity's object ID and its RBAC role assignments. This ensures that runbooks can authenticate without embedded secrets and continue to work seamlessly after the account is rebuilt.

Answer

Use a service principal with a client secret stored in an encrypted Automation variable.

Answer

Use a system-assigned managed identity attached to the Automation account because it is always reusable after recreation.

Answer

Store a storage account key in a runbook asset and retrieve it at runtime.

Question 15

A developer has the Contributor role on a resource group. A Bicep deployment that creates a VM with a public IP fails with a policy denial, but the same template succeeds after the public IP resource is removed. Which two statements are true? Select two.

Accepted Answer

The Contributor role allows deployments in the resource group, but it cannot override a deny policy inherited from a higher scope.. The Contributor role grants full management access to resources within the resource group, but it cannot override Azure Policy effects such as 'deny'. Policy inheritance flows from higher scopes (management group, subscription) down to the resource group, and even a Contributor cannot bypass a deny policy assigned at a higher scope. The Bicep deployment fails specifically because the public IP resource violates a policy rule, not because of a lack of permissions on the role itself.

Answer

A CanNotDelete lock is the reason the public IP resource cannot be created.

Answer

Assigning Owner on the resource group would automatically bypass the policy denial and allow the template to deploy unchanged.

Answer

Moving the VM to another subnet in the same virtual network would remove the inherited policy effect.