AZ-104 Practice Test 35 — 15 Questions

Question 1

A legal department stores scanned contracts that are kept for compliance and are almost never opened. They want the lowest storage cost, and it is acceptable if files take time to become available before download. Which blob tier should you choose?

Accepted Answer

Archive. The Archive tier is designed for data that is rarely accessed and has the lowest storage cost among Azure Blob Storage tiers. It requires rehydration (which can take up to 15 hours) before files become available, making it ideal for compliance data that is almost never opened and where delayed access is acceptable.

Answer

Hot

Answer

Cool

Answer

Cold

Question 2

A legal team stores archived case files in Azure Blob Storage. The files are rarely read, but they must remain online and available immediately when needed. Which access tier should the administrator use?

Accepted Answer

Cool tier. The Cool tier is designed for data that is infrequently accessed but must remain online with low-latency retrieval. Archived case files that are rarely read but need immediate availability fit this profile, as Cool tier offers lower storage costs than Hot tier while still providing millisecond access times.

Answer

Hot tier

Answer

Archive tier

Answer

Premium tier

Question 3

A legal department keeps evidence files in Azure Blob Storage. The files are accessed only a few times per year, but they must stay online and be immediately readable when requested. The team wants the lowest-cost online tier and does not want a rehydration step. Which tier should you choose?

Accepted Answer

Cold, because it keeps data online and is intended for rarely accessed content.. The Cold tier is the correct choice because it is an online tier designed for rarely accessed data that must remain immediately readable without a rehydration step. It offers lower storage costs than Hot or Cool while still providing instant access, meeting the requirement for the lowest-cost online tier.

Answer

Hot, because it prioritizes immediate access over storage cost.

Answer

Cool, because it is an online tier for infrequent access.

Answer

Archive, because it has the lowest cost and can be opened instantly from the portal.

Question 4

A line-of-business app must keep serving users if an entire Azure region becomes unavailable. Is Azure Backup by itself enough to meet this requirement?

Accepted Answer

No, you also need disaster recovery replication such as Azure Site Recovery. Azure Backup is designed to protect data by creating recovery points that can be used to restore VMs or files, but it does not provide automatic failover or continuous replication to another region. To meet the requirement of keeping an app running during a regional outage, you need a disaster recovery solution like Azure Site Recovery, which replicates VMs to a secondary region and enables orchestrated failover with minimal downtime.

Answer

Yes, because backup alone guarantees immediate failover to another region

Answer

Yes, as long as the VM has a backup policy

Answer

Yes, if diagnostic settings are enabled on the VM

Question 5

A line-of-business app runs on two Azure VMs in the same region. The business wants to reduce the chance that both VMs are affected by the same planned host update. What should the administrator use?

Accepted Answer

An availability set. An availability set ensures that VMs are placed on different fault domains and update domains within an Azure datacenter. Fault domains isolate VMs from shared hardware failures, while update domains ensure that planned host updates (e.g., OS patching) are applied sequentially across groups, so not all VMs are rebooted simultaneously. This directly reduces the chance that both VMs are affected by the same planned host update.

Answer

A public load balancer

Answer

A managed image

Answer

A private endpoint

Question 6

A Linux VM in a subnet must accept SSH only from the corporate admin subnet 10.8.4.0/24. The subnet NSG currently has an Allow-SSH rule for Any at priority 300 and a Deny-SSH rule for Any at priority 200. Administrators from 10.8.4.0/24 still cannot connect. What change should the administrator make?

Accepted Answer

Add an Allow-SSH rule for 10.8.4.0/24 with a priority lower than 200.. The subnet NSG has a Deny-SSH rule for Any at priority 200, which blocks all SSH traffic regardless of source. To allow SSH only from 10.8.4.0/24, an Allow-SSH rule for that specific subnet must be added with a priority lower (higher number) than 200, such as 210, so it is evaluated after the deny rule. Since NSG rules are processed in priority order (lowest number first), the deny at 200 will block traffic before the allow rule is reached unless the allow rule has a lower priority number, which is not possible here; instead, the allow rule must have a higher priority number (e.g., 210) to be evaluated after the deny, but the correct approach is to add an allow rule with a priority lower than 200 (i.e., a smaller number) to override the deny. However, the correct answer states 'priority lower than 200' meaning a numerically smaller value (e.g., 100), which would be evaluated before the deny rule, allowing traffic from 10.8.4.0/24 before the deny rule blocks it. This is the standard NSG rule evaluation behavior: the highest priority (lowest number) rule wins.

Answer

Change the deny rule protocol from TCP to Any so the allow rule is evaluated first.

Answer

Move the existing Allow-SSH rule to priority 400 so it applies later.

Answer

Add a route table to the subnet so the SSH packets follow a different path.

Question 7

A platform team must enforce two governance rules across every current and future subscription under a management group: only East US and West US deployments are allowed, and every resource must include an Environment tag. Which three actions should the administrator take? Select three.

Accepted Answer

Create a policy initiative that groups the governance requirements.. Option A is correct because a policy initiative (also known as a policy set) allows you to group multiple individual Azure Policy definitions into a single, reusable governance package. This simplifies assignment and ensures both the allowed locations and required tag policies are enforced together consistently across all subscriptions under the management group.

Answer

Assign the policies separately to each existing subscription only.

Answer

Use an RBAC Contributor role to enforce region and tag compliance.

Question 8

A policy that requires secure transfer for storage accounts has been assigned to a subscription with the DeployIfNotExists effect. Several existing storage accounts are still noncompliant and have not changed. What should you do next to update those existing resources automatically?

Accepted Answer

Create and run a remediation task for the policy assignment. The DeployIfNotExists effect on a policy assignment automatically deploys a template to remediate noncompliant resources, but only for new or updated resources. Existing noncompliant resources require a manual remediation task to trigger the deployment of the template. Creating and running a remediation task for the policy assignment applies the required secure transfer configuration to all existing storage accounts, bringing them into compliance.

Answer

Assign a CanNotDelete lock to the storage accounts

Answer

Move the storage accounts into a new resource group

Answer

Grant the administrators a higher RBAC role on the subscription

Question 9

A policy assignment denies storage accounts unless public network access is disabled. One legacy storage account in a pilot resource group must remain publicly reachable for 60 days while the application team remediates dependencies. Compliance reporting must continue to show the policy as enforced everywhere else. What should the administrator do?

Accepted Answer

Use an Azure Policy exemption for that storage account. An Azure Policy exemption allows the administrator to exclude a specific scope (the legacy storage account) from the policy's effect while still reporting the policy as enforced on all other resources. The exemption can be set with an expiration date (60 days) to automatically remove the exception after the remediation period. This ensures compliance reporting continues to show the policy as active and enforced everywhere except the exempted resource.

Answer

Delete the policy assignment and re-create it later

Answer

Apply a read-only lock to the storage account

Answer

Assign a custom RBAC role to the application team

Question 10

A platform team runs an internal automation tool that must restart VMs and read network interface settings in one resource group. Built-in roles available to the team are broader than the access they want to grant. What should the administrator create?

Accepted Answer

A custom role with only the required compute and read permissions, assigned at the resource group scope.. Option A is correct because the team needs only specific actions (restart VMs and read network interface settings) within a single resource group. Creating a custom role with only the required compute and read permissions, assigned at the resource group scope, follows the principle of least privilege and avoids granting broader access than necessary. Built-in roles like Contributor or Network Contributor include extra permissions (e.g., write, delete) that are not needed.

Answer

The Contributor role assigned at the subscription scope.

Answer

The Reader role assigned at the resource group scope.

Answer

The Network Contributor role assigned at the resource group scope.

Question 11

A platform team has a generalized VM image that must be published to East US and West Europe today and patched later without overwriting the original build. They want Azure to keep version history and replicate the image to both regions. Which two actions or resources should they use? Select two.

Accepted Answer

Create an Azure Compute Gallery. Azure Compute Gallery (formerly Shared Image Gallery) allows you to store and manage VM image versions, including version history, and replicate them across multiple Azure regions. By creating an image definition and image version within the gallery, you can publish the generalized VM image to East US and West Europe today, and later create a new image version for patching without overwriting the original build, preserving the version history.

Answer

Capture the VM as a single managed image and copy it manually to each region

Answer

Use an availability set to preserve the image

Answer

Take a snapshot of the OS disk and deploy VMs directly from the snapshot

Question 12

A production virtual machine is experiencing intermittent performance spikes. The operations team wants an alert when average CPU usage stays above 80 percent for 10 minutes and wants email and SMS notifications sent automatically. What should the administrator configure in Azure Monitor?

Accepted Answer

Create a metric alert on Percentage CPU and associate an action group with email and SMS receivers.. Option B is correct because Azure Monitor metric alerts can evaluate real-time performance counters like Percentage CPU against a threshold (e.g., 80%) over a specified duration (e.g., 10 minutes). By associating an action group with email and SMS receivers, the alert automatically triggers the desired notifications without requiring log ingestion or complex queries.

Answer

Create a log search alert on the VM performance data and attach a resource lock.

Answer

Assign an Azure Policy definition to the VM to stop it when CPU exceeds the threshold.

Answer

Enable diagnostic settings on the VM and send the data only to a storage account.

Question 13

A resource group has a ReadOnly lock applied to it. An operator can view the resources, but several portal changes fail. Which two operations will fail because of the lock? Select two.

Accepted Answer

Changing the size of an existing virtual machine in the resource group will fail because it is a write operation.. A is correct because changing the size of an existing virtual machine is a write operation that modifies the VM's configuration. A ReadOnly lock on the resource group prevents all write and delete operations, so any attempt to resize the VM will fail. The lock does not affect read operations, which remain functional.

Answer

Reading the resource group's activity log will fail because lock-protected scopes cannot be queried.

Answer

Listing the resources in the resource group with Azure CLI will fail because enumeration is a write operation.

Answer

Fetching the current VM configuration from the ARM API will fail because reads are denied by the lock.

Question 14

A project team expects frequent joiners and leavers. The same Azure permissions are needed for all members of the team, and you want to avoid editing role assignments for each person. Which two actions best meet the requirement? Select two.

Accepted Answer

Create a security group for the project team.. Option A is correct because creating a security group allows you to manage permissions collectively rather than individually. By adding or removing users from the group as joiners and leavers occur, you avoid editing role assignments for each person. This aligns with Azure AD group-based licensing and RBAC best practices for dynamic teams.

Answer

Assign the same roles directly to every user account.

Answer

Use guest accounts for all team members.

Answer

Assign the roles to a service principal shared by the team.

Question 15

An external consultant from another company needs read-only access to a resource group and must sign in with their own work account. What should be created in Microsoft Entra ID?

Accepted Answer

A guest user account. B is correct because a guest user account in Microsoft Entra ID (formerly Azure AD) allows an external user from another organization to sign in using their own work account (via B2B collaboration) and be granted read-only access to a specific resource group. This leverages the existing identity provider of the external consultant, eliminating the need to create a separate identity in the company tenant.

Answer

A member user account in the company tenant

Answer

A Microsoft 365 group

Answer

A service principal