AZ-104 Practice Test 35 — 15 Questions

Question 1

A security analyst is reviewing deleted-resource evidence, exported diagnostics, and heartbeat data. Match each monitoring term to the best description.

Accepted Answer

Activity Log: Records control-plane operations like creating or deleting resources.. The monitoring terms relate to Azure Monitor data sources. Deleted-resource evidence comes from activity logs, exported diagnostics are resource logs sent elsewhere, heartbeat data indicates agent health, and the other terms are standard Azure Monitor components.

Answer

Metrics: Rules that trigger actions based on conditions.

Answer

Alerts: Numerical values collected at regular intervals from resources.

Question 2

A backup administrator is learning how Azure VM backup actions map to their purpose. Match each Recovery Services or backup item to the best description.

Accepted Answer

Recovery Services vault: Stores backup data and recovery points.. Recovery Services vault stores backups; policy defines schedule; instant snapshot allows fast restore; extension is the agent; restore point is a backup copy; cross-region restore enables DR.

Answer

Extension: Stores backup data and recovery points.

Answer

Cross-region restore: Defines the backup schedule and retention rules.

Question 3

You are responsible for managing a large Azure environment with multiple subscriptions. You need to ensure compliance with company policies by auditing resource changes and enabling automated remediation for non-compliant resources. Which three of the following Azure services or features should you use? (Choose three.)

Accepted Answer

Azure Policy to define and enforce rules for resource configurations.. Azure Policy is correct because it allows you to define and enforce rules for resource configurations, ensuring compliance with company policies. The Activity Log is correct because it records all management operations, providing an audit trail for resource changes. Azure Automation with runbooks is correct because it can be triggered by Azure Policy or Activity Log alerts to automatically remediate non-compliant resources, such as stopping an unapproved VM or applying a required tag.

Answer

Azure Security Center (Defender for Cloud) to monitor for security threats.

Answer

Azure Blueprints to package and deploy environment definitions.

Answer

Azure Resource Graph to query and visualize resource properties across subscriptions.

Question 4

A support engineer is investigating a failed Azure VM backup job in Log Analytics. Match each KQL operator to the result it produces.

Accepted Answer

where: Filters rows based on a predicate. These are common KQL operators. 'where' filters, 'project' selects columns, 'extend' adds columns, 'summarize' aggregates, 'join' merges tables, and 'order by' sorts results.

Answer

where: Selects a subset of columns

Answer

extend: Aggregates groups of rows

Question 5

A production team wants to match common Azure Monitor components to the action each one performs. Match each item on the left to the best description on the right.

Accepted Answer

Log Analytics workspace: Stores log data from various sources for central querying and analysis.. Log Analytics workspace stores logs centrally; Azure Monitor Metrics handles numeric time-series data; Application Insights focuses on application performance; Activity Log tracks control plane events; Alerts send notifications; Workbooks create interactive reports.

Answer

Activity Log: Sends notifications or triggers automated actions when conditions are met.

Answer

Alerts: Tracks control plane events for subscription-level auditing.

Answer

Workbooks: Analyzes application usage and performance with detailed telemetry.

Question 6

Based on the exhibit, what should the administrator configure so the VM in the spoke VNet can resolve internal hostnames that are hosted on the DNS server in the hub VNet?

The team has already verified that IP connectivity between the spoke VM and the hub VM works.

Accepted Answer

Set the SpokeVNet DNS server list to use 10.40.0.4 so the spoke queries the hub resolver directly.. Setting the SpokeVNet DNS server list to 10.40.0.4 (the IP of the DNS server in the hub VNet) configures the spoke VNet to forward all DNS queries to that custom DNS server. Since IP connectivity between the VNets is already verified, the spoke VM can resolve internal hostnames hosted on the hub DNS server. This is the standard method for cross-VNet DNS resolution when using a custom DNS server in a hub-and-spoke topology.

Answer

Create a private endpoint for web01.corp.contoso.local in the spoke VNet so DNS resolves automatically.

Answer

Enable gateway transit on the peering so the spoke inherits the hub VNet DNS configuration.

Answer

Add inbound and outbound NSG rules allowing UDP and TCP port 53 between the two VNets.

Question 7

An Azure Automation account is recreated periodically during a migration project. Runbooks must authenticate to Azure resources without embedded secrets, and the identity must continue to work after the account is rebuilt. Which two choices should you make? Select two.

Accepted Answer

Use a user-assigned managed identity so the identity is independent of the Automation account lifecycle.. A user-assigned managed identity exists as a standalone Azure resource independent of the Automation account's lifecycle. When the Automation account is recreated, you can reassign the same user-assigned managed identity to the new account, preserving the identity's object ID and its RBAC role assignments. This ensures that runbooks can authenticate without embedded secrets and continue to work seamlessly after the account is rebuilt.

Answer

Use a service principal with a client secret stored in an encrypted Automation variable.

Answer

Use a system-assigned managed identity attached to the Automation account because it is always reusable after recreation.

Answer

Store a storage account key in a runbook asset and retrieve it at runtime.

Question 8

A developer has the Contributor role on a resource group. A Bicep deployment that creates a VM with a public IP fails with a policy denial, but the same template succeeds after the public IP resource is removed. Which two statements are true? Select two.

Accepted Answer

The Contributor role allows deployments in the resource group, but it cannot override a deny policy inherited from a higher scope.. The Contributor role grants full management access to resources within the resource group, but it cannot override Azure Policy effects such as 'deny'. Policy inheritance flows from higher scopes (management group, subscription) down to the resource group, and even a Contributor cannot bypass a deny policy assigned at a higher scope. The Bicep deployment fails specifically because the public IP resource violates a policy rule, not because of a lack of permissions on the role itself.

Answer

A CanNotDelete lock is the reason the public IP resource cannot be created.

Answer

Assigning Owner on the resource group would automatically bypass the policy denial and allow the template to deploy unchanged.

Answer

Moving the VM to another subnet in the same virtual network would remove the inherited policy effect.

Question 9

A user had a direct Reader assignment on a virtual machine, but that assignment was removed. The user can still open the VM blade and view its properties. Which two sources could still be granting access? Select two.

Accepted Answer

A Reader assignment at the parent resource group, subscription, or management group scope can still be inherited by the VM.. Azure RBAC permissions are inherited from higher scopes. Even if a direct Reader assignment on the VM is removed, a Reader role assigned at the parent resource group, subscription, or management group scope will still grant the user read access to the VM through inheritance. This is a fundamental behavior of Azure RBAC, where permissions flow down the hierarchy.

Answer

A CanNotDelete lock on the VM is granting the user permission to view it.

Answer

An Azure Policy assignment that audits the VM is granting read access through compliance evaluation.

Answer

A private endpoint connected to the VM subnet is providing inherited read permission through networking.

Question 10

A finance web app in AppSubnet must connect to Azure SQL Database over the service's public endpoint. Only AppSubnet should be allowed, and the security team does not want to deploy any private IPs or change DNS. What should you configure?

Accepted Answer

Enable the Microsoft.Sql service endpoint on AppSubnet and add a virtual network rule on the SQL server.. Enabling the Microsoft.Sql service endpoint on AppSubnet allows traffic from that subnet to reach Azure SQL Database's public endpoint without requiring public IP addresses or DNS changes. Adding a virtual network rule on the SQL server restricts access exclusively to that subnet, meeting the security requirement without deploying private IPs.

Answer

A private endpoint for the SQL server and a private DNS zone linked to AppSubnet.

Answer

Create an NSG rule on AppSubnet to allow outbound TCP 1433 traffic to the SQL server's public IP address.

Answer

Publish the AppSubnet public IP address range in the SQL server firewall as an allow list.

Question 11

A support team must be able to start, stop, and restart virtual machines in one application resource group, but they must not create or delete VMs, modify disks, or manage networking. What is the best access approach?

Accepted Answer

Create a custom RBAC role with only the required VM power actions and assign it at the resource group scope.. Azure RBAC allows you to create a custom role with specific actions like Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/restart/action, and Microsoft.Compute/virtualMachines/deallocate/action, and assign it at the resource group scope. This grants the support team exactly the permissions needed to start, stop, and restart VMs without allowing VM creation, deletion, disk modification, or networking changes, adhering to the principle of least privilege.

Answer

Assign Contributor at the subscription scope so the team can manage all resources.

Answer

Assign Reader at the resource group scope and use Azure Policy to permit VM restarts.

Answer

Apply a resource lock to the resource group so the team can only make approved changes.

Question 12

Based on the exhibit, an automation account must restart virtual machines and read network interface settings in RG-App. Built-in roles are too broad because they also allow actions the team does not want. What should the administrator do?

Accepted Answer

Create a custom role with only the required read and restart actions, then assign it at RG-App.. Built-in roles like Virtual Machine Contributor include actions beyond the required scope (e.g., write/delete operations), which the team wants to avoid. A custom role allows precise definition of only the needed actions: 'Microsoft.Compute/virtualMachines/restart/action' and 'Microsoft.Network/networkInterfaces/read'. Assigning this custom role at the RG-App scope ensures least privilege without exposing broader permissions.

Answer

Assign the Reader role at RG-App, because reading permissions automatically include restart actions.

Answer

Assign Virtual Machine Contributor at the subscription scope so the automation account can reach all resources.

Answer

Create a management group and move RG-App into it so only the needed actions are exposed.

Question 13

A stateless web tier must survive a datacenter outage in a region that supports availability zones, and the number of instances should increase during business hours. Which three actions should the administrator take? Select three.

Accepted Answer

Deploy the workload as a virtual machine scale set instead of a standalone VM.. A virtual machine scale set (VMSS) provides automatic scaling and high availability across multiple instances, which is essential for a stateless web tier that must survive a datacenter outage. By deploying as a scale set instead of a standalone VM, the administrator gains the ability to distribute instances across availability zones and configure autoscale rules to adjust capacity based on demand, meeting both the resilience and elasticity requirements.

Answer

Place all instances in a single availability set and scale them manually.

Answer

Deploy only one zonal VM and use snapshots to recover if the datacenter fails.

Question 14

Order the steps to recover an Azure VM using Azure Backup.

Question 15

A finance application stores monthly invoice PDFs in Azure Blob Storage. The business wants the data to remain available if one availability zone in the region becomes unavailable, but it does not require a secondary region for read access. Which redundancy option should the administrator choose?

Accepted Answer

ZRS, because it replicates data across zones in the same region and stays available through a zone outage.. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the same region, ensuring that if one zone becomes unavailable, the data remains accessible from the other zones. This meets the business requirement of staying available during a zone outage without needing a secondary region for read access.

Answer

LRS, because it keeps three copies within a single datacenter and is the least expensive option.

Answer

GRS, because it keeps a readable copy in the paired region and is always the best choice for resilience.

Answer

RA-GRS, because it provides read access to the secondary region and is required for zone-level resilience.