AZ-104 Practice Test 36 — 15 Questions

Question 1

A user had a direct Reader assignment on a virtual machine, but that assignment was removed. The user can still open the VM blade and view its properties. Which two sources could still be granting access? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Reader assignment at the parent resource group, subscription, or management group scope can still be inherited by the VM.. Azure RBAC permissions are inherited from higher scopes. Even if a direct Reader assignment on the VM is removed, a Reader role assigned at the parent resource group, subscription, or management group scope will still grant the user read access to the VM through inheritance. This is a fundamental behavior of Azure RBAC, where permissions flow down the hierarchy.

Answer

A CanNotDelete lock on the VM is granting the user permission to view it.

Answer

An Azure Policy assignment that audits the VM is granting read access through compliance evaluation.

Answer

A private endpoint connected to the VM subnet is providing inherited read permission through networking.

Question 2

A finance web app in AppSubnet must connect to Azure SQL Database over the service's public endpoint. Only AppSubnet should be allowed, and the security team does not want to deploy any private IPs or change DNS. What should you configure?

Accepted Answer

Enable the Microsoft.Sql service endpoint on AppSubnet and add a virtual network rule on the SQL server.. Enabling the Microsoft.Sql service endpoint on AppSubnet allows traffic from that subnet to reach Azure SQL Database's public endpoint without requiring public IP addresses or DNS changes. Adding a virtual network rule on the SQL server restricts access exclusively to that subnet, meeting the security requirement without deploying private IPs.

Answer

A private endpoint for the SQL server and a private DNS zone linked to AppSubnet.

Answer

Create an NSG rule on AppSubnet to allow outbound TCP 1433 traffic to the SQL server's public IP address.

Answer

Publish the AppSubnet public IP address range in the SQL server firewall as an allow list.

Question 3

A support team must be able to start, stop, and restart virtual machines in one application resource group, but they must not create or delete VMs, modify disks, or manage networking. What is the best access approach?

Accepted Answer

Create a custom RBAC role with only the required VM power actions and assign it at the resource group scope.. Azure RBAC allows you to create a custom role with specific actions like Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/restart/action, and Microsoft.Compute/virtualMachines/deallocate/action, and assign it at the resource group scope. This grants the support team exactly the permissions needed to start, stop, and restart VMs without allowing VM creation, deletion, disk modification, or networking changes, adhering to the principle of least privilege.

Answer

Assign Contributor at the subscription scope so the team can manage all resources.

Answer

Assign Reader at the resource group scope and use Azure Policy to permit VM restarts.

Answer

Apply a resource lock to the resource group so the team can only make approved changes.

Question 4

Based on the exhibit, an automation account must restart virtual machines and read network interface settings in RG-App. Built-in roles are too broad because they also allow actions the team does not want. What should the administrator do?

Accepted Answer

Create a custom role with only the required read and restart actions, then assign it at RG-App.. Built-in roles like Virtual Machine Contributor include actions beyond the required scope (e.g., write/delete operations), which the team wants to avoid. A custom role allows precise definition of only the needed actions: 'Microsoft.Compute/virtualMachines/restart/action' and 'Microsoft.Network/networkInterfaces/read'. Assigning this custom role at the RG-App scope ensures least privilege without exposing broader permissions.

Answer

Assign the Reader role at RG-App, because reading permissions automatically include restart actions.

Answer

Assign Virtual Machine Contributor at the subscription scope so the automation account can reach all resources.

Answer

Create a management group and move RG-App into it so only the needed actions are exposed.

Question 5

A stateless web tier must survive a datacenter outage in a region that supports availability zones, and the number of instances should increase during business hours. Which three actions should the administrator take? Select three.

Accepted Answer

Deploy the workload as a virtual machine scale set instead of a standalone VM.. A virtual machine scale set (VMSS) provides automatic scaling and high availability across multiple instances, which is essential for a stateless web tier that must survive a datacenter outage. By deploying as a scale set instead of a standalone VM, the administrator gains the ability to distribute instances across availability zones and configure autoscale rules to adjust capacity based on demand, meeting both the resilience and elasticity requirements.

Answer

Place all instances in a single availability set and scale them manually.

Answer

Deploy only one zonal VM and use snapshots to recover if the datacenter fails.

Question 6

A finance application stores monthly invoice PDFs in Azure Blob Storage. The business wants the data to remain available if one availability zone in the region becomes unavailable, but it does not require a secondary region for read access. Which redundancy option should the administrator choose?

Accepted Answer

ZRS, because it replicates data across zones in the same region and stays available through a zone outage.. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the same region, ensuring that if one zone becomes unavailable, the data remains accessible from the other zones. This meets the business requirement of staying available during a zone outage without needing a secondary region for read access.

Answer

LRS, because it keeps three copies within a single datacenter and is the least expensive option.

Answer

GRS, because it keeps a readable copy in the paired region and is always the best choice for resilience.

Answer

RA-GRS, because it provides read access to the secondary region and is required for zone-level resilience.

Question 7

The platform team wants every resource deployed in a subscription to include an Environment tag. New resources that do not meet the rule must be blocked, and existing noncompliant resources should appear in compliance reports. What should be configured?

Accepted Answer

An Azure Policy assignment at the subscription scope with a deny effect.. Azure Policy with a deny effect at the subscription scope is the correct choice because it enforces a rule that blocks the creation or update of any resource that does not include the required 'Environment' tag. The deny effect actively prevents noncompliant deployments, while the policy itself evaluates existing resources and marks them as noncompliant in compliance reports, meeting both requirements.

Answer

A Contributor role assignment at the subscription scope.

Answer

A resource lock on the subscription.

Answer

A custom RBAC role that includes tag write permissions.

Question 8

Based on the exhibit, an auditor needs to view all resources in RG-Finance but must not be able to make any changes. The auditor also should not have access to other resource groups. Which RBAC assignment best meets the requirement?

Accepted Answer

Reader at RG-Finance scope, because it allows viewing without granting write permissions.. The Reader role at the RG-Finance scope grants read-only access to all resources within that specific resource group, preventing any modifications. This meets the auditor's requirement to view resources in RG-Finance without write permissions and without access to other resource groups, as the scope is limited to RG-Finance.

Answer

Reader at the subscription scope, because it is read-only and easy to manage.

Answer

Contributor at RG-Finance scope, because the auditor needs to read tags and configuration.

Answer

Reader at the management group scope, because all finance resources are grouped there.

Question 9

A lifecycle rule moved old audit logs to the Archive tier. A support engineer now needs to read one archived blob, and the download request fails with a message that the blob is archived. The engineer can wait several hours for the data to become available. What should the administrator do?

Accepted Answer

Change the blob tier from Archive to Hot or Cool to start rehydration.. Archived blobs in Azure Storage are offline and cannot be read directly. To access the data, the blob must first be rehydrated by changing its tier to Hot or Cool, which initiates an asynchronous copy of the blob data to an online tier. This process can take up to 15 hours, matching the engineer's ability to wait several hours.

Answer

Enable versioning on the storage account so the archived blob can be read immediately.

Answer

Move the blob to a different container in the same storage account.

Answer

Switch the storage account replication from LRS to ZRS.

Question 10

An application team plans to store block blobs for application logs, lifecycle them to cooler tiers over time, and use Azure Monitor diagnostic exports from several Azure resources into the same storage account. They also want access tier controls and general-purpose features in one place. Which storage account type should the administrator create?

Accepted Answer

StorageV2 general-purpose account, because it supports blobs, tiering, and broad Azure integrations.. A StorageV2 general-purpose account (B) is the correct choice because it supports block blobs, lifecycle management policies for tiering to cool, cold, and archive tiers, and integrates seamlessly with Azure Monitor diagnostic exports. Unlike specialized accounts, StorageV2 provides a unified platform for blobs, files, queues, and tables, meeting the team's need for access tier controls and general-purpose features in one place.

Answer

BlobStorage account, because it is optimized for storing only unstructured blobs.

Answer

FileStorage account, because it supports any Azure diagnostic data format and access tiers.

Answer

BlockBlobStorage account, because it is required whenever logs are exported from Azure Monitor.

Question 11

A finance team stores monthly invoice PDFs in Azure and wants the data to remain available if an entire availability zone in the region fails. They do not need read access to a secondary region, and they want to keep the storage service simple. Which redundancy option should they choose for the storage account?

Accepted Answer

Zone-redundant storage (ZRS), because it replicates data across zones in the same region.. Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones within the same region, ensuring durability even if an entire zone fails. This meets the requirement for intra-region zone failure protection without needing a secondary region, and it keeps the storage service simple by avoiding the complexity of geo-replication.

Answer

Locally redundant storage (LRS), because it protects against a single disk failure inside one datacenter.

Answer

Geo-redundant storage (GRS), because it automatically provides the lowest-cost cross-region protection.

Answer

Geo-zone-redundant storage (GZRS), because it is required whenever zone resilience is needed.

Question 12

During a change freeze, an administrator applies a lock to a resource group. Users can still read resource details, but attempts to update tags, resize a VM, or change an NSG fail. Which lock was applied?

Accepted Answer

ReadOnly lock, because it blocks write operations while allowing read access.. The ReadOnly lock (option B) is correct because it explicitly blocks all write operations (including updates to tags, resizing a VM, or modifying an NSG) while allowing read operations. This matches the scenario where users can still read resource details but cannot perform any modifications.

Answer

CanNotDelete lock, because it blocks all updates but allows reading.

Answer

Reader role assignment, because it removes edit permissions from the group.

Answer

Azure Policy audit assignment, because it reports changes without blocking them.

Question 13

An administrator has already increased the size of a managed data disk attached to a running Windows VM. Azure now shows the larger disk size, but the application still cannot use the new capacity. What should the administrator do next?

Accepted Answer

Expand the partition or volume inside the guest operating system.. When a managed data disk attached to a running Windows VM is resized in Azure, the underlying virtual hard disk (VHD) expands, but the guest operating system does not automatically recognize the new unallocated space. The administrator must use the Disk Management tool (diskmgmt.msc) or the diskpart command to extend the volume or partition into the unallocated space. This is a standard operating system task, not an Azure control-plane action.

Answer

Detach the disk, shrink it, and reattach it to refresh the filesystem.

Answer

Convert the data disk to a shared disk so Windows can auto-detect the size increase.

Answer

Redeploy the virtual machine to apply the new disk size.

Question 14

Which two statements about network security group processing are correct? Select two.

Accepted Answer

NSG rules are evaluated starting with the lowest priority number.. NSG rules are processed in order of increasing priority number, meaning the rule with the lowest priority number (e.g., 100) is evaluated first. This ensures that more specific or critical rules can be applied before broader rules with higher priority numbers.

Answer

An NSG can be linked only to a subnet, not to a network interface card.

Answer

Azure ignores NSG rules whenever a route table is attached to the subnet.

Answer

Security rules are processed alphabetically by name.

Question 15

A contractor is a member of an Entra security group that has a PIM-eligible Contributor assignment on a resource group. The contractor sees the role in the portal, but deployment fails with a role not active message. The activation policy requires justification, MFA, and manager approval. Which two actions are required before the deployment succeeds? Select two.

Accepted Answer

Activate the eligible role assignment in Privileged Identity Management.. The contractor has a PIM-eligible role assignment, which means the role is not active until the user activates it through Privileged Identity Management. Activation is a prerequisite for the role to be effective, and without it, any deployment requiring the Contributor role will fail with a 'role not active' message.

Answer

Add the contractor directly to the subscription Owner role to bypass the eligibility workflow.

Answer

Wait for Azure Policy compliance evaluation to finish before trying again.

Answer

Remove the user from the security group and add them back so the role becomes active.