AZ-104 Practice Test 37 — 15 Questions

Question 1

Based on the exhibit, a contractor must be able to restart only one virtual machine named vm-pay-01 and read its properties. The contractor must not be able to manage any other VM in the resource group. Where should the role assignment be created?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

At the resource scope for vm-pay-01 so the contractor receives permissions only on that VM.. Azure RBAC allows role assignments at the resource scope, which in this case is the virtual machine vm-pay-01. By assigning a role (e.g., Virtual Machine Contributor or a custom role with restart and read permissions) directly to the VM resource, the contractor receives permissions only on that specific VM, fulfilling the requirement to restrict access to other VMs in the resource group.

Answer

At the subscription scope so the contractor inherits access everywhere in the subscription.

Answer

At the resource group scope because resource assignments cannot be applied to virtual machines.

Answer

At the management group scope so the same role can be reused for all payroll subscriptions.

Question 2

Based on the exhibit, the governance team wants to assign three related policy definitions together: allowed regions, required tags, and approved VM SKUs. What should the administrator create first?

Accepted Answer

A policy initiative that groups the three policy definitions into one object.. A policy initiative (also known as a policy set) is the correct answer because it allows you to group multiple related policy definitions into a single assignable object. This is the intended Azure governance pattern for bundling policies like allowed regions, required tags, and approved VM SKUs, ensuring they are applied together consistently across management groups or subscriptions.

Answer

A resource lock so the policies cannot be changed after assignment.

Answer

A custom RBAC role that grants permission to edit policy assignments.

Answer

A management group exemption so all three rules apply automatically.

Question 3

A business-critical storage account must keep data available if one availability zone fails in the primary region. It must also keep a readable copy in the paired region so administrators can verify data during disaster recovery testing before failover. Which redundancy option should be selected?

Accepted Answer

RA-GZRS, because it provides zone redundancy in the primary region and read access to the secondary region.. D is correct because RA-GZRS (Read-Access Geo-Zone-Redundant Storage) provides synchronous replication across three Azure availability zones within the primary region, ensuring data remains available if one zone fails. It also asynchronously replicates data to the paired region, where a read-only copy is available for verification during disaster recovery testing without requiring a failover.

Answer

LRS, because it stores three copies in one datacenter and is the lowest-cost option.

Answer

ZRS, because it replicates data across zones in the same region but not to another region.

Answer

GRS, because it replicates to the paired region and supports a secondary copy for recovery.

Question 4

An administrator wants a storage account to be accessible only from one subnet. The storage account should still use its public FQDN, the team does not want a private IP address in the VNet, and they do not want to manage private DNS zones. Which solution should be used?

Accepted Answer

Enable a service endpoint on the subnet and restrict the storage firewall to that subnet.. A service endpoint allows the storage account to be accessed from a specific subnet while still using the public FQDN. By enabling a service endpoint on the subnet and configuring the storage firewall to allow traffic only from that subnet, the administrator meets all requirements: no private IP, no private DNS zones, and access restricted to one subnet.

Answer

Create a private endpoint and disable public network access.

Answer

Peer the subnet to a dedicated storage VNet and route traffic through peering.

Answer

Assign a route table with a host route to the storage account.

Question 5

A contractor should be able to view resources in one resource group for 30 days. When the contract ends, removing the contractor from the group should immediately remove access. What is the best approach?

Accepted Answer

Assign Reader to an Entra ID group and add the contractor to that group.. Assigning the Reader role to an Entra ID group and adding the contractor as a member allows centralized access management. When the contractor is removed from the group, the role assignment is immediately revoked because Azure RBAC evaluates group membership at the time of authorization. This meets the 30-day requirement and ensures instant access removal upon contract termination.

Answer

Assign Reader directly to the contractor's user account at the resource group scope.

Answer

Assign Reader at the subscription scope to the contractor so access is simple.

Answer

Create a CanNotDelete lock on the resource group until the contract ends.

Question 6

A line-of-business app runs on two Azure VMs in the same region. The business wants to reduce the chance that both VMs are affected by the same planned host update. What should the administrator use?

Accepted Answer

An availability set. An availability set ensures that VMs are placed on different fault domains and update domains within an Azure datacenter. Fault domains isolate VMs from shared hardware failures, while update domains ensure that planned host updates (e.g., OS patching) are applied sequentially across groups, so not all VMs are rebooted simultaneously. This directly reduces the chance that both VMs are affected by the same planned host update.

Answer

A public load balancer

Answer

A managed image

Answer

A private endpoint

Question 7

A private endpoint was created for Azure SQL Database in VNet A. A VM in peered VNet B can reach other resources, but it resolves the SQL server name to the public IP and connection attempts fail because public network access is disabled. What is the best fix?

Accepted Answer

Link the appropriate private DNS zone to VNet B.. When public network access is disabled on an Azure SQL Database, the private endpoint in VNet A provides a private IP address for the SQL server. However, for VMs in peered VNet B to resolve the SQL server's fully qualified domain name (FQDN) to that private IP instead of the public IP, the private DNS zone (typically `privatelink.database.windows.net`) must be linked to VNet B. Without this link, DNS resolution falls back to the public IP, causing connection failures because public access is disabled.

Answer

Add an outbound NSG rule allowing TCP 1433 to the internet.

Answer

Assign a public IP address to the private endpoint.

Answer

Replace the private endpoint with a service endpoint.

Question 8

Based on the exhibit, the operations team says the alert is too noisy because short CPU spikes after nightly maintenance trigger notifications. They want an alert only when VM1's average CPU stays above 80% for at least 10 minutes. What should you change?

Accepted Answer

Increase the window size to 10 minutes and keep the evaluation frequency at 1 minute.. Increasing the window size to 10 minutes while keeping the evaluation frequency at 1 minute means the alert will only fire when the average CPU over the last 10 minutes exceeds 80%. This filters out transient spikes from nightly maintenance, as the alert requires sustained high CPU for the full duration. The evaluation frequency of 1 minute ensures the alert is checked every minute, but the condition is based on the 10-minute rolling average.

Answer

Lower the threshold to 70% so the alert becomes less sensitive.

Answer

Replace the metric alert with a Log Analytics query alert against the activity log.

Answer

Move the alert scope from the VM to the resource group.

Question 9

Based on the exhibit, three Azure virtual machines run the same automation script. The VMs are rebuilt often, and the team wants one identity that can be reused across all three VMs and retained even if a VM is replaced. Which identity type should the administrator use?

Accepted Answer

A user-assigned managed identity attached to all three VMs.. A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource and can be assigned to multiple VMs. Unlike system-assigned identities, which are tied to the lifecycle of a single VM, a user-assigned identity persists independently and remains available even when VMs are rebuilt or replaced. This allows the automation script to use the same identity across all three VMs without needing to reconfigure permissions after each rebuild.

Answer

System-assigned managed identity on each VM, because each VM gets the same identity automatically.

Answer

An Azure AD guest user account, because the same account can sign in from every VM.

Answer

A shared storage account key, because it can be used by multiple VMs without extra configuration.

Question 10

An application in a subnet must access an Azure Storage account over a private IP. The storage account must not be reachable through its public endpoint, and access should be limited to that subnet only. Which configuration should the administrator implement?

Accepted Answer

Create a private endpoint in the subnet and disable public network access on the storage account.. A private endpoint assigns a private IP from the subnet to the storage account, effectively bringing the service into the virtual network. Disabling public network access ensures the storage account is only reachable via that private endpoint, meeting the requirement to block public endpoint access and limit access to the specific subnet.

Answer

Create a service endpoint for Microsoft.Storage on the subnet and keep the public endpoint enabled.

Answer

Use a shared access signature token and leave network settings unchanged.

Answer

Associate the storage account with a NAT gateway to control inbound access.

Question 11

Based on the exhibit, which network feature should you use so only the subnet can reach the storage account while still using the public endpoint?

Accepted Answer

Enable a service endpoint on app-subnet and allow that subnet on the storage firewall.. Enabling a service endpoint on the app-subnet allows traffic from that subnet to reach the storage account over the Azure backbone network while still using the public endpoint. By then adding the subnet to the storage account firewall, you restrict access to only that subnet, ensuring no other internet traffic can reach the storage account. This approach leverages the public endpoint but with subnet-level access control, meeting the requirement.

Answer

Create a private endpoint and disable the storage account public endpoint.

Answer

Add a NAT gateway to app-subnet and use the NAT public IP for firewall rules.

Answer

Peer app-subnet with a new VNet and access the storage account through peering.

Question 12

A VM named VM1 cannot establish TCP 1433 connectivity to VM2. The administrator wants to test the exact flow, confirm whether an NSG allows or denies it, and identify the rule that applies if the flow is blocked. Which Network Watcher tool should be used?

Accepted Answer

IP flow verify, because it evaluates the 5-tuple and reports the matching allow or deny rule.. IP flow verify is the correct tool because it evaluates the 5-tuple (source IP, destination IP, source port, destination port, and protocol) against the effective Network Security Group (NSG) rules for a given virtual machine network interface. It explicitly reports whether the traffic is allowed or denied and, if denied, identifies the exact NSG rule (name and priority) that caused the denial. This directly meets the administrator's requirement to test the exact flow and identify the blocking rule.

Answer

Effective routes, because it shows the exact NSG rule name for blocked traffic.

Answer

Packet capture, because it automatically tells you which NSG rule denied the traffic.

Answer

Connection troubleshoot, because it only checks DNS name resolution.

Question 13

A VM subnet has an NSG with these custom rules:
- Inbound priority 100: Allow TCP 443 from Internet
- Outbound priority 100: Deny Any to Internet
The VM hosts an app that must download updates from an HTTPS repository on the Internet. The downloads fail. What change should be made?

Accepted Answer

Add an outbound allow rule for TCP 443 to Internet or the repository service tag.. The VM's outbound traffic is blocked by the default outbound deny rule (priority 100). Since the app needs to download updates from an HTTPS repository (TCP 443), an outbound allow rule for TCP 443 to the Internet or the repository service tag is required. Inbound rules do not affect outbound traffic, so the existing inbound allow rule is irrelevant to the download failure.

Answer

Add another inbound allow rule for TCP 443 from the repository address.

Answer

Change the inbound allow rule to priority 50.

Answer

Remove the VM's public IP address.

Question 14

You need to ensure that all newly created resource groups in a subscription automatically inherit the CostCenter tag with a fixed value, even if the creator forgets to add it. Which Azure Policy effect should you use?

Accepted Answer

Modify. The Modify effect is correct because it allows Azure Policy to automatically add or alter tags on resources or resource groups during creation or update, ensuring the CostCenter tag with a fixed value is applied even if the creator omits it. Unlike Audit or Deny, Modify actively remediates non-compliant resources by appending the required tag, making it ideal for enforcing mandatory inheritance without blocking deployment.

Answer

Audit

Answer

Deny

Answer

Disabled

Question 15

A team has an existing storage account with the public endpoint enabled. They want to allow access only from a specific subnet in a virtual network, but they do not want to create a private endpoint or manage private DNS zones. Which configuration should the administrator use?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account network rules.. Enabling a service endpoint for Microsoft.Storage on the subnet allows traffic from that subnet to the storage account over the Azure backbone network, and then adding the subnet to the storage account's network rules restricts access to only that subnet while keeping the public endpoint enabled. This meets the requirement of not using a private endpoint or managing private DNS zones.

Answer

Create a private endpoint and disable the public endpoint.

Answer

Assign a SAS token to the subnet so only resources there can connect.

Answer

Use an Azure Policy assignment to block public traffic to the storage account.