AZ-104 Practice Test 37 — 15 Questions

Question 1

A private endpoint was created for Azure SQL Database in VNet A. A VM in peered VNet B can reach other resources, but it resolves the SQL server name to the public IP and connection attempts fail because public network access is disabled. What is the best fix?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Link the appropriate private DNS zone to VNet B.. When public network access is disabled on an Azure SQL Database, the private endpoint in VNet A provides a private IP address for the SQL server. However, for VMs in peered VNet B to resolve the SQL server's fully qualified domain name (FQDN) to that private IP instead of the public IP, the private DNS zone (typically `privatelink.database.windows.net`) must be linked to VNet B. Without this link, DNS resolution falls back to the public IP, causing connection failures because public access is disabled.

Answer

Add an outbound NSG rule allowing TCP 1433 to the internet.

Answer

Assign a public IP address to the private endpoint.

Answer

Replace the private endpoint with a service endpoint.

Question 2

Based on the exhibit, the operations team says the alert is too noisy because short CPU spikes after nightly maintenance trigger notifications. They want an alert only when VM1's average CPU stays above 80% for at least 10 minutes. What should you change?

Accepted Answer

Increase the window size to 10 minutes and keep the evaluation frequency at 1 minute.. Increasing the window size to 10 minutes while keeping the evaluation frequency at 1 minute means the alert will only fire when the average CPU over the last 10 minutes exceeds 80%. This filters out transient spikes from nightly maintenance, as the alert requires sustained high CPU for the full duration. The evaluation frequency of 1 minute ensures the alert is checked every minute, but the condition is based on the 10-minute rolling average.

Answer

Lower the threshold to 70% so the alert becomes less sensitive.

Answer

Replace the metric alert with a Log Analytics query alert against the activity log.

Answer

Move the alert scope from the VM to the resource group.

Question 3

Based on the exhibit, three Azure virtual machines run the same automation script. The VMs are rebuilt often, and the team wants one identity that can be reused across all three VMs and retained even if a VM is replaced. Which identity type should the administrator use?

Accepted Answer

A user-assigned managed identity attached to all three VMs.. A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource and can be assigned to multiple VMs. Unlike system-assigned identities, which are tied to the lifecycle of a single VM, a user-assigned identity persists independently and remains available even when VMs are rebuilt or replaced. This allows the automation script to use the same identity across all three VMs without needing to reconfigure permissions after each rebuild.

Answer

System-assigned managed identity on each VM, because each VM gets the same identity automatically.

Answer

An Azure AD guest user account, because the same account can sign in from every VM.

Answer

A shared storage account key, because it can be used by multiple VMs without extra configuration.

Question 4

An application in a subnet must access an Azure Storage account over a private IP. The storage account must not be reachable through its public endpoint, and access should be limited to that subnet only. Which configuration should the administrator implement?

Accepted Answer

Create a private endpoint in the subnet and disable public network access on the storage account.. A private endpoint assigns a private IP from the subnet to the storage account, effectively bringing the service into the virtual network. Disabling public network access ensures the storage account is only reachable via that private endpoint, meeting the requirement to block public endpoint access and limit access to the specific subnet.

Answer

Create a service endpoint for Microsoft.Storage on the subnet and keep the public endpoint enabled.

Answer

Use a shared access signature token and leave network settings unchanged.

Answer

Associate the storage account with a NAT gateway to control inbound access.

Question 5

Based on the exhibit, which network feature should you use so only the subnet can reach the storage account while still using the public endpoint?

Accepted Answer

Enable a service endpoint on app-subnet and allow that subnet on the storage firewall.. Enabling a service endpoint on the app-subnet allows traffic from that subnet to reach the storage account over the Azure backbone network while still using the public endpoint. By then adding the subnet to the storage account firewall, you restrict access to only that subnet, ensuring no other internet traffic can reach the storage account. This approach leverages the public endpoint but with subnet-level access control, meeting the requirement.

Answer

Create a private endpoint and disable the storage account public endpoint.

Answer

Add a NAT gateway to app-subnet and use the NAT public IP for firewall rules.

Answer

Peer app-subnet with a new VNet and access the storage account through peering.

Question 6

A VM named VM1 cannot establish TCP 1433 connectivity to VM2. The administrator wants to test the exact flow, confirm whether an NSG allows or denies it, and identify the rule that applies if the flow is blocked. Which Network Watcher tool should be used?

Accepted Answer

IP flow verify, because it evaluates the 5-tuple and reports the matching allow or deny rule.. IP flow verify is the correct tool because it evaluates the 5-tuple (source IP, destination IP, source port, destination port, and protocol) against the effective Network Security Group (NSG) rules for a given virtual machine network interface. It explicitly reports whether the traffic is allowed or denied and, if denied, identifies the exact NSG rule (name and priority) that caused the denial. This directly meets the administrator's requirement to test the exact flow and identify the blocking rule.

Answer

Effective routes, because it shows the exact NSG rule name for blocked traffic.

Answer

Packet capture, because it automatically tells you which NSG rule denied the traffic.

Answer

Connection troubleshoot, because it only checks DNS name resolution.

Question 7

A VM subnet has an NSG with these custom rules:
- Inbound priority 100: Allow TCP 443 from Internet
- Outbound priority 100: Deny Any to Internet
The VM hosts an app that must download updates from an HTTPS repository on the Internet. The downloads fail. What change should be made?

Accepted Answer

Add an outbound allow rule for TCP 443 to Internet or the repository service tag.. The VM's outbound traffic is blocked by the default outbound deny rule (priority 100). Since the app needs to download updates from an HTTPS repository (TCP 443), an outbound allow rule for TCP 443 to the Internet or the repository service tag is required. Inbound rules do not affect outbound traffic, so the existing inbound allow rule is irrelevant to the download failure.

Answer

Add another inbound allow rule for TCP 443 from the repository address.

Answer

Change the inbound allow rule to priority 50.

Answer

Remove the VM's public IP address.

Question 8

You need to ensure that all newly created resource groups in a subscription automatically inherit the CostCenter tag with a fixed value, even if the creator forgets to add it. Which Azure Policy effect should you use?

Accepted Answer

Modify. The Modify effect is correct because it allows Azure Policy to automatically add or alter tags on resources or resource groups during creation or update, ensuring the CostCenter tag with a fixed value is applied even if the creator omits it. Unlike Audit or Deny, Modify actively remediates non-compliant resources by appending the required tag, making it ideal for enforcing mandatory inheritance without blocking deployment.

Answer

Audit

Answer

Deny

Answer

Disabled

Question 9

A team has an existing storage account with the public endpoint enabled. They want to allow access only from a specific subnet in a virtual network, but they do not want to create a private endpoint or manage private DNS zones. Which configuration should the administrator use?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account network rules.. Enabling a service endpoint for Microsoft.Storage on the subnet allows traffic from that subnet to the storage account over the Azure backbone network, and then adding the subnet to the storage account's network rules restricts access to only that subnet while keeping the public endpoint enabled. This meets the requirement of not using a private endpoint or managing private DNS zones.

Answer

Create a private endpoint and disable the public endpoint.

Answer

Assign a SAS token to the subnet so only resources there can connect.

Answer

Use an Azure Policy assignment to block public traffic to the storage account.

Question 10

A VM in a subnet must access an Azure Storage account without creating a private endpoint. The organization is fine with the storage account remaining on its public endpoint, but traffic should stay on the Azure backbone rather than the public internet. Which feature should you use?

Accepted Answer

A service endpoint for Microsoft.Storage on the subnet.. A service endpoint for Microsoft.Storage on the subnet extends the virtual network identity to the storage account, allowing traffic from the subnet to the storage account's public endpoint to traverse the Azure backbone network instead of the public internet. This meets the requirement of keeping traffic on the Azure backbone without creating a private endpoint, as service endpoints use the public endpoint but route traffic through Microsoft's network.

Answer

A private endpoint and a private DNS zone.

Answer

A NAT gateway attached to the subnet.

Answer

A VPN gateway connection to the storage account resource group.

Question 11

A reporting server will run an analytics engine that needs 8 vCPUs and 64 GiB of RAM. Average CPU use is expected to stay moderate, but the workload is memory heavy and should not use a burstable SKU. Which two deployment choices best align with the requirement? Select two.

Accepted Answer

Select a memory-optimized VM family.. The workload is memory heavy, and memory-optimized VM families (e.g., E-series) are designed with a higher memory-to-vCPU ratio to handle such workloads efficiently. Option B is correct because the requirement explicitly states 8 vCPUs and 64 GiB of RAM, so selecting a size that meets these exact specifications is necessary, regardless of family, as long as it is not burstable.

Answer

Choose a burstable B-series size to lower cost.

Answer

Pick a compute-optimized F-series size because CPU use is only moderate.

Answer

Select the smallest VM size that supports managed disks.

Question 12

A hub VNet is peered to two spoke VNets. The spokes can reach the hub, but they cannot communicate with each other through the hub. The administrator wants centralized inspection in the hub. What should be deployed and configured?

Accepted Answer

An Azure Firewall or other NVA in the hub, plus user-defined routes and forwarding support.. Azure Firewall or an NVA in the hub can inspect traffic between spokes, but by default, Azure routing does not forward spoke-to-spoke traffic through the hub. To force this traffic through the firewall, you must configure user-defined routes (UDRs) on the spoke subnets with a next hop of the firewall's private IP, and enable IP forwarding on the NVA. This setup enables centralized inspection and transitive routing through the hub.

Answer

Only additional peering links between the hub and both spokes.

Answer

A private endpoint in the hub for each spoke subnet.

Answer

A service endpoint on each spoke subnet to the hub VNet.

Question 13

A web app currently accesses Azure Blob Storage by using the storage account key in a connection string. Security now requires blocking any new requests that use shared key authorization, while Microsoft Entra-based access must continue to work. Which storage account setting should the administrator change?

Accepted Answer

Disable shared key authorization on the storage account.. Disabling shared key authorization on the storage account explicitly blocks all requests that use the storage account key (shared key) for authentication, while still allowing requests authenticated via Microsoft Entra ID (formerly Azure AD). This directly meets the security requirement to block new requests using shared key authorization without affecting Entra-based access.

Answer

Set the storage account network access to selected networks only.

Answer

Rotate the account keys and leave all authentication methods enabled.

Answer

Enable object replication for the storage account.

Question 14

You want to deploy a resource group with Bicep and see the changes Azure plans to make before you apply them. Which command should you run?

Accepted Answer

az deployment group what-if. The `az deployment group what-if` command is correct because it performs a dry-run validation of a Bicep (or ARM) deployment against a resource group, showing the changes Azure will make (create, modify, delete) without actually applying them. This is the Azure equivalent of a 'what-if' analysis, allowing you to review the impact before execution.

Answer

az deployment group create

Answer

az group delete

Answer

az vm update

Question 15

A team needs to understand Azure RBAC inheritance. Which two statements are correct? Select two.

Accepted Answer

A role assignment at a resource group scope applies to resources inside that group.. Azure RBAC inheritance follows a hierarchical scope model: a role assignment at a resource group scope applies to all resources within that resource group, as the resource group is the parent scope for its child resources. This means any user or group assigned a role at the resource group level automatically inherits those permissions for every resource (e.g., VMs, storage accounts) inside that group, without needing separate assignments.

Answer

A role assignment at a resource scope automatically applies to all other resources in the subscription.

Answer

A role assignment at management group scope applies only to the subscription where it was created.

Answer

A role assignment at a resource group scope is broader than a subscription scope.