AZ-104 Practice Test 38 — 15 Questions

Question 1

Based on the exhibit, two development virtual networks must be peered so the workloads can exchange traffic directly. What should the administrator do first?

Accepted Answer

Change one VNet to a non-overlapping address space before creating the peering.. Azure Virtual Network peering requires that the address spaces of the peered VNets do not overlap. Overlapping address spaces cause routing conflicts because Azure cannot determine which VNet should receive traffic destined for the overlapping range. Therefore, the administrator must first change one VNet to a non-overlapping address space before creating the peering.

Answer

Create a VPN gateway in each VNet before attempting peering.

Answer

Add a user-defined route to each subnet so the VNets can ignore the overlap.

Answer

Enable service endpoints on both VNets to allow cross-network communication.

Question 2

Which two statements about application security groups and service tags are correct? Select two.

Accepted Answer

An application security group lets you reference a set of virtual machines in NSG rules.. Option A is correct because an application security group (ASG) allows you to group virtual machines logically, and then reference that group as a source or destination in network security group (NSG) rules. This simplifies rule management by decoupling the rule from individual VM IP addresses or NICs, enabling dynamic membership based on application tiers.

Answer

Application security groups are used to assign Azure roles.

Answer

Service tags are custom labels you create for your own subscriptions.

Answer

Service tags create a private IP address for a service.

Question 3

An application on an Azure VM needs more CPU and memory. The administrator wants to keep the same OS disk and installed apps, without redeploying the server. What should be done?

Accepted Answer

Resize the VM to a larger size. Resizing the VM (Option A) allows you to change the VM size to a SKU with more CPU and memory while preserving the OS disk, installed applications, and all data. This operation can be performed on a stopped (deallocated) VM and does not require redeployment or reimaging, making it the correct choice for scaling up resources without disruption to the existing configuration.

Answer

Reimage the VM

Answer

Move the VM into a different availability zone

Answer

Create a new storage account

Question 4

Based on the exhibit, which policy best matches the requirement for daily backups retained for 30 days?

Accepted Answer

A policy with daily backups retained for 30 days.. Option B is correct because the requirement explicitly states 'daily backups retained for 30 days.' A backup policy in Azure Backup allows you to define the frequency (daily) and retention duration (30 days) for recovery points. This policy directly matches the requirement without over-retention or under-retention.

Answer

A policy with daily backups retained for 7 days.

Answer

A policy with weekly backups retained for 30 days.

Answer

A policy with daily backups retained for 365 days.

Question 5

Based on the exhibit, you want the resource logs for the storage account to appear in Log Analytics so you can investigate read and write failures. What should you configure?

Accepted Answer

Add a diagnostic setting that sends resource logs to the Log Analytics workspace.. Diagnostic settings in Azure allow you to stream resource logs (such as StorageRead and StorageWrite logs) from a storage account directly to a Log Analytics workspace. By configuring a diagnostic setting with the appropriate log categories enabled, you can query and analyze read and write failures in Log Analytics without additional infrastructure.

Answer

Create a metric alert rule on the storage account and link it to an action group.

Answer

Enable a resource lock so the storage account cannot be modified.

Answer

Move the storage account to a different subscription that already has Log Analytics enabled.

Question 6

An application runs on two VMs in one Azure region. The business wants protection from a single hardware host failure and planned maintenance, but it does not require protection from an entire datacenter outage. Which two choices should the administrator make? Select two.

Accepted Answer

Place both VMs in an availability set.. An availability set distributes VMs across multiple fault domains (hardware hosts) and update domains within a single Azure datacenter. This protects against a single hardware host failure and planned maintenance (update domains ensure VMs are not rebooted simultaneously during updates). Option B is correct because it provides this isolation without requiring protection from an entire datacenter outage.

Answer

Place the workload in a single VM with a premium SSD.

Answer

Use availability zones across the region.

Answer

Replicate the VMs to another region with Azure Site Recovery.

Question 7

Central IT wants to apply three related policy definitions—allowed Azure regions, required owner tag, and approved VM sizes—to all subscriptions in the Corp management group and report compliance as one package. What should the administrator create?

Accepted Answer

An initiative. An initiative (also known as a policy set) in Azure Policy allows you to group multiple related policy definitions into a single package. By assigning the initiative to the Corp management group, all subscriptions under that management group inherit the three policies (allowed regions, required owner tag, approved VM sizes) as a bundle, and compliance is reported collectively for the entire initiative.

Answer

A resource lock

Answer

A role assignment

Answer

A managed identity

Question 8

A user accidentally deleted a nested folder tree from an Azure file share yesterday. Other folders were modified after the deletion and must not be rolled back. The administrator wants to restore only the deleted folder tree. What is the best recovery method?

Accepted Answer

Use a file share snapshot and copy the deleted folder tree back into the live share.. Azure file share snapshots provide a point-in-time, read-only copy of the entire file share. By mounting a snapshot taken before the accidental deletion, the administrator can browse the snapshot's directory structure and copy only the deleted folder tree back into the live share. This approach restores the lost data without affecting any other files or folders that were modified after the snapshot was taken, meeting the requirement to avoid rolling back other changes.

Answer

Delete the current share and restore the whole share from the most recent backup.

Answer

Change the share’s access tier from Hot to Cool and then refresh the folder view.

Answer

Enable soft delete for blobs in the same storage account and recover the folder from there.

Question 9

A workload uses Azure Blob Storage for customer uploads. The team wants protection against a datacenter failure within the primary region and wants data copied to a paired region for disaster recovery, but they do not need to read from the secondary region during normal operations. Which redundancy option fits best?

Accepted Answer

GZRS. GZRS (Geo-Zone-Redundant Storage) is correct because it combines ZRS within the primary region (synchronously replicating data across three Azure availability zones) with asynchronous geo-replication to a paired secondary region. This provides protection against both a datacenter failure (via ZRS) and a full region failure (via geo-replication), while the lack of read access from the secondary during normal operations matches the requirement exactly.

Answer

ZRS

Answer

RA-GZRS

Answer

GRS

Question 10

A team wants to restrict a storage account so only one Azure subnet can reach it. They do not need a private IP address, and they are fine with the storage account still using its public endpoint. Which configuration should the administrator use?

Accepted Answer

Enable a service endpoint on the subnet and allow that subnet in the storage account firewall.. Option B is correct because a service endpoint extends the virtual network identity to the storage account over the public endpoint, allowing the administrator to restrict access to only traffic originating from that specific subnet via the storage account firewall. This meets the requirement of using the public endpoint while limiting access to a single Azure subnet without needing a private IP address.

Answer

Create a private endpoint and disable public network access.

Answer

Generate a user delegation SAS token and distribute it only to the subnet.

Answer

Change the redundancy setting to ZRS and enable soft delete.

Question 11

A user deleted a nested folder tree from an Azure file share yesterday. Other folders in the share were updated after the deletion and must not be rolled back. Which two actions should the administrator take? Select two.

Accepted Answer

Open a snapshot taken before the deletion.. Option B is correct because Azure file share snapshots provide a point-in-time, read-only copy of the entire share. By opening a snapshot taken before the deletion, the administrator can browse the exact folder tree as it existed at that time. Option C is correct because the administrator can copy only the deleted folder tree from the snapshot back into the live share, leaving all other folders (including those updated after the deletion) intact.

Answer

Restore the entire file share from the latest snapshot.

Answer

Convert the file share to the Hot access tier.

Answer

Delete the newer folders so the share matches the snapshot exactly.

Question 12

An NSG is associated with a subnet. It contains these inbound rules:
- Priority 100: Deny TCP 443 from Internet to Any
- Priority 200: Allow TCP 443 from 203.0.113.0/24 to Any
A tester at 203.0.113.10 browses to the VM's HTTPS endpoint in that subnet. What happens?

Accepted Answer

The request is denied because the priority 100 deny rule matches before the allow rule.. The correct answer is B. Network Security Group (NSG) rules are evaluated in priority order, from lowest to highest numeric value. The priority 100 rule explicitly denies TCP 443 from the Internet (which includes the 203.0.113.0/24 range), and it is evaluated before the priority 200 allow rule. Since the deny rule matches first, the traffic is blocked regardless of the more specific source IP in the allow rule.

Answer

The request is allowed because the more specific source range matches first.

Answer

The request is denied only if the VM has no public IP address.

Answer

The request is allowed because default NSG rules always override custom rules.

Question 13

Based on the exhibit, the Prod management group contains three subscriptions that host application workloads. An operations group must be able to read all current and future resources in those Prod subscriptions, but it must not have access to Sandbox. Where should you assign the Reader role?

Accepted Answer

Assign Reader to OpsGroup at the Prod management group.. Assigning the Reader role at the Prod management group scope ensures that OpsGroup inherits read permissions to all current and future subscriptions and resources within that management group, while excluding the Sandbox subscription which is outside the Prod hierarchy. This leverages Azure RBAC inheritance, where roles assigned at a management group propagate to all child subscriptions and resource groups, meeting the requirement for a single assignment that covers all Prod workloads without granting access to Sandbox.

Answer

Assign Reader to OpsGroup at the Corp management group.

Answer

Assign Reader to OpsGroup at one application resource group in AppSub1.

Answer

Assign Reader to OpsGroup at each subscription individually.

Question 14

Based on the exhibit, which subnet prefix is the smallest that can support the planned resources in Azure?

Accepted Answer

/26. The subnet prefix /26 provides 64 IP addresses per subnet (2^(32-26) = 64), of which 59 are usable after Azure reserves 5 addresses (first 4 and last 1). The planned resources require 50 IP addresses, so /26 is the smallest prefix that meets this requirement without waste. A /27 would only provide 32 total addresses (27 usable), which is insufficient.

Answer

/27

Answer

/25

Answer

/24

Question 15

Based on the exhibit, which subnet prefix should be used for Subnet A so it can support about 30 VM NICs?

Accepted Answer

/26. Option C (/26) is correct because a /26 subnet provides 64 IP addresses (2^(32-26) = 64), of which 62 are usable for VM NICs after reserving the network address and broadcast address. This comfortably supports about 30 VM NICs while leaving room for growth.

Answer

/28

Answer

/27

Answer

/25

AZ-104 Practice Test 38 — 15 Questions

Exhibit

AZ-104 Practice Test 38 — 15 Questions

Exhibit