AZ-104 Practice Test 38 — 15 Questions

Question 1

A development team stores build artifacts in Azure Blob Storage. The artifacts must remain available if one datacenter in the Azure region fails, but the business does not want to pay for replication to another region. Which redundancy option should the administrator select?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ZRS, because it distributes copies across availability zones within the same region.. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the same region, ensuring durability even if one entire datacenter (zone) fails. This meets the requirement of intra-region resilience without incurring the cost of geo-replication to another region.

Answer

LRS, because it keeps multiple copies in the same zone and is the cheapest option.

Answer

GRS, because it keeps the workload available in two regions at all times.

Answer

RA-GRS, because it provides zone redundancy and read access in the secondary region.

Question 2

An on-premises application connects to Azure through an existing site-to-site VPN. The application must access an Azure Storage account, public network access on the storage account is disabled, and the company does not want the storage account exposed through a public endpoint. Which solution should the administrator implement?

Accepted Answer

Create a private endpoint for the storage account in a VNet reachable over the VPN and configure private DNS.. A private endpoint assigns the storage account a private IP from a VNet that is reachable over the site-to-site VPN, effectively bringing the storage account into the on-premises network without exposing a public endpoint. Private DNS zones ensure that the storage account's FQDN resolves to the private IP, enabling seamless connectivity from on-premises while public network access remains disabled.

Answer

Enable a service endpoint on the on-premises network and allow the storage account firewall to trust it.

Answer

Generate a shared access signature and use it from the on-premises application.

Answer

Associate a NAT gateway with the on-premises VPN connection.

Question 3

A production resource group contains web and data resources. Administrators must be able to update, scale, and restart resources, but they must not delete the resource group or any resource inside it during maintenance windows. Which two actions should the administrator take? Select two.

Accepted Answer

Apply a CanNotDelete lock to the resource group.. Applying a CanNotDelete lock to the resource group prevents the deletion of the resource group and all resources within it, while still allowing administrators to update, scale, and restart resources. This lock type blocks delete operations but permits read and update operations, which aligns with the requirement to perform maintenance actions without risking deletion. The lock is inherited by all child resources in the resource group, ensuring comprehensive protection.

Answer

Apply a ReadOnly lock to the resource group.

Answer

Apply a CanNotDelete lock only to the individual virtual machines.

Answer

Use tags to mark the resources as production and prevent deletion.

Question 4

Based on the exhibit, which change should you make so the VM reaches the blob service over a private IP address?

Accepted Answer

Create a private endpoint for the storage account and link the appropriate private DNS zone.. A private endpoint assigns the storage account a private IP address from the VM's virtual network, enabling direct connectivity over a private IP. Linking the private endpoint to a private DNS zone ensures that the storage account's FQDN resolves to the private IP instead of the public endpoint, meeting the requirement without exposing traffic to the internet.

Answer

Enable a service endpoint on the subnet and keep the current DNS configuration.

Answer

Assign the VM a public IP address and allow it through the storage firewall.

Answer

Add the VM to a network security group that allows outbound TCP 443 to Azure Storage.

Question 5

A storage account has a private endpoint in VNet A. A VM in peered VNet B can reach the storage account by private IP, but when the VM resolves the storage account name it still gets the public IP address. What should be configured so the name resolves to the private IP from VNet B?

Accepted Answer

Link the private DNS zone for the storage service to VNet B.. When a private endpoint is created in VNet A, a private DNS zone (e.g., `privatelink.blob.core.windows.net`) is automatically linked to VNet A, enabling name resolution to the private IP within that VNet. However, VNet B is peered but not linked to that private DNS zone, so VMs in VNet B continue to resolve the storage account name via public DNS, returning the public IP. By linking the private DNS zone to VNet B, the VM will resolve the storage account name to the private IP address of the private endpoint.

Answer

Create a new storage account in VNet B.

Answer

Add an inbound NSG rule allowing DNS traffic from VNet B.

Answer

Replace the private endpoint with a service endpoint.

Question 6

A modify policy that appends a CostCenter tag was assigned to a management group. The policy shows as assigned, but older virtual machines still lack the tag. What must the administrator do to update those existing resources?

Accepted Answer

Create a remediation task for the policy assignment.. The 'modify' policy effect appends the CostCenter tag to new or updated resources automatically, but it does not retroactively apply to existing resources. To update older virtual machines that lack the tag, the administrator must create a remediation task for the policy assignment. This task uses Azure Policy's 'deployIfNotExists' or 'modify' effect to trigger a deployment that evaluates and corrects non-compliant existing resources.

Answer

Reassign the policy at a lower scope so it applies more quickly.

Answer

Change the policy effect from modify to audit.

Answer

Add a CanNotDelete lock to the virtual machines.

Question 7

A subnet NSG contains these inbound rules: Priority 100 denies TCP 8443 from VirtualNetwork to any destination, Priority 110 allows TCP 8443 from AzureLoadBalancer to any destination, and Priority 200 allows TCP 8443 from ASG-Web to ASG-App. The app VM NIC has no additional inbound rules. Web servers are members of ASG-Web and the app VM is a member of ASG-App. The web tier still cannot connect to TCP 8443. What should the administrator change?

Accepted Answer

Move the allow rule for ASG-Web to ASG-App to a priority lower than 100.. NSG rules are evaluated in priority order, from lowest to highest number. The deny rule at priority 100 explicitly blocks TCP 8443 from VirtualNetwork, which includes traffic from ASG-Web (since ASG-Web members are within the virtual network). The allow rule at priority 110 only permits traffic from AzureLoadBalancer, not from ASG-Web. The allow rule at priority 200 is never evaluated because the deny rule at priority 100 matches first. By moving the allow rule for ASG-Web to ASG-App to a priority lower than 100 (e.g., 90), it will be evaluated before the deny rule, allowing the web servers to connect.

Answer

Replace ASG-Web with the VirtualNetwork service tag in the allow rule.

Answer

Add a route table that sends TCP 8443 traffic to the app subnet.

Answer

Create a second NSG on the app NIC with an allow rule at priority 50.

Question 8

Based on the exhibit, a production VM must send an email and SMS notification if average CPU stays above 85% for 10 minutes. The team created the alert rule, but no one receives notifications when the condition is met. What should the administrator add to the alert rule?

Accepted Answer

Attach an action group that includes email and SMS receivers.. The alert rule is correctly configured to trigger when the average CPU exceeds 85% for 10 minutes, but notifications are not being sent because no action group is attached. An action group defines the notification channels (e.g., email, SMS, webhook) that fire when the alert is activated. Without an action group, the alert can fire silently, so the administrator must attach an action group containing the desired email and SMS receivers.

Answer

Add a diagnostic setting that sends VM metrics to a Log Analytics workspace.

Answer

Change the alert to use a log query instead of a metric condition.

Answer

Create a resource lock to prevent changes to the virtual machine.

Question 9

A project team adds and removes contractors every few weeks. The team needs Azure access to follow membership changes without updating role assignments for each person. What should the administrator use to delegate the access?

Accepted Answer

Create a Microsoft Entra security group, add the contractors, and assign the Azure role to the group.. Assigning an Azure role to a Microsoft Entra security group allows the administrator to manage access by simply adding or removing contractors from the group, without needing to update role assignments for each individual. This leverages Azure RBAC's support for group-based assignments, which automatically propagate role permissions to new members and revoke them from removed members.

Answer

Assign the Azure role directly to each contractor user account.

Answer

Use a Microsoft 365 group and assign the Azure role to it.

Answer

Create a management group for the contractors and assign the role there.

Question 10

A DevOps engineer must run an Azure CLI script from a Windows VM to create resources in a specific resource group in another subscription. The script must not use a client secret or password, and access should be limited to only that resource group. Which three actions should the administrator take? Select three.

Accepted Answer

Enable a system-assigned managed identity on the source VM so the script can authenticate without stored credentials.. Enabling a system-assigned managed identity on the source VM allows the Azure CLI script to authenticate to Azure without storing any client secret or password. The managed identity is automatically managed by Microsoft Entra ID and tied to the VM lifecycle, eliminating the need for credential management.

Answer

Create a service principal and store its client secret in a file on the VM for the script to read.

Answer

Grant Reader on the resource group because Reader permissions are sufficient for Azure CLI resource creation.

Question 11

A user accidentally deleted a nested folder tree from an Azure file share yesterday. Other folders were modified after the deletion and must not be rolled back. The administrator wants to restore only the deleted folder tree. What is the best recovery method?

Accepted Answer

Use a file share snapshot and copy the deleted folder tree back into the live share.. Azure file share snapshots provide a point-in-time, read-only copy of the entire file share. By mounting a snapshot taken before the accidental deletion, the administrator can browse the snapshot's directory structure and copy only the deleted folder tree back into the live share. This approach restores the lost data without affecting any other files or folders that were modified after the snapshot was taken, meeting the requirement to avoid rolling back other changes.

Answer

Delete the current share and restore the whole share from the most recent backup.

Answer

Change the share’s access tier from Hot to Cool and then refresh the folder view.

Answer

Enable soft delete for blobs in the same storage account and recover the folder from there.

Question 12

A storage account must be reachable only from a single Azure VNet. The team wants the storage account to have a private IP in that VNet and wants to disable public network access. Which solution should the administrator implement?

Accepted Answer

Create a private endpoint for the storage account and disable public network access.. A private endpoint assigns the storage account a private IP from the VNet, making it accessible only within that VNet over a private connection. Disabling public network access ensures no traffic can reach the storage account from the internet, meeting both requirements. This is the only option that provides a private IP and blocks all public access.

Answer

Configure a service endpoint on the subnet and keep public network access enabled.

Answer

Assign a shared access signature and rely on IP-based firewall rules.

Answer

Use a route table to force traffic to the storage account over the virtual network gateway.

Question 13

The operations team wants an email and SMS notification whenever any production virtual machine's average CPU stays above 85 percent for 10 minutes. They also want to reuse the same notification targets for future alerts. What should they configure?

Accepted Answer

An action group attached to a metric alert rule. An action group in Azure Monitor defines the notification targets (email, SMS, etc.) for alerts, and a metric alert rule can be configured to trigger when the average CPU percentage exceeds 85% for 10 minutes. By attaching the same action group to multiple alert rules, the operations team can reuse the notification targets for future alerts without reconfiguring them each time.

Answer

A diagnostic setting on each VM that sends metrics to a storage account

Answer

A Log Analytics query alert with no notification target

Answer

A resource lock on the virtual machines

Question 14

A project team adds and removes contractors every month. The admin wants Azure access to update automatically when membership changes without editing role assignments for each person. Which two actions should the admin take? Select two.

Accepted Answer

Create a Microsoft Entra ID security group for the contractors.. Creating a Microsoft Entra ID security group for contractors allows the admin to manage membership dynamically. When contractors are added or removed from the group, their Azure access updates automatically without needing to edit individual role assignments. This leverages group-based RBAC, where the group is assigned the role, and membership changes propagate to Azure RBAC.

Answer

Assign the Azure RBAC role directly to each contractor user account.

Answer

Create a management group for the contractors.

Answer

Use a resource lock to control access.

Question 15

A user is assigned the Reader role on a resource group named RG1. Later, a new storage account is created in RG1. What access will the user have to that storage account without any new role assignment?

Accepted Answer

Reader access, because the resource group assignment is inherited by the storage account.. Azure RBAC permissions assigned at a resource group scope are inherited by all resources within that resource group, including resources created after the assignment. Since the user has the Reader role on RG1, that role is inherited by the new storage account, granting read-only access to it without any additional role assignment.

Answer

No access, because RBAC assignments do not apply to resources created later.

Answer

Contributor access, because storage accounts inherit the highest available permissions.

Answer

Owner access, because resource group permissions always become full control on child resources.