AZ-104 Practice Test 38 — 15 Questions

Question 1

A VM in a subnet must access an Azure Storage account without creating a private endpoint. The organization is fine with the storage account remaining on its public endpoint, but traffic should stay on the Azure backbone rather than the public internet. Which feature should you use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A service endpoint for Microsoft.Storage on the subnet.. A service endpoint for Microsoft.Storage on the subnet extends the virtual network identity to the storage account, allowing traffic from the subnet to the storage account's public endpoint to traverse the Azure backbone network instead of the public internet. This meets the requirement of keeping traffic on the Azure backbone without creating a private endpoint, as service endpoints use the public endpoint but route traffic through Microsoft's network.

Answer

A private endpoint and a private DNS zone.

Answer

A NAT gateway attached to the subnet.

Answer

A VPN gateway connection to the storage account resource group.

Question 2

A reporting server will run an analytics engine that needs 8 vCPUs and 64 GiB of RAM. Average CPU use is expected to stay moderate, but the workload is memory heavy and should not use a burstable SKU. Which two deployment choices best align with the requirement? Select two.

Accepted Answer

Select a memory-optimized VM family.. The workload is memory heavy, and memory-optimized VM families (e.g., E-series) are designed with a higher memory-to-vCPU ratio to handle such workloads efficiently. Option B is correct because the requirement explicitly states 8 vCPUs and 64 GiB of RAM, so selecting a size that meets these exact specifications is necessary, regardless of family, as long as it is not burstable.

Answer

Choose a burstable B-series size to lower cost.

Answer

Pick a compute-optimized F-series size because CPU use is only moderate.

Answer

Select the smallest VM size that supports managed disks.

Question 3

A hub VNet is peered to two spoke VNets. The spokes can reach the hub, but they cannot communicate with each other through the hub. The administrator wants centralized inspection in the hub. What should be deployed and configured?

Accepted Answer

An Azure Firewall or other NVA in the hub, plus user-defined routes and forwarding support.. Azure Firewall or an NVA in the hub can inspect traffic between spokes, but by default, Azure routing does not forward spoke-to-spoke traffic through the hub. To force this traffic through the firewall, you must configure user-defined routes (UDRs) on the spoke subnets with a next hop of the firewall's private IP, and enable IP forwarding on the NVA. This setup enables centralized inspection and transitive routing through the hub.

Answer

Only additional peering links between the hub and both spokes.

Answer

A private endpoint in the hub for each spoke subnet.

Answer

A service endpoint on each spoke subnet to the hub VNet.

Question 4

A web app currently accesses Azure Blob Storage by using the storage account key in a connection string. Security now requires blocking any new requests that use shared key authorization, while Microsoft Entra-based access must continue to work. Which storage account setting should the administrator change?

Accepted Answer

Disable shared key authorization on the storage account.. Disabling shared key authorization on the storage account explicitly blocks all requests that use the storage account key (shared key) for authentication, while still allowing requests authenticated via Microsoft Entra ID (formerly Azure AD). This directly meets the security requirement to block new requests using shared key authorization without affecting Entra-based access.

Answer

Set the storage account network access to selected networks only.

Answer

Rotate the account keys and leave all authentication methods enabled.

Answer

Enable object replication for the storage account.

Question 5

You want to deploy a resource group with Bicep and see the changes Azure plans to make before you apply them. Which command should you run?

Accepted Answer

az deployment group what-if. The `az deployment group what-if` command is correct because it performs a dry-run validation of a Bicep (or ARM) deployment against a resource group, showing the changes Azure will make (create, modify, delete) without actually applying them. This is the Azure equivalent of a 'what-if' analysis, allowing you to review the impact before execution.

Answer

az deployment group create

Answer

az group delete

Answer

az vm update

Question 6

A team needs to understand Azure RBAC inheritance. Which two statements are correct? Select two.

Accepted Answer

A role assignment at a resource group scope applies to resources inside that group.. Azure RBAC inheritance follows a hierarchical scope model: a role assignment at a resource group scope applies to all resources within that resource group, as the resource group is the parent scope for its child resources. This means any user or group assigned a role at the resource group level automatically inherits those permissions for every resource (e.g., VMs, storage accounts) inside that group, without needing separate assignments.

Answer

A role assignment at a resource scope automatically applies to all other resources in the subscription.

Answer

A role assignment at management group scope applies only to the subscription where it was created.

Answer

A role assignment at a resource group scope is broader than a subscription scope.

Question 7

A development team stores build artifacts in Azure Blob Storage. The artifacts must remain available if one datacenter in the Azure region fails, but the business does not want to pay for replication to another region. Which redundancy option should the administrator select?

Accepted Answer

ZRS, because it distributes copies across availability zones within the same region.. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the same region, ensuring durability even if one entire datacenter (zone) fails. This meets the requirement of intra-region resilience without incurring the cost of geo-replication to another region.

Answer

LRS, because it keeps multiple copies in the same zone and is the cheapest option.

Answer

GRS, because it keeps the workload available in two regions at all times.

Answer

RA-GRS, because it provides zone redundancy and read access in the secondary region.

Question 8

An on-premises application connects to Azure through an existing site-to-site VPN. The application must access an Azure Storage account, public network access on the storage account is disabled, and the company does not want the storage account exposed through a public endpoint. Which solution should the administrator implement?

Accepted Answer

Create a private endpoint for the storage account in a VNet reachable over the VPN and configure private DNS.. A private endpoint assigns the storage account a private IP from a VNet that is reachable over the site-to-site VPN, effectively bringing the storage account into the on-premises network without exposing a public endpoint. Private DNS zones ensure that the storage account's FQDN resolves to the private IP, enabling seamless connectivity from on-premises while public network access remains disabled.

Answer

Enable a service endpoint on the on-premises network and allow the storage account firewall to trust it.

Answer

Generate a shared access signature and use it from the on-premises application.

Answer

Associate a NAT gateway with the on-premises VPN connection.

Question 9

A production resource group contains web and data resources. Administrators must be able to update, scale, and restart resources, but they must not delete the resource group or any resource inside it during maintenance windows. Which two actions should the administrator take? Select two.

Accepted Answer

Apply a CanNotDelete lock to the resource group.. Applying a CanNotDelete lock to the resource group prevents the deletion of the resource group and all resources within it, while still allowing administrators to update, scale, and restart resources. This lock type blocks delete operations but permits read and update operations, which aligns with the requirement to perform maintenance actions without risking deletion. The lock is inherited by all child resources in the resource group, ensuring comprehensive protection.

Answer

Apply a ReadOnly lock to the resource group.

Answer

Apply a CanNotDelete lock only to the individual virtual machines.

Answer

Use tags to mark the resources as production and prevent deletion.

Question 10

Based on the exhibit, which change should you make so the VM reaches the blob service over a private IP address?

Accepted Answer

Create a private endpoint for the storage account and link the appropriate private DNS zone.. A private endpoint assigns the storage account a private IP address from the VM's virtual network, enabling direct connectivity over a private IP. Linking the private endpoint to a private DNS zone ensures that the storage account's FQDN resolves to the private IP instead of the public endpoint, meeting the requirement without exposing traffic to the internet.

Answer

Enable a service endpoint on the subnet and keep the current DNS configuration.

Answer

Assign the VM a public IP address and allow it through the storage firewall.

Answer

Add the VM to a network security group that allows outbound TCP 443 to Azure Storage.

Question 11

A storage account has a private endpoint in VNet A. A VM in peered VNet B can reach the storage account by private IP, but when the VM resolves the storage account name it still gets the public IP address. What should be configured so the name resolves to the private IP from VNet B?

Accepted Answer

Link the private DNS zone for the storage service to VNet B.. When a private endpoint is created in VNet A, a private DNS zone (e.g., `privatelink.blob.core.windows.net`) is automatically linked to VNet A, enabling name resolution to the private IP within that VNet. However, VNet B is peered but not linked to that private DNS zone, so VMs in VNet B continue to resolve the storage account name via public DNS, returning the public IP. By linking the private DNS zone to VNet B, the VM will resolve the storage account name to the private IP address of the private endpoint.

Answer

Create a new storage account in VNet B.

Answer

Add an inbound NSG rule allowing DNS traffic from VNet B.

Answer

Replace the private endpoint with a service endpoint.

Question 12

A modify policy that appends a CostCenter tag was assigned to a management group. The policy shows as assigned, but older virtual machines still lack the tag. What must the administrator do to update those existing resources?

Accepted Answer

Create a remediation task for the policy assignment.. The 'modify' policy effect appends the CostCenter tag to new or updated resources automatically, but it does not retroactively apply to existing resources. To update older virtual machines that lack the tag, the administrator must create a remediation task for the policy assignment. This task uses Azure Policy's 'deployIfNotExists' or 'modify' effect to trigger a deployment that evaluates and corrects non-compliant existing resources.

Answer

Reassign the policy at a lower scope so it applies more quickly.

Answer

Change the policy effect from modify to audit.

Answer

Add a CanNotDelete lock to the virtual machines.

Question 13

A subnet NSG contains these inbound rules: Priority 100 denies TCP 8443 from VirtualNetwork to any destination, Priority 110 allows TCP 8443 from AzureLoadBalancer to any destination, and Priority 200 allows TCP 8443 from ASG-Web to ASG-App. The app VM NIC has no additional inbound rules. Web servers are members of ASG-Web and the app VM is a member of ASG-App. The web tier still cannot connect to TCP 8443. What should the administrator change?

Accepted Answer

Move the allow rule for ASG-Web to ASG-App to a priority lower than 100.. NSG rules are evaluated in priority order, from lowest to highest number. The deny rule at priority 100 explicitly blocks TCP 8443 from VirtualNetwork, which includes traffic from ASG-Web (since ASG-Web members are within the virtual network). The allow rule at priority 110 only permits traffic from AzureLoadBalancer, not from ASG-Web. The allow rule at priority 200 is never evaluated because the deny rule at priority 100 matches first. By moving the allow rule for ASG-Web to ASG-App to a priority lower than 100 (e.g., 90), it will be evaluated before the deny rule, allowing the web servers to connect.

Answer

Replace ASG-Web with the VirtualNetwork service tag in the allow rule.

Answer

Add a route table that sends TCP 8443 traffic to the app subnet.

Answer

Create a second NSG on the app NIC with an allow rule at priority 50.

Question 14

Based on the exhibit, a production VM must send an email and SMS notification if average CPU stays above 85% for 10 minutes. The team created the alert rule, but no one receives notifications when the condition is met. What should the administrator add to the alert rule?

Accepted Answer

Attach an action group that includes email and SMS receivers.. The alert rule is correctly configured to trigger when the average CPU exceeds 85% for 10 minutes, but notifications are not being sent because no action group is attached. An action group defines the notification channels (e.g., email, SMS, webhook) that fire when the alert is activated. Without an action group, the alert can fire silently, so the administrator must attach an action group containing the desired email and SMS receivers.

Answer

Add a diagnostic setting that sends VM metrics to a Log Analytics workspace.

Answer

Change the alert to use a log query instead of a metric condition.

Answer

Create a resource lock to prevent changes to the virtual machine.

Question 15

A project team adds and removes contractors every few weeks. The team needs Azure access to follow membership changes without updating role assignments for each person. What should the administrator use to delegate the access?

Accepted Answer

Create a Microsoft Entra security group, add the contractors, and assign the Azure role to the group.. Assigning an Azure role to a Microsoft Entra security group allows the administrator to manage access by simply adding or removing contractors from the group, without needing to update role assignments for each individual. This leverages Azure RBAC's support for group-based assignments, which automatically propagate role permissions to new members and revoke them from removed members.

Answer

Assign the Azure role directly to each contractor user account.

Answer

Use a Microsoft 365 group and assign the Azure role to it.

Answer

Create a management group for the contractors and assign the role there.