AZ-104 Practice Test 39 — 15 Questions

Question 1

A DevOps engineer must run an Azure CLI script from a Windows VM to create resources in a specific resource group in another subscription. The script must not use a client secret or password, and access should be limited to only that resource group. Which three actions should the administrator take? Select three.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable a system-assigned managed identity on the source VM so the script can authenticate without stored credentials.. Enabling a system-assigned managed identity on the source VM allows the Azure CLI script to authenticate to Azure without storing any client secret or password. The managed identity is automatically managed by Azure AD and tied to the VM lifecycle, eliminating the need for credential management.

Answer

Create a service principal and store its client secret in a file on the VM for the script to read.

Answer

Grant Reader on the resource group because Reader permissions are sufficient for Azure CLI resource creation.

Question 2

A user accidentally deleted a nested folder tree from an Azure file share yesterday. Other folders were modified after the deletion and must not be rolled back. The administrator wants to restore only the deleted folder tree. What is the best recovery method?

Accepted Answer

Use a file share snapshot and copy the deleted folder tree back into the live share.. Azure file share snapshots provide a point-in-time, read-only copy of the entire file share. By mounting a snapshot taken before the accidental deletion, the administrator can browse the snapshot's directory structure and copy only the deleted folder tree back into the live share. This approach restores the lost data without affecting any other files or folders that were modified after the snapshot was taken, meeting the requirement to avoid rolling back other changes.

Answer

Delete the current share and restore the whole share from the most recent backup.

Answer

Change the share’s access tier from Hot to Cool and then refresh the folder view.

Answer

Enable soft delete for blobs in the same storage account and recover the folder from there.

Question 3

A storage account must be reachable only from a single Azure VNet. The team wants the storage account to have a private IP in that VNet and wants to disable public network access. Which solution should the administrator implement?

Accepted Answer

Create a private endpoint for the storage account and disable public network access.. A private endpoint assigns the storage account a private IP from the VNet, making it accessible only within that VNet over a private connection. Disabling public network access ensures no traffic can reach the storage account from the internet, meeting both requirements. This is the only option that provides a private IP and blocks all public access.

Answer

Configure a service endpoint on the subnet and keep public network access enabled.

Answer

Assign a shared access signature and rely on IP-based firewall rules.

Answer

Use a route table to force traffic to the storage account over the virtual network gateway.

Question 4

The operations team wants an email and SMS notification whenever any production virtual machine's average CPU stays above 85 percent for 10 minutes. They also want to reuse the same notification targets for future alerts. What should they configure?

Accepted Answer

An action group attached to a metric alert rule. An action group in Azure Monitor defines the notification targets (email, SMS, etc.) for alerts, and a metric alert rule can be configured to trigger when the average CPU percentage exceeds 85% for 10 minutes. By attaching the same action group to multiple alert rules, the operations team can reuse the notification targets for future alerts without reconfiguring them each time.

Answer

A diagnostic setting on each VM that sends metrics to a storage account

Answer

A Log Analytics query alert with no notification target

Answer

A resource lock on the virtual machines

Question 5

A project team adds and removes contractors every month. The admin wants Azure access to update automatically when membership changes without editing role assignments for each person. Which two actions should the admin take? Select two.

Accepted Answer

Create a Microsoft Entra ID security group for the contractors.. Creating a Microsoft Entra ID security group for contractors allows the admin to manage membership dynamically. When contractors are added or removed from the group, their Azure access updates automatically without needing to edit individual role assignments. This leverages group-based RBAC, where the group is assigned the role, and membership changes propagate to Azure RBAC.

Answer

Assign the Azure RBAC role directly to each contractor user account.

Answer

Create a management group for the contractors.

Answer

Use a resource lock to control access.

Question 6

A user is assigned the Reader role on a resource group named RG1. Later, a new storage account is created in RG1. What access will the user have to that storage account without any new role assignment?

Accepted Answer

Reader access, because the resource group assignment is inherited by the storage account.. Azure RBAC permissions assigned at a resource group scope are inherited by all resources within that resource group, including resources created after the assignment. Since the user has the Reader role on RG1, that role is inherited by the new storage account, granting read-only access to it without any additional role assignment.

Answer

No access, because RBAC assignments do not apply to resources created later.

Answer

Contributor access, because storage accounts inherit the highest available permissions.

Answer

Owner access, because resource group permissions always become full control on child resources.

Question 7

Based on the exhibit, the backup policy must support 30-day recovery for daily backups while keeping 12 months of monthly copies. Which setting should be changed?

Accepted Answer

Increase daily retention from 7 days to 30 days.. The backup policy currently has daily retention set to 7 days, which only keeps daily recovery points for a week. To meet the requirement of 30-day recovery for daily backups, you must increase the daily retention to 30 days. This ensures that each daily backup is retained for 30 days, allowing point-in-time recovery within that window.

Answer

Increase weekly retention from 4 weeks to 30 weeks.

Answer

Change the backup schedule to every 30 days.

Answer

Turn on archive tier for the backup policy.

Question 8

Based on the exhibit, which KQL query should you use in a scheduled query alert to trigger only when five or more failed events occur within any 15-minute window?

Accepted Answer

CustomAppLogs_CL | where TimeGenerated >= ago(1h) | where Status_s == 'Failed' | summarize FailedCount=count() by bin(TimeGenerated, 15m) | where FailedCount >= 5. It filters for 'Failed' events in the last hour, groups them into 15-minute bins using `bin(TimeGenerated, 15m)`, and then counts them. The `where FailedCount >= 5` condition triggers the alert only when five or more failed events occur within any single 15-minute window, matching the requirement exactly.

Answer

CustomAppLogs_CL | where TimeGenerated >= ago(15m) | where Status_s == 'Failed' | summarize FailedCount=count() by bin(TimeGenerated, 1h) | where FailedCount >= 5

Answer

CustomAppLogs_CL | where TimeGenerated >= ago(1h) | summarize FailedCount=count() by bin(TimeGenerated, 15m) | where FailedCount >= 5

Answer

CustomAppLogs_CL | where TimeGenerated >= ago(1h) | where Status_s == 'Failed' | summarize FailedCount=count() by bin(TimeGenerated, 15m) | where FailedCount > 0

Question 9

Based on the exhibit, the production resource group must not be deleted during a change freeze, but administrators still need to update VM sizes and tag values. Which lock should you apply?

Accepted Answer

Apply a CanNotDelete lock to RG-Prod.. A CanNotDelete lock (B) prevents deletion of the resource group while allowing all other operations, including updating VM sizes and modifying tag values. This meets the requirement of blocking deletion during a change freeze without restricting administrative updates.

Answer

Apply a ReadOnly lock to RG-Prod.

Answer

Apply a lock to the subscription instead of the resource group.

Answer

Use Azure Policy with a deny effect to block deletes.

Question 10

A storage account must be reachable only from Azure VMs in a single subnet. Public network access should not be used, and the team wants the storage service to keep using a private IP address inside the virtual network. Which feature should the administrator configure?

Accepted Answer

A private endpoint for the storage account in the subnet.. A private endpoint assigns the storage account a private IP address from the subnet's address space, using Azure Private Link to route traffic entirely over the Microsoft backbone network. This ensures the storage account is reachable only from VMs in that subnet and blocks all public internet access, meeting both requirements.

Answer

A service endpoint on the subnet, because it creates a private IP address for the storage account.

Answer

A shared access signature that is limited to the subnet.

Answer

Storage account access keys, because they bind access to one subnet automatically.

Question 11

A subnet has an NSG with these inbound rules: priority 200 DenyAllInbound and priority 300 AllowHTTPSFromInternet. A VM in the subnet is still unreachable on TCP 443 from the internet. What should you do to make HTTPS work while keeping the deny rule in place?

Accepted Answer

Move the allow HTTPS rule to a lower priority number such as 100 so it is evaluated before the deny rule.. NSG rules are evaluated in priority order, with lower numbers evaluated first. Moving the allow HTTPS rule to priority 100 ensures it is processed before the DenyAllInbound rule at priority 200, allowing TCP 443 traffic from the internet while the deny rule remains in place for all other inbound traffic.

Answer

Create the same allow rule on the NIC-level NSG at priority 300 and leave the subnet NSG unchanged.

Answer

Change the deny rule to protocol Any and keep the same priority so Azure evaluates the allow rule first.

Answer

Add a route table entry for TCP 443 traffic so Azure sends it directly to the VM.

Question 12

A subnet uses a route table with gateway route propagation disabled so internet-bound traffic can be forced through a network virtual appliance. After the change, VMs in the subnet can no longer reach servers in the on-premises network 172.16.0.0/16 over the VPN gateway. What should the administrator add to the route table?

Accepted Answer

A user-defined route for 172.16.0.0/16 with next hop type Virtual network gateway.. When gateway route propagation is disabled on a route table, the subnet no longer receives the default system routes that include the VPN gateway route for on-premises networks. To restore connectivity to 172.16.0.0/16, you must add a user-defined route (UDR) with next hop type 'Virtual network gateway', which explicitly directs traffic for that prefix through the VPN gateway. This overrides the missing propagated route and forces the traffic to the on-premises network correctly.

Answer

A user-defined route for 172.16.0.0/16 with next hop type Internet.

Answer

An NSG allow rule for TCP 172.16.0.0/16.

Answer

A service endpoint for the on-premises network range.

Question 13

An administrator is troubleshooting inbound HTTPS to a VM. The subnet NSG has these custom rules: Deny-Internet-Inbound at priority 150, Allow-HTTPS-Admin at priority 200, and the default deny rules remain in place. The administrator’s client is on the internet and should be able to reach the VM on TCP 443. What change will fix the problem?

Accepted Answer

Move the allow rule to a lower priority number than the deny rule.. Network Security Group (NSG) rules are evaluated in priority order, with lower numbers evaluated first. The Deny-Internet-Inbound rule at priority 150 is evaluated before the Allow-HTTPS-Admin rule at priority 200, so the deny rule blocks the inbound HTTPS traffic before the allow rule can be processed. Moving the allow rule to a lower priority number (e.g., 140) ensures it is evaluated first, permitting the traffic from the internet on TCP 443.

Answer

Change the allow rule source from Internet to Any and keep the same priority.

Answer

Create a route table to the VM subnet so traffic reaches the VM faster.

Answer

Associate an application security group with the VM and leave the rules unchanged.

Question 14

A blob was moved to the Archive tier last month. A project team now needs the file available later today, and they expect to read it several times during review. What should the administrator do first?

Accepted Answer

Start a rehydration request and move the blob to the Hot tier with high priority.. A blob in the Archive tier is offline and must be rehydrated (changed to Hot or Cool) before it can be accessed. Using high-priority rehydration ensures the blob becomes available within 1 hour, which meets the requirement for later today. The Hot tier is appropriate since the team expects to read the blob several times, providing low-latency access without incurring read costs from Cool tier.

Answer

Copy the blob directly from Archive to a local machine and reopen it there.

Answer

Change the blob to the Cool tier immediately and expect it to become available within minutes.

Answer

Create a lifecycle rule to move the blob back to Hot automatically on the next day.

Question 15

Based on the exhibit, what should the administrator create so VMs in AppSubnet can access the storage account over a private IP address?

Accepted Answer

A private endpoint for the storage account in AppSubnet.. A private endpoint assigns a private IP address from AppSubnet to the storage account, enabling VMs in that subnet to access the storage account over a private IP within the VNet. This eliminates exposure to the public internet and uses Azure Private Link for secure, direct connectivity.

Answer

A service endpoint for Microsoft.Storage on AppSubnet.

Answer

A site-to-site VPN gateway between AppVNet and the storage account.

Answer

An application security group for the storage account and subnet.