AZ-104 Practice Test 39 — 15 Questions

Question 1

An administrator is deploying a site-to-site VPN gateway in an existing VNet. The GatewaySubnet already exists, but deployment validation fails because the gateway has no public-facing IP resource. Which configuration is required?

Accepted Answer

Attach a Standard SKU public IP address with static allocation to the VPN gateway.. A site-to-site VPN gateway in Azure requires a public IP address to establish connectivity with the on-premises VPN device. The Standard SKU public IP with static allocation is required because VPN gateways do not support Basic SKU public IPs and must have a static IP that does not change. Without this public IP resource, the gateway cannot be provisioned as it has no public endpoint for the VPN tunnel.

Answer

Attach a private IP address from the GatewaySubnet to the VPN gateway.

Answer

Place the gateway behind an internal load balancer in the GatewaySubnet.

Answer

Create a NAT gateway and associate it with the GatewaySubnet.

Question 2

An administrator is deploying an Azure VPN gateway for a site-to-site connection. The deployment fails because required network resources are missing. Which configuration is required before the gateway can be created?

Accepted Answer

A subnet named GatewaySubnet and a public IP address for the VPN gateway.. A VPN gateway in Azure requires a dedicated subnet named 'GatewaySubnet' to host the gateway instances, and a public IP address resource must be allocated to the gateway to establish the site-to-site VPN tunnel over the internet. Without these two prerequisites, the deployment will fail because the gateway cannot be provisioned or addressed externally.

Answer

A subnet named AzureBastionSubnet and a static private IP address.

Answer

A network security group attached directly to the virtual network gateway.

Answer

A load balancer with a public frontend to terminate the VPN connection.

Question 3

An archive of legal documents is accessed only a few times each month, but when someone needs a document it must open immediately without a rehydration wait. Which access tier should be used?

Accepted Answer

Cool tier. The Cool tier is designed for data that is infrequently accessed but must be available immediately when needed, with a lower storage cost than Hot tier but higher access costs. Since the archive is accessed only a few times per month and requires instant retrieval without rehydration delay, Cool tier meets both requirements, whereas Archive tier would impose a rehydration wait of up to 15 hours.

Answer

Hot tier

Answer

Archive tier

Answer

Geo-redundant storage (GRS)

Question 4

An application team plans to store block blobs for application logs, lifecycle them to cooler tiers over time, and use Azure Monitor diagnostic exports from several Azure resources into the same storage account. They also want access tier controls and general-purpose features in one place. Which storage account type should the administrator create?

Accepted Answer

StorageV2 general-purpose account, because it supports blobs, tiering, and broad Azure integrations.. A StorageV2 general-purpose account (B) is the correct choice because it supports block blobs, lifecycle management policies for tiering to cool, cold, and archive tiers, and integrates seamlessly with Azure Monitor diagnostic exports. Unlike specialized accounts, StorageV2 provides a unified platform for blobs, files, queues, and tables, meeting the team's need for access tier controls and general-purpose features in one place.

Answer

BlobStorage account, because it is optimized for storing only unstructured blobs.

Answer

FileStorage account, because it supports any Azure diagnostic data format and access tiers.

Answer

BlockBlobStorage account, because it is required whenever logs are exported from Azure Monitor.

Question 5

Backend VMs are rebuilt often and get new private IP addresses. Frontend VMs must reach them only on TCP 8443, and the rule should keep working after rebuilds. Which two actions should the administrator take? Select two.

Accepted Answer

Place the backend NICs in an ASG named ASG-Backend.. Option A is correct because an Application Security Group (ASG) allows you to group backend VMs by their NICs, regardless of their private IP addresses. When backend VMs are rebuilt and receive new IPs, the ASG membership remains intact, so NSG rules referencing the ASG continue to work without manual updates. This decouples security rules from dynamic IP addresses.

Answer

Create a static route for the backend subnet to preserve the same IPs.

Answer

Use a service endpoint between the two subnets.

Answer

Add a load balancer health probe rule on TCP 8443 only.

Question 6

An operations team must deploy 20 identical application VMs every sprint from source control and wants the deployment definition to be readable and repeatable. Which approach should they use?

Accepted Answer

Use a Bicep template stored in source control. B is correct because Bicep is a domain-specific language (DSL) for deploying Azure resources declaratively. Storing a Bicep template in source control ensures the deployment definition is readable (using concise syntax) and repeatable (via idempotent deployments), meeting the team's requirement for 20 identical VMs every sprint.

Answer

Manually create each VM in the Azure portal

Answer

Capture a screenshot of the portal settings for future reference

Answer

Use Azure Policy to create the VMs automatically

Question 7

Based on the exhibit, where should the Network Contributor role be assigned so the engineer can manage only VNet-vm and its subnets, but not other resources in rg-platform?

Accepted Answer

Assign Network Contributor at the VNet-vm resource scope.. Option D is correct because assigning the Network Contributor role at the VNet-vm resource scope grants the engineer permissions to manage only that specific virtual network and its subnets, while preventing any access to other resources within the rg-platform resource group. This follows the principle of least privilege by scoping the role assignment to the exact resource that needs to be managed.

Answer

Assign Network Contributor at the management group scope.

Answer

Assign Network Contributor at the subscription scope.

Answer

Assign Network Contributor at the resource group scope for rg-platform.

Question 8

Based on the exhibit, which Azure service is preventing deployment because the resource is missing a required tag?

Accepted Answer

Azure Policy. Azure Policy is the correct answer because it enforces organizational standards and compliance rules, such as requiring specific tags on resources. When a policy is defined to require a tag (e.g., 'CostCenter') and a deployment attempts to create a resource without that tag, Azure Policy evaluates the request against the policy assignment and denies the deployment. This is a built-in capability of Azure Policy, not a permission or lock mechanism.

Answer

Azure RBAC

Answer

Resource locks

Answer

Azure Monitor

Question 9

An NSG outbound rule allows TCP 8443 traffic from ASG-Web to ASG-Api. The web VM NIC is in ASG-Web, but the API VM NICs were deployed into the correct subnet and never added to ASG-Api. The traffic still fails. What should the administrator do?

Accepted Answer

Add the API VM NICs to ASG-Api.. The NSG rule references ASG-Api as the destination, but the API VM NICs were never added to that application security group. ASGs are logical groupings of VM NICs; a rule targeting an ASG only applies to NICs that are members of that ASG. Since the API NICs are not in ASG-Api, the rule does not match them, and traffic fails. Adding the API VM NICs to ASG-Api resolves the issue by making them valid destinations for the rule.

Answer

Move the NSG to the web subnet so source membership is automatically detected.

Answer

Change the destination port to 443 because ASGs only work with common HTTPS traffic.

Answer

Create a service endpoint for the spoke subnet so the NSG rule becomes effective.

Question 10

Which two statements about network security group processing are correct? Select two.

Accepted Answer

NSG rules are evaluated starting with the lowest priority number.. Option A is correct because NSG rules are processed in order of increasing priority number, meaning the rule with the lowest priority number (e.g., 100) is evaluated first. This ensures that more specific or critical rules can be applied before broader rules with higher priority numbers.

Answer

An NSG can be linked only to a subnet, not to a network interface card.

Answer

Azure ignores NSG rules whenever a route table is attached to the subnet.

Answer

Security rules are processed alphabetically by name.

Question 11

Based on the exhibit, which feature should be enabled on the subnet so the storage account remains reachable through its public endpoint but only from that subnet?

Accepted Answer

Service endpoint. Service endpoints (B) extend the virtual network private address space and the identity of the VNet to Azure services over a direct connection. By enabling a Microsoft.Storage service endpoint on the subnet and configuring the storage account firewall to allow access only from that subnet's virtual network, the storage account remains reachable via its public endpoint but only from the specified subnet, without requiring a public IP on the subnet.

Answer

Private endpoint

Answer

Azure Bastion

Answer

VPN Gateway

Question 12

Based on the exhibit, which address space can you assign to the new spoke virtual network so it can be peered to the hub and later connected to on-premises without an IP overlap?

Accepted Answer

10.52.0.0/16. Option C (10.52.0.0/16) is correct because it does not overlap with the hub virtual network's address space (10.50.0.0/16) or the on-premises network (10.51.0.0/16). This allows the spoke VNet to be peered to the hub and later connected to on-premises via a gateway in the hub without IP address conflicts, which is a requirement for successful VNet peering and VPN/ExpressRoute connectivity.

Answer

10.50.128.0/17

Answer

10.51.0.0/16

Answer

10.50.0.0/24

Question 13

Based on the exhibit, what should the administrator create so VMs in AppSubnet can access the storage account over a private IP address?

Accepted Answer

A private endpoint for the storage account in AppSubnet.. A private endpoint assigns a private IP address from AppSubnet to the storage account, enabling VMs in that subnet to access the storage account over a private IP within the VNet. This eliminates exposure to the public internet and uses Azure Private Link for secure, direct connectivity.

Answer

A service endpoint for Microsoft.Storage on AppSubnet.

Answer

A site-to-site VPN gateway between AppVNet and the storage account.

Answer

An application security group for the storage account and subnet.

Question 14

Based on the exhibit, what should the administrator do to prevent anyone from changing the retention settings after validation?

Accepted Answer

Lock the immutability policy after validation is complete.. Option A is correct because locking the immutability policy (also known as a legal hold or time-based retention policy) prevents any user—including administrators—from modifying or deleting the policy. Once locked, the retention settings become irrevocable, ensuring that data cannot be altered or overwritten during the specified retention period. This is a critical step for compliance with regulations such as SEC 17a-4 or FINRA.

Answer

Move the container to the Cool access tier to preserve the retention period.

Answer

Create a blob snapshot every day so the retention settings cannot be edited.

Answer

Enable container public access so the audit logs are easier to verify.

Question 15

Based on the exhibit, which Azure feature best meets the file-sharing requirement?

Accepted Answer

Azure File Sync, because it synchronizes local servers with a central Azure file share and keeps hot data cached.. Azure File Sync is the correct choice because it enables hybrid file sharing by synchronizing on-premises Windows file servers with a central Azure file share, while also keeping frequently accessed (hot) data cached locally for low-latency access. This directly meets the requirement to replace branch server shares with a cloud-backed solution that maintains local performance.

Answer

Azure Files only, because a cloud file share can replace every branch server share directly.

Answer

Azure Backup, because it can restore files after a WAN outage occurs.

Answer

Azure NetApp Files, because it is the only service that supports SMB access from Windows servers.