AZ-104 Practice Test 39 — 15 Questions

Question 1

Based on the exhibit, the backup policy must support 30-day recovery for daily backups while keeping 12 months of monthly copies. Which setting should be changed?

Accepted Answer

Increase daily retention from 7 days to 30 days.. The backup policy currently has daily retention set to 7 days, which only keeps daily recovery points for a week. To meet the requirement of 30-day recovery for daily backups, you must increase the daily retention to 30 days. This ensures that each daily backup is retained for 30 days, allowing point-in-time recovery within that window.

Answer

Increase weekly retention from 4 weeks to 30 weeks.

Answer

Change the backup schedule to every 30 days.

Answer

Turn on archive tier for the backup policy.

Question 2

Based on the exhibit, which KQL query should you use in a scheduled query alert to trigger only when five or more failed events occur within any 15-minute window?

Accepted Answer

CustomAppLogs_CL | where TimeGenerated >= ago(1h) | where Status_s == 'Failed' | summarize FailedCount=count() by bin(TimeGenerated, 15m) | where FailedCount >= 5. It filters for 'Failed' events in the last hour, groups them into 15-minute bins using `bin(TimeGenerated, 15m)`, and then counts them. The `where FailedCount >= 5` condition triggers the alert only when five or more failed events occur within any single 15-minute window, matching the requirement exactly.

Answer

CustomAppLogs_CL | where TimeGenerated >= ago(15m) | where Status_s == 'Failed' | summarize FailedCount=count() by bin(TimeGenerated, 1h) | where FailedCount >= 5

Answer

CustomAppLogs_CL | where TimeGenerated >= ago(1h) | summarize FailedCount=count() by bin(TimeGenerated, 15m) | where FailedCount >= 5

Answer

CustomAppLogs_CL | where TimeGenerated >= ago(1h) | where Status_s == 'Failed' | summarize FailedCount=count() by bin(TimeGenerated, 15m) | where FailedCount > 0

Question 3

Based on the exhibit, the production resource group must not be deleted during a change freeze, but administrators still need to update VM sizes and tag values. Which lock should you apply?

Accepted Answer

Apply a CanNotDelete lock to RG-Prod.. A CanNotDelete lock (B) prevents deletion of the resource group while allowing all other operations, including updating VM sizes and modifying tag values. This meets the requirement of blocking deletion during a change freeze without restricting administrative updates.

Answer

Apply a ReadOnly lock to RG-Prod.

Answer

Apply a lock to the subscription instead of the resource group.

Answer

Use Azure Policy with a deny effect to block deletes.

Question 4

A storage account must be reachable only from Azure VMs in a single subnet. Public network access should not be used, and the team wants the storage service to keep using a private IP address inside the virtual network. Which feature should the administrator configure?

Accepted Answer

A private endpoint for the storage account in the subnet.. A private endpoint assigns the storage account a private IP address from the subnet's address space, using Azure Private Link to route traffic entirely over the Microsoft backbone network. This ensures the storage account is reachable only from VMs in that subnet and blocks all public internet access, meeting both requirements.

Answer

A service endpoint on the subnet, because it creates a private IP address for the storage account.

Answer

A shared access signature that is limited to the subnet.

Answer

Storage account access keys, because they bind access to one subnet automatically.

Question 5

A subnet has an NSG with these inbound rules: priority 200 DenyAllInbound and priority 300 AllowHTTPSFromInternet. A VM in the subnet is still unreachable on TCP 443 from the internet. What should you do to make HTTPS work while keeping the deny rule in place?

Accepted Answer

Move the allow HTTPS rule to a lower priority number such as 100 so it is evaluated before the deny rule.. NSG rules are evaluated in priority order, with lower numbers evaluated first. Moving the allow HTTPS rule to priority 100 ensures it is processed before the DenyAllInbound rule at priority 200, allowing TCP 443 traffic from the internet while the deny rule remains in place for all other inbound traffic.

Answer

Create the same allow rule on the NIC-level NSG at priority 300 and leave the subnet NSG unchanged.

Answer

Change the deny rule to protocol Any and keep the same priority so Azure evaluates the allow rule first.

Answer

Add a route table entry for TCP 443 traffic so Azure sends it directly to the VM.

Question 6

A subnet uses a route table with gateway route propagation disabled so internet-bound traffic can be forced through a network virtual appliance. After the change, VMs in the subnet can no longer reach servers in the on-premises network 172.16.0.0/16 over the VPN gateway. What should the administrator add to the route table?

Accepted Answer

A user-defined route for 172.16.0.0/16 with next hop type Virtual network gateway.. When gateway route propagation is disabled on a route table, the subnet no longer receives the default system routes that include the VPN gateway route for on-premises networks. To restore connectivity to 172.16.0.0/16, you must add a user-defined route (UDR) with next hop type 'Virtual network gateway', which explicitly directs traffic for that prefix through the VPN gateway. This overrides the missing propagated route and forces the traffic to the on-premises network correctly.

Answer

A user-defined route for 172.16.0.0/16 with next hop type Internet.

Answer

An NSG allow rule for TCP 172.16.0.0/16.

Answer

A service endpoint for the on-premises network range.

Question 7

An administrator is troubleshooting inbound HTTPS to a VM. The subnet NSG has these custom rules: Deny-Internet-Inbound at priority 150, Allow-HTTPS-Admin at priority 200, and the default deny rules remain in place. The administrator’s client is on the internet and should be able to reach the VM on TCP 443. What change will fix the problem?

Accepted Answer

Move the allow rule to a lower priority number than the deny rule.. Network Security Group (NSG) rules are evaluated in priority order, with lower numbers evaluated first. The Deny-Internet-Inbound rule at priority 150 is evaluated before the Allow-HTTPS-Admin rule at priority 200, so the deny rule blocks the inbound HTTPS traffic before the allow rule can be processed. Moving the allow rule to a lower priority number (e.g., 140) ensures it is evaluated first, permitting the traffic from the internet on TCP 443.

Answer

Change the allow rule source from Internet to Any and keep the same priority.

Answer

Create a route table to the VM subnet so traffic reaches the VM faster.

Answer

Associate an application security group with the VM and leave the rules unchanged.

Question 8

A blob was moved to the Archive tier last month. A project team now needs the file available later today, and they expect to read it several times during review. What should the administrator do first?

Accepted Answer

Start a rehydration request and move the blob to the Hot tier with high priority.. A blob in the Archive tier is offline and must be rehydrated (changed to Hot or Cool) before it can be accessed. Using high-priority rehydration ensures the blob becomes available within 1 hour, which meets the requirement for later today. The Hot tier is appropriate since the team expects to read the blob several times, providing low-latency access without incurring read costs from Cool tier.

Answer

Copy the blob directly from Archive to a local machine and reopen it there.

Answer

Change the blob to the Cool tier immediately and expect it to become available within minutes.

Answer

Create a lifecycle rule to move the blob back to Hot automatically on the next day.

Question 9

Based on the exhibit, what should the administrator create so VMs in AppSubnet can access the storage account over a private IP address?

Accepted Answer

A private endpoint for the storage account in AppSubnet.. A private endpoint assigns a private IP address from AppSubnet to the storage account, enabling VMs in that subnet to access the storage account over a private IP within the VNet. This eliminates exposure to the public internet and uses Azure Private Link for secure, direct connectivity.

Answer

A service endpoint for Microsoft.Storage on AppSubnet.

Answer

A site-to-site VPN gateway between AppVNet and the storage account.

Answer

An application security group for the storage account and subnet.

Question 10

A storage account is failing writes, and the team also wants to correlate those errors with subscription-level changes such as role assignments or deployments. What should the administrator configure?

Accepted Answer

Create diagnostic settings on the storage account and the subscription that send logs to the same Log Analytics workspace.. Diagnostic settings on both the storage account and the subscription can stream platform logs (e.g., StorageWrite failures) and activity logs (e.g., role assignments, deployments) to the same Log Analytics workspace. This enables correlated queries across resource-level operational issues and subscription-level changes, allowing the administrator to identify if a recent role assignment or deployment caused the write failures.

Answer

Rotate the storage account keys and review access from the portal activity feed.

Answer

Place the storage account behind an availability set so writes remain available during maintenance.

Answer

Enable a service endpoint from the application subnet and check whether the firewall blocks the writes.

Question 11

A web app running in Azure App Service must read blobs from a storage account. The app must authenticate without storing secrets or SAS tokens, and administrators should grant only blob data permissions, not storage management permissions. What should you configure?

Accepted Answer

A system-assigned managed identity for the app with Storage Blob Data Reader assigned at the storage scope.. A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any secrets or SAS tokens. By assigning the Storage Blob Data Reader role at the storage account scope, you grant only the necessary blob read permissions while explicitly excluding any storage management permissions (e.g., creating or deleting storage accounts). This aligns with the principle of least privilege and eliminates credential management overhead.

Answer

The storage account access key in an application setting, because it works with any blob operation.

Answer

The Contributor role on the storage account, because it includes both management and data permissions.

Answer

A service endpoint on the subnet, because service endpoints are used for application authentication.

Question 12

Based on the exhibit, which KQL query should you use to find failed storage account delete operations in the last hour and count them by caller?

Accepted Answer

AzureActivity | where TimeGenerated > ago(1h) | where OperationNameValue has 'Microsoft.Storage/storageAccounts/delete' | where ActivityStatusValue == 'Failed' | summarize Failures=count() by Caller. It filters AzureActivity logs to the last hour using `TimeGenerated > ago(1h)`, targets only storage account delete operations with `OperationNameValue has 'Microsoft.Storage/storageAccounts/delete'`, restricts to failed operations via `ActivityStatusValue == 'Failed'`, and then counts failures by caller using `summarize Failures=count() by Caller`. This precisely meets the requirement to find failed storage account delete operations in the last hour and count them by caller.

Answer

AzureActivity | where TimeGenerated > ago(1h) | where OperationNameValue has 'Microsoft.Storage/storageAccounts/delete' | where ActivityStatusValue == 'Succeeded' | summarize Failures=count() by Caller

Answer

SecurityEvent | where EventID == 4670 | summarize count() by Account

Answer

AzureActivity | where TimeGenerated > ago(1h) | where OperationNameValue has 'Microsoft.Storage/storageAccounts/delete' | summarize Failures=count() by Caller

Question 13

A storage account must be reachable only from a single subnet. The team wants to keep the storage public endpoint in place, avoid a private endpoint, and avoid managing any custom DNS records. Which change best meets the requirement?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account firewall allow list.. Enabling a service endpoint for Microsoft.Storage on the subnet injects the subnet's identity into the traffic to the storage account, allowing the storage account firewall to permit access only from that subnet while keeping the public endpoint active. This avoids the need for a private endpoint, custom DNS records, or additional routing appliances, directly meeting the requirement of restricting access to a single subnet.

Answer

Add a network security group rule to the subnet that allows outbound TCP 443 to the storage account.

Answer

Create a private endpoint and set the storage account to use a private DNS zone.

Answer

Create a route table that sends storage traffic through an Azure Firewall appliance.

Question 14

Based on the exhibit, the web tier can reach the API subnet by name, but the traffic is still blocked. What should the administrator do?

Accepted Answer

Add the API VM NICs to the destination application security group.. The web tier can resolve the API subnet's name, but traffic is still blocked. This indicates that the network security group (NSG) rules are not correctly configured to allow traffic from the web VMs (in ASG-Web) to the API VMs (in ASG-API). By adding the API VM NICs to the destination application security group (ASG), the NSG rule that references ASG-API as the destination will match the API VMs, allowing the traffic. Without this, the NSG rule may be referencing an empty or incorrect destination, causing the traffic to be denied by the default deny rule.

Answer

Increase the priority number of the allow rule so it is evaluated earlier.

Answer

Replace the ASG with a service endpoint on the API subnet.

Answer

Remove the web VMs from ASG-Web because ASGs block traffic by default.

Question 15

A development subnet must access an Azure Storage account privately, but the security team does not want to create a private IP in the VNet. They only want the subnet identity to be extended to the storage service. Which feature should the administrator configure?

Accepted Answer

Service endpoint. A service endpoint extends the VNet identity to the Azure Storage service, allowing traffic from the subnet to reach the storage account over the Azure backbone network without requiring a private IP. This meets the requirement of private access without creating a private IP in the VNet, as the subnet's identity is used for access control via the storage account firewall.

Answer

Private endpoint

Answer

Azure Front Door

Answer

Network security group outbound rule