AZ-104 Practice Test 40 — 15 Questions

Question 1

Based on the exhibit, a script running on an Azure VM must create resources in another subscription without using passwords or client secrets. Which command should the administrator use first?

Accepted Answer

az login --identity. Option A is correct because the script must authenticate without passwords or client secrets, and Azure VMs can use a managed identity for this purpose. The `az login --identity` command authenticates the Azure CLI using the VM's managed identity, which is a passwordless, secretless authentication method. This allows the script to obtain tokens for accessing resources in another subscription, provided the managed identity has appropriate RBAC permissions.

Answer

az login --service-principal

Answer

az account set --subscription <subscriptionId>

Answer

Connect-AzAccount -UseDeviceAuthentication

Question 2

Based on the exhibit, a policy assigned at the subscription denies storage accounts that allow public network access. One existing storage account in RG-Legacy must remain publicly reachable for 30 days while a migration is completed. What should the administrator use?

Accepted Answer

Create a policy exemption for stlegacy01 at the resource scope.. A policy exemption at the resource scope is the correct approach because it allows the administrator to selectively exclude the specific storage account (stlegacy01) from the subscription-level policy that denies public network access. This exemption can be configured with an expiration date of 30 days, ensuring the legacy account remains publicly reachable during the migration while the policy continues to apply to all other resources. Policy exemptions are designed for exactly this scenario—temporary exceptions for compliance or migration needs—without altering the policy definition or assignment.

Answer

Remove the policy assignment from the subscription until the migration finishes.

Answer

Change the policy effect from Deny to Audit.

Answer

Move the legacy storage account to a separate subscription and assign the policy there.

Question 3

Based on the exhibit, the administrator cannot create VNet peering between the hub and spoke networks. What should be changed?

Accepted Answer

Change the spoke VNet address space so it does not overlap the hub.. VNet peering requires that the address spaces of the peered VNets do not overlap. Overlapping address spaces cause routing conflicts because Azure cannot distinguish between resources in the hub and spoke when IP addresses are identical or within the same CIDR range. Changing the spoke VNet address space to a non-overlapping range resolves this issue and allows peering to be established.

Answer

Change the hub VNet to use a smaller subnet mask.

Answer

Add a route table to the spoke VNet before creating peering.

Answer

Enable a service endpoint on both VNets.

Question 4

Based on the exhibit, what is the best change so the VNet peering can be created successfully?

Accepted Answer

Change VNet-B to a non-overlapping address space, such as 10.1.0.0/24.. VNet peering requires that the address spaces of the two virtual networks do not overlap. If VNet-A uses 10.0.0.0/16 and VNet-B also uses 10.0.0.0/16, they conflict, preventing peering. Changing VNet-B to a non-overlapping address space like 10.1.0.0/24 resolves this conflict, allowing the peering to be established.

Answer

Add a route table to VNet-B before creating the peering.

Answer

Enable gateway transit on VNet-A.

Answer

Resize VNet-A to 10.0.0.0/15 so both VNets fit.

Question 5

Based on the exhibit, what configuration should the administrator change so VMs in the spoke can resolve internal names from the hub?

Accepted Answer

Set the spoke VNet custom DNS server to 10.50.0.4.. The hub VNet has a DNS server at 10.50.0.4 that is configured to resolve internal names. By setting the spoke VNet's custom DNS server to 10.50.0.4, VMs in the spoke will forward DNS queries to that server, enabling resolution of internal names from the hub. This overrides the default Azure-provided DNS and directs name resolution to the hub's DNS infrastructure.

Answer

Add a route table entry that points to the hub DNS server.

Answer

Enable a service endpoint for Microsoft.Storage on the spoke subnet.

Answer

Create a private endpoint for the spoke VM subnet.

Question 6

Based on the exhibit, which identity should the administrator enable to remove the secret from app settings and have the identity disappear automatically when the app is deleted?

Accepted Answer

System-assigned managed identity. The system-assigned managed identity is tied directly to the lifecycle of the Azure resource (e.g., an App Service). When you enable it, Azure automatically creates a service principal in Azure AD for that resource, and you can use the identity to access Azure Key Vault without storing secrets in app settings. When the resource is deleted, the system-assigned managed identity and its corresponding service principal are automatically removed, eliminating the need for manual cleanup.

Answer

User-assigned managed identity

Answer

Service principal with a client secret

Answer

Shared access signature

Question 7

During a change freeze, the operations team wants to prevent accidental deletion of a production resource group and everything in it. They still need to update VM settings, change tags, and modify network rules. Which lock should be applied?

Accepted Answer

Apply a CanNotDelete lock to the resource group.. The CanNotDelete lock (Option B) prevents deletion of the resource group and all resources within it, while still allowing read and update operations such as modifying VM settings, changing tags, and updating network rules. This lock type is specifically designed to protect against accidental deletion during a change freeze without blocking management operations.

Answer

Apply a ReadOnly lock to the resource group.

Answer

Assign the Reader role to all operators.

Answer

Assign an Azure Policy deny assignment at the subscription.

Question 8

Based on the exhibit, what should the administrator configure so storage logs can be queried later with KQL?

Accepted Answer

Configure diagnostic settings to send logs to a Log Analytics workspace.. Diagnostic settings in Azure allow you to stream platform logs, including storage logs, to a Log Analytics workspace. Once the logs are in Log Analytics, you can query them using Kusto Query Language (KQL) to analyze storage operations, errors, and metrics. This is the only option that directly enables querying storage logs with KQL.

Answer

Create a backup policy for the storage account so the logs are retained automatically.

Answer

Enable a resource lock on the storage account so no logs are lost.

Answer

Turn on blob versioning so every change to the storage account is searchable.

Question 9

Based on the exhibit, where should the administrator go next to review the failed backup job details?

Accepted Answer

Jobs, because it contains the backup job status and error details.. The Jobs blade in Azure Backup is the central location for reviewing the status, progress, and detailed error messages of all backup jobs, including failed ones. It provides a filtered view of backup, restore, and other operations, allowing the administrator to drill into specific job failures to see error codes and recommended actions.

Answer

Backup policy, because it shows the retention and schedule configuration.

Answer

Backup items, because it lists protected resources and recovery points.

Answer

Properties, because it contains the general vault settings.

Question 10

Based on the exhibit, which subnet prefix should you create for the workload subnet so it has enough usable IP addresses for all listed resources?

Accepted Answer

/26. The workload subnet must support 30 VMs, 5 internal load balancer frontend IPs, and 5 backend pool instances, totaling 40 IP addresses. A /26 subnet provides 64 total IPs, with 62 usable (after reserving network and broadcast addresses), which is sufficient. Smaller prefixes like /27 (30 usable) or /28 (14 usable) lack capacity, while /25 (126 usable) is excessive and wastes IP space.

Answer

/27

Answer

/25

Answer

/28

Question 11

Three application VMs in different resource groups must use the same Azure identity to read blobs from a storage account. The identity must continue to work if the VMs are redeployed. What should you use?

Accepted Answer

A user-assigned managed identity. A user-assigned managed identity is the correct choice because it is a standalone Azure resource that can be assigned to multiple VMs across different resource groups. It persists independently of the VM lifecycle, so it continues to work even if the VMs are redeployed, and it can be used to authenticate to Azure Storage for blob read operations via Azure AD.

Answer

A system-assigned managed identity on each VM

Answer

A shared access signature stored in a configuration file

Answer

The local Administrator account on each VM

Question 12

Three Azure virtual machines in different resource groups must all use the same Azure identity to access a storage account. The identity should keep working even if one VM is rebuilt. What should you use?

Accepted Answer

A user-assigned managed identity. A user-assigned managed identity is created as a standalone Azure resource and can be assigned to multiple VMs, even across resource groups. It persists independently of any VM lifecycle, so rebuilding a VM does not affect the identity's availability or its permissions to access the storage account.

Answer

A system-assigned managed identity on each VM

Answer

A shared VM administrator password

Answer

A storage account SAS token

Question 13

Based on the exhibit, which KQL clause should replace the blank to show only heartbeat records from the last 30 minutes?

Accepted Answer

where TimeGenerated >= ago(30m). The KQL clause `where TimeGenerated >= ago(30m)` filters the results to include only records where the `TimeGenerated` timestamp is within the last 30 minutes. The `ago()` function calculates a datetime value relative to the current time, and the `>=` operator ensures only records from that point forward are returned. This directly satisfies the requirement to show heartbeat records from the last 30 minutes.

Answer

project Computer, TimeGenerated

Answer

extend TimeWindow = 30m

Answer

sort by TimeGenerated desc

Question 14

The operations team wants an email and SMS notification whenever any production virtual machine's average CPU stays above 85 percent for 10 minutes. They also want to reuse the same notification targets for future alerts. What should they configure?

Accepted Answer

An action group attached to a metric alert rule. Option B is correct because an action group in Azure Monitor defines the notification targets (email, SMS, etc.) for alerts, and a metric alert rule can be configured to trigger when the average CPU percentage exceeds 85% for 10 minutes. By attaching the same action group to multiple alert rules, the operations team can reuse the notification targets for future alerts without reconfiguring them each time.

Answer

A diagnostic setting on each VM that sends metrics to a storage account

Answer

A Log Analytics query alert with no notification target

Answer

A resource lock on the virtual machines

Question 15

The team accidentally stopped protection for a VM and deleted its backup data. They want Azure Backup to keep deleted backup items recoverable for a grace period so the item can be undeleted if needed. Which vault feature should be enabled?

Accepted Answer

Soft delete. Soft delete is the correct feature because it provides a grace period (default 14 days) during which deleted backup data is retained in a soft-deleted state. This allows administrators to recover (undelete) backup items that were accidentally deleted, including cases where protection was stopped and data was removed. Without soft delete, deleted backup data is permanently purged and cannot be recovered.

Answer

Instant restore

Answer

A new backup policy

Answer

A private endpoint for the vault

AZ-104 Practice Test 40 — 15 Questions

Exhibit

AZ-104 Practice Test 40 — 15 Questions

Exhibit