AZ-104 Practice Test 40 — 15 Questions

Question 1

Based on the exhibit, a VM is protected by Azure Backup. The business wants daily backups at 11:00 PM, retention of daily recovery points for 30 days, and no changes to the existing vault or VM. The current policy already backs up every day but keeps recovery points for only 7 days. What should the administrator modify?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Edit the backup policy and change daily retention to 30 days.. The existing backup policy already performs daily backups at 11:00 PM, but its retention setting for daily recovery points is only 7 days. By editing the policy and changing the daily retention to 30 days, the administrator meets the business requirement without creating a new VM, altering the vault, or modifying the VM itself. Azure Backup policies allow modification of retention durations independently of backup frequency, so this is a straightforward configuration change.

Answer

Create a new VM and attach the existing backup vault to it.

Answer

Enable soft delete on the vault.

Answer

Move the VM to another availability zone.

Question 2

A development team runs Windows and Linux VMs in a single Azure subnet. The VMs must access an Azure Storage account, and the security team wants to restrict the storage account so only that subnet can reach it. The team does not want to create a private IP for the storage account or change DNS records. What should the administrator configure?

Accepted Answer

A service endpoint on the subnet and a storage account network rule allowing that subnet.. A service endpoint extends the subnet's identity to the storage account, allowing the storage firewall to accept traffic from that subnet without assigning a private IP. This meets the security requirement of restricting access to only that subnet while avoiding private IPs or DNS changes.

Answer

A private endpoint for the storage account and a private DNS zone.

Answer

A site-to-site VPN between the subnet and the storage account.

Answer

A user-defined route that sends storage traffic to the default internet next hop.

Question 3

You need to resize a production VM from Standard_D2s_v5 to Standard_D4s_v5 by using Azure CLI. `az vm list-vm-resize-options` shows the target size, but `az vm resize` fails while the VM is running. Which action should you take first?

Accepted Answer

Run `az vm deallocate`, then resize the VM, then start it again.. Resizing a VM to a different size often requires the VM to be in a deallocated state, especially when the new size is in a different hardware cluster or when the VM is currently running and the resize operation fails. The `az vm deallocate` command releases the underlying hardware resources, allowing the VM to be resized to any available size, including Standard_D4s_v5, and then you can start it again. This is a common requirement for production VMs when live resizing is not supported or fails.

Answer

Run `az vm stop`, then resize the VM.

Answer

Run `az vm restart`, then resize the VM.

Answer

Run `az vm generalize`, then recreate the VM from the image.

Question 4

A team has 20 operators who need the same Reader access to one application resource group. You want to grant access and later revoke it by changing group membership instead of editing each user's permissions. What should you use for the role assignment?

Accepted Answer

An Entra ID security group. Using an Entra ID security group allows you to assign the Reader role to the group, then add or remove the 20 operators as members. This centralizes permission management: granting or revoking access is done by changing group membership rather than editing individual role assignments, which is more efficient and less error-prone.

Answer

Individual user accounts

Answer

A management group

Answer

A resource lock

Question 5

Your operations team wants to query collected VM log data by using Kusto Query Language and retain it centrally for analysis. Which Azure resource should you deploy?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the correct Azure resource because it serves as the central repository for VM log data collected via Azure Monitor agents. It supports Kusto Query Language (KQL) for querying and analyzing the collected data, enabling the operations team to perform advanced log analytics and retention. This aligns directly with the requirement to query and retain VM log data centrally.

Answer

An availability set

Answer

A local user account on each VM

Answer

A network security group

Question 6

A platform team must enforce two governance rules across every current and future subscription under a management group: resources must include an Environment tag, and only East US or West US may be used for deployment. They want one compliance view for both rules and a way to correct missing tags on existing resources where supported. What should they assign?

Accepted Answer

Assign an initiative at the management group scope that contains the tag and allowed-location policies, then remediate the tag policy.. An initiative (policy set) at the management group scope enforces both the required tag and allowed-location rules across all current and future subscriptions in a single compliance view. The tag policy can be remediated using a remediation task with a managed identity to automatically add missing tags on existing resources where supported (e.g., via modify effect). This approach centralizes governance without manual per-subscription assignment.

Answer

Assign two separate policies manually to each subscription and skip remediation.

Answer

Assign Contributor to the management group so administrators can fix any noncompliant resource manually.

Answer

Apply a CanNotDelete lock at the management group scope to prevent drift.

Question 7

A storage account has a blob private endpoint in VNet-A. A VM in peered VNet-B can reach the storage account by private IP, but name resolution for the storage account still returns the public IP address. The private DNS zone privatelink.blob.core.windows.net is already linked only to VNet-A. What should the administrator do next?

Accepted Answer

Create a virtual network link from the private DNS zone to VNet-B.. The private DNS zone `privatelink.blob.core.windows.net` is linked only to VNet-A, so VMs in VNet-B cannot resolve the storage account's FQDN to its private IP. By creating a virtual network link from the private DNS zone to VNet-B, the zone's records become available for resolution in VNet-B, allowing the VM to resolve the storage FQDN to the private endpoint's IP address instead of the public IP.

Answer

Create a second private endpoint in VNet-B for the same storage account.

Answer

Enable a service endpoint on VNet-B and remove the private endpoint.

Answer

Add a user-defined route in VNet-B that points the storage FQDN to the private IP.

Question 8

A line-of-business application stores transaction logs in an Azure Storage account. The app must keep working if one availability zone in the primary region fails, and administrators want read access to the secondary copy if the primary region becomes unavailable. Which redundancy option should you choose?

Accepted Answer

RA-GZRS, because it keeps the primary region zone-redundant and allows read access to the secondary copy.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is correct because it combines zone-redundant storage (ZRS) across availability zones in the primary region, ensuring continued operation if one zone fails, with geo-replication to a secondary region. Additionally, the 'RA' prefix enables read access to the secondary copy if the primary region becomes unavailable, meeting both requirements.

Answer

LRS, because it keeps three local copies in one datacenter and is the simplest choice.

Answer

RA-GRS, because it provides geo-replication and read access to the secondary region.

Answer

GZRS, because it combines zone redundancy in the primary region with geo-replication.

Question 9

Based on the exhibit, what should the administrator do to meet the performance requirement without rebuilding the server?

Accepted Answer

Resize the VM to a larger SKU that provides more vCPU and RAM.. Resizing the VM to a larger SKU with more vCPU and RAM directly addresses the performance requirement by providing additional compute and memory resources to the existing server without requiring a rebuild. This is the correct approach because the VM's current SKU is insufficient for the workload, and Azure allows resizing within the same hardware family or to a compatible series, preserving the OS and application state.

Answer

Attach an additional data disk and move the application binaries to it.

Answer

Redeploy the VM from a different marketplace image.

Answer

Place the VM in an availability set to spread processing across hosts.

Question 10

A developer wants to publish an internet-facing web application from source code. The solution must support built-in HTTPS, deployment slots for testing, and autoscale. The team does not want to manage servers. Which Azure service should the administrator recommend?

Accepted Answer

Azure App Service. Azure App Service is the correct choice because it provides a fully managed platform for hosting web applications from source code, with built-in support for HTTPS via TLS/SSL certificates, deployment slots for staging and testing, and autoscale capabilities. It eliminates server management, aligning with the requirement for a PaaS (Platform as a Service) solution that handles infrastructure, patching, and scaling automatically.

Answer

Azure Container Instances

Answer

Azure Virtual Machine Scale Sets

Answer

Azure Bastion

Question 11

Based on the exhibit, the team wants to validate that a protected Azure VM can be recovered without affecting production. Which restore approach best meets the requirement?

Accepted Answer

Restore the VM to a separate resource group or test environment from the latest recovery point.. Restoring the VM to a separate resource group or test environment from the latest recovery point creates an isolated copy of the VM that does not interact with production resources. This approach validates recoverability without risking production name conflicts, IP address overlaps, or accidental data modification. Azure Backup's restore-to-new-location option explicitly supports this isolation by allowing you to choose a different resource group, virtual network, and storage account.

Answer

Use Replace existing VM so the test uses the production name and disks.

Answer

Export a snapshot and assume that proves the VM can boot successfully.

Answer

Enable Site Recovery failover, because backup restore and failover are identical.

Question 12

Two line-of-business VMs in a single region must stay available if one physical host is patched or fails. A zone failure is not part of the requirement. Which three actions should the administrator take? Select three.

Accepted Answer

Create an availability set for the application VMs before deployment.. An availability set ensures that VMs are placed on different fault domains (physical hosts) and update domains within a single Azure region, protecting against physical host patching or failure. This meets the requirement of keeping VMs available during a single host event without requiring zone-level redundancy.

Answer

Deploy the VMs in separate availability zones to protect against a datacenter outage.

Answer

Use a single larger VM and rely on snapshots for uptime.

Question 13

An NSG attached to a subnet contains these inbound rules: Deny-All-Inbound at priority 200, Allow-HTTPS-Admin at priority 250 from 203.0.113.20/32, and Allow-HTTPS-Internet at priority 300. A VM in the subnet cannot receive HTTPS from the admin workstation even though the source IP is correct. What should the administrator change?

Accepted Answer

Move the Allow-HTTPS-Admin rule to a priority number lower than 200.. The Deny-All-Inbound rule at priority 200 blocks all traffic, including HTTPS from the admin workstation, because NSG rules are evaluated in priority order (lowest number first). The Allow-HTTPS-Admin rule at priority 250 is never reached since the deny rule with a higher priority (lower number) matches first. To allow the admin traffic, the allow rule must have a priority lower than 200 (e.g., 150) so it is evaluated before the deny rule.

Answer

Change the protocol from TCP to Any on the allow rule.

Answer

Associate a NAT gateway with the subnet.

Answer

Enable service endpoint policies on the subnet.

Question 14

A Windows file server VM in Azure needs to mount an Azure file share by using existing Active Directory Domain Services credentials. The security team does not want to use storage account keys. Which authentication option should be configured for Azure Files?

Accepted Answer

Azure Files identity-based authentication using Active Directory Domain Services.. Azure Files supports identity-based authentication using Active Directory Domain Services (AD DS), which allows domain-joined VMs to mount Azure file shares using existing AD credentials without exposing storage account keys. This method leverages Kerberos authentication and enables fine-grained access control via NTFS permissions, meeting the security team's requirement to avoid storage account keys.

Answer

Shared key authorization, because it is the only method supported by Azure Files.

Answer

A user delegation SAS, because it maps the share automatically to domain accounts.

Answer

Anonymous access, because Windows file servers can mount Azure shares without authentication.

Question 15

A subnet NSG contains these inbound rules: Deny-All-Inbound at priority 300, Allow-HTTPS-From-Bastion at priority 200, and Allow-HTTPS-From-AdminIP at priority 350. An administrator expects a management workstation on the internet to connect to a VM over TCP 443, but the connection is blocked. What is the most likely reason?

Accepted Answer

The deny rule at priority 300 is matched before the allow rule at priority 350.. NSG rules are evaluated in priority order, from the lowest priority number (highest priority) to the highest priority number (lowest priority). The Allow-HTTPS-From-AdminIP rule at priority 350 is evaluated after the Deny-All-Inbound rule at priority 300. Since the deny rule at priority 300 matches all inbound traffic before the allow rule at priority 350 is evaluated, the traffic is blocked. The administrator's connection from the internet is denied because the deny rule with a lower priority number (300) takes precedence over the allow rule with a higher priority number (350).

Answer

NSG rules are evaluated from the highest priority number to the lowest priority number.

Answer

Azure NSGs cannot allow inbound traffic from public IP addresses.

Answer

TCP 443 requires an application security group to be used as the source.