AZ-104 Practice Test 40 — 15 Questions

Question 1

A storage account is failing writes, and the team also wants to correlate those errors with subscription-level changes such as role assignments or deployments. What should the administrator configure?

Accepted Answer

Create diagnostic settings on the storage account and the subscription that send logs to the same Log Analytics workspace.. Diagnostic settings on both the storage account and the subscription can stream platform logs (e.g., StorageWrite failures) and activity logs (e.g., role assignments, deployments) to the same Log Analytics workspace. This enables correlated queries across resource-level operational issues and subscription-level changes, allowing the administrator to identify if a recent role assignment or deployment caused the write failures.

Answer

Rotate the storage account keys and review access from the portal activity feed.

Answer

Place the storage account behind an availability set so writes remain available during maintenance.

Answer

Enable a service endpoint from the application subnet and check whether the firewall blocks the writes.

Question 2

A web app running in Azure App Service must read blobs from a storage account. The app must authenticate without storing secrets or SAS tokens, and administrators should grant only blob data permissions, not storage management permissions. What should you configure?

Accepted Answer

A system-assigned managed identity for the app with Storage Blob Data Reader assigned at the storage scope.. A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any secrets or SAS tokens. By assigning the Storage Blob Data Reader role at the storage account scope, you grant only the necessary blob read permissions while explicitly excluding any storage management permissions (e.g., creating or deleting storage accounts). This aligns with the principle of least privilege and eliminates credential management overhead.

Answer

The storage account access key in an application setting, because it works with any blob operation.

Answer

The Contributor role on the storage account, because it includes both management and data permissions.

Answer

A service endpoint on the subnet, because service endpoints are used for application authentication.

Question 3

Based on the exhibit, which KQL query should you use to find failed storage account delete operations in the last hour and count them by caller?

Accepted Answer

AzureActivity | where TimeGenerated > ago(1h) | where OperationNameValue has 'Microsoft.Storage/storageAccounts/delete' | where ActivityStatusValue == 'Failed' | summarize Failures=count() by Caller. It filters AzureActivity logs to the last hour using `TimeGenerated > ago(1h)`, targets only storage account delete operations with `OperationNameValue has 'Microsoft.Storage/storageAccounts/delete'`, restricts to failed operations via `ActivityStatusValue == 'Failed'`, and then counts failures by caller using `summarize Failures=count() by Caller`. This precisely meets the requirement to find failed storage account delete operations in the last hour and count them by caller.

Answer

AzureActivity | where TimeGenerated > ago(1h) | where OperationNameValue has 'Microsoft.Storage/storageAccounts/delete' | where ActivityStatusValue == 'Succeeded' | summarize Failures=count() by Caller

Answer

SecurityEvent | where EventID == 4670 | summarize count() by Account

Answer

AzureActivity | where TimeGenerated > ago(1h) | where OperationNameValue has 'Microsoft.Storage/storageAccounts/delete' | summarize Failures=count() by Caller

Question 4

A storage account must be reachable only from a single subnet. The team wants to keep the storage public endpoint in place, avoid a private endpoint, and avoid managing any custom DNS records. Which change best meets the requirement?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account firewall allow list.. Enabling a service endpoint for Microsoft.Storage on the subnet injects the subnet's identity into the traffic to the storage account, allowing the storage account firewall to permit access only from that subnet while keeping the public endpoint active. This avoids the need for a private endpoint, custom DNS records, or additional routing appliances, directly meeting the requirement of restricting access to a single subnet.

Answer

Add a network security group rule to the subnet that allows outbound TCP 443 to the storage account.

Answer

Create a private endpoint and set the storage account to use a private DNS zone.

Answer

Create a route table that sends storage traffic through an Azure Firewall appliance.

Question 5

Based on the exhibit, the web tier can reach the API subnet by name, but the traffic is still blocked. What should the administrator do?

Accepted Answer

Add the API VM NICs to the destination application security group.. The web tier can resolve the API subnet's name, but traffic is still blocked. This indicates that the network security group (NSG) rules are not correctly configured to allow traffic from the web VMs (in ASG-Web) to the API VMs (in ASG-API). By adding the API VM NICs to the destination application security group (ASG), the NSG rule that references ASG-API as the destination will match the API VMs, allowing the traffic. Without this, the NSG rule may be referencing an empty or incorrect destination, causing the traffic to be denied by the default deny rule.

Answer

Increase the priority number of the allow rule so it is evaluated earlier.

Answer

Replace the ASG with a service endpoint on the API subnet.

Answer

Remove the web VMs from ASG-Web because ASGs block traffic by default.

Question 6

A development subnet must access an Azure Storage account privately, but the security team does not want to create a private IP in the VNet. They only want the subnet identity to be extended to the storage service. Which feature should the administrator configure?

Accepted Answer

Service endpoint. A service endpoint extends the VNet identity to the Azure Storage service, allowing traffic from the subnet to reach the storage account over the Azure backbone network without requiring a private IP. This meets the requirement of private access without creating a private IP in the VNet, as the subnet's identity is used for access control via the storage account firewall.

Answer

Private endpoint

Answer

Azure Front Door

Answer

Network security group outbound rule

Question 7

Based on the exhibit, a VM is protected by Azure Backup. The business wants daily backups at 11:00 PM, retention of daily recovery points for 30 days, and no changes to the existing vault or VM. The current policy already backs up every day but keeps recovery points for only 7 days. What should the administrator modify?

Accepted Answer

Edit the backup policy and change daily retention to 30 days.. The existing backup policy already performs daily backups at 11:00 PM, but its retention setting for daily recovery points is only 7 days. By editing the policy and changing the daily retention to 30 days, the administrator meets the business requirement without creating a new VM, altering the vault, or modifying the VM itself. Azure Backup policies allow modification of retention durations independently of backup frequency, so this is a straightforward configuration change.

Answer

Create a new VM and attach the existing backup vault to it.

Answer

Enable soft delete on the vault.

Answer

Move the VM to another availability zone.

Question 8

A development team runs Windows and Linux VMs in a single Azure subnet. The VMs must access an Azure Storage account, and the security team wants to restrict the storage account so only that subnet can reach it. The team does not want to create a private IP for the storage account or change DNS records. What should the administrator configure?

Accepted Answer

A service endpoint on the subnet and a storage account network rule allowing that subnet.. A service endpoint extends the subnet's identity to the storage account, allowing the storage firewall to accept traffic from that subnet without assigning a private IP. This meets the security requirement of restricting access to only that subnet while avoiding private IPs or DNS changes.

Answer

A private endpoint for the storage account and a private DNS zone.

Answer

A site-to-site VPN between the subnet and the storage account.

Answer

A user-defined route that sends storage traffic to the default internet next hop.

Question 9

You need to resize a production VM from Standard_D2s_v5 to Standard_D4s_v5 by using Azure CLI. `az vm list-vm-resize-options` shows the target size, but `az vm resize` fails while the VM is running. Which action should you take first?

Accepted Answer

Run `az vm deallocate`, then resize the VM, then start it again.. Resizing a VM to a different size often requires the VM to be in a deallocated state, especially when the new size is in a different hardware cluster or when the VM is currently running and the resize operation fails. The `az vm deallocate` command releases the underlying hardware resources, allowing the VM to be resized to any available size, including Standard_D4s_v5, and then you can start it again. This is a common requirement for production VMs when live resizing is not supported or fails.

Answer

Run `az vm stop`, then resize the VM.

Answer

Run `az vm restart`, then resize the VM.

Answer

Run `az vm generalize`, then recreate the VM from the image.

Question 10

A team has 20 operators who need the same Reader access to one application resource group. You want to grant access and later revoke it by changing group membership instead of editing each user's permissions. What should you use for the role assignment?

Accepted Answer

An Entra ID security group. Using an Entra ID security group allows you to assign the Reader role to the group, then add or remove the 20 operators as members. This centralizes permission management: granting or revoking access is done by changing group membership rather than editing individual role assignments, which is more efficient and less error-prone.

Answer

Individual user accounts

Answer

A management group

Answer

A resource lock

Question 11

Your operations team wants to query collected VM log data by using Kusto Query Language and retain it centrally for analysis. Which Azure resource should you deploy?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the correct Azure resource because it serves as the central repository for VM log data collected via Azure Monitor agents. It supports Kusto Query Language (KQL) for querying and analyzing the collected data, enabling the operations team to perform advanced log analytics and retention. This aligns directly with the requirement to query and retain VM log data centrally.

Answer

An availability set

Answer

A local user account on each VM

Answer

A network security group

Question 12

A platform team must enforce two governance rules across every current and future subscription under a management group: resources must include an Environment tag, and only East US or West US may be used for deployment. They want one compliance view for both rules and a way to correct missing tags on existing resources where supported. What should they assign?

Accepted Answer

Assign an initiative at the management group scope that contains the tag and allowed-location policies, then remediate the tag policy.. An initiative (policy set) at the management group scope enforces both the required tag and allowed-location rules across all current and future subscriptions in a single compliance view. The tag policy can be remediated using a remediation task with a managed identity to automatically add missing tags on existing resources where supported (e.g., via modify effect). This approach centralizes governance without manual per-subscription assignment.

Answer

Assign two separate policies manually to each subscription and skip remediation.

Answer

Assign Contributor to the management group so administrators can fix any noncompliant resource manually.

Answer

Apply a CanNotDelete lock at the management group scope to prevent drift.

Question 13

A storage account has a blob private endpoint in VNet-A. A VM in peered VNet-B can reach the storage account by private IP, but name resolution for the storage account still returns the public IP address. The private DNS zone privatelink.blob.core.windows.net is already linked only to VNet-A. What should the administrator do next?

Accepted Answer

Create a virtual network link from the private DNS zone to VNet-B.. The private DNS zone `privatelink.blob.core.windows.net` is linked only to VNet-A, so VMs in VNet-B cannot resolve the storage account's FQDN to its private IP. By creating a virtual network link from the private DNS zone to VNet-B, the zone's records become available for resolution in VNet-B, allowing the VM to resolve the storage FQDN to the private endpoint's IP address instead of the public IP.

Answer

Create a second private endpoint in VNet-B for the same storage account.

Answer

Enable a service endpoint on VNet-B and remove the private endpoint.

Answer

Add a user-defined route in VNet-B that points the storage FQDN to the private IP.

Question 14

A line-of-business application stores transaction logs in an Azure Storage account. The app must keep working if one availability zone in the primary region fails, and administrators want read access to the secondary copy if the primary region becomes unavailable. Which redundancy option should you choose?

Accepted Answer

RA-GZRS, because it keeps the primary region zone-redundant and allows read access to the secondary copy.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is correct because it combines zone-redundant storage (ZRS) across availability zones in the primary region, ensuring continued operation if one zone fails, with geo-replication to a secondary region. Additionally, the 'RA' prefix enables read access to the secondary copy if the primary region becomes unavailable, meeting both requirements.

Answer

LRS, because it keeps three local copies in one datacenter and is the simplest choice.

Answer

RA-GRS, because it provides geo-replication and read access to the secondary region.

Answer

GZRS, because it combines zone redundancy in the primary region with geo-replication.

Question 15

Based on the exhibit, what should the administrator do to meet the performance requirement without rebuilding the server?

Accepted Answer

Resize the VM to a larger SKU that provides more vCPU and RAM.. Resizing the VM to a larger SKU with more vCPU and RAM directly addresses the performance requirement by providing additional compute and memory resources to the existing server without requiring a rebuild. This is the correct approach because the VM's current SKU is insufficient for the workload, and Azure allows resizing within the same hardware family or to a compatible series, preserving the OS and application state.

Answer

Attach an additional data disk and move the application binaries to it.

Answer

Redeploy the VM from a different marketplace image.

Answer

Place the VM in an availability set to spread processing across hosts.