AZ-104 Practice Test 41 — 15 Questions

Question 1

Based on the exhibit, you want the resource logs for the storage account to appear in Log Analytics so you can investigate read and write failures. What should you configure?

Accepted Answer

Add a diagnostic setting that sends resource logs to the Log Analytics workspace.. Diagnostic settings in Azure allow you to stream resource logs (such as StorageRead and StorageWrite logs) from a storage account directly to a Log Analytics workspace. By configuring a diagnostic setting with the appropriate log categories enabled, you can query and analyze read and write failures in Log Analytics without additional infrastructure.

Answer

Create a metric alert rule on the storage account and link it to an action group.

Answer

Enable a resource lock so the storage account cannot be modified.

Answer

Move the storage account to a different subscription that already has Log Analytics enabled.

Question 2

The service desk needs to add and remove users from a support group that grants access to an internal application, but the service desk must not receive Azure subscription permissions. Which two actions should you take? Select two.

Accepted Answer

Create a security group in Microsoft Entra ID for the application access.. Creating a security group in Microsoft Entra ID (formerly Azure AD) allows you to manage access to the internal application without granting any Azure subscription permissions. The service desk can then add or remove users from this group, and the application's access control can be configured to rely on group membership, ensuring the service desk staff never receive Azure RBAC roles.

Answer

Assign the service desk staff Contributor on the subscription.

Answer

Convert the service desk staff into guest users in the tenant.

Answer

Add the service desk staff as members only, without ownership.

Question 3

A build pipeline needs to run a Linux container for 10 to 15 minutes at a time. The team does not want to manage servers, clusters, or an always-on VM. Which Azure service should be used?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice because it allows you to run a Linux container directly on Azure without provisioning or managing any underlying infrastructure. ACI is ideal for short-lived, burstable workloads like a build pipeline that runs for 10–15 minutes, as it supports per-second billing and automatic startup/shutdown without the overhead of a cluster or VM.

Answer

Azure Kubernetes Service

Answer

Azure Virtual Machine

Answer

Azure App Service

Question 4

Based on the exhibit, a script running on an Azure VM must create resources in another subscription without using passwords or client secrets. Which command should the administrator use first?

Accepted Answer

az login --identity. The script must authenticate without passwords or client secrets, and Azure VMs can use a managed identity for this purpose. The `az login --identity` command authenticates the Azure CLI using the VM's managed identity, which is a passwordless, secretless authentication method. This allows the script to obtain tokens for accessing resources in another subscription, provided the managed identity has appropriate RBAC permissions.

Answer

az login --service-principal

Answer

az account set --subscription <subscriptionId>

Answer

Connect-AzAccount -UseDeviceAuthentication

Question 5

A VM-hosted automation tool must call Azure APIs without storing a password or certificate on disk. The identity should disappear automatically when the VM is deleted. Which identity should the administrator assign?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is tied directly to the lifecycle of the Azure VM — when the VM is deleted, the identity is automatically removed. It allows the VM to authenticate to Azure APIs without storing any credentials (password or certificate) on disk, using Microsoft Entra ID tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254.

Answer

A user-assigned managed identity

Answer

A service principal with a client secret

Answer

A storage account access key

Question 6

Based on the exhibit, a backup administrator accidentally stopped protection for a critical VM and then deleted its backup item. The team wants Azure Backup to retain the deleted item long enough to recover it after the mistake is discovered the next day. What should be enabled on the vault?

Accepted Answer

Soft delete for backup data. Soft delete for backup data is the correct answer because it provides a safety net for accidentally deleted backup items. When enabled, Azure Backup retains deleted backup data for an additional 14 days (default) in a soft-deleted state, allowing administrators to recover the data before it is permanently purged. This directly addresses the scenario where protection was stopped and the backup item was deleted, as the data remains recoverable within the retention period.

Answer

A read-only resource lock on the VM

Answer

A network security group rule allowing port 445

Answer

Instant restore snapshots set to 30 days

Question 7

A team has Windows VMs in a subnet that need to access an Azure Storage account. The storage account should remain reachable through its public endpoint, but only traffic from that one subnet should be allowed. Which configuration best meets the requirement?

Accepted Answer

Enable a service endpoint on the subnet and add a virtual network rule for that subnet on the storage account firewall.. A service endpoint extends the virtual network private address space to the storage account, allowing traffic from the specified subnet to reach the storage account via the Azure backbone while keeping the public endpoint accessible. By adding a virtual network rule on the storage account firewall, you restrict access to only traffic originating from that subnet, meeting the requirement of allowing only that subnet through the public endpoint.

Answer

Create a private endpoint and disable public network access on the storage account.

Answer

Place the subnet behind a NAT gateway and use a shared public IP.

Answer

Add a VPN gateway and route storage traffic through the branch office.

Question 8

An application subnet has a network security group with these inbound rules: Allow-Web-From-Internet at priority 200, Allow-App-From-Web at priority 300, and Deny-All-Inbound at priority 250. The web tier must reach the app tier on TCP 8080, but traffic is being denied. The administrator confirms the source and destination IPs are correct. What is the best fix?

Accepted Answer

Change the Allow-App-From-Web rule to a lower priority number than 250.. The Deny-All-Inbound rule at priority 250 is evaluated before the Allow-App-From-Web rule at priority 300 because lower priority numbers are processed first. To allow web-to-app traffic on TCP 8080, the Allow-App-From-Web rule must have a lower priority number (e.g., 240) than the Deny-All-Inbound rule so it is evaluated and applied first, permitting the traffic before the deny rule blocks it.

Answer

Delete the Deny-All-Inbound rule because default NSG rules will allow the traffic.

Answer

Add a route table entry for TCP 8080 traffic to bypass the NSG.

Answer

Move the Allow-Web-From-Internet rule to priority 400.

Question 9

A hub VNet contains a VPN gateway that provides access to on-premises resources. A spoke VNet is peered to the hub and must send on-premises traffic through the hub gateway without deploying its own gateway. What peering configuration is required?

Accepted Answer

Enable gateway transit on the hub peering and Use remote gateways on the spoke peering.. To route spoke VNet traffic through the hub VPN gateway without deploying a separate gateway in the spoke, you must enable 'Use remote gateways' on the spoke peering and 'Gateway transit' on the hub peering. This configuration allows the spoke to use the hub's VPN gateway for on-premises connectivity, leveraging the transitive routing capability of VNet peering.

Answer

Enable forwarded traffic on both peerings and disable gateway transit.

Answer

Create a second VPN gateway in the spoke and peer the two gateways.

Answer

Configure the spoke subnet with a service endpoint to the hub gateway subnet.

Question 10

A Recovery Services vault currently keeps daily Azure VM recovery points for 7 days. The business changes the requirement to keep daily recovery points for 30 days. Where should the administrator change the setting?

Accepted Answer

In the backup policy associated with the Recovery Services vault.. The retention duration for Azure VM backups is configured within the backup policy that is associated with the Recovery Services vault. By modifying the backup policy (either the default policy or a custom policy), the administrator can change the retention setting from 7 days to 30 days for daily recovery points. This policy directly controls how long backup snapshots are retained, and the change takes effect for all VMs linked to that policy.

Answer

In the VM's network interface settings, because backup retention follows the NIC configuration.

Answer

In Azure Policy, by assigning a retention compliance initiative to the subscription.

Answer

In a storage account lifecycle rule attached to the VM disks.

Question 11

Your company must retain Azure Activity Log data beyond the default retention period and make it available for long-term analysis. What should you configure?

Accepted Answer

Diagnostic settings for the Activity Log. Diagnostic settings for the Activity Log allow you to stream the log to a Log Analytics workspace, storage account, or Event Hubs, thereby extending retention beyond the default 90 days (for storage) or indefinitely (in Log Analytics). This is the only mechanism that enables long-term retention and analysis of Azure Activity Log data.

Answer

A ReadOnly lock on the subscription

Answer

An availability set

Answer

NSG flow logs only

Question 12

During a change freeze, the operations team wants to prevent accidental deletion of a production resource group and everything in it. They still need to update VM settings, change tags, and modify network rules. Which lock should be applied?

Accepted Answer

Apply a CanNotDelete lock to the resource group.. The CanNotDelete lock (Option B) prevents deletion of the resource group and all resources within it, while still allowing read and update operations such as modifying VM settings, changing tags, and updating network rules. This lock type is specifically designed to protect against accidental deletion during a change freeze without blocking management operations.

Answer

Apply a ReadOnly lock to the resource group.

Answer

Assign the Reader role to all operators.

Answer

Assign an Azure Policy deny assignment at the subscription.

Question 13

Based on the exhibit, which alert type should the administrator create to detect when Azure marks the storage account unhealthy because of a platform issue?

Accepted Answer

Resource Health alert.. Resource Health alerts are specifically designed to notify administrators when an Azure service or resource becomes unhealthy due to platform issues. In this scenario, the storage account being marked unhealthy by Azure due to a platform issue is exactly the kind of event that a Resource Health alert captures, as it monitors the health status of Azure resources and triggers alerts on state transitions (e.g., from 'Available' to 'Degraded' or 'Unavailable').

Answer

Metric alert on account capacity.

Answer

Log search alert against AzureDiagnostics.

Answer

Autoscale rule based on storage transactions.

Question 14

A scheduled script runs on several Azure virtual machines that are created and replaced over time. The script must use the same Azure identity on every VM, and the identity should continue to exist even if one VM is deleted and recreated. What should the administrator use?

Accepted Answer

A user-assigned managed identity attached to the VMs.. A user-assigned managed identity is the correct choice because it is an Azure resource that exists independently of any VM, and it can be attached to multiple VMs. When a VM is deleted and recreated, the same user-assigned managed identity can be reattached, ensuring the script uses the same identity consistently. This decouples the identity lifecycle from the VM lifecycle, meeting the requirement for persistence across VM replacements.

Answer

A system-assigned managed identity on each VM.

Answer

A service principal with a client secret stored in each VM.

Answer

A shared access signature stored in the VM registry.

Question 15

A company has two application VMs in the same Azure region. The main requirement is to reduce downtime during planned host maintenance. The business does not require protection from a complete datacenter outage. Which option should you choose?

Accepted Answer

Availability set. An availability set distributes VMs across multiple fault domains and update domains within a single Azure datacenter. During planned host maintenance, Azure updates one update domain at a time, ensuring that only a subset of VMs are rebooted simultaneously, thereby reducing downtime. This meets the requirement of protecting against planned maintenance without needing cross-datacenter redundancy.

Answer

Availability zones

Answer

Virtual machine scale set

Answer

Proximity placement group