AZ-104 Practice Test 41 — 15 Questions

Question 1

Match each Azure VM deployment concept to the description that best fits it.

Question 2

You need to resize a production VM from Standard_D2s_v5 to Standard_D4s_v5 by using Azure CLI. `az vm list-vm-resize-options` shows the target size, but `az vm resize` fails while the VM is running. Which action should you take first?

Accepted Answer

Run `az vm deallocate`, then resize the VM, then start it again.. Option B is correct because resizing a VM to a different size often requires the VM to be in a deallocated state, especially when the new size is in a different hardware cluster or when the VM is currently running and the resize operation fails. The `az vm deallocate` command releases the underlying hardware resources, allowing the VM to be resized to any available size, including Standard_D4s_v5, and then you can start it again. This is a common requirement for production VMs when live resizing is not supported or fails.

Answer

Run `az vm stop`, then resize the VM.

Answer

Run `az vm restart`, then resize the VM.

Answer

Run `az vm generalize`, then recreate the VM from the image.

Question 3

You need to deploy a new Ubuntu VM that automatically creates an app user and installs packages the first time it boots. Which approach should you use?

Accepted Answer

Use cloud-init in the VM creation settings to perform first-boot configuration.. B is correct because cloud-init is the standard, native mechanism for performing first-boot configuration on Linux VMs in Azure. It allows you to inject a configuration file (e.g., YAML or shell script) during VM creation that automatically creates users, installs packages, and runs custom commands on the first boot, without requiring any post-deployment scripts or manual intervention.

Answer

Use an availability set so the VM runs the initialization tasks during host placement.

Answer

Use an Azure Policy assignment to install the packages after deployment.

Answer

Use a managed disk snapshot and attach it to the VM after deployment.

Question 4

You need to allow a partner application to upload files to a blob container for the next 24 hours. The partner must not receive the storage account key. What should you provide?

Accepted Answer

A shared access signature (SAS). A shared access signature (SAS) provides delegated, time-limited access to a specific Azure Storage resource (like a blob container) without exposing the storage account key. By generating a SAS token with write permissions and a 24-hour expiry, you grant the partner application the ability to upload files while maintaining security and control over the access window.

Answer

The storage account access key

Answer

The connection string with the account key

Answer

A Recovery Services vault

Question 5

You need to synchronize an on-premises Windows file server with an Azure file share so that branch offices can continue using the local server while keeping cloud-based copies of the files. Which service should you configure?

Accepted Answer

Azure File Sync. Azure File Sync is the correct service because it enables you to centralize your on-premises file shares in Azure Files while maintaining local access to the data. It uses a sync agent installed on the Windows file server to replicate files to an Azure file share, allowing branch offices to continue using the local server with cloud-based copies for backup, disaster recovery, or multi-site access. This directly meets the requirement of keeping the on-premises server operational while maintaining cloud copies.

Answer

Blob versioning

Answer

Azure NetApp Files

Answer

Storage account failover

Question 6

Match each blob tier or protection feature to the correct description.

Question 7

Match each NSG or ASG scenario to the most accurate Azure security behavior.

Question 8

Match each workload requirement to the Azure storage account kind that best fits it.

Question 9

Three Azure VMs in different resource groups need to access the same Azure resources using one identity. The identity must keep working if any VM is deleted and recreated. What should the administrator assign to the VMs?

Accepted Answer

A user-assigned managed identity.. A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource and can be assigned to multiple VMs, even across different resource groups. If a VM is deleted and recreated, the user-assigned identity persists independently and can be reassigned to the new VM, ensuring continuous access to Azure resources without reconfiguration.

Answer

A system-assigned managed identity on each VM.

Answer

A local administrator account.

Answer

An Azure Blueprint assignment.

Question 10

The service desk needs to add and remove users from a support group that grants access to an internal application, but the service desk must not receive Azure subscription permissions. Which two actions should you take? Select two.

Accepted Answer

Create a security group in Microsoft Entra ID for the application access.. Option A is correct because creating a security group in Microsoft Entra ID (formerly Azure AD) allows you to manage access to the internal application without granting any Azure subscription permissions. The service desk can then add or remove users from this group, and the application's access control can be configured to rely on group membership, ensuring the service desk staff never receive Azure RBAC roles.

Answer

Assign the service desk staff Contributor on the subscription.

Answer

Convert the service desk staff into guest users in the tenant.

Answer

Add the service desk staff as members only, without ownership.

Question 11

Based on the exhibit, what should you configure so the analysts can manage group membership without granting Azure resource permissions?

Accepted Answer

Add the service desk analysts as owners of the App-Support group.. Option B is correct because adding the service desk analysts as owners of the App-Support group grants them the ability to manage group membership directly within Microsoft Entra ID (formerly Azure AD) without assigning any Azure RBAC permissions on resources. Group owners can add or remove members from the group, but they do not inherit any permissions to manage Azure resources like VMs or storage accounts.

Answer

Assign the service desk analysts the User Administrator role in Microsoft Entra ID.

Answer

Create separate local administrator accounts for each analyst.

Answer

Assign Contributor on the subscription to the service desk analysts.

Question 12

A production team wants to match common Azure Monitor components to the action each one performs. Match each item on the left to the best description on the right.

Question 13

An administrator is comparing Azure monitoring data sources and destinations during an investigation. Match each item to the best operational use.

Question 14

An operations team monitors a group of Azure VMs and storage accounts. Match each Azure Monitor component to the behavior it provides in day-to-day operations.

Question 15

A Windows VM fails to start after a configuration change. You need to capture screenshots and serial console output to troubleshoot the boot problem. Which feature should you use?

Accepted Answer

Boot diagnostics. Boot diagnostics captures serial console output and screenshots of a VM during boot, which is essential for troubleshooting boot failures after a configuration change. This feature provides logs and visual data from the VM's boot process, accessible via the Azure portal or CLI, without requiring guest OS access.

Answer

Azure Backup

Answer

Just-in-Time VM access

Answer

Autoscale