AZ-104 Practice Test 41 — 15 Questions

Question 1

A developer wants to publish an internet-facing web application from source code. The solution must support built-in HTTPS, deployment slots for testing, and autoscale. The team does not want to manage servers. Which Azure service should the administrator recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure App Service. Azure App Service is the correct choice because it provides a fully managed platform for hosting web applications from source code, with built-in support for HTTPS via TLS/SSL certificates, deployment slots for staging and testing, and autoscale capabilities. It eliminates server management, aligning with the requirement for a PaaS (Platform as a Service) solution that handles infrastructure, patching, and scaling automatically.

Answer

Azure Container Instances

Answer

Azure Virtual Machine Scale Sets

Answer

Azure Bastion

Question 2

Based on the exhibit, the team wants to validate that a protected Azure VM can be recovered without affecting production. Which restore approach best meets the requirement?

Accepted Answer

Restore the VM to a separate resource group or test environment from the latest recovery point.. Restoring the VM to a separate resource group or test environment from the latest recovery point creates an isolated copy of the VM that does not interact with production resources. This approach validates recoverability without risking production name conflicts, IP address overlaps, or accidental data modification. Azure Backup's restore-to-new-location option explicitly supports this isolation by allowing you to choose a different resource group, virtual network, and storage account.

Answer

Use Replace existing VM so the test uses the production name and disks.

Answer

Export a snapshot and assume that proves the VM can boot successfully.

Answer

Enable Site Recovery failover, because backup restore and failover are identical.

Question 3

Two line-of-business VMs in a single region must stay available if one physical host is patched or fails. A zone failure is not part of the requirement. Which three actions should the administrator take? Select three.

Accepted Answer

Create an availability set for the application VMs before deployment.. An availability set ensures that VMs are placed on different fault domains (physical hosts) and update domains within a single Azure region, protecting against physical host patching or failure. This meets the requirement of keeping VMs available during a single host event without requiring zone-level redundancy.

Answer

Deploy the VMs in separate availability zones to protect against a datacenter outage.

Answer

Use a single larger VM and rely on snapshots for uptime.

Question 4

An NSG attached to a subnet contains these inbound rules: Deny-All-Inbound at priority 200, Allow-HTTPS-Admin at priority 250 from 203.0.113.20/32, and Allow-HTTPS-Internet at priority 300. A VM in the subnet cannot receive HTTPS from the admin workstation even though the source IP is correct. What should the administrator change?

Accepted Answer

Move the Allow-HTTPS-Admin rule to a priority number lower than 200.. The Deny-All-Inbound rule at priority 200 blocks all traffic, including HTTPS from the admin workstation, because NSG rules are evaluated in priority order (lowest number first). The Allow-HTTPS-Admin rule at priority 250 is never reached since the deny rule with a higher priority (lower number) matches first. To allow the admin traffic, the allow rule must have a priority lower than 200 (e.g., 150) so it is evaluated before the deny rule.

Answer

Change the protocol from TCP to Any on the allow rule.

Answer

Associate a NAT gateway with the subnet.

Answer

Enable service endpoint policies on the subnet.

Question 5

A Windows file server VM in Azure needs to mount an Azure file share by using existing Active Directory Domain Services credentials. The security team does not want to use storage account keys. Which authentication option should be configured for Azure Files?

Accepted Answer

Azure Files identity-based authentication using Active Directory Domain Services.. Azure Files supports identity-based authentication using Active Directory Domain Services (AD DS), which allows domain-joined VMs to mount Azure file shares using existing AD credentials without exposing storage account keys. This method leverages Kerberos authentication and enables fine-grained access control via NTFS permissions, meeting the security team's requirement to avoid storage account keys.

Answer

Shared key authorization, because it is the only method supported by Azure Files.

Answer

A user delegation SAS, because it maps the share automatically to domain accounts.

Answer

Anonymous access, because Windows file servers can mount Azure shares without authentication.

Question 6

A subnet NSG contains these inbound rules: Deny-All-Inbound at priority 300, Allow-HTTPS-From-Bastion at priority 200, and Allow-HTTPS-From-AdminIP at priority 350. An administrator expects a management workstation on the internet to connect to a VM over TCP 443, but the connection is blocked. What is the most likely reason?

Accepted Answer

The deny rule at priority 300 is matched before the allow rule at priority 350.. NSG rules are evaluated in priority order, from the lowest priority number (highest priority) to the highest priority number (lowest priority). The Allow-HTTPS-From-AdminIP rule at priority 350 is evaluated after the Deny-All-Inbound rule at priority 300. Since the deny rule at priority 300 matches all inbound traffic before the allow rule at priority 350 is evaluated, the traffic is blocked. The administrator's connection from the internet is denied because the deny rule with a lower priority number (300) takes precedence over the allow rule with a higher priority number (350).

Answer

NSG rules are evaluated from the highest priority number to the lowest priority number.

Answer

Azure NSGs cannot allow inbound traffic from public IP addresses.

Answer

TCP 443 requires an application security group to be used as the source.

Question 7

Based on the exhibit, you want the resource logs for the storage account to appear in Log Analytics so you can investigate read and write failures. What should you configure?

Accepted Answer

Add a diagnostic setting that sends resource logs to the Log Analytics workspace.. Diagnostic settings in Azure allow you to stream resource logs (such as StorageRead and StorageWrite logs) from a storage account directly to a Log Analytics workspace. By configuring a diagnostic setting with the appropriate log categories enabled, you can query and analyze read and write failures in Log Analytics without additional infrastructure.

Answer

Create a metric alert rule on the storage account and link it to an action group.

Answer

Enable a resource lock so the storage account cannot be modified.

Answer

Move the storage account to a different subscription that already has Log Analytics enabled.

Question 8

The service desk needs to add and remove users from a support group that grants access to an internal application, but the service desk must not receive Azure subscription permissions. Which two actions should you take? Select two.

Accepted Answer

Create a security group in Microsoft Entra ID for the application access.. Creating a security group in Microsoft Entra ID (formerly Azure AD) allows you to manage access to the internal application without granting any Azure subscription permissions. The service desk can then add or remove users from this group, and the application's access control can be configured to rely on group membership, ensuring the service desk staff never receive Azure RBAC roles.

Answer

Assign the service desk staff Contributor on the subscription.

Answer

Convert the service desk staff into guest users in the tenant.

Answer

Add the service desk staff as members only, without ownership.

Question 9

A build pipeline needs to run a Linux container for 10 to 15 minutes at a time. The team does not want to manage servers, clusters, or an always-on VM. Which Azure service should be used?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice because it allows you to run a Linux container directly on Azure without provisioning or managing any underlying infrastructure. ACI is ideal for short-lived, burstable workloads like a build pipeline that runs for 10–15 minutes, as it supports per-second billing and automatic startup/shutdown without the overhead of a cluster or VM.

Answer

Azure Kubernetes Service

Answer

Azure Virtual Machine

Answer

Azure App Service

Question 10

Based on the exhibit, a script running on an Azure VM must create resources in another subscription without using passwords or client secrets. Which command should the administrator use first?

Accepted Answer

az login --identity. The script must authenticate without passwords or client secrets, and Azure VMs can use a managed identity for this purpose. The `az login --identity` command authenticates the Azure CLI using the VM's managed identity, which is a passwordless, secretless authentication method. This allows the script to obtain tokens for accessing resources in another subscription, provided the managed identity has appropriate RBAC permissions.

Answer

az login --service-principal

Answer

az account set --subscription <subscriptionId>

Answer

Connect-AzAccount -UseDeviceAuthentication

Question 11

A VM-hosted automation tool must call Azure APIs without storing a password or certificate on disk. The identity should disappear automatically when the VM is deleted. Which identity should the administrator assign?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is tied directly to the lifecycle of the Azure VM — when the VM is deleted, the identity is automatically removed. It allows the VM to authenticate to Azure APIs without storing any credentials (password or certificate) on disk, using Azure AD tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254.

Answer

A user-assigned managed identity

Answer

A service principal with a client secret

Answer

A storage account access key

Question 12

Based on the exhibit, a backup administrator accidentally stopped protection for a critical VM and then deleted its backup item. The team wants Azure Backup to retain the deleted item long enough to recover it after the mistake is discovered the next day. What should be enabled on the vault?

Accepted Answer

Soft delete for backup data. Soft delete for backup data is the correct answer because it provides a safety net for accidentally deleted backup items. When enabled, Azure Backup retains deleted backup data for an additional 14 days (default) in a soft-deleted state, allowing administrators to recover the data before it is permanently purged. This directly addresses the scenario where protection was stopped and the backup item was deleted, as the data remains recoverable within the retention period.

Answer

A read-only resource lock on the VM

Answer

A network security group rule allowing port 445

Answer

Instant restore snapshots set to 30 days

Question 13

A team has Windows VMs in a subnet that need to access an Azure Storage account. The storage account should remain reachable through its public endpoint, but only traffic from that one subnet should be allowed. Which configuration best meets the requirement?

Accepted Answer

Enable a service endpoint on the subnet and add a virtual network rule for that subnet on the storage account firewall.. A service endpoint extends the virtual network private address space to the storage account, allowing traffic from the specified subnet to reach the storage account via the Azure backbone while keeping the public endpoint accessible. By adding a virtual network rule on the storage account firewall, you restrict access to only traffic originating from that subnet, meeting the requirement of allowing only that subnet through the public endpoint.

Answer

Create a private endpoint and disable public network access on the storage account.

Answer

Place the subnet behind a NAT gateway and use a shared public IP.

Answer

Add a VPN gateway and route storage traffic through the branch office.

Question 14

An application subnet has a network security group with these inbound rules: Allow-Web-From-Internet at priority 200, Allow-App-From-Web at priority 300, and Deny-All-Inbound at priority 250. The web tier must reach the app tier on TCP 8080, but traffic is being denied. The administrator confirms the source and destination IPs are correct. What is the best fix?

Accepted Answer

Change the Allow-App-From-Web rule to a lower priority number than 250.. The Deny-All-Inbound rule at priority 250 is evaluated before the Allow-App-From-Web rule at priority 300 because lower priority numbers are processed first. To allow web-to-app traffic on TCP 8080, the Allow-App-From-Web rule must have a lower priority number (e.g., 240) than the Deny-All-Inbound rule so it is evaluated and applied first, permitting the traffic before the deny rule blocks it.

Answer

Delete the Deny-All-Inbound rule because default NSG rules will allow the traffic.

Answer

Add a route table entry for TCP 8080 traffic to bypass the NSG.

Answer

Move the Allow-Web-From-Internet rule to priority 400.

Question 15

A hub VNet contains a VPN gateway that provides access to on-premises resources. A spoke VNet is peered to the hub and must send on-premises traffic through the hub gateway without deploying its own gateway. What peering configuration is required?

Accepted Answer

Enable gateway transit on the hub peering and Use remote gateways on the spoke peering.. To route spoke VNet traffic through the hub VPN gateway without deploying a separate gateway in the spoke, you must enable 'Use remote gateways' on the spoke peering and 'Gateway transit' on the hub peering. This configuration allows the spoke to use the hub's VPN gateway for on-premises connectivity, leveraging the transitive routing capability of VNet peering.

Answer

Enable forwarded traffic on both peerings and disable gateway transit.

Answer

Create a second VPN gateway in the spoke and peer the two gateways.

Answer

Configure the spoke subnet with a service endpoint to the hub gateway subnet.