AZ-104 Practice Test 42 — 15 Questions

Question 1

A Recovery Services vault currently keeps daily Azure VM recovery points for 7 days. The business changes the requirement to keep daily recovery points for 30 days. Where should the administrator change the setting?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

In the backup policy associated with the Recovery Services vault.. The retention duration for Azure VM backups is configured within the backup policy that is associated with the Recovery Services vault. By modifying the backup policy (either the default policy or a custom policy), the administrator can change the retention setting from 7 days to 30 days for daily recovery points. This policy directly controls how long backup snapshots are retained, and the change takes effect for all VMs linked to that policy.

Answer

In the VM's network interface settings, because backup retention follows the NIC configuration.

Answer

In Azure Policy, by assigning a retention compliance initiative to the subscription.

Answer

In a storage account lifecycle rule attached to the VM disks.

Question 2

During a change freeze, the operations team wants to prevent accidental deletion of a production resource group and everything in it. They still need to update VM settings, change tags, and modify network rules. Which lock should be applied?

Accepted Answer

Apply a CanNotDelete lock to the resource group.. The CanNotDelete lock (Option B) prevents deletion of the resource group and all resources within it, while still allowing read and update operations such as modifying VM settings, changing tags, and updating network rules. This lock type is specifically designed to protect against accidental deletion during a change freeze without blocking management operations.

Answer

Apply a ReadOnly lock to the resource group.

Answer

Assign the Reader role to all operators.

Answer

Assign an Azure Policy deny assignment at the subscription.

Question 3

Based on the exhibit, which alert type should the administrator create to detect when Azure marks the storage account unhealthy because of a platform issue?

Accepted Answer

Resource Health alert.. Resource Health alerts are specifically designed to notify administrators when an Azure service or resource becomes unhealthy due to platform issues. In this scenario, the storage account being marked unhealthy by Azure due to a platform issue is exactly the kind of event that a Resource Health alert captures, as it monitors the health status of Azure resources and triggers alerts on state transitions (e.g., from 'Available' to 'Degraded' or 'Unavailable').

Answer

Metric alert on account capacity.

Answer

Log search alert against AzureDiagnostics.

Answer

Autoscale rule based on storage transactions.

Question 4

A scheduled script runs on several Azure virtual machines that are created and replaced over time. The script must use the same Azure identity on every VM, and the identity should continue to exist even if one VM is deleted and recreated. What should the administrator use?

Accepted Answer

A user-assigned managed identity attached to the VMs.. A user-assigned managed identity is the correct choice because it is an Azure resource that exists independently of any VM, and it can be attached to multiple VMs. When a VM is deleted and recreated, the same user-assigned managed identity can be reattached, ensuring the script uses the same identity consistently. This decouples the identity lifecycle from the VM lifecycle, meeting the requirement for persistence across VM replacements.

Answer

A system-assigned managed identity on each VM.

Answer

A service principal with a client secret stored in each VM.

Answer

A shared access signature stored in the VM registry.

Question 5

A company has two application VMs in the same Azure region. The main requirement is to reduce downtime during planned host maintenance. The business does not require protection from a complete datacenter outage. Which option should you choose?

Accepted Answer

Availability set. An availability set distributes VMs across multiple fault domains and update domains within a single Azure datacenter. During planned host maintenance, Azure updates one update domain at a time, ensuring that only a subset of VMs are rebooted simultaneously, thereby reducing downtime. This meets the requirement of protecting against planned maintenance without needing cross-datacenter redundancy.

Answer

Availability zones

Answer

Virtual machine scale set

Answer

Proximity placement group

Question 6

A team enabled Azure Files for a Windows-based application. The app can reach the storage account, but the mount fails because users cannot authenticate with the share. The team does not want to use the storage account key. What is the best next step?

Accepted Answer

Grant the VM or user an Azure Files data-plane role, such as Storage File Data SMB Share Contributor, and use identity-based authentication.. Azure Files supports identity-based authentication over SMB using either on-premises Active Directory Domain Services (AD DS) or Azure Active Directory Domain Services (Azure AD DS). By granting the VM or user the Storage File Data SMB Share Contributor role, the team enables Kerberos-based authentication, eliminating the need for the storage account key. This approach allows the mount to succeed while meeting the requirement to avoid using the shared key.

Answer

Turn off the storage account firewall and retry the mount anonymously.

Answer

Create a network security group rule that allows TCP 445 to the share.

Answer

Convert the storage account to a premium block blob account.

Question 7

A team in RG-Apps must be able to start, stop, and deallocate virtual machines and read their properties. Built-in roles available to the team are broader than necessary. What should the administrator do?

Accepted Answer

Create a custom role with only the required VM actions and assign it at RG-Apps scope.. The team needs specific actions (start, stop, deallocate, read properties) that are a subset of the Virtual Machine Contributor role's permissions. Creating a custom role with only the required actions (Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, Microsoft.Compute/virtualMachines/read, etc.) and assigning it at the RG-Apps scope provides least-privilege access without granting broader capabilities like creating or deleting VMs.

Answer

Assign Virtual Machine Contributor at the subscription scope.

Answer

Assign Reader and Virtual Machine Contributor together at the resource group scope.

Answer

Assign Owner at the resource group scope to avoid troubleshooting access issues.

Question 8

Based on the exhibit, an administrator needs to recover one deleted configuration file from a running Azure VM without replacing the VM. Which restore option should be used?

Accepted Answer

Use File Recovery to mount the recovery point and copy back the missing file.. Azure VM File Recovery (part of Azure Backup) allows you to mount a recovery point as a drive on a running VM, browse the file system, and copy specific files back without restoring the entire VM or disks. This is the only option that recovers a single deleted configuration file without replacing or rebuilding the VM.

Answer

Create a new VM from the recovery point so the deleted file returns with a clean operating system.

Answer

Restore disks and manually rebuild the VM afterward.

Answer

Replace the existing VM immediately to recover only one file.

Question 9

Your company has an on-premises office network that needs encrypted connectivity to an Azure virtual network. In addition, traveling users need secure access from their laptops when they are away from the office. Which Azure design best meets both requirements?

Accepted Answer

Deploy a VPN gateway and configure both site-to-site and point-to-site connections.. A VPN gateway supports both site-to-site (S2S) connections for the on-premises office network and point-to-site (P2S) connections for individual traveling users. The S2S connection uses IPsec/IKE to establish encrypted tunnels between the on-premises VPN device and the Azure VPN gateway, while the P2S connection uses SSTP, OpenVPN, or IKEv2 to allow remote laptops to connect securely from anywhere. This single gateway resource can handle both connection types simultaneously, meeting both requirements efficiently.

Answer

Use VNet peering between the office network and Azure, then share the same connection with remote users.

Answer

Create a service endpoint to the virtual network and enable private access for laptops.

Answer

Deploy a NAT gateway and use it for secure office and laptop connectivity.

Question 10

A subnet is associated with a NAT gateway, but its route table also contains a 0.0.0.0/0 route to a virtual appliance at 10.2.0.4. The business wants all outbound internet traffic from the VMs to use one static public IP, and inspection by the appliance is no longer required. What should the administrator change?

Accepted Answer

Remove the 0.0.0.0/0 user-defined route from the subnet.. Removing the 0.0.0.0/0 user-defined route (UDR) from the subnet's route table will allow the NAT gateway to handle all outbound internet traffic. The NAT gateway provides a single static public IP for outbound traffic, and since inspection by the virtual appliance is no longer required, the conflicting UDR that directs traffic to the appliance must be deleted. This ensures that the subnet's default route points to the NAT gateway, which uses Source Network Address Translation (SNAT) to translate private IPs to the static public IP.

Answer

Add a public IP address directly to each virtual machine NIC.

Answer

Enable service endpoints for the subnet.

Answer

Change the NAT gateway to a zone-redundant SKU.

Question 11

A hub VNet already has a VPN gateway connected to on-premises. A spoke VNet in the same region must reach on-premises networks through that existing gateway, and you do not want to deploy a separate VPN gateway in the spoke. What peering settings should you use?

Accepted Answer

Enable Allow gateway transit on the hub peering and Use remote gateways on the spoke peering.. To enable a spoke VNet to use a hub VNet's VPN gateway for on-premises connectivity without deploying a separate gateway, you must configure the hub peering with 'Allow gateway transit' and the spoke peering with 'Use remote gateways'. This allows the spoke to route traffic through the hub's VPN gateway, leveraging the existing site-to-site VPN connection to on-premises.

Answer

Create peering only; the spoke will automatically use the hub gateway without extra settings.

Answer

Enable Use remote gateways on the hub peering and Allow gateway transit on the spoke peering.

Answer

Create a service endpoint from the spoke VNet to the on-premises network.

Question 12

A storage account must remain reachable through its public endpoint for an on-premises integration server, but only one Azure subnet should be allowed to access it from Azure. The team does not want private endpoints or DNS changes. What should the administrator configure?

Accepted Answer

Enable a service endpoint on the subnet and add that subnet to the storage account networking rules. A service endpoint extends the virtual network identity to the storage account, allowing you to restrict access to a specific subnet while keeping the public endpoint enabled for on-premises access. This meets the requirement of allowing only one Azure subnet to access the storage account from Azure without using private endpoints or DNS changes.

Answer

Add a private endpoint and disable public network access

Answer

Create a SAS token restricted to that subnet

Answer

Assign Storage Blob Data Reader to the subnet

Question 13

Based on the exhibit, an administrator wants to prevent new Azure resources from being deployed in any region except East US and West US across the entire Corp hierarchy. What should the administrator configure?

Accepted Answer

Create and assign an Azure Policy at the Corp management group using the allowed locations rule.. Azure Policy is the correct tool to enforce governance rules across management groups. The 'allowed locations' built-in policy definition restricts resource deployment to specified regions. By assigning this policy at the Corp management group, the rule applies to all child subscriptions and resources, preventing deployment in any region except East US and West US.

Answer

Assign a built-in RBAC role that denies deployments in unsupported regions.

Answer

Apply a CanNotDelete lock to the subscriptions.

Answer

Use a resource tag named RegionApproved and require teams to set it manually.

Question 14

Based on the exhibit, administrators can reach a web server from the approved subnet, but connections still fail. What is the most likely reason?

Accepted Answer

The deny rule has a higher priority and matches the traffic before the allow rule.. Network Security Groups (NSGs) evaluate rules in order of priority, where a lower priority number (e.g., 100) is evaluated before a higher number (e.g., 200). If a deny rule with a higher priority (lower number) matches the traffic before the allow rule, the traffic is blocked. In this scenario, the deny rule (priority 100) matches the source subnet and destination port 443 before the allow rule (priority 200) can permit it, causing connections to fail.

Answer

The allow rule is blocked because inbound rules are evaluated from highest priority number to lowest.

Answer

The destination port must be changed to 80 because NSGs cannot allow TCP 443.

Answer

The subnet requires a route table before HTTPS can be permitted.

Question 15

Based on the exhibit, which Azure connectivity option should the administrator use for the branch office?

Accepted Answer

A site-to-site VPN connection to an Azure VPN gateway.. A site-to-site VPN connection to an Azure VPN gateway (Option D) is the correct choice because it provides a persistent, encrypted tunnel between the branch office's on-premises network and Azure, enabling seamless connectivity for all users and devices at the branch without requiring per-user configuration. This aligns with the typical scenario where a branch office needs constant, secure access to Azure resources, and the VPN gateway supports IPsec/IKE protocols for site-to-site connections.

Answer

Point-to-site VPN for each user laptop.

Answer

VNet peering between the branch office and Azure.

Answer

A service endpoint on the Azure subnet.