AZ-104 Practice Test 42 — 15 Questions

Question 1

A team enabled Azure Files for a Windows-based application. The app can reach the storage account, but the mount fails because users cannot authenticate with the share. The team does not want to use the storage account key. What is the best next step?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Grant the VM or user an Azure Files data-plane role, such as Storage File Data SMB Share Contributor, and use identity-based authentication.. Azure Files supports identity-based authentication over SMB using either on-premises Active Directory Domain Services (AD DS) or Microsoft Entra Domain Services (Microsoft Entra Domain Services). By granting the VM or user the Storage File Data SMB Share Contributor role, the team enables Kerberos-based authentication, eliminating the need for the storage account key. This approach allows the mount to succeed while meeting the requirement to avoid using the shared key.

Answer

Turn off the storage account firewall and retry the mount anonymously.

Answer

Create a network security group rule that allows TCP 445 to the share.

Answer

Convert the storage account to a premium block blob account.

Question 2

A team in RG-Apps must be able to start, stop, and deallocate virtual machines and read their properties. Built-in roles available to the team are broader than necessary. What should the administrator do?

Accepted Answer

Create a custom role with only the required VM actions and assign it at RG-Apps scope.. The team needs specific actions (start, stop, deallocate, read properties) that are a subset of the Virtual Machine Contributor role's permissions. Creating a custom role with only the required actions (Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, Microsoft.Compute/virtualMachines/read, etc.) and assigning it at the RG-Apps scope provides least-privilege access without granting broader capabilities like creating or deleting VMs.

Answer

Assign Virtual Machine Contributor at the subscription scope.

Answer

Assign Reader and Virtual Machine Contributor together at the resource group scope.

Answer

Assign Owner at the resource group scope to avoid troubleshooting access issues.

Question 3

Based on the exhibit, an administrator needs to recover one deleted configuration file from a running Azure VM without replacing the VM. Which restore option should be used?

Accepted Answer

Use File Recovery to mount the recovery point and copy back the missing file.. Azure VM File Recovery (part of Azure Backup) allows you to mount a recovery point as a drive on a running VM, browse the file system, and copy specific files back without restoring the entire VM or disks. This is the only option that recovers a single deleted configuration file without replacing or rebuilding the VM.

Answer

Create a new VM from the recovery point so the deleted file returns with a clean operating system.

Answer

Restore disks and manually rebuild the VM afterward.

Answer

Replace the existing VM immediately to recover only one file.

Question 4

Your company has an on-premises office network that needs encrypted connectivity to an Azure virtual network. In addition, traveling users need secure access from their laptops when they are away from the office. Which Azure design best meets both requirements?

Accepted Answer

Deploy a VPN gateway and configure both site-to-site and point-to-site connections.. A VPN gateway supports both site-to-site (S2S) connections for the on-premises office network and point-to-site (P2S) connections for individual traveling users. The S2S connection uses IPsec/IKE to establish encrypted tunnels between the on-premises VPN device and the Azure VPN gateway, while the P2S connection uses SSTP, OpenVPN, or IKEv2 to allow remote laptops to connect securely from anywhere. This single gateway resource can handle both connection types simultaneously, meeting both requirements efficiently.

Answer

Use VNet peering between the office network and Azure, then share the same connection with remote users.

Answer

Create a service endpoint to the virtual network and enable private access for laptops.

Answer

Deploy a NAT gateway and use it for secure office and laptop connectivity.

Question 5

A subnet is associated with a NAT gateway, but its route table also contains a 0.0.0.0/0 route to a virtual appliance at 10.2.0.4. The business wants all outbound internet traffic from the VMs to use one static public IP, and inspection by the appliance is no longer required. What should the administrator change?

Accepted Answer

Remove the 0.0.0.0/0 user-defined route from the subnet.. Removing the 0.0.0.0/0 user-defined route (UDR) from the subnet's route table will allow the NAT gateway to handle all outbound internet traffic. The NAT gateway provides a single static public IP for outbound traffic, and since inspection by the virtual appliance is no longer required, the conflicting UDR that directs traffic to the appliance must be deleted. This ensures that the subnet's default route points to the NAT gateway, which uses Source Network Address Translation (SNAT) to translate private IPs to the static public IP.

Answer

Add a public IP address directly to each virtual machine NIC.

Answer

Enable service endpoints for the subnet.

Answer

Change the NAT gateway to a zone-redundant SKU.

Question 6

A hub VNet already has a VPN gateway connected to on-premises. A spoke VNet in the same region must reach on-premises networks through that existing gateway, and you do not want to deploy a separate VPN gateway in the spoke. What peering settings should you use?

Accepted Answer

Enable Allow gateway transit on the hub peering and Use remote gateways on the spoke peering.. To enable a spoke VNet to use a hub VNet's VPN gateway for on-premises connectivity without deploying a separate gateway, you must configure the hub peering with 'Allow gateway transit' and the spoke peering with 'Use remote gateways'. This allows the spoke to route traffic through the hub's VPN gateway, leveraging the existing site-to-site VPN connection to on-premises.

Answer

Create peering only; the spoke will automatically use the hub gateway without extra settings.

Answer

Enable Use remote gateways on the hub peering and Allow gateway transit on the spoke peering.

Answer

Create a service endpoint from the spoke VNet to the on-premises network.

Question 7

A storage account must remain reachable through its public endpoint for an on-premises integration server, but only one Azure subnet should be allowed to access it from Azure. The team does not want private endpoints or DNS changes. What should the administrator configure?

Accepted Answer

Enable a service endpoint on the subnet and add that subnet to the storage account networking rules. A service endpoint extends the virtual network identity to the storage account, allowing you to restrict access to a specific subnet while keeping the public endpoint enabled for on-premises access. This meets the requirement of allowing only one Azure subnet to access the storage account from Azure without using private endpoints or DNS changes.

Answer

Add a private endpoint and disable public network access

Answer

Create a SAS token restricted to that subnet

Answer

Assign Storage Blob Data Reader to the subnet

Question 8

Based on the exhibit, an administrator wants to prevent new Azure resources from being deployed in any region except East US and West US across the entire Corp hierarchy. What should the administrator configure?

Accepted Answer

Create and assign an Azure Policy at the Corp management group using the allowed locations rule.. Azure Policy is the correct tool to enforce governance rules across management groups. The 'allowed locations' built-in policy definition restricts resource deployment to specified regions. By assigning this policy at the Corp management group, the rule applies to all child subscriptions and resources, preventing deployment in any region except East US and West US.

Answer

Assign a built-in RBAC role that denies deployments in unsupported regions.

Answer

Apply a CanNotDelete lock to the subscriptions.

Answer

Use a resource tag named RegionApproved and require teams to set it manually.

Question 9

Based on the exhibit, administrators can reach a web server from the approved subnet, but connections still fail. What is the most likely reason?

Accepted Answer

The deny rule has a higher priority and matches the traffic before the allow rule.. Network Security Groups (NSGs) evaluate rules in order of priority, where a lower priority number (e.g., 100) is evaluated before a higher number (e.g., 200). If a deny rule with a higher priority (lower number) matches the traffic before the allow rule, the traffic is blocked. In this scenario, the deny rule (priority 100) matches the source subnet and destination port 443 before the allow rule (priority 200) can permit it, causing connections to fail.

Answer

The allow rule is blocked because inbound rules are evaluated from highest priority number to lowest.

Answer

The destination port must be changed to 80 because NSGs cannot allow TCP 443.

Answer

The subnet requires a route table before HTTPS can be permitted.

Question 10

Based on the exhibit, which Azure connectivity option should the administrator use for the branch office?

Accepted Answer

A site-to-site VPN connection to an Azure VPN gateway.. A site-to-site VPN connection to an Azure VPN gateway (Option D) is the correct choice because it provides a persistent, encrypted tunnel between the branch office's on-premises network and Azure, enabling seamless connectivity for all users and devices at the branch without requiring per-user configuration. This aligns with the typical scenario where a branch office needs constant, secure access to Azure resources, and the VPN gateway supports IPsec/IKE protocols for site-to-site connections.

Answer

Point-to-site VPN for each user laptop.

Answer

VNet peering between the branch office and Azure.

Answer

A service endpoint on the Azure subnet.

Question 11

Based on the exhibit, what should the administrator add to send an email and SMS notification?

Accepted Answer

An action group with email and SMS receivers.. To send email and SMS notifications from an Azure Monitor alert, you must configure an action group. An action group defines the notification channels (e.g., email, SMS, webhook) and their respective receivers. When the alert rule triggers, Azure Monitor invokes the action group to deliver the notifications. Without an action group, the alert rule has no mechanism to send email or SMS.

Answer

A Log Analytics workspace connected to the virtual machine.

Answer

A backup recovery point for the virtual machine.

Answer

A private endpoint for the virtual machine.

Question 12

Two application VMs run in the same Azure region. The business wants to reduce the chance that both VMs are rebooted during planned host maintenance, but a datacenter outage is not part of the requirement. What should the administrator configure?

Accepted Answer

Availability set. An availability set ensures that VMs are placed on different fault domains and update domains within the same Azure datacenter. This configuration guarantees that during planned host maintenance, only one update domain is rebooted at a time, reducing the chance that both VMs are rebooted simultaneously. Since the requirement explicitly excludes a datacenter outage, an availability set is the correct choice to protect against planned maintenance events.

Answer

Availability zone

Answer

Azure Load Balancer

Answer

Virtual machine scale set

Question 13

A storage account must be accessible only from one Azure subnet. The security team does not want a private endpoint or private DNS zone, and they are fine with the storage account continuing to use its public FQDN. Which configuration should you use?

Accepted Answer

Create a service endpoint on the subnet and allow that subnet in the storage account firewall.. A service endpoint extends the virtual network identity to the Azure Storage service, allowing the storage account firewall to restrict access to traffic originating from the specific subnet. This meets the requirement of limiting access to one Azure subnet without using a private endpoint or DNS zone, and the storage account continues to use its public FQDN.

Answer

Create a private endpoint for the storage account and disable public network access.

Answer

Use an NSG rule to allow only the subnet to reach port 443 on the storage account.

Answer

Associate a route table that sends storage traffic to an Azure firewall appliance.

Question 14

In Log Analytics, you want an alert that fires if VM01 has not sent a Heartbeat record in the last 15 minutes. Which query should be used as the alert condition?

Accepted Answer

Heartbeat | where Computer == "VM01" | summarize LastHeartbeat = max(TimeGenerated) | where LastHeartbeat < ago(15m). The alert must fire when VM01 has *not* sent a Heartbeat in the last 15 minutes. The query uses `max(TimeGenerated)` to find the most recent heartbeat, then filters with `where LastHeartbeat < ago(15m)` to detect records older than 15 minutes. This condition evaluates to true when the last heartbeat is older than the threshold, triggering the alert.

Answer

Heartbeat | where Computer == "VM01" | summarize LastHeartbeat = max(TimeGenerated) | where LastHeartbeat > ago(15m)

Answer

Heartbeat | where Computer == "VM01" and TimeGenerated > ago(15m) | summarize count() by Computer

Answer

Heartbeat | where Computer == "VM01" | summarize count() by bin(TimeGenerated, 15m)

Question 15

Based on the exhibit, which identity should the administrator enable to remove the secret from app settings and have the identity disappear automatically when the app is deleted?

Accepted Answer

System-assigned managed identity. The system-assigned managed identity is tied directly to the lifecycle of the Azure resource (e.g., an App Service). When you enable it, Azure automatically creates a service principal in Microsoft Entra ID for that resource, and you can use the identity to access Azure Key Vault without storing secrets in app settings. When the resource is deleted, the system-assigned managed identity and its corresponding service principal are automatically removed, eliminating the need for manual cleanup.

Answer

User-assigned managed identity

Answer

Service principal with a client secret

Answer

Shared access signature