AZ-104 Practice Test 43 — 15 Questions

Question 1

Based on the exhibit, what should the administrator add to send an email and SMS notification?

Accepted Answer

An action group with email and SMS receivers.. To send email and SMS notifications from an Azure Monitor alert, you must configure an action group. An action group defines the notification channels (e.g., email, SMS, webhook) and their respective receivers. When the alert rule triggers, Azure Monitor invokes the action group to deliver the notifications. Without an action group, the alert rule has no mechanism to send email or SMS.

Answer

A Log Analytics workspace connected to the virtual machine.

Answer

A backup recovery point for the virtual machine.

Answer

A private endpoint for the virtual machine.

Question 2

Two application VMs run in the same Azure region. The business wants to reduce the chance that both VMs are rebooted during planned host maintenance, but a datacenter outage is not part of the requirement. What should the administrator configure?

Accepted Answer

Availability set. An availability set ensures that VMs are placed on different fault domains and update domains within the same Azure datacenter. This configuration guarantees that during planned host maintenance, only one update domain is rebooted at a time, reducing the chance that both VMs are rebooted simultaneously. Since the requirement explicitly excludes a datacenter outage, an availability set is the correct choice to protect against planned maintenance events.

Answer

Availability zone

Answer

Azure Load Balancer

Answer

Virtual machine scale set

Question 3

A storage account must be accessible only from one Azure subnet. The security team does not want a private endpoint or private DNS zone, and they are fine with the storage account continuing to use its public FQDN. Which configuration should you use?

Accepted Answer

Create a service endpoint on the subnet and allow that subnet in the storage account firewall.. A service endpoint extends the virtual network identity to the Azure Storage service, allowing the storage account firewall to restrict access to traffic originating from the specific subnet. This meets the requirement of limiting access to one Azure subnet without using a private endpoint or DNS zone, and the storage account continues to use its public FQDN.

Answer

Create a private endpoint for the storage account and disable public network access.

Answer

Use an NSG rule to allow only the subnet to reach port 443 on the storage account.

Answer

Associate a route table that sends storage traffic to an Azure firewall appliance.

Question 4

In Log Analytics, you want an alert that fires if VM01 has not sent a Heartbeat record in the last 15 minutes. Which query should be used as the alert condition?

Accepted Answer

Heartbeat | where Computer == "VM01" | summarize LastHeartbeat = max(TimeGenerated) | where LastHeartbeat < ago(15m). The alert must fire when VM01 has *not* sent a Heartbeat in the last 15 minutes. The query uses `max(TimeGenerated)` to find the most recent heartbeat, then filters with `where LastHeartbeat < ago(15m)` to detect records older than 15 minutes. This condition evaluates to true when the last heartbeat is older than the threshold, triggering the alert.

Answer

Heartbeat | where Computer == "VM01" | summarize LastHeartbeat = max(TimeGenerated) | where LastHeartbeat > ago(15m)

Answer

Heartbeat | where Computer == "VM01" and TimeGenerated > ago(15m) | summarize count() by Computer

Answer

Heartbeat | where Computer == "VM01" | summarize count() by bin(TimeGenerated, 15m)

Question 5

Based on the exhibit, which identity should the administrator enable to remove the secret from app settings and have the identity disappear automatically when the app is deleted?

Accepted Answer

System-assigned managed identity. The system-assigned managed identity is tied directly to the lifecycle of the Azure resource (e.g., an App Service). When you enable it, Azure automatically creates a service principal in Azure AD for that resource, and you can use the identity to access Azure Key Vault without storing secrets in app settings. When the resource is deleted, the system-assigned managed identity and its corresponding service principal are automatically removed, eliminating the need for manual cleanup.

Answer

User-assigned managed identity

Answer

Service principal with a client secret

Answer

Shared access signature

Question 6

A lifecycle rule moved quarterly audit logs to the Archive tier. An auditor now needs one blob for an urgent investigation and wants it available for download as soon as the rehydration completes. What should the administrator do?

Accepted Answer

Change the blob access tier to Hot and wait for rehydration to finish before downloading it.. Changing the access tier of a blob from Archive to Hot initiates an asynchronous rehydration process that moves the blob data back to an online tier. Once rehydration completes, the blob becomes available for download. This is the standard method to make archived blobs accessible for immediate use.

Answer

Copy the blob directly from Archive tier to the client's local disk.

Answer

Assign the blob a shorter retention policy so it becomes accessible automatically.

Answer

Move the blob to the Cool tier and attempt the download immediately.

Question 7

Based on the exhibit, VM name resolution works for IP addresses but fails for internal hostnames. What should the administrator configure on the spoke VNet?

Accepted Answer

Configure the spoke VNet to use 10.20.0.4 as a custom DNS server.. The hub VNet uses a custom DNS server at 10.20.0.4 (likely a Windows Server with DNS role) that can resolve internal hostnames like app01.corp.local. The spoke VNet is currently using Azure-provided DNS, which cannot resolve custom private DNS zones. By configuring the spoke VNet to use 10.20.0.4 as a custom DNS server, the spoke VMs will forward DNS queries to the hub DNS server, enabling hostname resolution for internal resources.

Answer

Keep Azure-provided DNS because the spoke can already reach the hub by IP.

Answer

Create a private endpoint for app01.corp.local in the spoke VNet.

Answer

Enable a NAT gateway on the spoke subnet.

Question 8

An application on an Azure VM needs more CPU and memory. The administrator wants to keep the same OS disk and installed apps, without redeploying the server. What should be done?

Accepted Answer

Resize the VM to a larger size. Resizing the VM (Option A) allows you to change the VM size to a SKU with more CPU and memory while preserving the OS disk, installed applications, and all data. This operation can be performed on a stopped (deallocated) VM and does not require redeployment or reimaging, making it the correct choice for scaling up resources without disruption to the existing configuration.

Answer

Reimage the VM

Answer

Move the VM into a different availability zone

Answer

Create a new storage account

Question 9

A payroll application in a VNet must access an Azure Storage account containing confidential blobs. The security team requires the storage account to be reachable only over a private IP, and public network access must be disabled. Which feature should the administrator implement?

Accepted Answer

A private endpoint for the storage account in the VNet.. A private endpoint assigns the storage account a private IP address from the VNet, enabling secure access over a private connection while completely disabling public network access. This meets the security team's requirement because traffic never traverses the public internet, and the storage account's firewall can be configured to deny all public traffic.

Answer

A service endpoint for Microsoft.Storage on the application subnet.

Answer

A shared access signature embedded in the application configuration.

Answer

A VPN gateway connection between the subnet and the storage account.

Question 10

A storage account must be reachable only from one Azure virtual network. The team wants the storage service to have a private IP in that VNet, public network access disabled, and name resolution to work without using the public endpoint. What should the administrator configure?

Accepted Answer

A private endpoint and a private DNS zone linked to the VNet. A private endpoint assigns the storage account a private IP from the VNet's address space, making it reachable only within that VNet. Disabling public network access ensures no traffic can reach the storage account via its public endpoint. A private DNS zone linked to the VNet enables name resolution to resolve the storage account's FQDN to the private IP without using the public endpoint.

Answer

A service endpoint on the subnet and a storage firewall rule

Answer

A public IP address and IP-based firewall exceptions

Answer

A shared access signature and blob container ACLs

Question 11

A VM has an NSG with these inbound rules: Deny-RDP at priority 100 for TCP 3389 from Any, and Allow-RDP-Admins at priority 200 for TCP 3389 from 10.8.1.0/24. Admins from 10.8.1.0/24 still cannot connect by RDP. What change fixes access while keeping all other sources blocked?

Accepted Answer

Move the allow rule to a lower priority number than 100.. C is correct because NSG rules are evaluated in priority order, with lower numbers evaluated first. The Deny-RDP rule at priority 100 is evaluated before the Allow-RDP-Admins rule at priority 200, so traffic from 10.8.1.0/24 is denied before the allow rule is reached. Moving the allow rule to a priority lower than 100 (e.g., 90) ensures it is evaluated first, allowing the admin traffic while the deny rule still blocks all other sources.

Answer

Change the deny rule to protocol Any so the allow rule will be evaluated first.

Answer

Add a UDR that sends TCP 3389 traffic to the VM subnet.

Answer

Associate an application security group with the VM and keep the existing priorities.

Question 12

New Azure subscriptions are created every month. Production subscriptions require stricter governance than sandbox subscriptions, and central IT wants those rules to apply automatically to any future production subscription without reconfiguring each one. What should they set up?

Accepted Answer

A management group hierarchy with production and sandbox child management groups, then assign governance at the appropriate scope.. Management groups allow you to build a hierarchy that reflects your organizational structure and apply governance policies (e.g., Azure Policy, RBAC) at the management group scope. By creating a 'Production' child management group under the root, any new subscription placed in that group automatically inherits the assigned policies and role assignments, eliminating the need to reconfigure each subscription individually.

Answer

Separate resource groups for production and sandbox workloads in each subscription.

Answer

A CanNotDelete lock on each subscription.

Answer

A custom role assigned to each subscription owner.

Question 13

A platform team must enforce three governance rules across every subscription in a management group: allowed Azure regions, required Environment tags, and approved VM sizes. They want one assignment that groups the rules together and gives a single compliance view. What should they use?

Accepted Answer

An Azure Policy initiative assigned at the management group.. An Azure Policy initiative (also known as a policy set) allows you to group multiple individual policy definitions—such as allowed regions, required tags, and approved VM sizes—into a single assignment. When assigned at the management group scope, the initiative enforces all three rules across every subscription within that group and provides a unified compliance view in the Azure Policy dashboard, meeting the team's requirement for consolidated governance.

Answer

A single RBAC role assignment at the management group.

Answer

A management lock on each subscription.

Answer

A private endpoint for Azure Resource Manager.

Question 14

A legal department keeps signed contract scans in a blob container. The files are almost never opened, but when a reviewer requests one, it must be available later the same day and then stay online for about three days while the review is completed. The team wants the lowest ongoing storage cost during that review window. What should the administrator do?

Accepted Answer

Rehydrate the blob to the Cool tier with standard priority. Rehydrating the blob from Archive to the Cool tier with standard priority meets the requirement of making the file available later the same day (standard priority rehydration completes within 1–15 hours) and provides the lowest ongoing storage cost during the three-day review window, as Cool tier is cheaper than Hot tier for data that is infrequently accessed.

Answer

Leave the blob in Archive and download it directly when needed

Answer

Copy the blob to the Hot tier permanently before the review starts

Answer

Change the storage account replication to GZRS to make archived data readable

Question 15

A company created a new spoke virtual network with the address space 10.40.1.0/24. The existing hub virtual network already uses 10.40.0.0/16. The administrator must peer the two VNets so resources can communicate normally. What must be changed before peering can succeed?

Accepted Answer

Change the spoke VNet address space to a range that does not overlap the hub.. Azure Virtual Network peering requires that the address spaces of the peered VNets do not overlap. The hub VNet uses 10.40.0.0/16, which includes the spoke's 10.40.1.0/24 range. Overlapping address spaces prevent successful peering because Azure cannot route traffic correctly between overlapping IP ranges. Therefore, the spoke VNet address space must be changed to a non-overlapping range before peering can succeed.

Answer

Create a route table on the spoke subnet before adding the peering.

Answer

Enable gateway transit on the hub peering to permit overlapping spaces.

Answer

Add an NSG rule that allows traffic between the hub and spoke address spaces.