AZ-104 Practice Test 43 — 15 Questions

Question 1

A lifecycle rule moved quarterly audit logs to the Archive tier. An auditor now needs one blob for an urgent investigation and wants it available for download as soon as the rehydration completes. What should the administrator do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the blob access tier to Hot and wait for rehydration to finish before downloading it.. Changing the access tier of a blob from Archive to Hot initiates an asynchronous rehydration process that moves the blob data back to an online tier. Once rehydration completes, the blob becomes available for download. This is the standard method to make archived blobs accessible for immediate use.

Answer

Copy the blob directly from Archive tier to the client's local disk.

Answer

Assign the blob a shorter retention policy so it becomes accessible automatically.

Answer

Move the blob to the Cool tier and attempt the download immediately.

Question 2

Based on the exhibit, VM name resolution works for IP addresses but fails for internal hostnames. What should the administrator configure on the spoke VNet?

Accepted Answer

Configure the spoke VNet to use 10.20.0.4 as a custom DNS server.. The hub VNet uses a custom DNS server at 10.20.0.4 (likely a Windows Server with DNS role) that can resolve internal hostnames like app01.corp.local. The spoke VNet is currently using Azure-provided DNS, which cannot resolve custom private DNS zones. By configuring the spoke VNet to use 10.20.0.4 as a custom DNS server, the spoke VMs will forward DNS queries to the hub DNS server, enabling hostname resolution for internal resources.

Answer

Keep Azure-provided DNS because the spoke can already reach the hub by IP.

Answer

Create a private endpoint for app01.corp.local in the spoke VNet.

Answer

Enable a NAT gateway on the spoke subnet.

Question 3

An application on an Azure VM needs more CPU and memory. The administrator wants to keep the same OS disk and installed apps, without redeploying the server. What should be done?

Accepted Answer

Resize the VM to a larger size. Resizing the VM (Option A) allows you to change the VM size to a SKU with more CPU and memory while preserving the OS disk, installed applications, and all data. This operation can be performed on a stopped (deallocated) VM and does not require redeployment or reimaging, making it the correct choice for scaling up resources without disruption to the existing configuration.

Answer

Reimage the VM

Answer

Move the VM into a different availability zone

Answer

Create a new storage account

Question 4

A payroll application in a VNet must access an Azure Storage account containing confidential blobs. The security team requires the storage account to be reachable only over a private IP, and public network access must be disabled. Which feature should the administrator implement?

Accepted Answer

A private endpoint for the storage account in the VNet.. A private endpoint assigns the storage account a private IP address from the VNet, enabling secure access over a private connection while completely disabling public network access. This meets the security team's requirement because traffic never traverses the public internet, and the storage account's firewall can be configured to deny all public traffic.

Answer

A service endpoint for Microsoft.Storage on the application subnet.

Answer

A shared access signature embedded in the application configuration.

Answer

A VPN gateway connection between the subnet and the storage account.

Question 5

A storage account must be reachable only from one Azure virtual network. The team wants the storage service to have a private IP in that VNet, public network access disabled, and name resolution to work without using the public endpoint. What should the administrator configure?

Accepted Answer

A private endpoint and a private DNS zone linked to the VNet. A private endpoint assigns the storage account a private IP from the VNet's address space, making it reachable only within that VNet. Disabling public network access ensures no traffic can reach the storage account via its public endpoint. A private DNS zone linked to the VNet enables name resolution to resolve the storage account's FQDN to the private IP without using the public endpoint.

Answer

A service endpoint on the subnet and a storage firewall rule

Answer

A public IP address and IP-based firewall exceptions

Answer

A shared access signature and blob container ACLs

Question 6

A VM has an NSG with these inbound rules: Deny-RDP at priority 100 for TCP 3389 from Any, and Allow-RDP-Admins at priority 200 for TCP 3389 from 10.8.1.0/24. Admins from 10.8.1.0/24 still cannot connect by RDP. What change fixes access while keeping all other sources blocked?

Accepted Answer

Move the allow rule to a lower priority number than 100.. C is correct because NSG rules are evaluated in priority order, with lower numbers evaluated first. The Deny-RDP rule at priority 100 is evaluated before the Allow-RDP-Admins rule at priority 200, so traffic from 10.8.1.0/24 is denied before the allow rule is reached. Moving the allow rule to a priority lower than 100 (e.g., 90) ensures it is evaluated first, allowing the admin traffic while the deny rule still blocks all other sources.

Answer

Change the deny rule to protocol Any so the allow rule will be evaluated first.

Answer

Add a UDR that sends TCP 3389 traffic to the VM subnet.

Answer

Associate an application security group with the VM and keep the existing priorities.

Question 7

New Azure subscriptions are created every month. Production subscriptions require stricter governance than sandbox subscriptions, and central IT wants those rules to apply automatically to any future production subscription without reconfiguring each one. What should they set up?

Accepted Answer

A management group hierarchy with production and sandbox child management groups, then assign governance at the appropriate scope.. Management groups allow you to build a hierarchy that reflects your organizational structure and apply governance policies (e.g., Azure Policy, RBAC) at the management group scope. By creating a 'Production' child management group under the root, any new subscription placed in that group automatically inherits the assigned policies and role assignments, eliminating the need to reconfigure each subscription individually.

Answer

Separate resource groups for production and sandbox workloads in each subscription.

Answer

A CanNotDelete lock on each subscription.

Answer

A custom role assigned to each subscription owner.

Question 8

A platform team must enforce three governance rules across every subscription in a management group: allowed Azure regions, required Environment tags, and approved VM sizes. They want one assignment that groups the rules together and gives a single compliance view. What should they use?

Accepted Answer

An Azure Policy initiative assigned at the management group.. An Azure Policy initiative (also known as a policy set) allows you to group multiple individual policy definitions—such as allowed regions, required tags, and approved VM sizes—into a single assignment. When assigned at the management group scope, the initiative enforces all three rules across every subscription within that group and provides a unified compliance view in the Azure Policy dashboard, meeting the team's requirement for consolidated governance.

Answer

A single RBAC role assignment at the management group.

Answer

A management lock on each subscription.

Answer

A private endpoint for Azure Resource Manager.

Question 9

A legal department keeps signed contract scans in a blob container. The files are almost never opened, but when a reviewer requests one, it must be available later the same day and then stay online for about three days while the review is completed. The team wants the lowest ongoing storage cost during that review window. What should the administrator do?

Accepted Answer

Rehydrate the blob to the Cool tier with standard priority. Rehydrating the blob from Archive to the Cool tier with standard priority meets the requirement of making the file available later the same day (standard priority rehydration completes within 1–15 hours) and provides the lowest ongoing storage cost during the three-day review window, as Cool tier is cheaper than Hot tier for data that is infrequently accessed.

Answer

Leave the blob in Archive and download it directly when needed

Answer

Copy the blob to the Hot tier permanently before the review starts

Answer

Change the storage account replication to GZRS to make archived data readable

Question 10

A company created a new spoke virtual network with the address space 10.40.1.0/24. The existing hub virtual network already uses 10.40.0.0/16. The administrator must peer the two VNets so resources can communicate normally. What must be changed before peering can succeed?

Accepted Answer

Change the spoke VNet address space to a range that does not overlap the hub.. Azure Virtual Network peering requires that the address spaces of the peered VNets do not overlap. The hub VNet uses 10.40.0.0/16, which includes the spoke's 10.40.1.0/24 range. Overlapping address spaces prevent successful peering because Azure cannot route traffic correctly between overlapping IP ranges. Therefore, the spoke VNet address space must be changed to a non-overlapping range before peering can succeed.

Answer

Create a route table on the spoke subnet before adding the peering.

Answer

Enable gateway transit on the hub peering to permit overlapping spaces.

Answer

Add an NSG rule that allows traffic between the hub and spoke address spaces.

Question 11

A production storage account must remain available for updates, but administrators want to prevent accidental deletion during maintenance windows. Which lock should be applied to the storage account?

Accepted Answer

CanNotDelete lock at the storage account scope.. The CanNotDelete lock at the storage account scope prevents the storage account from being deleted while still allowing all read and update operations. This meets the requirement of keeping the storage account available for updates while preventing accidental deletion during maintenance windows.

Answer

ReadOnly lock at the storage account scope.

Answer

CanNotDelete lock at the subscription scope.

Answer

Azure Policy deny assignment on all storage account operations.

Question 12

The team accidentally stopped protection for a VM and deleted its backup data. They want Azure Backup to keep deleted backup items recoverable for a grace period so the item can be undeleted if needed. Which vault feature should be enabled?

Accepted Answer

Soft delete. Soft delete is the correct feature because it provides a grace period (default 14 days) during which deleted backup data is retained in a soft-deleted state. This allows administrators to recover (undelete) backup items that were accidentally deleted, including cases where protection was stopped and data was removed. Without soft delete, deleted backup data is permanently purged and cannot be recovered.

Answer

Instant restore

Answer

A new backup policy

Answer

A private endpoint for the vault

Question 13

A reporting server VM will run an analytics engine that uses a large in-memory cache. Required minimums are 8 vCPUs and 64 GiB of RAM, and the workload benefits more from memory than from extra compute. Which Azure VM series is the best fit?

Accepted Answer

E-series, because it provides memory-optimized sizing for data-intensive workloads. The E-series (specifically Ev3, Esv3, or Ebsv5) is memory-optimized, offering the highest memory-to-vCPU ratio among Azure general-purpose families. With a requirement of 64 GiB RAM and only 8 vCPUs, the workload benefits more from memory than compute, making the E-series the best fit. D-series provides balanced ratios but not the memory density needed, while F-series and B-series are compute- or burst-oriented and lack sufficient memory per vCPU.

Answer

B-series, because burstable credits handle temporary spikes economically

Answer

D-series, because it balances general-purpose CPU and memory

Answer

F-series, because it is optimized for high CPU throughput

Question 14

Engineers need a single Log Analytics workspace to investigate incidents by querying Windows event logs from a VM and Azure resource logs from a storage account. What should the administrator configure?

Accepted Answer

Use Azure Monitor Agent with a data collection rule for the VM and diagnostic settings for the storage account, both sending data to the same workspace.. Azure Monitor Agent (AMA) with a data collection rule (DCR) collects Windows event logs from VMs, and diagnostic settings on a storage account send Azure resource logs to the same Log Analytics workspace. This centralizes both data sources for unified querying and incident investigation.

Answer

Create a resource lock on the workspace and let each team send emails when incidents happen.

Answer

Move the VM and storage account into the same availability set so their logs appear together.

Answer

Enable a private endpoint for the workspace and disable all diagnostic collection.

Question 15

An internal line-of-business application runs on two VMs in Azure. Users connect only from a peered virtual network and from on-premises through VPN. The application must not be reachable from the internet, but traffic should be balanced across the two VMs. Which configuration should you choose?

Accepted Answer

A Standard Load Balancer with a private frontend IP.. A Standard Load Balancer with a private frontend IP is correct because it distributes traffic to the two VMs using a private IP address that is only reachable from within the peered virtual network and the on-premises network via VPN. This configuration ensures the application is not exposed to the internet while still providing load balancing across the VMs.

Answer

A public Standard Load Balancer with a public frontend IP.

Answer

A NAT gateway attached to the application subnet.

Answer

A network security group rule allowing TCP 443 from the internet.