AZ-104 Practice Test 44 — 15 Questions

Question 1

A production storage account must remain available for updates, but administrators want to prevent accidental deletion during maintenance windows. Which lock should be applied to the storage account?

Accepted Answer

CanNotDelete lock at the storage account scope.. The CanNotDelete lock at the storage account scope prevents the storage account from being deleted while still allowing all read and update operations. This meets the requirement of keeping the storage account available for updates while preventing accidental deletion during maintenance windows.

Answer

ReadOnly lock at the storage account scope.

Answer

CanNotDelete lock at the subscription scope.

Answer

Azure Policy deny assignment on all storage account operations.

Question 2

The team accidentally stopped protection for a VM and deleted its backup data. They want Azure Backup to keep deleted backup items recoverable for a grace period so the item can be undeleted if needed. Which vault feature should be enabled?

Accepted Answer

Soft delete. Soft delete is the correct feature because it provides a grace period (default 14 days) during which deleted backup data is retained in a soft-deleted state. This allows administrators to recover (undelete) backup items that were accidentally deleted, including cases where protection was stopped and data was removed. Without soft delete, deleted backup data is permanently purged and cannot be recovered.

Answer

Instant restore

Answer

A new backup policy

Answer

A private endpoint for the vault

Question 3

A reporting server VM will run an analytics engine that uses a large in-memory cache. Required minimums are 8 vCPUs and 64 GiB of RAM, and the workload benefits more from memory than from extra compute. Which Azure VM series is the best fit?

Accepted Answer

E-series, because it provides memory-optimized sizing for data-intensive workloads. The E-series (specifically Ev3, Esv3, or Ebsv5) is memory-optimized, offering the highest memory-to-vCPU ratio among Azure general-purpose families. With a requirement of 64 GiB RAM and only 8 vCPUs, the workload benefits more from memory than compute, making the E-series the best fit. D-series provides balanced ratios but not the memory density needed, while F-series and B-series are compute- or burst-oriented and lack sufficient memory per vCPU.

Answer

B-series, because burstable credits handle temporary spikes economically

Answer

D-series, because it balances general-purpose CPU and memory

Answer

F-series, because it is optimized for high CPU throughput

Question 4

Engineers need a single Log Analytics workspace to investigate incidents by querying Windows event logs from a VM and Azure resource logs from a storage account. What should the administrator configure?

Accepted Answer

Use Azure Monitor Agent with a data collection rule for the VM and diagnostic settings for the storage account, both sending data to the same workspace.. Azure Monitor Agent (AMA) with a data collection rule (DCR) collects Windows event logs from VMs, and diagnostic settings on a storage account send Azure resource logs to the same Log Analytics workspace. This centralizes both data sources for unified querying and incident investigation.

Answer

Create a resource lock on the workspace and let each team send emails when incidents happen.

Answer

Move the VM and storage account into the same availability set so their logs appear together.

Answer

Enable a private endpoint for the workspace and disable all diagnostic collection.

Question 5

An internal line-of-business application runs on two VMs in Azure. Users connect only from a peered virtual network and from on-premises through VPN. The application must not be reachable from the internet, but traffic should be balanced across the two VMs. Which configuration should you choose?

Accepted Answer

A Standard Load Balancer with a private frontend IP.. A Standard Load Balancer with a private frontend IP is correct because it distributes traffic to the two VMs using a private IP address that is only reachable from within the peered virtual network and the on-premises network via VPN. This configuration ensures the application is not exposed to the internet while still providing load balancing across the VMs.

Answer

A public Standard Load Balancer with a public frontend IP.

Answer

A NAT gateway attached to the application subnet.

Answer

A network security group rule allowing TCP 443 from the internet.

Question 6

Based on the exhibit, what should the administrator create to let Alex restart one VM and read its properties without giving broader permissions?

Accepted Answer

Create a custom role that includes only the required VM read and restart actions.. Azure custom roles allow you to define granular permissions by specifying only the required actions in the `Actions` field of the role definition. For Alex to restart a VM (`Microsoft.Compute/virtualMachines/restart/action`) and read its properties (`Microsoft.Compute/virtualMachines/read`), a custom role with exactly these two actions provides the least-privilege access without granting broader permissions like VM write or delete.

Answer

Create an Azure Policy assignment that allows restart operations on the VM.

Answer

Apply a CanNotDelete lock to the VM resource.

Answer

Move the VM to a management group so the permissions become more specific.

Question 7

During a change freeze, administrators must prevent deletion of a production resource group and all resources inside it, but they still need to update VM sizes and tags. Which lock should be applied?

Accepted Answer

CanNotDelete on the resource group. The CanNotDelete lock on the resource group prevents deletion of the resource group and all resources within it, while still allowing read and update operations such as modifying VM sizes and tags. This meets the requirement of blocking deletions during the change freeze without restricting updates. ReadOnly locks would block all write operations, including the needed updates.

Answer

ReadOnly on the resource group

Answer

CanNotDelete on the management group

Answer

An Azure Policy deny assignment

Question 8

A records team stores monthly regulatory exports in a blob container. The files are rarely opened, but auditors may request one specific file later the same day. The team wants the lowest storage cost possible while keeping a path to restore a single file on demand. Which approach should you use?

Accepted Answer

Move the blobs to the Archive tier and use high-priority rehydration when a file is requested.. The Archive tier offers the lowest storage cost for rarely accessed data, and high-priority rehydration allows a single file to be restored within approximately one hour, meeting the auditor's same-day request requirement. This approach minimizes cost while retaining the ability to retrieve a specific file on demand.

Answer

Keep the blobs in the Hot tier and rely on lifecycle rules to delete them after 90 days.

Answer

Move the blobs to the Cool tier because it is offline until accessed.

Answer

Use the Cold tier because it requires a rehydration job before the blob becomes readable.

Question 9

Based on the exhibit, the team wants a readable, repeatable deployment definition stored in source control. Which approach should they use for the Azure resources?

Accepted Answer

Bicep because it provides a concise declarative syntax for Azure deployments.. Bicep is a domain-specific language (DSL) that provides a concise, declarative syntax for deploying Azure resources. It is designed to be more readable than ARM templates and can be stored in source control, enabling repeatable, version-controlled deployments. This directly meets the team's requirement for a readable, repeatable deployment definition.

Answer

Azure Policy because it enforces the deployment automatically.

Answer

A runbook in Azure Automation because it is always easier to read than templates.

Answer

A resource lock because it prevents unauthorized changes to the deployment.

Question 10

Based on the exhibit, which Azure compute service should you deploy for a stateless web app that needs more instances during business hours and fewer at night?

Accepted Answer

A virtual machine scale set with autoscale rules.. A virtual machine scale set with autoscale rules is the correct choice because it automatically adjusts the number of VM instances based on demand, scaling out during business hours and scaling in at night. This matches the stateless web app requirement, as scale sets are designed for stateless workloads where instances can be added or removed without data loss.

Answer

A single larger virtual machine.

Answer

An availability set with two VMs.

Answer

A dedicated host with one VM per host.

Question 11

Based on the exhibit, which deployment choice should the administrator use to keep the application available if one datacenter in the Azure region fails?

Accepted Answer

Deploy the VMs across separate availability zones.. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across separate availability zones ensures that if one datacenter fails, the application remains available in the other zone, providing resilience against datacenter-level failures.

Answer

Place both VMs in the same availability set.

Answer

Use a proximity placement group for both VMs.

Answer

Use a larger VM size for each virtual machine.

Question 12

A platform team wants to investigate incidents involving Azure VM performance, storage failures, and subscription-level changes in one place. They want to minimize Log Analytics ingestion cost. Which telemetry approach should they use?

Accepted Answer

Send only the required platform diagnostic logs and Activity logs to one Log Analytics workspace, and use metric alerts for threshold-based signals. It balances the need for centralized incident investigation with cost control. By sending only required platform diagnostic logs (e.g., from Azure Storage and VM metrics) and Activity logs to a single Log Analytics workspace, the team avoids unnecessary ingestion of verbose guest-level logs. Metric alerts provide threshold-based signals without log ingestion costs, enabling efficient monitoring of performance and failures.

Answer

Enable full guest-level logging on every VM, send all storage logs to the workspace, and add all activity logs from every subscription

Answer

Use metric alerts only and avoid Log Analytics because metrics are always cheaper than logs

Answer

Export all telemetry to a storage account and query it manually when an incident occurs

Question 13

An Azure Files share must stay available if one availability zone in its primary region fails. The business does not need replication to another region. Which redundancy option should you choose for the storage account?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) synchronously replicates your Azure Files share across three Azure availability zones within the primary region. This ensures the share remains available if one zone fails, without requiring replication to another region. LRS only replicates within a single data center, while GRS and RA-GRS involve secondary region replication, which the business does not need.

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 14

An administrator assigns Contributor at the RG-Apps resource group scope and Reader at the subscription scope. A developer opens a VM inside RG-Apps and can change its settings, but a different VM in RG-Shared is read-only. Which statement best explains this behavior?

Accepted Answer

The VM in RG-Apps inherited Contributor from the resource group, while RG-Shared only inherits Reader.. Role assignments in Azure are inherited from higher scopes (subscription, management group) down to lower scopes (resource group, resource). The developer has Reader at the subscription scope, which is inherited by all resource groups, including RG-Shared. However, the Contributor assignment at the RG-Apps resource group scope overrides the inherited Reader for that specific resource group, granting write access to VMs within RG-Apps. RG-Shared has no direct role assignment, so it only inherits the subscription-level Reader, making its VMs read-only.

Answer

The VM in RG-Apps has a direct Contributor assignment that does not apply elsewhere.

Answer

Reader always overrides Contributor when both roles exist in the same subscription.

Answer

Azure Policy is granting write access only inside RG-Apps because the subscription has no policy.

Question 15

A production subscription contains 20 virtual machines across two resource groups. Operations needs an email and SMS notification whenever any single VM's average Percentage CPU stays above 85 for 10 minutes. The alert should be managed as one rule, and evaluation must happen independently for each VM. What should the administrator configure?

Accepted Answer

Create one metric alert scoped to the 20 VM resources, using Percentage CPU and the shared action group.. A single metric alert rule can be scoped to multiple resources (up to 20 VMs) in Azure Monitor, allowing independent evaluation of each VM's Percentage CPU metric. When the average CPU exceeds 85% for 10 minutes on any individual VM, the alert fires and triggers the shared action group to send email and SMS notifications. This meets the requirement of one rule with per-VM independent evaluation.

Answer

Create a log query alert that uses the Heartbeat table and the existing action group.

Answer

Create one subscription-wide metric alert and average CPU across all virtual machines.

Answer

Configure diagnostic settings on each VM and use the action group for threshold processing.