AZ-104 Practice Test 44 — 15 Questions

Question 1

Based on the exhibit, what should the administrator create to let Alex restart one VM and read its properties without giving broader permissions?

Accepted Answer

Create a custom role that includes only the required VM read and restart actions.. Azure custom roles allow you to define granular permissions by specifying only the required actions in the `Actions` field of the role definition. For Alex to restart a VM (`Microsoft.Compute/virtualMachines/restart/action`) and read its properties (`Microsoft.Compute/virtualMachines/read`), a custom role with exactly these two actions provides the least-privilege access without granting broader permissions like VM write or delete.

Answer

Create an Azure Policy assignment that allows restart operations on the VM.

Answer

Apply a CanNotDelete lock to the VM resource.

Answer

Move the VM to a management group so the permissions become more specific.

Question 2

During a change freeze, administrators must prevent deletion of a production resource group and all resources inside it, but they still need to update VM sizes and tags. Which lock should be applied?

Accepted Answer

CanNotDelete on the resource group. The CanNotDelete lock on the resource group prevents deletion of the resource group and all resources within it, while still allowing read and update operations such as modifying VM sizes and tags. This meets the requirement of blocking deletions during the change freeze without restricting updates. ReadOnly locks would block all write operations, including the needed updates.

Answer

ReadOnly on the resource group

Answer

CanNotDelete on the management group

Answer

An Azure Policy deny assignment

Question 3

A records team stores monthly regulatory exports in a blob container. The files are rarely opened, but auditors may request one specific file later the same day. The team wants the lowest storage cost possible while keeping a path to restore a single file on demand. Which approach should you use?

Accepted Answer

Move the blobs to the Archive tier and use high-priority rehydration when a file is requested.. The Archive tier offers the lowest storage cost for rarely accessed data, and high-priority rehydration allows a single file to be restored within approximately one hour, meeting the auditor's same-day request requirement. This approach minimizes cost while retaining the ability to retrieve a specific file on demand.

Answer

Keep the blobs in the Hot tier and rely on lifecycle rules to delete them after 90 days.

Answer

Move the blobs to the Cool tier because it is offline until accessed.

Answer

Use the Cold tier because it requires a rehydration job before the blob becomes readable.

Question 4

Based on the exhibit, the team wants a readable, repeatable deployment definition stored in source control. Which approach should they use for the Azure resources?

Accepted Answer

Bicep because it provides a concise declarative syntax for Azure deployments.. Bicep is a domain-specific language (DSL) that provides a concise, declarative syntax for deploying Azure resources. It is designed to be more readable than ARM templates and can be stored in source control, enabling repeatable, version-controlled deployments. This directly meets the team's requirement for a readable, repeatable deployment definition.

Answer

Azure Policy because it enforces the deployment automatically.

Answer

A runbook in Azure Automation because it is always easier to read than templates.

Answer

A resource lock because it prevents unauthorized changes to the deployment.

Question 5

Based on the exhibit, which Azure compute service should you deploy for a stateless web app that needs more instances during business hours and fewer at night?

Accepted Answer

A virtual machine scale set with autoscale rules.. A virtual machine scale set with autoscale rules is the correct choice because it automatically adjusts the number of VM instances based on demand, scaling out during business hours and scaling in at night. This matches the stateless web app requirement, as scale sets are designed for stateless workloads where instances can be added or removed without data loss.

Answer

A single larger virtual machine.

Answer

An availability set with two VMs.

Answer

A dedicated host with one VM per host.

Question 6

Based on the exhibit, which deployment choice should the administrator use to keep the application available if one datacenter in the Azure region fails?

Accepted Answer

Deploy the VMs across separate availability zones.. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across separate availability zones ensures that if one datacenter fails, the application remains available in the other zone, providing resilience against datacenter-level failures.

Answer

Place both VMs in the same availability set.

Answer

Use a proximity placement group for both VMs.

Answer

Use a larger VM size for each virtual machine.

Question 7

A platform team wants to investigate incidents involving Azure VM performance, storage failures, and subscription-level changes in one place. They want to minimize Log Analytics ingestion cost. Which telemetry approach should they use?

Accepted Answer

Send only the required platform diagnostic logs and Activity logs to one Log Analytics workspace, and use metric alerts for threshold-based signals. It balances the need for centralized incident investigation with cost control. By sending only required platform diagnostic logs (e.g., from Azure Storage and VM metrics) and Activity logs to a single Log Analytics workspace, the team avoids unnecessary ingestion of verbose guest-level logs. Metric alerts provide threshold-based signals without log ingestion costs, enabling efficient monitoring of performance and failures.

Answer

Enable full guest-level logging on every VM, send all storage logs to the workspace, and add all activity logs from every subscription

Answer

Use metric alerts only and avoid Log Analytics because metrics are always cheaper than logs

Answer

Export all telemetry to a storage account and query it manually when an incident occurs

Question 8

An Azure Files share must stay available if one availability zone in its primary region fails. The business does not need replication to another region. Which redundancy option should you choose for the storage account?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) synchronously replicates your Azure Files share across three Azure availability zones within the primary region. This ensures the share remains available if one zone fails, without requiring replication to another region. LRS only replicates within a single data center, while GRS and RA-GRS involve secondary region replication, which the business does not need.

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 9

An administrator assigns Contributor at the RG-Apps resource group scope and Reader at the subscription scope. A developer opens a VM inside RG-Apps and can change its settings, but a different VM in RG-Shared is read-only. Which statement best explains this behavior?

Accepted Answer

The VM in RG-Apps inherited Contributor from the resource group, while RG-Shared only inherits Reader.. Role assignments in Azure are inherited from higher scopes (subscription, management group) down to lower scopes (resource group, resource). The developer has Reader at the subscription scope, which is inherited by all resource groups, including RG-Shared. However, the Contributor assignment at the RG-Apps resource group scope overrides the inherited Reader for that specific resource group, granting write access to VMs within RG-Apps. RG-Shared has no direct role assignment, so it only inherits the subscription-level Reader, making its VMs read-only.

Answer

The VM in RG-Apps has a direct Contributor assignment that does not apply elsewhere.

Answer

Reader always overrides Contributor when both roles exist in the same subscription.

Answer

Azure Policy is granting write access only inside RG-Apps because the subscription has no policy.

Question 10

A production subscription contains 20 virtual machines across two resource groups. Operations needs an email and SMS notification whenever any single VM's average Percentage CPU stays above 85 for 10 minutes. The alert should be managed as one rule, and evaluation must happen independently for each VM. What should the administrator configure?

Accepted Answer

Create one metric alert scoped to the 20 VM resources, using Percentage CPU and the shared action group.. A single metric alert rule can be scoped to multiple resources (up to 20 VMs) in Azure Monitor, allowing independent evaluation of each VM's Percentage CPU metric. When the average CPU exceeds 85% for 10 minutes on any individual VM, the alert fires and triggers the shared action group to send email and SMS notifications. This meets the requirement of one rule with per-VM independent evaluation.

Answer

Create a log query alert that uses the Heartbeat table and the existing action group.

Answer

Create one subscription-wide metric alert and average CPU across all virtual machines.

Answer

Configure diagnostic settings on each VM and use the action group for threshold processing.

Question 11

Based on the exhibit, what is the best access change to let John download blobs from only the invoices container?

Accepted Answer

Assign Storage Blob Data Reader at the invoices container scope.. Assigning the Storage Blob Data Reader role at the invoices container scope grants John the minimum permissions needed to download blobs from that specific container. This role provides read access to blob data without allowing any write or management operations, and scoping it to the container ensures John cannot access other containers in the storage account.

Answer

Assign Reader at the storage account scope so John can view the storage account and its data.

Answer

Assign Storage Account Contributor at the resource group scope.

Answer

Make the invoices container public and keep John's existing Contributor role.

Question 12

A help desk engineer needs a Log Analytics query that returns each computer whose most recent heartbeat is older than 20 minutes. Which query should they use?

Accepted Answer

Heartbeat | summarize LastSeen = max(TimeGenerated) by Computer | where LastSeen < ago(20m). It first summarizes the most recent heartbeat timestamp for each computer using `max(TimeGenerated)`, then filters for computers where that latest heartbeat is older than 20 minutes with `where LastSeen < ago(20m)`. This ensures only computers that have not sent a heartbeat in the last 20 minutes are returned, which is the exact requirement.

Answer

Heartbeat | where TimeGenerated < ago(20m) | summarize LastSeen = max(TimeGenerated) by Computer

Answer

Heartbeat | summarize count() by Computer | where count_ < 20

Answer

Heartbeat | where TimeGenerated > ago(20m) | summarize LastSeen = max(TimeGenerated) by Computer

Question 13

An operations team archived monthly log exports six weeks ago. An auditor now needs one specific blob restored within a day, and the file will likely be opened several times during the audit. Which action should the administrator take first?

Accepted Answer

Rehydrate the blob to the Hot tier. The blob is currently in the Archive tier, which is offline and cannot be read directly. To access the data, the blob must first be rehydrated to an online tier (Hot or Cool) by changing its tier or copying it to a new blob. Rehydrating to the Hot tier ensures the blob is available for multiple reads within the audit timeframe, as the rehydration process typically takes up to 15 hours for Archive tier blobs.

Answer

Set the blob directly to the Archive tier again

Answer

Create a snapshot of the archived blob and open the snapshot

Answer

Increase the account redundancy to RA-GRS before the audit

Question 14

A company wants to stop users from deploying resources in any region except East US and West US. Users still need to be able to create resources if they choose an approved region. Which Azure feature should the administrator use?

Accepted Answer

Azure Policy with a deny effect assigned at the appropriate scope.. Azure Policy with a deny effect can enforce that resource deployments are only allowed in specified regions (East US and West US) by evaluating the location property of the resource against a policy definition. When a user attempts to deploy a resource in a non-approved region, the policy engine rejects the request before any resource creation begins, ensuring compliance without blocking approved regions.

Answer

Azure RBAC with a Contributor role at the subscription scope.

Answer

A resource lock at the subscription level.

Answer

A tag requirement in Azure RBAC.

Question 15

Based on the exhibit, which identity should be enabled on the VM so the application can access Azure Blob Storage and the identity disappears when the VM is deleted?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is tied directly to the lifecycle of the Azure VM — when the VM is deleted, the identity is automatically removed. It can be granted access to Azure Blob Storage via Azure RBAC, allowing the application to authenticate without storing credentials. This matches the requirement for an identity that disappears with the VM.

Answer

User-assigned managed identity

Answer

Storage account shared key

Answer

SAS token stored in a startup script