AZ-104 Practice Test 44 — 15 Questions

Question 1

A developer wants to keep application data separate from the operating system so the VM can be rebuilt without losing files. Before making a risky change, the administrator also wants a fast rollback point for that data disk. Which two actions should the administrator take? Select two.

Accepted Answer

Store the application data on a separate managed data disk. Option A is correct because storing application data on a separate managed data disk decouples the data from the OS disk. This allows the VM to be rebuilt or reimaged without affecting the application files, as the data disk persists independently. Option B is correct because a snapshot of the data disk provides a point-in-time, crash-consistent backup that can be used to quickly restore the data disk to its pre-change state, enabling fast rollback without needing to rebuild the entire VM.

Answer

Use an ephemeral OS disk for the application files

Answer

Keep the files only on the OS disk and rely on reimaging

Answer

Delete and recreate the VM from the same image

Question 2

A support engineer is narrowing a Log Analytics query to only failed backup jobs and wants to show only the needed columns. Which two KQL operators should they use? Select two.

Accepted Answer

project. The `where` operator filters rows based on a condition, so it is used to narrow results to only failed backup jobs (e.g., `where Status == "Failed"`). The `project` operator selects a subset of columns, allowing the engineer to display only the needed columns (e.g., `project JobName, Status, StartTime`). Together, they achieve both row filtering and column selection in a Kusto Query Language (KQL) query.

Answer

extend

Answer

join

Answer

summarize

Question 3

Based on the exhibit, why does a query against AzureDiagnostics return no rows after the storage account diagnostic setting was changed?

Accepted Answer

The logs are written to resource-specific tables instead of AzureDiagnostics.. Option B is correct because when you change a diagnostic setting for a storage account from 'AzureDiagnostics' mode to 'Resource-specific' mode, logs are no longer sent to the AzureDiagnostics table. Instead, they are written to dedicated resource-specific tables (e.g., StorageReadLogs, StorageWriteLogs). Since the query targets AzureDiagnostics, it returns no rows because the logs are now stored in the new table format.

Answer

The storage account cannot send logs to Log Analytics when public network access is disabled.

Answer

The diagnostic setting only sends metrics, not logs, to the workspace.

Answer

The workspace retention period automatically deletes all records after one hour.

Question 4

Diagnostic settings on an Azure storage account must send logs to a destination storage account that has its firewall set to deny all public network access. The team cannot create a private endpoint, but the destination service is one of the Azure services that can bypass the firewall as a trusted Microsoft service. What should the administrator enable?

Accepted Answer

The Allow trusted Microsoft services to bypass this firewall setting. Option B is correct because the 'Allow trusted Microsoft services to bypass this firewall' setting enables specific Azure services, such as Azure Monitor or Azure Backup, to write diagnostic logs to a storage account even when the storage account's firewall blocks all public network access. This bypass is controlled at the Azure platform level and does not require a private endpoint or public IP, making it the only viable solution when the destination storage account denies all public traffic.

Answer

A service endpoint on the destination storage account subnet

Answer

A shared access signature with read permission

Answer

A private DNS zone linked to the workspace virtual network

Question 5

A team is creating a new spoke VNet that will later be peered to an existing hub VNet and connected to on-premises networks. The proposed address space for the spoke is 10.60.1.0/24. The hub already uses 10.60.0.0/16. What should the administrator do before deploying the spoke?

Accepted Answer

Choose a non-overlapping address space for the spoke, such as 10.61.1.0/24.. Option B is correct because VNet address spaces must not overlap when peered or connected via VPN/ExpressRoute. The proposed spoke address 10.60.1.0/24 falls within the hub's 10.60.0.0/16 range, creating an overlap that would prevent successful peering and routing. A non-overlapping address space like 10.61.1.0/24 ensures unique IP ranges, allowing proper route propagation and connectivity.

Answer

Use the proposed address space because the spoke subnet is smaller than the hub address space.

Answer

Create a private endpoint in the spoke to separate its routing table from the hub.

Answer

Enable gateway transit on the hub peering before creating the spoke.

Question 6

Based on the exhibit, what should the administrator configure so the VM in the spoke VNet can resolve internal hostnames that are hosted on the DNS server in the hub VNet?

The team has already verified that IP connectivity between the spoke VM and the hub VM works.

Accepted Answer

Set the SpokeVNet DNS server list to use 10.40.0.4 so the spoke queries the hub resolver directly.. Option A is correct because setting the SpokeVNet DNS server list to 10.40.0.4 (the IP of the DNS server in the hub VNet) configures the spoke VNet to forward all DNS queries to that custom DNS server. Since IP connectivity between the VNets is already verified, the spoke VM can resolve internal hostnames hosted on the hub DNS server. This is the standard method for cross-VNet DNS resolution when using a custom DNS server in a hub-and-spoke topology.

Answer

Create a private endpoint for web01.corp.contoso.local in the spoke VNet so DNS resolves automatically.

Answer

Enable gateway transit on the peering so the spoke inherits the hub VNet DNS configuration.

Answer

Add inbound and outbound NSG rules allowing UDP and TCP port 53 between the two VNets.

Question 7

A team is creating a new workload subnet in a spoke virtual network. The subnet must support 41 VM NICs, 2 internal load balancer frontend IP configurations, 3 private endpoint IPs, and 4 spare IPs for near-term growth. Azure reserves 5 IP addresses in every subnet. What is the smallest IPv4 subnet size that satisfies the requirement?

Accepted Answer

/26, because 64 total addresses provide enough usable IPs for the workload and growth.. The total IP addresses required are 41 (VM NICs) + 2 (ILB frontends) + 3 (private endpoints) + 4 (spare) + 5 (Azure reserved) = 55 IPs. A /26 subnet provides 64 total addresses, of which 59 are usable (64 - 5 reserved), which meets the requirement. Option B is correct because /26 is the smallest subnet that provides enough usable IPs.

Answer

/27, because 32 total addresses are enough for a small workload subnet.

Answer

/25, because 128 total addresses are required once private endpoints are included.

Answer

/28, because 16 total addresses are sufficient when load balancers are used.

Question 8

A stateless customer portal runs on Azure VMs and must keep serving traffic if an entire datacenter in the region fails. The operations team also wants the portal to add and remove instances automatically during daily spikes without managing a Kubernetes cluster. Which two Azure compute capabilities should the administrator configure? Select two.

Accepted Answer

Deploy the portal instances across availability zones.. Availability zones protect against a full datacenter failure by distributing VM instances across physically separate datacenters within a region. This ensures that if one datacenter goes down, the portal continues serving traffic from the other zones. Combined with a load balancer, this provides high availability for stateless workloads.

Answer

Place the VMs in an availability set within a single datacenter.

Answer

Create a proximity placement group for the portal VMs.

Answer

Use a single larger VM with premium managed disks.

Question 9

A storage account has public network access disabled. A VM in VNet-Prod must reach Blob storage by using the storage account name, but nslookup from the VM still returns the public endpoint address. What should the administrator do?

Accepted Answer

Create a private endpoint for the blob service and link the private DNS zone to VNet-Prod.. Option B is correct because the VM's nslookup returns the public endpoint address, indicating that DNS resolution is not pointing to the private IP of the storage account. Creating a private endpoint for the blob service assigns a private IP from the VNet-Prod subnet to the storage account, and linking a private DNS zone (privatelink.blob.core.windows.net) to VNet-Prod ensures that DNS queries from the VM resolve the storage account name to that private IP, bypassing the public endpoint entirely.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet and keep public network access disabled.

Answer

Add an inbound NSG rule that allows TCP 443 from the VM to the storage account.

Answer

Turn on the trusted Microsoft services exception for the storage account firewall.

Question 10

A Windows file server VM in Azure must mount an Azure file share by using existing Active Directory Domain Services credentials, not the storage account key. Yesterday, a user deleted a folder tree from the share, and only that folder tree should be restored. Which two actions should the administrator take? Select two.

Accepted Answer

Configure identity-based authentication for Azure Files with Active Directory Domain Services.. Option A is correct because identity-based authentication for Azure Files with Active Directory Domain Services (AD DS) allows the Windows file server VM to mount the Azure file share using existing AD DS credentials instead of the storage account key. This is required by the scenario, which specifies that the mount must use AD DS credentials. Option B is correct because Azure file share snapshots capture the state of the share at a point in time, enabling restoration of a specific deleted folder tree without affecting other data. This directly addresses the need to restore only the deleted folder tree.

Answer

Mount the share by using the storage account key in the command line.

Answer

Enable anonymous access on the file share so the VM can mount it.

Answer

Recreate the share as a blob container and use blob snapshots.

Question 11

A subnet has a route table with these user-defined routes: 172.16.0.0/16 -> Virtual appliance 10.1.1.4 and 172.16.1.0/24 -> Internet. A VM in the subnet sends traffic to 172.16.1.20. Which next hop is used?

Accepted Answer

Internet, because the most specific route prefix always wins.. Azure route selection uses the longest prefix match (most specific route) to determine the next hop. The route 172.16.1.0/24 is more specific than 172.16.0.0/16, so traffic to 172.16.1.20 uses the Internet next hop, not the virtual appliance. This is consistent with how Azure evaluates user-defined routes (UDRs) and system routes.

Answer

Virtual appliance 10.1.1.4, because the broader route was added first.

Answer

Virtual network gateway, because all traffic to private IP addresses uses the gateway by default.

Answer

No next hop, because conflicting user-defined routes disable routing for that destination.

Question 12

An application subnet has a network security group with these inbound rules: Allow-Web-From-Internet at priority 200, Allow-App-From-Web at priority 300, and Deny-All-Inbound at priority 250. The web tier must reach the app tier on TCP 8080, but traffic is being denied. The administrator confirms the source and destination IPs are correct. What is the best fix?

Accepted Answer

Change the Allow-App-From-Web rule to a lower priority number than 250.. The Deny-All-Inbound rule at priority 250 is evaluated before the Allow-App-From-Web rule at priority 300 because lower priority numbers are processed first. To allow web-to-app traffic on TCP 8080, the Allow-App-From-Web rule must have a lower priority number (e.g., 240) than the Deny-All-Inbound rule so it is evaluated and applied first, permitting the traffic before the deny rule blocks it.

Answer

Delete the Deny-All-Inbound rule because default NSG rules will allow the traffic.

Answer

Add a route table entry for TCP 8080 traffic to bypass the NSG.

Answer

Move the Allow-Web-From-Internet rule to priority 400.

Question 13

An NSG attached to a subnet contains these inbound rules: Deny-All-Inbound at priority 200, Allow-HTTPS-Admin at priority 250 from 203.0.113.20/32, and Allow-HTTPS-Internet at priority 300. A VM in the subnet cannot receive HTTPS from the admin workstation even though the source IP is correct. What should the administrator change?

Accepted Answer

Move the Allow-HTTPS-Admin rule to a priority number lower than 200.. The Deny-All-Inbound rule at priority 200 blocks all traffic, including HTTPS from the admin workstation, because NSG rules are evaluated in priority order (lowest number first). The Allow-HTTPS-Admin rule at priority 250 is never reached since the deny rule with a higher priority (lower number) matches first. To allow the admin traffic, the allow rule must have a priority lower than 200 (e.g., 150) so it is evaluated before the deny rule.

Answer

Change the protocol from TCP to Any on the allow rule.

Answer

Associate a NAT gateway with the subnet.

Answer

Enable service endpoint policies on the subnet.

Question 14

An administrator archives monthly log exports in a blob container to reduce storage cost. During an audit, one archived blob must be downloaded and opened later the same day. What must the administrator do before the blob can be read?

Accepted Answer

Change the blob tier from Archive to Hot or Cool and wait for rehydration to finish. Blobs stored in the Archive tier are offline and must be rehydrated to the Hot or Cool tier before they can be read. Rehydration can take up to 15 hours, so the administrator must initiate a tier change and wait for completion before downloading the blob. Option B correctly identifies this required step.

Answer

Read the blob directly from the Archive tier because archive data remains immediately online

Answer

Copy the blob to a new container in the same account to bypass the archive restriction

Answer

Assign an Azure RBAC role to the auditor so the archived blob becomes available immediately

Question 15

An administrator archived monthly log exports in a blob container six weeks ago. An auditor now needs to open one of those files later today, and the file must be readable from Azure Storage rather than restored from a separate backup copy. What should the administrator do?

Accepted Answer

Start rehydration of the blob to the Hot tier before opening it.. Option B is correct because blobs in the Archive tier are offline and cannot be read directly. To access the data, the blob must first be rehydrated to the Hot or Cool tier, which changes its state to online and readable. Rehydration can take up to 15 hours, so the administrator must start this process well before the auditor needs the file.

Answer

Open the blob directly from the Archive tier because archived blobs remain online for read access.

Answer

Change the blob to the Cold tier, because Cold is designed for archived content.

Answer

Use a snapshot of the archived blob, because snapshots can be opened even when the base blob is archived.