AZ-104 Practice Test 45 — 15 Questions

Question 1

Based on the exhibit, why is TCP 8443 traffic from the web tier still denied to the app tier, and what should you do to allow only the web tier?

Accepted Answer

Add an inbound allow rule for TCP 8443 from ASG-Web to ASG-App with a priority lower than 100.. Option B is correct because in Azure Network Security Groups (NSGs), rules are evaluated in priority order, with lower numbers evaluated first. The existing rule at priority 100 allows traffic from the web tier, but a subsequent deny-all rule at priority 200 blocks all traffic, including TCP 8443. To allow only the web tier, you must add an inbound allow rule for TCP 8443 from ASG-Web with a priority lower than 200 (e.g., 150) so it is evaluated before the deny-all rule, effectively permitting the desired traffic while still blocking other sources.

Answer

Change the deny-all rule at priority 200 to allow TCP 8443 from ASG-Web.

Answer

Add a route table entry for 8443 traffic from the web tier to the app tier.

Answer

Remove the AzureLoadBalancer rule because it is overriding the web tier traffic.

Question 2

An administrator is deploying a new VPN gateway in an existing VNet. The GatewaySubnet currently uses a /28 range, and the deployment fails because the selected gateway configuration does not have enough available IP addresses. What is the best action?

Accepted Answer

Expand GatewaySubnet to a larger range, such as /27, and redeploy the VPN gateway.. The GatewaySubnet requires a minimum /27 range to support most VPN gateway SKUs, as Azure reserves several IP addresses for internal use and the gateway instances need at least 3–6 usable IPs depending on the SKU. Expanding the subnet to /27 provides enough addresses (32 total, minus reserved) to satisfy the gateway's allocation requirements, allowing the deployment to succeed.

Answer

Move one of the gateway's NICs into a normal workload subnet.

Answer

Create a private endpoint inside GatewaySubnet to reserve extra addresses.

Answer

Enable BGP so the gateway needs fewer IP addresses.

Question 3

Based on the exhibit, which lock should the administrator apply to protect the resource group from accidental deletion while still allowing normal updates to the resources inside it?

Accepted Answer

Apply a CanNotDelete lock to rg-payroll-prod.. The CanNotDelete lock (also known as Delete lock) prevents the resource group itself from being deleted while still allowing all updates (including create, modify, and delete operations) on the resources within it. This is the correct choice because the requirement is to protect only the resource group from accidental deletion, not to restrict changes to the resources inside.

Answer

Apply a ReadOnly lock to rg-payroll-prod.

Answer

Apply a tag named Protected=True to rg-payroll-prod.

Answer

Create an Azure Policy assignment that denies all delete operations.

Question 4

An administrator is troubleshooting inbound HTTPS to a VM. The subnet NSG has these custom rules: Deny-Internet-Inbound at priority 150, Allow-HTTPS-Admin at priority 200, and the default deny rules remain in place. The administrator’s client is on the internet and should be able to reach the VM on TCP 443. What change will fix the problem?

Accepted Answer

Move the allow rule to a lower priority number than the deny rule.. The correct answer is A because Network Security Group (NSG) rules are evaluated in priority order, with lower numbers evaluated first. The Deny-Internet-Inbound rule at priority 150 is evaluated before the Allow-HTTPS-Admin rule at priority 200, so the deny rule blocks the inbound HTTPS traffic before the allow rule can be processed. Moving the allow rule to a lower priority number (e.g., 140) ensures it is evaluated first, permitting the traffic from the internet on TCP 443.

Answer

Change the allow rule source from Internet to Any and keep the same priority.

Answer

Create a route table to the VM subnet so traffic reaches the VM faster.

Answer

Associate an application security group with the VM and leave the rules unchanged.

Question 5

You are deploying a stateless web application on Azure virtual machines. The solution must automatically add and remove instances based on CPU demand and allow all instances to be managed as one logical group. Which Azure compute feature should you deploy?

Accepted Answer

A Virtual Machine Scale Set. A Virtual Machine Scale Set (VMSS) is the correct Azure compute feature because it automatically manages a group of identical, load-balanced VMs that can scale in and out based on CPU demand using autoscale rules. It treats all instances as a single logical group, enabling unified management, patching, and application deployment, which is exactly what the stateless web application requires.

Answer

An availability set

Answer

A Recovery Services vault

Answer

Boot diagnostics

Question 6

You need to allow a support engineer to restart virtual machines in the RG-App resource group, but the engineer must not be able to create, delete, or resize the virtual machines. What should you do?

Accepted Answer

Create a custom role that includes restart permissions and assign it at the RG-App scope. The Virtual Machine Contributor role includes permissions to restart VMs but also allows creating, deleting, and resizing VMs, which violates the requirement. A custom role with only the Microsoft.Compute/virtualMachines/restart/action permission assigned at the RG-App scope grants the exact restart capability without broader management rights.

Answer

Assign the Virtual Machine Contributor role at the RG-App scope

Answer

Assign the Contributor role at the subscription scope

Answer

Assign the Reader role at the RG-App scope

Question 7

A team wants to keep Azure platform logs for a storage account in a central location and analyze them with queries. The logs should be queryable together with other Azure resource logs. What destination should the administrator choose for the diagnostic setting?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the correct destination because it allows you to collect Azure platform logs (such as resource logs, activity logs, and metrics) from multiple resources into a central location. These logs can then be queried together using Kusto Query Language (KQL) across different resource types, enabling cross-resource analysis and correlation. This meets the requirement for queryable logs alongside other Azure resource logs.

Answer

A storage account only

Answer

An action group

Answer

A management group

Question 8

You need to create a storage account that provides the lowest-cost redundant storage for non-critical data and only needs protection against local disk or server failure within a single datacenter. Which redundancy option should you choose?

Accepted Answer

LRS. A is correct because Locally Redundant Storage (LRS) replicates data three times within a single datacenter in the same region, protecting against local disk or server failures. It is the lowest-cost redundancy option, making it ideal for non-critical data that does not require protection against zone- or region-level outages.

Answer

ZRS

Answer

GRS

Answer

GZRS

Question 9

You need to deploy 20 identical Azure virtual machines for a web application and automatically scale the number of instances based on CPU demand. Which Azure feature should you use?

Accepted Answer

A Virtual Machine Scale Set. A Virtual Machine Scale Set (VMSS) is the correct Azure feature because it allows you to deploy and manage a group of identical, load-balanced VMs that can automatically scale in or out based on CPU demand using autoscale rules. This directly meets the requirement for deploying 20 identical VMs with automatic scaling based on a performance metric like CPU utilization.

Answer

An availability set

Answer

A Recovery Services vault

Answer

Boot diagnostics

Question 10

You need to deploy several identical virtual machines and ensure that the failure of a single Azure host does not affect all of them. Which feature should you use?

Accepted Answer

An availability set. An availability set distributes virtual machines across multiple fault domains (physical hosts) and update domains within an Azure datacenter. By placing VMs in an availability set, you ensure that a failure of a single Azure host (fault domain) does not affect all VMs, as each VM is placed on a different physical host. This meets the requirement for isolation from a single host failure.

Answer

A proximity placement group

Answer

A private endpoint

Answer

A custom script extension

Question 11

You need to ensure that a user can view cost data for Azure resources but cannot create or modify those resources. Which built-in role should you assign at the required scope?

Accepted Answer

Reader. The Reader role provides read-only access to Azure resources, including cost data, while explicitly preventing any create, modify, or delete actions. This is the correct built-in role for a user who needs to view cost information but not manage resources.

Answer

Owner

Answer

Contributor

Answer

User Access Administrator

Question 12

You need to prevent accidental deletion of a production resource group while still allowing administrators to update resources inside it. What should you apply to the resource group?

Accepted Answer

A CanNotDelete lock. A CanNotDelete lock (B) prevents the resource group from being deleted while still allowing all operations (including updates) on resources within it. This is the correct choice because the requirement is to block accidental deletion of the entire resource group, not to restrict modifications to its resources.

Answer

A ReadOnly lock

Answer

A deny assignment

Answer

A budget alert

Question 13

An on-premises application connects to Azure through an existing site-to-site VPN. The application must access an Azure Blob Storage account over a private IP, and the storage account must not accept public network traffic. Which configuration should the administrator deploy?

Accepted Answer

A private endpoint for the storage account in an Azure VNet reachable through the VPN.. Option B is correct because a private endpoint assigns the storage account a private IP from an Azure VNet, making it accessible over the site-to-site VPN without traversing the public internet. This satisfies the requirement for private IP access and allows the storage account to block all public network traffic by disabling public network access in the firewall settings.

Answer

A service endpoint on the on-premises network and a storage account firewall exception.

Answer

A NAT gateway on the subnet that hosts the storage account.

Answer

An application security group applied to the storage account.

Question 14

You need to collect performance counters and event logs from multiple Azure virtual machines and query the data centrally by using Kusto Query Language. Which Azure resource should you deploy?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the correct Azure resource because it ingests performance counters and event logs from Azure virtual machines via the Azure Monitor agent or the legacy Log Analytics agent, and stores them in a centralized repository. You can then query this data using Kusto Query Language (KQL) to perform real-time analysis, troubleshooting, and reporting across multiple VMs.

Answer

A Recovery Services vault

Answer

Azure Network Watcher

Answer

A load balancer

Question 15

You need to deploy a set of identical Azure virtual machines that can automatically scale out during demand spikes and scale in when usage falls. Which Azure feature should you use?

Accepted Answer

A Virtual Machine Scale Set. A Virtual Machine Scale Set (VMSS) is the correct Azure feature because it is designed specifically to deploy and manage a set of identical, load-balanced VMs that can automatically scale out (increase instance count) during demand spikes and scale in (decrease instance count) when usage falls, using autoscale rules based on metrics like CPU or memory.

Answer

An availability set

Answer

A Recovery Services vault

Answer

Boot diagnostics

AZ-104 Practice Test 45 — 15 Questions

Exhibit

AZ-104 Practice Test 45 — 15 Questions

Exhibit