AZ-104 Practice Test 45 — 15 Questions

Question 1

A Recovery Services vault protects 40 VMs by using one daily backup policy that retains recovery points for 7 days. One finance VM must keep daily recovery points for 30 days, but the other VMs should remain on the 7-day policy. What should the administrator do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a second backup policy with 30-day retention and assign only the finance VM to it.. Azure Backup allows multiple backup policies within a single Recovery Services vault, and you can assign different policies to different VMs. By creating a second policy with 30-day retention and assigning only the finance VM to it, the administrator meets the requirement without affecting the other 39 VMs that continue using the existing 7-day policy.

Answer

Edit the existing policy so all protected VMs inherit 30-day retention.

Answer

Move the finance VM to another resource group so it gets different retention automatically.

Answer

Apply a resource lock to the finance VM to preserve its recovery points longer.

Question 2

A subnet already has a user-defined default route (0.0.0.0/0) that sends all outbound traffic to a network virtual appliance. The administrator now needs traffic to the on-premises network 10.50.0.0/16 to use the VPN gateway instead of the appliance. What should be added to the route table?

Accepted Answer

Add a user-defined route for 10.50.0.0/16 with next hop type Virtual network gateway. Adding a user-defined route (UDR) for the specific prefix 10.50.0.0/16 with next hop type 'Virtual network gateway' creates a more specific route (longest prefix match) than the existing default route (0.0.0.0/0). This ensures traffic destined for the on-premises network is forwarded to the VPN gateway instead of the network virtual appliance, while all other outbound traffic continues to use the appliance.

Answer

Remove the default route so the system route to the VPN gateway is used

Answer

Change the subnet address space to a smaller CIDR block

Answer

Enable a service endpoint for the on-premises prefix

Question 3

A storage account hosts application logs that security wants to search in Log Analytics for 30 days and keep in a separate retained copy for one year. They also want to monitor storage metrics in the same place for troubleshooting. What should be configured on the storage account?

Accepted Answer

Create a diagnostic setting that sends the storage resource logs and AllMetrics to Log Analytics and a storage account.. A diagnostic setting on a storage account can send both resource logs (e.g., StorageRead, StorageWrite) and AllMetrics (e.g., transactions, ingress) to a Log Analytics workspace for querying and to a secondary storage account for long-term retention. This meets the requirement to search logs for 30 days in Log Analytics (which has its own retention setting) and keep a separate archived copy for one year in the storage account.

Answer

Enable only the activity log export because it already includes all storage telemetry.

Answer

Create an action group that archives storage events and forwards them to investigators.

Answer

Create a metric alert on the storage account and use it as the retention mechanism.

Question 4

A user deleted one Excel file from a file share backed up with Azure Backup. You want to restore only that file, not the entire share. What should you use?

Accepted Answer

A file-level restore from the backup recovery point. Azure Backup for Azure Files supports file-level restore from a recovery point. When you select a recovery point in the Azure portal, you can browse the file share contents and restore individual files or folders to the original or an alternate location, without restoring the entire share. This is achieved by mounting the recovery point as a read-only share via the SMB protocol, allowing you to copy the specific file.

Answer

A full VM restore

Answer

A metric alert rule

Answer

A private endpoint

Question 5

Frontend VMs in one subnet must reach backend VMs on TCP 8443. The backend VMs are rebuilt frequently, so their private IP addresses change often. The administrator wants to avoid updating NSG rules every time the backend IPs change. What should be used in the NSG rule?

Accepted Answer

Application Security Groups for the frontend and backend tiers.. Application Security Groups (ASGs) allow you to group VMs logically by function (e.g., frontend, backend) and reference those groups in NSG rules. Since the backend VMs are rebuilt frequently and their private IPs change, using ASGs in the NSG rule (source = frontend ASG, destination = backend ASG, port = 8443) eliminates the need to update IP addresses manually. The NSG rule remains valid as long as the VMs are assigned to the correct ASG, regardless of IP changes.

Answer

A service endpoint on the backend subnet.

Answer

A route table with a next hop of Virtual network gateway.

Answer

A private endpoint for each backend VM.

Question 6

A Windows Azure VM must download configuration data from Azure Key Vault during first boot. Security policy forbids storing passwords, certificates, or client secrets on the VM. What should the administrator configure?

Accepted Answer

Enable a system-assigned managed identity on the VM and grant it Key Vault access.. A system-assigned managed identity provides an automatically managed service principal in Entra ID, tied to the VM's lifecycle. Granting this identity the appropriate Key Vault access policy (e.g., Get, List secrets) allows the VM to authenticate to Key Vault without any stored credentials, satisfying the security policy. The VM can then retrieve configuration data during first boot using the Azure Instance Metadata Service (IMDS) endpoint.

Answer

Create a service principal and place its secret in the VM's startup script.

Answer

Attach a custom script extension that embeds the Key Vault password in plain text.

Answer

Use an Entra ID user account and sign in interactively after deployment.

Question 7

A company uses one management group for all production subscriptions. A compliance analyst is a member of an Entra ID group and must view every current and future resource in all production subscriptions, but must not make any changes. Where should you assign the Reader role?

Accepted Answer

Assign Reader to the Entra ID group at the management group scope.. Assigning the Reader role to the Entra ID group at the management group scope ensures that all current and future resources in all production subscriptions inherit the role via Azure RBAC inheritance. This meets the requirement to view every resource without making changes, as the management group encompasses all production subscriptions and the group membership automatically grants permissions to the compliance analyst.

Answer

Assign Reader to the compliance analyst's user account at each resource group.

Answer

Assign Reader to one production subscription and rely on inheritance to cover the others.

Answer

Assign Reader directly to each resource because resource-level assignments always override broader scopes.

Question 8

Based on the exhibit, where should the new subscription be placed so it inherits the production governance baseline automatically?

Accepted Answer

Place the subscription under Prod-MG.. Placing the new subscription under the Prod-MG management group ensures it automatically inherits the Azure Policy and RBAC assignments applied at that level. Management groups in Azure allow hierarchical governance, and any subscription within a management group inherits policies and role assignments from that group and all parent groups. This enables consistent enforcement of the production governance baseline without manual configuration.

Answer

Place the subscription under Sandbox-MG.

Answer

Create a resource group named Finance-Prod instead of assigning a management group.

Answer

Move the subscription to the tenant root and assign policies later.

Question 9

A customer-facing application runs on two Azure VMs. The business wants the application to stay available even if one datacenter in the Azure region has an outage. Which availability option should the administrator use?

Accepted Answer

Availability zones. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. By deploying the two VMs into different zones, the application remains available if one entire datacenter fails, meeting the requirement for datacenter-level fault tolerance.

Answer

Availability set

Answer

Proximity placement group

Answer

Azure Load Balancer

Question 10

Based on the exhibit, what is the best change so the VNet peering can be created successfully?

Accepted Answer

Change VNet-B to a non-overlapping address space, such as 10.1.0.0/24.. VNet peering requires that the address spaces of the two virtual networks do not overlap. If VNet-A uses 10.0.0.0/16 and VNet-B also uses 10.0.0.0/16, they conflict, preventing peering. Changing VNet-B to a non-overlapping address space like 10.1.0.0/24 resolves this conflict, allowing the peering to be established.

Answer

Add a route table to VNet-B before creating the peering.

Answer

Enable gateway transit on VNet-A.

Answer

Resize VNet-A to 10.0.0.0/15 so both VNets fit.

Question 11

Based on the exhibit, compliance requires one backup every week to be kept for 52 weeks, in addition to the daily backups already configured. What should you change in the backup policy?

Accepted Answer

Add a weekly retention rule that keeps one weekly recovery point for 52 weeks.. The requirement is to retain one weekly backup for 52 weeks, in addition to the existing daily backups. Adding a weekly retention rule that keeps one recovery point per week for 52 weeks directly satisfies this requirement by ensuring that each weekly backup is retained for the full year, while daily backups remain unaffected. This is the correct approach because Azure Backup allows granular retention policies with multiple rules for different frequencies (daily, weekly, monthly, yearly).

Answer

Increase the daily retention from 30 days to 365 days.

Answer

Change the vault to use soft delete so backups are retained for 52 weeks.

Answer

Create a metric alert to warn the team when backups are older than seven days.

Question 12

Based on the exhibit, help desk staff must restart virtual machines only in RG-App. What is the narrowest scope where you should assign the role?

Accepted Answer

Assign the role at the RG-App resource group scope.. The narrowest scope that grants the necessary permissions to restart VMs only in RG-App is the resource group scope. Assigning the Virtual Machine Contributor role at the RG-App resource group level ensures that help desk staff can restart VMs within that specific resource group without having permissions to any other resources in the subscription or management group. This follows the principle of least privilege, limiting access to only what is required.

Answer

Assign the role at the subscription scope for Sub-IT-01.

Answer

Assign the role at the management group scope above the subscription.

Answer

Assign the role at the individual VM scope only.

Question 13

Based on the exhibit, where should the administrator assign the role so the contractor can start and stop virtual machines only in RG-App and nothing else?

Accepted Answer

Assign the role at the resource group scope for RG-App.. The contractor needs to manage virtual machines only within RG-App. Azure RBAC allows you to assign the Virtual Machine Contributor role at the resource group scope, which grants permissions to start and stop VMs within that specific resource group while preventing access to resources in other resource groups or at higher scopes. Assigning at the subscription or management group level would grant permissions across all resource groups, violating the principle of least privilege.

Answer

Assign the role at the subscription scope so it covers the contractor's work area.

Answer

Assign the role at the management group scope above the subscription.

Answer

Assign the role directly to one virtual machine only, because that is always the best scope.

Question 14

A platform team wants every current and future subscription under the company's Azure hierarchy to inherit Reader access for a central audit group. The team does not want to create separate assignments for each subscription. Where should the role be assigned?

Accepted Answer

At the management group that contains the subscriptions.. Assigning the Reader role at the management group level ensures that all current and future subscriptions within that management group inherit the assignment via Azure RBAC inheritance. This meets the requirement without needing separate assignments per subscription, as role assignments flow down the hierarchy from management group to subscription to resource group to resource.

Answer

At one subscription and rely on inheritance to reach the others.

Answer

At a resource group in a single subscription.

Answer

At an individual resource that the audit team will inspect.

Question 15

A Windows VM and a Linux VM in the same on-premises Active Directory Domain Services domain must mount the same Azure Files share over SMB. Security policy forbids storage account keys and long-lived SAS tokens. What should the administrator configure?

Accepted Answer

Use Azure Files with Active Directory Domain Services authentication and grant permissions to the required AD group.. Azure Files supports identity-based authentication over SMB using on-premises Active Directory Domain Services (AD DS). By enabling AD DS authentication for the storage account and granting share-level permissions to an AD group that includes both the Windows and Linux VMs, the administrator can mount the Azure Files share without using storage account keys or SAS tokens. This satisfies the security policy while allowing SMB access from both operating systems.

Answer

Use a private endpoint and rely on network isolation instead of authentication.

Answer

Use the storage account access key because SMB requires shared-key authentication.

Answer

Use Azure Files NFS authentication because Linux and Windows workloads can both mount it.