AZ-104 Practice Test 46 — 15 Questions

Question 1

Based on the exhibit, help desk staff must restart virtual machines only in RG-App. What is the narrowest scope where you should assign the role?

Accepted Answer

Assign the role at the RG-App resource group scope.. The narrowest scope that grants the necessary permissions to restart VMs only in RG-App is the resource group scope. Assigning the Virtual Machine Contributor role at the RG-App resource group level ensures that help desk staff can restart VMs within that specific resource group without having permissions to any other resources in the subscription or management group. This follows the principle of least privilege, limiting access to only what is required.

Answer

Assign the role at the subscription scope for Sub-IT-01.

Answer

Assign the role at the management group scope above the subscription.

Answer

Assign the role at the individual VM scope only.

Question 2

Based on the exhibit, where should the administrator assign the role so the contractor can start and stop virtual machines only in RG-App and nothing else?

Accepted Answer

Assign the role at the resource group scope for RG-App.. The contractor needs to manage virtual machines only within RG-App. Azure RBAC allows you to assign the Virtual Machine Contributor role at the resource group scope, which grants permissions to start and stop VMs within that specific resource group while preventing access to resources in other resource groups or at higher scopes. Assigning at the subscription or management group level would grant permissions across all resource groups, violating the principle of least privilege.

Answer

Assign the role at the subscription scope so it covers the contractor's work area.

Answer

Assign the role at the management group scope above the subscription.

Answer

Assign the role directly to one virtual machine only, because that is always the best scope.

Question 3

A platform team wants every current and future subscription under the company's Azure hierarchy to inherit Reader access for a central audit group. The team does not want to create separate assignments for each subscription. Where should the role be assigned?

Accepted Answer

At the management group that contains the subscriptions.. Assigning the Reader role at the management group level ensures that all current and future subscriptions within that management group inherit the assignment via Azure RBAC inheritance. This meets the requirement without needing separate assignments per subscription, as role assignments flow down the hierarchy from management group to subscription to resource group to resource.

Answer

At one subscription and rely on inheritance to reach the others.

Answer

At a resource group in a single subscription.

Answer

At an individual resource that the audit team will inspect.

Question 4

A Windows VM and a Linux VM in the same on-premises Active Directory Domain Services domain must mount the same Azure Files share over SMB. Security policy forbids storage account keys and long-lived SAS tokens. What should the administrator configure?

Accepted Answer

Use Azure Files with Active Directory Domain Services authentication and grant permissions to the required AD group.. Azure Files supports identity-based authentication over SMB using on-premises Active Directory Domain Services (AD DS). By enabling AD DS authentication for the storage account and granting share-level permissions to an AD group that includes both the Windows and Linux VMs, the administrator can mount the Azure Files share without using storage account keys or SAS tokens. This satisfies the security policy while allowing SMB access from both operating systems.

Answer

Use a private endpoint and rely on network isolation instead of authentication.

Answer

Use the storage account access key because SMB requires shared-key authentication.

Answer

Use Azure Files NFS authentication because Linux and Windows workloads can both mount it.

Question 5

Which two authentication methods let an app access blob data without storing the storage account key on the machine? Select two.

Accepted Answer

Microsoft Entra ID authorization with an appropriate Azure RBAC role.. Microsoft Entra ID authorization with an appropriate Azure RBAC role (e.g., Storage Blob Data Contributor) allows an app to authenticate to blob storage using OAuth 2.0 tokens, eliminating the need to store the storage account key on the machine. Option B is correct because a user delegation SAS is signed with Microsoft Entra ID credentials and can be generated without the account key, providing time-limited, scoped access to blob data.

Answer

The storage account access key.

Answer

A service SAS generated directly from the account key.

Answer

Anonymous public access to the container.

Question 6

A deny policy blocks creation of storage accounts with public network access enabled. A legacy application in RG-Legacy must keep one existing storage account publicly reachable for 45 days while the rest of the subscription remains governed by the policy. What should the administrator configure?

Accepted Answer

A policy exemption at the RG-Legacy scope with an expiration date.. A policy exemption at the RG-Legacy scope with an expiration date is the correct solution because it allows the specific storage account to bypass the deny policy while keeping the policy enforced for all other resources. The exemption can be scoped to the resource group and set to expire in 45 days, ensuring the legacy application retains public access temporarily without permanently weakening the governance posture. This approach directly addresses the requirement to maintain compliance for the rest of the subscription.

Answer

A new role assignment that grants Owner on RG-Legacy.

Answer

A management lock on the storage account.

Answer

A separate initiative assigned only to RG-Legacy with the deny setting disabled.

Question 7

A storage account experiences a brief regional platform issue. The team wants an alert whenever Azure marks the resource as unavailable, even if no custom metric changes are detected. What should the administrator use?

Accepted Answer

A Resource Health alert for the storage account.. A Resource Health alert is designed to monitor the health of Azure resources and trigger notifications when Azure detects that the resource is unavailable due to platform issues, even if no custom metric thresholds are breached. This alert uses signals from the Azure Resource Health service, which tracks the current and historical health status of resources, making it the correct choice for detecting regional platform unavailability without relying on custom metrics.

Answer

A metric alert on the account's transaction count.

Answer

A diagnostic setting that sends logs only to a storage account.

Answer

An Azure Policy assignment that denies writes to the storage account.

Question 8

A hub VNet already has a VPN gateway connected to on-premises. A new spoke VNet must reach on-premises through the hub gateway and should not deploy its own gateway. What configuration should be enabled on the peering?

Accepted Answer

Enable gateway transit on the hub peering and Use remote gateways on the spoke peering.. Enabling 'Use remote gateways' on the spoke VNet peering and 'Allow gateway transit' on the hub VNet peering allows the spoke VNet to route traffic to on-premises through the hub's VPN gateway without deploying its own gateway. This configuration leverages BGP routes (if the VPN gateway is route-based) to propagate on-premises prefixes to the spoke, enabling transitive routing across the peering.

Answer

Create a service endpoint from the spoke to the hub.

Answer

Add a default route to Internet in the spoke subnet.

Answer

Enable accelerated networking on the spoke subnet.

Question 9

A policy at the management group denies storage accounts that allow public network access. One legacy storage account in RG-Legacy must stay public for 30 days while a migration runs, and the team does not want to change the policy for everyone else. What should the administrator create?

Accepted Answer

A policy exemption for that storage account. A policy exemption allows specific resources to be excluded from the effect of a policy initiative without modifying the original policy definition. In this scenario, the management group policy denies storage accounts with public network access, but the legacy account needs to remain public temporarily. By creating a policy exemption (with 'exempt' category) for that specific storage account, the administrator can bypass the deny effect for 30 days while the policy continues to apply to all other resources.

Answer

A resource lock on the storage account

Answer

A second policy assignment with higher priority

Answer

A custom RBAC role for the migration team

Question 10

Based on the exhibit, what should the administrator change so the web tier can reach the database tier on TCP 443 without opening the subnet more broadly?

Accepted Answer

Move the allow rule for WebTierASG to a priority lower than 100.. The administrator must ensure the allow rule for WebTierASG is evaluated before the deny-all rule. In Azure Network Security Groups (NSGs), rules are processed in priority order (lower numbers first). The current deny rule at priority 100 blocks all traffic from VirtualNetwork, including TCP 443 from the web tier. By moving the allow rule to a priority lower than 100 (e.g., 90), it will be evaluated first, permitting TCP 443 traffic from WebTierASG to the database tier, while the deny rule still blocks all other traffic from the virtual network.

Answer

Delete the deny rule because default rules already block unwanted traffic.

Answer

Change the deny rule source from VirtualNetwork to Internet.

Answer

Change the default inbound rule to AllowVnetInBound.

Question 11

You need to synchronize an on-premises Windows file server with an Azure file share so that branch offices can continue using the local server while keeping cloud-based copies of the files. Which service should you configure?

Accepted Answer

Azure File Sync. Azure File Sync is the correct service because it enables you to centralize your on-premises file shares in Azure Files while maintaining local access to the data. It uses a sync agent installed on the Windows file server to replicate files to an Azure file share, allowing branch offices to continue using the local server with cloud-based copies for backup, disaster recovery, or multi-site access. This directly meets the requirement of keeping the on-premises server operational while maintaining cloud copies.

Answer

Blob versioning

Answer

Azure NetApp Files

Answer

Storage account failover

Question 12

A team runs a Windows service on an Azure virtual machine that uploads invoices to Blob storage every few minutes. Security policy forbids storing account keys or long-lived SAS tokens on the VM. The service must authenticate without human interaction. What should the administrator configure?

Accepted Answer

Assign the VM a managed identity and grant it Storage Blob Data Contributor on the container or storage account.. Assigning a managed identity to the VM allows it to authenticate to Azure Blob Storage without any secrets stored on the VM. The managed identity provides an automatically managed service principal in Azure AD, and by granting the Storage Blob Data Contributor role, the service obtains the necessary permissions to upload invoices. This satisfies the security policy forbidding account keys or long-lived SAS tokens and enables unattended authentication.

Answer

Generate a SAS token with a 1-year expiry and store it in an encrypted file on the VM.

Answer

Share the storage account access key with the service account and rotate it monthly.

Answer

Create a storage firewall rule that allows the VM's public IP address and keep using anonymous access.

Question 13

Two application teams created separate virtual networks so their workloads can communicate through VNet peering. VNet-A uses 10.20.0.0/16. VNet-B was created with 10.20.128.0/17. The peering request fails during validation. What is the best fix?

Accepted Answer

Change one VNet to use a non-overlapping address space.. VNet peering requires that the address spaces of the peered virtual networks do not overlap. VNet-A uses 10.20.0.0/16, which includes the entire range from 10.20.0.0 to 10.20.255.255. VNet-B uses 10.20.128.0/17, which is a subset of VNet-A's range (10.20.128.0 to 10.20.255.255). This overlap causes the peering validation to fail because Azure cannot route traffic between overlapping address spaces. Changing one VNet to a non-overlapping address space resolves the conflict.

Answer

Add an NSG rule to allow traffic between the two VNets.

Answer

Create a private endpoint in each VNet.

Answer

Attach a route table to both subnets.

Question 14

A subnet has a user-defined route for 10.0.0.0/8 with next hop Virtual appliance 10.1.1.4. The VNet is peered with VNet-Shared, whose address space is 10.12.0.0/16. A VM in the subnet sends traffic to 10.12.4.25. Which next hop will Azure use?

Accepted Answer

VNet peering, because the peered VNet prefix is more specific than the broader UDR.. Azure uses the most specific matching route to determine next hop. The user-defined route (UDR) for 10.0.0.0/8 has a broader prefix length (/8) than the VNet peering route for 10.12.0.0/16 (/16). Since 10.12.4.25 falls within the peered VNet's address space, the more specific /16 route from VNet peering takes precedence over the UDR, directing traffic through the peering connection.

Answer

Virtual appliance 10.1.1.4, because the user-defined route controls all 10.x.x.x traffic.

Answer

Internet, because traffic not explicitly matched by the UDR leaves through the default route.

Answer

None, because Azure cannot route to peered VNets when a UDR exists on the subnet.

Question 15

A company wants its file share data to be automatically copied to a paired Azure region, and administrators want to read the secondary copy during a disaster test. Which redundancy option should they use?

Accepted Answer

RA-GRS. RA-GRS (Read-Access Geo-Redundant Storage) is correct because it replicates data to a paired secondary region asynchronously and provides read-only access to that secondary copy. This allows administrators to read the secondary copy during a disaster test without impacting the primary region. ZRS and LRS do not replicate to a paired region, and Cool is a tier, not a redundancy option.

Answer

ZRS

Answer

LRS

Answer

Cool