AZ-104 Practice Test 47 — 15 Questions

Question 1

A contractor needs to upload data into one specific blob container for six hours. The administrator must avoid sharing the storage account key and should grant only the minimum permissions needed. Which access method should be used?

Accepted Answer

A service SAS scoped to the container with write permission and an expiry time in six hours.. A service SAS scoped to the container with write permission and an expiry time of six hours is correct because it provides time-limited, delegated access to a specific blob container without exposing the storage account key. This meets the requirement of granting only the minimum permissions needed (write) for the six-hour duration, and the SAS can be revoked by regenerating the storage account key if necessary.

Answer

The storage account access key, because it is easier to revoke later.

Answer

A shared key rotation policy, because it grants time-limited access to one container.

Answer

A user-assigned managed identity assigned to the contractor’s laptop.

Question 2

You need to allow SSH access to only one Linux VM in a subnet that contains several application servers. The other VMs in the subnet must remain inaccessible from the internet. What is the best configuration?

Accepted Answer

Associate an NSG with the target VM's NIC and add an inbound allow rule for TCP 22 from your admin IP.. Option B is correct because Network Security Groups (NSGs) can be associated at the subnet or NIC level. By associating an NSG directly with the target VM's NIC and adding an inbound allow rule for TCP port 22 from your admin IP address, you restrict SSH access exclusively to that VM while leaving the other VMs in the subnet unaffected by the rule. This provides granular, host-level security without impacting the broader subnet traffic.

Answer

Add an inbound allow rule on the subnet NSG for TCP 22 from your admin IP address.

Answer

Create a public load balancer in front of the subnet and forward port 22 to the VM.

Answer

Enable a service endpoint on the subnet so SSH traffic is limited to that VM.

Question 3

You want to deploy a resource group with Bicep and see the changes Azure plans to make before you apply them. Which command should you run?

Accepted Answer

az deployment group what-if. The `az deployment group what-if` command is correct because it performs a dry-run validation of a Bicep (or ARM) deployment against a resource group, showing the changes Azure will make (create, modify, delete) without actually applying them. This is the Azure equivalent of a 'what-if' analysis, allowing you to review the impact before execution.

Answer

az deployment group create

Answer

az group delete

Answer

az vm update

Question 4

An application writes transaction logs to a storage account in a region that supports availability zones. The business wants the account to stay available if one datacenter or zone fails, but it does not need a secondary region replica. Which redundancy option should you choose?

Accepted Answer

ZRS, because it replicates synchronously across zones in the same region and survives a zone outage.. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the same region. This design ensures that if one datacenter or zone fails, the storage account remains available and durable without requiring a secondary region replica, exactly matching the business requirement.

Answer

LRS, because it keeps three copies within a single datacenter and is enough for any zone failure.

Answer

GRS, because it adds a geographically replicated secondary region for disaster recovery.

Answer

RA-GRS, because read access to the secondary region is the best protection against a zone failure.

Question 5

You need to resize a VM to a larger size, but Azure says the target size is not available while the VM is running. What should you do first?

Accepted Answer

Deallocate the VM, then retry the resize.. When a VM is running, Azure may not have the target VM size available in the cluster hosting the VM. Deallocating the VM releases the underlying hardware resources and removes the VM from its current cluster, allowing Azure to select a new cluster that supports the desired size. After deallocation, the resize operation can succeed because the VM is no longer pinned to a specific host or cluster.

Answer

Delete the VM and recreate it from the image.

Answer

Attach a new data disk first.

Answer

Create an availability set for the VM.

Question 6

A company runs two identical Linux VMs for a stateless web app in an Azure region that supports availability zones. The business requires protection from a full datacenter outage, not just planned host maintenance. Which deployment choice best meets this requirement?

Accepted Answer

Deploy the VMs across availability zones.. Option B is correct because deploying the two VMs across different availability zones ensures that each VM resides in a physically separate datacenter within the region. This architecture protects against a full datacenter outage, as an availability zone failure affects only one zone, leaving the other VM operational. Availability zones provide a 99.99% SLA for VMs when two or more instances are deployed across zones, which aligns with the requirement for protection beyond planned host maintenance.

Answer

Place both VMs in an availability set.

Answer

Use a proximity placement group for both VMs.

Answer

Deploy both VMs in a single-zone virtual machine scale set.

Question 7

Based on the exhibit, which Azure feature should the administrator use to install software and run the bootstrap script during VM provisioning?

Accepted Answer

Azure VM Custom Script Extension. The Azure VM Custom Script Extension (CSE) is the correct feature because it allows the administrator to execute scripts (such as installing software or running a bootstrap script) during VM provisioning or after the VM is running. The extension downloads the script from Azure Storage or a public URL and executes it using the local system account, making it ideal for post-deployment configuration tasks.

Answer

A network security group rule allowing RDP from the Internet

Answer

An availability set with two fault domains

Answer

A managed disk snapshot restored as the operating system disk

Question 8

A team has an approved Windows VM that already includes patches, a monitoring agent, and line-of-business software. They want future VMs to start from that same build. What should they use?

Accepted Answer

A custom image. A custom image captures the exact state of a VM, including installed patches, monitoring agents, and line-of-business software, allowing you to create multiple identical VMs from that golden image. Unlike a snapshot, which is tied to a specific disk and requires manual steps to create a VM, a custom image is stored as a managed image resource that can be used directly during VM provisioning via the Azure portal, CLI, or ARM templates.

Answer

A snapshot of the OS disk

Answer

An availability set

Answer

A larger VM size

Question 9

A data disk was accidentally deleted from a production VM. The team has a snapshot of that disk from the previous night and wants the fastest Azure-side recovery path with the least risk of overwriting the existing OS disk. What should the administrator do first?

Accepted Answer

Create a new managed disk from the snapshot, then attach that disk to the VM.. Option B is correct because creating a new managed disk from the snapshot and attaching it to the VM is the fastest Azure-side recovery path. This approach directly reuses the existing OS disk without any risk of overwriting it, and the new data disk can be attached within minutes using the Azure portal, CLI, or PowerShell. It avoids any downtime for the VM beyond the brief attach operation.

Answer

Restore the entire virtual machine from the snapshot and overwrite the current instance.

Answer

Convert the snapshot into a temporary storage account and copy the files back manually.

Answer

Recreate the VM from the same marketplace image and restore only the deleted disk later.

Question 10

A DevOps engineer must run an Azure CLI script from a Windows VM to create resources in a specific resource group in another subscription. The script must not use a client secret or password, and access should be limited to only that resource group. Which three actions should the administrator take? Select three.

Accepted Answer

Enable a system-assigned managed identity on the source VM so the script can authenticate without stored credentials.. Option A is correct because enabling a system-assigned managed identity on the source VM allows the Azure CLI script to authenticate to Azure without storing any client secret or password. The managed identity is automatically managed by Azure AD and tied to the VM lifecycle, eliminating the need for credential management.

Answer

Create a service principal and store its client secret in a file on the VM for the script to read.

Answer

Grant Reader on the resource group because Reader permissions are sufficient for Azure CLI resource creation.

Question 11

A data disk was accidentally deleted from a VM. You have a snapshot of that disk from before the deletion. What should you create first to restore the data with minimal impact to the VM's OS disk?

Accepted Answer

A new managed disk from the snapshot. A is correct because creating a new managed disk from the snapshot is the direct and minimal-impact method to restore the deleted data disk. Once the new managed disk is created, you can attach it to the existing VM without affecting the OS disk or requiring a VM rebuild. This approach avoids any downtime beyond the brief attachment operation.

Answer

A new virtual machine

Answer

A new availability set

Answer

A larger VM size

Question 12

A developer can access an Azure Blob container from the portal using Microsoft Entra sign-in, but their custom app gets a 403 error when reading the same blob. The storage account is configured to use Azure AD authorization. What is the most likely fix?

Accepted Answer

Assign the user the Storage Blob Data Reader role on the container or storage account.. The developer can authenticate via the portal because the portal uses the user's own Microsoft Entra identity, which may have implicit permissions (e.g., via group membership or subscription-level Reader). However, the custom app must explicitly be granted the Storage Blob Data Reader role on the container or storage account to authorize data plane operations (reading blobs). Without this role assignment, the app's identity lacks the RBAC permission to perform blob read operations, resulting in a 403 error.

Answer

Assign the user the Reader role on the subscription.

Answer

Enable shared key access so the app can bypass Azure AD permissions.

Answer

Move the container to the Hot tier so Azure AD authentication can succeed.

Question 13

A managed data disk was accidentally deleted from a VM. A snapshot taken the day before is still available. Which two actions should the administrator perform to recover the data? Select two.

Accepted Answer

Create a new managed disk from the snapshot.. Option A is correct because a snapshot is a point-in-time, read-only copy of a managed disk. To recover the data, you must create a new managed disk from the snapshot using the `az disk create --source` command or the Azure portal. This new disk will contain the exact data as it existed when the snapshot was taken.

Answer

Mount the snapshot directly as a data disk.

Answer

Redeploy the VM and reinstall the operating system.

Answer

Delete the snapshot after verifying it exists.

Question 14

You need to ensure engineers cannot delete a production resource group, but they must still be able to start and stop VMs and change network rules during maintenance. Which resource lock should you apply to the resource group?

Accepted Answer

CanNotDelete. The CanNotDelete lock prevents deletion of the resource group while allowing all other operations, including starting/stopping VMs and modifying network rules. This meets the requirement because engineers retain full management capabilities except for deletion, which is explicitly blocked at the resource group scope.

Answer

No lock

Answer

ReadOnly

Answer

Azure Policy deny assignment

Question 15

A media company stores project video assets in Azure Blob Storage. The business requires the data to survive a single availability zone outage in the primary region. In addition, if the primary region becomes unavailable, operations staff must still be able to read the most recently replicated copy from the secondary region right away, even if writes are temporarily unavailable. Which redundancy option best meets this requirement?

Accepted Answer

RA-GZRS. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is correct because it combines zone-redundant storage (ZRS) within the primary region to survive a single availability zone outage, and geo-redundant storage (GRS) to replicate data to a secondary region. The 'RA' prefix enables read access to the secondary region immediately after a primary region failure, allowing operations staff to read the most recently replicated copy even if writes are temporarily unavailable.

Answer

ZRS

Answer

GZRS

Answer

RA-GRS