AZ-104 Practice Test 48 — 15 Questions

Question 1

Based on the exhibit, where should the Network Contributor role be assigned so the engineer can manage only VNet-vm and its subnets, but not other resources in rg-platform?

Accepted Answer

Assign Network Contributor at the VNet-vm resource scope.. Assigning the Network Contributor role at the VNet-vm resource scope grants the engineer permissions to manage only that specific virtual network and its subnets, while preventing any access to other resources within the rg-platform resource group. This follows the principle of least privilege by scoping the role assignment to the exact resource that needs to be managed.

Answer

Assign Network Contributor at the management group scope.

Answer

Assign Network Contributor at the subscription scope.

Answer

Assign Network Contributor at the resource group scope for rg-platform.

Question 2

An archive of legal documents is accessed only a few times each month, but when someone needs a document it must open immediately without a rehydration wait. Which access tier should be used?

Accepted Answer

Cool tier. The Cool tier is designed for data that is infrequently accessed but must be available immediately when needed, with a lower storage cost than Hot tier but higher access costs. Since the archive is accessed only a few times per month and requires instant retrieval without rehydration delay, Cool tier meets both requirements, whereas Archive tier would impose a rehydration wait of up to 15 hours.

Answer

Hot tier

Answer

Archive tier

Answer

Geo-redundant storage (GRS)

Question 3

Based on the exhibit, what should the administrator do so the hub and spoke can be peered successfully?

Accepted Answer

Change the spoke VNet to a non-overlapping address space.. VNet peering requires that the address spaces of the peered VNets do not overlap. Overlapping IP ranges cause routing conflicts and prevent successful peering. Changing the spoke VNet to a non-overlapping address space resolves this issue and allows the peering to be established.

Answer

Keep the current ranges and enable gateway transit on the peering.

Answer

Add another subnet inside the spoke VNet and reuse the current address space.

Answer

Create a network security group on the spoke subnet before peering.

Question 4

A virtual machine is already protected by Azure Backup. The current policy runs daily at 23:00 and keeps daily recovery points for 30 days. The business now wants the same schedule but wants new daily recovery points retained for 90 days. No new vault or re-registration should occur. What should the administrator do?

Accepted Answer

Edit the existing backup policy and change the daily retention for future recovery points.. Azure Backup allows you to modify an existing backup policy to change the retention duration for future recovery points without creating a new vault or re-registering the VM. By editing the policy and setting the daily retention to 90 days, all new daily recovery points will be retained for the longer period, while existing recovery points remain unaffected by the change.

Answer

Create a new Recovery Services vault and enable backup again with the longer retention period.

Answer

Take nightly managed disk snapshots because snapshots automatically inherit the Recovery Services vault retention period.

Answer

Change the vault redundancy setting to increase the number of retained recovery points.

Question 5

A company has a hub VNet and two peered spoke VNets, AppSpoke and DataSpoke. Both spokes can reach on-premises networks through the hub gateway. The app VM in AppSpoke must connect privately to the data VM in DataSpoke without using the internet or sending traffic on-premises first. What should the administrator do?

Accepted Answer

Create a direct VNet peering between AppSpoke and DataSpoke.. A direct VNet peering between AppSpoke and DataSpoke establishes a private, low-latency connection between the two VNets without routing traffic through the hub gateway or on-premises networks. This satisfies the requirement for a private connection that does not use the internet or traverse on-premises, as VNet peering uses the Microsoft backbone infrastructure.

Answer

Add an NSG rule that allows traffic from AppSpoke to DataSpoke.

Answer

Enable gateway transit on both spoke peerings.

Answer

Add a user-defined route in AppSpoke pointing DataSpoke traffic to the hub gateway.

Question 6

Based on the exhibit, which Azure Policy effect should be used so new resources without an Environment tag are blocked at deployment time?

Accepted Answer

Deny. The Deny effect (Option C) is the correct choice because it actively blocks any deployment that does not meet the policy rule—in this case, resources lacking an Environment tag. When a policy with Deny is assigned, Azure Resource Manager evaluates the request during deployment and rejects it with a 403 (Forbidden) status if the condition is not satisfied, preventing the resource from being created entirely.

Answer

Audit

Answer

Append

Answer

Disabled

Question 7

Based on the exhibit, which Azure construct should the administrator create to group these related policy rules into one assignment?

Accepted Answer

Azure Policy initiative. An Azure Policy initiative is a collection of policy definitions designed to group related policies into a single assignable unit. This allows the administrator to apply multiple policy rules together for consistent governance across resources, which is exactly what the question describes.

Answer

Resource lock

Answer

Azure RBAC custom role

Answer

Policy exemption

Question 8

A platform team must enforce two governance rules across every current and future subscription under a management group: only East US and West US deployments are allowed, and every resource must include an Environment tag. Which three actions should the administrator take? Select three.

Accepted Answer

Create a policy initiative that groups the governance requirements.. A policy initiative (also known as a policy set) allows you to group multiple individual Azure Policy definitions into a single, reusable governance package. This simplifies assignment and ensures both the allowed locations and required tag policies are enforced together consistently across all subscriptions under the management group.

Answer

Assign the policies separately to each existing subscription only.

Answer

Use an RBAC Contributor role to enforce region and tag compliance.

Question 9

A web application on a VM is failing on TCP 8443. The administrator wants to capture packets on the VM NIC to inspect retransmissions and handshake details after the test run. Which Network Watcher capability should be used?

Accepted Answer

Packet capture. Packet capture in Network Watcher allows you to capture network traffic to and from a VM, including TCP retransmissions and handshake details (SYN, SYN-ACK, ACK). This is the correct tool for inspecting raw packets after a test run to diagnose issues like failed connections on TCP 8443.

Answer

IP flow verify

Answer

Connection troubleshoot

Answer

Effective routes

Question 10

A DevOps pipeline runs on an on-premises build server and must deploy ARM templates to a resource group in Azure without using a user password. The server is not in Azure, so managed identity is not available. What should the administrator create?

Accepted Answer

A service principal for the pipeline, with certificate-based or federated authentication.. The on-premises build server cannot use Azure managed identities (which require an Azure resource). Instead, a service principal with certificate-based or federated authentication provides a secure, passwordless identity for the pipeline to authenticate to Microsoft Entra ID and deploy ARM templates. This aligns with the principle of using Microsoft Entra ID application credentials for non-Azure workloads.

Answer

A system-assigned managed identity on the build server.

Answer

A user-assigned managed identity attached to the on-premises server.

Answer

A shared access signature for the target resource group.

Question 11

An analytics team stores exported reports in a storage account. They want the data to survive a zone failure and a regional outage, and if the primary region becomes unavailable they also want read-only access to the replica while failover is being planned. Which redundancy option should you select?

Accepted Answer

RA-GZRS. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is correct because it combines zone-redundant storage (ZRS) within the primary region with geo-redundant replication to a secondary region, and crucially provides read-only access to the secondary replica even when the primary region is available. This meets the requirement for data survival during both a zone failure and a regional outage, while allowing read-only access to the replica during failover planning.

Answer

GZRS

Answer

RA-GRS

Answer

ZRS

Question 12

Based on the exhibit, what should the administrator check first to resolve the backup failure for the Azure VM?

Accepted Answer

Verify that the Azure VM Agent is installed and running on the VM.. The Azure VM backup failure is most commonly caused by the Azure VM Agent (also known as the Windows Guest Agent or Linux Agent) not being installed, outdated, or in a non-responsive state. The backup extension relies on the VM Agent to execute snapshots and coordinate with the Azure Backup service; without a healthy agent, the backup process cannot initiate. Therefore, verifying the agent's installation and status is the first troubleshooting step.

Answer

Increase the backup retention period in the vault policy.

Answer

Move the VM to a different availability zone.

Answer

Change the storage account redundancy to ZRS.

Question 13

You need to collect performance counters and event logs from multiple Azure virtual machines and query the data centrally by using Kusto Query Language. Which Azure resource should you deploy?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the correct Azure resource because it ingests performance counters and event logs from Azure virtual machines via the Azure Monitor agent or the legacy Log Analytics agent, and stores them in a centralized repository. You can then query this data using Kusto Query Language (KQL) to perform real-time analysis, troubleshooting, and reporting across multiple VMs.

Answer

A Recovery Services vault

Answer

Azure Network Watcher

Answer

A load balancer

Question 14

A data-processing app reads blobs immediately after upload, and operations do not want any rehydration delay. Which three access tiers can be read directly? Select three.

Accepted Answer

Hot. The Hot, Cool, and Cold access tiers are designed for online data access, meaning blobs stored in these tiers can be read immediately without any rehydration delay. This is because the data is always stored on high-throughput, low-latency media and is immediately available for read operations. In contrast, the Archive tier requires a rehydration process (which can take hours) before data can be accessed, making it unsuitable for scenarios where blobs must be read immediately after upload.

Answer