AZ-104 Practice Test 48 — 15 Questions

Question 1

A stateless API runs on Azure VMs and experiences unpredictable traffic spikes during the day. The administrator must automatically add or remove identical VM instances based on CPU usage, and the platform should distribute instances across fault domains without manual placement. What should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Virtual machine scale set. Virtual machine scale sets (VMSS) automatically manage identical VM instances and can scale out/in based on CPU usage metrics via autoscale rules. They distribute instances across fault domains automatically without manual placement, ensuring high availability during unpredictable traffic spikes.

Answer

Availability set

Answer

Availability zone

Answer

Proximity placement group

Question 2

Remote administrators work from home laptops and need secure access to Azure VMs in a virtual network. There is no branch office device to configure, and each administrator should connect individually using Azure-side VPN authentication. Which option should be implemented?

Accepted Answer

A point-to-site VPN connection to an Azure VPN gateway.. A point-to-site (P2S) VPN connection allows individual remote clients to connect securely to an Azure virtual network using an Azure VPN gateway. This solution requires no on-premises device, supports per-user authentication (e.g., Azure AD, certificate, or RADIUS), and is ideal for ad-hoc remote access from home laptops.

Answer

VNet peering between the administrators' home networks and Azure.

Answer

An ExpressRoute circuit from each administrator's home internet connection.

Answer

A service endpoint enabled on the VM subnet.

Question 3

A Windows VM mounts an Azure Files share by using SMB and identity-based authentication. Which two permission layers can affect access to folders in the share? Select two.

Accepted Answer

Azure RBAC permissions on the file share. Azure RBAC permissions on the file share (Option A) control whether a user or service principal can mount the share or perform management operations, such as listing or modifying share properties. When identity-based authentication is used (Kerberos or Azure AD Kerberos), RBAC roles like 'Storage File Data SMB Share Reader' or 'Contributor' are required to grant access at the share level before any file-level permissions apply.

Answer

Network security group rules on the storage account

Answer

Blob access tier settings

Answer

Route table next-hop selection

Question 4

A subnet NSG contains a deny RDP rule from Any at priority 200. The administrator must allow RDP from 10.8.0.0/24 to the virtual machines in that subnet. What should the administrator do?

Accepted Answer

Create an allow rule with a lower priority number than 200.. B is correct because NSG rules are evaluated in priority order, with lower numbers having higher priority. The existing deny rule at priority 200 blocks all RDP traffic. To allow RDP from 10.8.0.0/24, a new allow rule must be created with a priority lower than 200 (e.g., 150) so it is evaluated before the deny rule, permitting the specific traffic.

Answer

Create an allow rule with a higher priority number than 200.

Answer

Add a route table entry for TCP 3389.

Answer

Disable the default security rules on the NSG.

Question 5

Based on the exhibit, where should the Network Contributor role be assigned so the engineer can manage only VNet-vm and its subnets, but not other resources in rg-platform?

Accepted Answer

Assign Network Contributor at the VNet-vm resource scope.. Assigning the Network Contributor role at the VNet-vm resource scope grants the engineer permissions to manage only that specific virtual network and its subnets, while preventing any access to other resources within the rg-platform resource group. This follows the principle of least privilege by scoping the role assignment to the exact resource that needs to be managed.

Answer

Assign Network Contributor at the management group scope.

Answer

Assign Network Contributor at the subscription scope.

Answer

Assign Network Contributor at the resource group scope for rg-platform.

Question 6

An archive of legal documents is accessed only a few times each month, but when someone needs a document it must open immediately without a rehydration wait. Which access tier should be used?

Accepted Answer

Cool tier. The Cool tier is designed for data that is infrequently accessed but must be available immediately when needed, with a lower storage cost than Hot tier but higher access costs. Since the archive is accessed only a few times per month and requires instant retrieval without rehydration delay, Cool tier meets both requirements, whereas Archive tier would impose a rehydration wait of up to 15 hours.

Answer

Hot tier

Answer

Archive tier

Answer

Geo-redundant storage (GRS)

Question 7

Based on the exhibit, what should the administrator do so the hub and spoke can be peered successfully?

Accepted Answer

Change the spoke VNet to a non-overlapping address space.. VNet peering requires that the address spaces of the peered VNets do not overlap. Overlapping IP ranges cause routing conflicts and prevent successful peering. Changing the spoke VNet to a non-overlapping address space resolves this issue and allows the peering to be established.

Answer

Keep the current ranges and enable gateway transit on the peering.

Answer

Add another subnet inside the spoke VNet and reuse the current address space.

Answer

Create a network security group on the spoke subnet before peering.

Question 8

A virtual machine is already protected by Azure Backup. The current policy runs daily at 23:00 and keeps daily recovery points for 30 days. The business now wants the same schedule but wants new daily recovery points retained for 90 days. No new vault or re-registration should occur. What should the administrator do?

Accepted Answer

Edit the existing backup policy and change the daily retention for future recovery points.. Azure Backup allows you to modify an existing backup policy to change the retention duration for future recovery points without creating a new vault or re-registering the VM. By editing the policy and setting the daily retention to 90 days, all new daily recovery points will be retained for the longer period, while existing recovery points remain unaffected by the change.

Answer

Create a new Recovery Services vault and enable backup again with the longer retention period.

Answer

Take nightly managed disk snapshots because snapshots automatically inherit the Recovery Services vault retention period.

Answer

Change the vault redundancy setting to increase the number of retained recovery points.

Question 9

A company has a hub VNet and two peered spoke VNets, AppSpoke and DataSpoke. Both spokes can reach on-premises networks through the hub gateway. The app VM in AppSpoke must connect privately to the data VM in DataSpoke without using the internet or sending traffic on-premises first. What should the administrator do?

Accepted Answer

Create a direct VNet peering between AppSpoke and DataSpoke.. A direct VNet peering between AppSpoke and DataSpoke establishes a private, low-latency connection between the two VNets without routing traffic through the hub gateway or on-premises networks. This satisfies the requirement for a private connection that does not use the internet or traverse on-premises, as VNet peering uses the Microsoft backbone infrastructure.

Answer

Add an NSG rule that allows traffic from AppSpoke to DataSpoke.

Answer

Enable gateway transit on both spoke peerings.

Answer

Add a user-defined route in AppSpoke pointing DataSpoke traffic to the hub gateway.

Question 10

Based on the exhibit, which Azure Policy effect should be used so new resources without an Environment tag are blocked at deployment time?

Accepted Answer

Deny. The Deny effect (Option C) is the correct choice because it actively blocks any deployment that does not meet the policy rule—in this case, resources lacking an Environment tag. When a policy with Deny is assigned, Azure Resource Manager evaluates the request during deployment and rejects it with a 403 (Forbidden) status if the condition is not satisfied, preventing the resource from being created entirely.

Answer

Audit

Answer

Append

Answer

Disabled

Question 11

Based on the exhibit, which Azure construct should the administrator create to group these related policy rules into one assignment?

Accepted Answer

Azure Policy initiative. An Azure Policy initiative is a collection of policy definitions designed to group related policies into a single assignable unit. This allows the administrator to apply multiple policy rules together for consistent governance across resources, which is exactly what the question describes.

Answer

Resource lock

Answer

Azure RBAC custom role

Answer

Policy exemption

Question 12

A platform team must enforce two governance rules across every current and future subscription under a management group: only East US and West US deployments are allowed, and every resource must include an Environment tag. Which three actions should the administrator take? Select three.

Accepted Answer

Create a policy initiative that groups the governance requirements.. A policy initiative (also known as a policy set) allows you to group multiple individual Azure Policy definitions into a single, reusable governance package. This simplifies assignment and ensures both the allowed locations and required tag policies are enforced together consistently across all subscriptions under the management group.

Answer

Assign the policies separately to each existing subscription only.

Answer

Use an RBAC Contributor role to enforce region and tag compliance.

Question 13

A web application on a VM is failing on TCP 8443. The administrator wants to capture packets on the VM NIC to inspect retransmissions and handshake details after the test run. Which Network Watcher capability should be used?

Accepted Answer

Packet capture. Packet capture in Network Watcher allows you to capture network traffic to and from a VM, including TCP retransmissions and handshake details (SYN, SYN-ACK, ACK). This is the correct tool for inspecting raw packets after a test run to diagnose issues like failed connections on TCP 8443.

Answer

IP flow verify

Answer

Connection troubleshoot

Answer

Effective routes

Question 14

A DevOps pipeline runs on an on-premises build server and must deploy ARM templates to a resource group in Azure without using a user password. The server is not in Azure, so managed identity is not available. What should the administrator create?

Accepted Answer

A service principal for the pipeline, with certificate-based or federated authentication.. The on-premises build server cannot use Azure managed identities (which require an Azure resource). Instead, a service principal with certificate-based or federated authentication provides a secure, passwordless identity for the pipeline to authenticate to Azure AD and deploy ARM templates. This aligns with the principle of using Azure AD application credentials for non-Azure workloads.

Answer

A system-assigned managed identity on the build server.

Answer

A user-assigned managed identity attached to the on-premises server.

Answer

A shared access signature for the target resource group.

Question 15

An analytics team stores exported reports in a storage account. They want the data to survive a zone failure and a regional outage, and if the primary region becomes unavailable they also want read-only access to the replica while failover is being planned. Which redundancy option should you select?

Accepted Answer

RA-GZRS. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is correct because it combines zone-redundant storage (ZRS) within the primary region with geo-redundant replication to a secondary region, and crucially provides read-only access to the secondary replica even when the primary region is available. This meets the requirement for data survival during both a zone failure and a regional outage, while allowing read-only access to the replica during failover planning.

Answer

GZRS

Answer

RA-GRS

Answer

ZRS