AZ-104 Practice Test 49 — 15 Questions

Question 1

Your organization requires all storage accounts to allow access only from selected networks. You need a governance solution that automatically corrects noncompliant new storage accounts when possible instead of only reporting them. What policy effect should you choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

DeployIfNotExists. The DeployIfNotExists policy effect is correct because it can automatically remediate noncompliant storage accounts by deploying a network rules configuration that restricts access to selected networks. Unlike Audit, which only reports compliance status, DeployIfNotExists actively modifies the resource to meet the policy requirement when possible, aligning with the need for automatic correction.

Answer

Audit

Answer

Disabled

Answer

Append

Question 2

A platform team runs an internal automation tool that must restart VMs and read network interface settings in one resource group. Built-in roles available to the team are broader than the access they want to grant. What should the administrator create?

Accepted Answer

A custom role with only the required compute and read permissions, assigned at the resource group scope.. The team needs only specific actions (restart VMs and read network interface settings) within a single resource group. Creating a custom role with only the required compute and read permissions, assigned at the resource group scope, follows the principle of least privilege and avoids granting broader access than necessary. Built-in roles like Contributor or Network Contributor include extra permissions (e.g., write, delete) that are not needed.

Answer

The Contributor role assigned at the subscription scope.

Answer

The Reader role assigned at the resource group scope.

Answer

The Network Contributor role assigned at the resource group scope.

Question 3

A legacy application still authenticates to Azure Blob Storage by using the account key. Security now requires preventing any new requests that use shared key authorization, while leaving the storage account itself and Microsoft Entra-based access unchanged. Which setting should the administrator enable?

Accepted Answer

Disable shared key access on the storage account. Disabling shared key access on the storage account enforces that all incoming requests must use Microsoft Entra ID (formerly Azure AD) authorization instead of the account key. This directly meets the security requirement to block new requests using shared key authorization while leaving the storage account itself and Entra-based access unchanged. The setting is available under the storage account's Configuration blade as 'Allow storage account key access'.

Answer

Rotate the storage account keys every 24 hours

Answer

Require secure transfer for the storage account

Answer

Create a private endpoint for the storage account

Question 4

Help desk staff must start, stop, and restart virtual machines in one application resource group. They must not create or delete VMs or modify networking or disks. Which built-in role should you assign?

Accepted Answer

Virtual Machine Operator. The Virtual Machine Operator role allows starting, stopping, and restarting virtual machines, but explicitly denies creating, deleting, or modifying VMs, networking, or disks. This matches the help desk staff's required permissions exactly, making it the correct built-in role for this scenario.

Answer

Reader

Answer

Virtual Machine Contributor

Answer

Contributor

Question 5

Based on the exhibit, what should the administrator configure so the alert sends email and SMS when CPU stays above the threshold?

Accepted Answer

Associate an Azure Monitor action group with the alert rule.. An Azure Monitor action group defines the notification channels (e.g., email, SMS) and actions to trigger when an alert fires. Associating an action group with the alert rule enables the administrator to send both email and SMS when the CPU threshold is breached. Without an action group, the alert rule can only log the condition but cannot deliver notifications.

Answer

Create a diagnostic setting on the virtual machine and send metrics to a Log Analytics workspace.

Answer

Enable boot diagnostics on the virtual machine so the CPU threshold can be reported.

Answer

Apply a resource lock to the virtual machine to prevent the CPU from increasing further.

Question 6

A reporting application stores files in Azure Blob Storage. The business wants the secondary region to be readable if the primary region becomes unavailable. Which redundancy option should you use?

Accepted Answer

RA-GRS, because it provides geo-replication with read access to the secondary endpoint.. (RA-GRS) is correct because it provides geo-replication by asynchronously copying data to a secondary region and enables read access to that secondary endpoint. If the primary region becomes unavailable, the application can continue reading from the secondary region, meeting the business requirement for readable secondary access during a primary outage.

Answer

LRS, because it stores all copies in one region only.

Answer

ZRS, because it replicates across availability zones.

Answer

Archive, because archived blobs are stored cheaply for long-term retention.

Question 7

A storage account has public network access disabled. An app in a VNet must read and write blobs privately, and the team wants the blob endpoint name to resolve to a private IP without exposing the service publicly. What should the administrator configure?

Accepted Answer

A private endpoint for the storage account and a private DNS zone for blob name resolution.. A private endpoint assigns the storage account a private IP from the VNet, ensuring all traffic to the blob endpoint stays within Microsoft's backbone. A private DNS zone (e.g., `privatelink.blob.core.windows.net`) is required so that the blob endpoint name resolves to that private IP instead of the public IP, meeting the requirement for private name resolution without any public exposure.

Answer

A service endpoint on the subnet and a storage firewall allow rule.

Answer

A public IP address for the app and allow access from that IP in the storage firewall.

Answer

An NSG rule that allows outbound TCP 443 from the app subnet to storage.

Question 8

A legal team stores scanned contracts in Blob Archive. Auditors will need to open several files next week for about five days and then the documents should return to the lowest practical storage cost. Which two actions should the administrator plan? Select two.

Accepted Answer

Initiate a rehydration to the Cool tier before the review window.. Blobs in the Archive tier are offline and cannot be read directly; they must first be rehydrated to a hot or cool tier. Rehydrating to the Cool tier is appropriate for a five-day access window and avoids the higher cost of the Hot tier. After the review, moving the blobs back to Archive (Option D) ensures the lowest practical storage cost for long-term retention.

Answer

Download the blobs directly from Archive with a normal read operation.

Answer

Set the blobs to the Hot tier permanently as soon as the review starts.

Answer

Change the storage account redundancy to RA-GRS so the files can be read.

Question 9

Your company wants to know when an Azure service outage in the region might affect subscribed resources, even if no metric threshold has been crossed yet. Which alert type should you configure?

Accepted Answer

A Service Health alert. Service Health alerts are designed to notify you about Azure service incidents, maintenance, health advisories, and security advisories that may impact your subscribed resources. Unlike metric alerts, they trigger based on Azure's own health status rather than any metric threshold you configure, making them ideal for detecting region-wide outages before they affect your specific metrics.

Answer

A metric alert

Answer

A budget alert

Answer

A boot diagnostics alert

Question 10

A support engineer finds a blob that was moved to the Archive tier by a lifecycle rule and must download it today. Which two actions are required before the blob can be read? Select two.

Accepted Answer

Change the blob access tier from Archive to Hot or Cool.. A blob in the Archive tier is offline and cannot be read directly. You must change its access tier to Hot or Cool (a process called rehydration) to make it available for download. This tier change initiates an asynchronous operation that moves the blob from the archived state to an online tier.

Answer

Download the blob directly from Archive without any tier change.

Answer

Disable the lifecycle management policy for the storage account.

Answer

Create a new container and copy the archived blob into it.

Question 11

A subnet NSG contains a deny inbound rule for TCP 3389 from Any at priority 100 and an allow inbound rule for TCP 3389 from 10.4.1.0/24 at priority 200. Admin workstations in 10.4.1.0/24 cannot connect by RDP. What change should the administrator make?

Accepted Answer

Lower the allow rule priority number so it is evaluated before the deny rule.. NSG rules are evaluated in priority order, with lower numbers having higher priority. The deny rule at priority 100 blocks all TCP 3389 traffic from Any, and the allow rule at priority 200 is never reached. Lowering the allow rule's priority number (e.g., to 90) ensures it is evaluated before the deny rule, allowing RDP traffic from 10.4.1.0/24.

Answer

Replace the source IP range with an application security group in the allow rule.

Answer

Change the protocol from TCP to Any in the allow rule.

Answer

Add a user-defined route to the subnet so RDP traffic bypasses the NSG.

Question 12

An application team needs Contributor access only for the resources in rg-app. They must not manage any other resources in the subscription. At what scope should you assign the role?

Accepted Answer

Resource group scope. The Contributor role assigned at the resource group scope grants the application team full management access to all resources within rg-app, but no access to resources in other resource groups or at the subscription level. This meets the requirement of restricting permissions to only that specific resource group.

Answer

Management group scope

Answer

Subscription scope

Answer

Resource scope

Question 13

A web app in VNet1 must access a storage account by using a private IP address, and the storage account has public network access disabled. The app resolves the storage FQDN from inside the VNet. What should you deploy?

Accepted Answer

A private endpoint for the storage account and the required private DNS zone linkage.. A private endpoint assigns the storage account a private IP address from the VNet, enabling access via a private IP while public network access is disabled. The required private DNS zone linkage ensures the storage FQDN resolves to that private IP from within the VNet, meeting both requirements.

Answer

A service endpoint on the subnet so the storage account gets a private IP.

Answer

A storage account firewall rule that allows the VNet and a public DNS record update.

Answer

A SAS token created for the application service principal.

Question 14

A subscription must block creation of resources in any region except East US and West US, and the security team also wants a nonblocking report of existing resources that are missing a CostCenter tag. Which two Azure Policy effects should you use? Select two.

Accepted Answer

Deny. Deny is correct because it actively blocks resource creation in regions outside East US and West US by evaluating the location property against an allowed list and rejecting non-compliant requests at deployment time. Audit is correct because it logs a compliance event for existing resources missing the CostCenter tag without blocking any operations, providing a nonblocking report for the security team.

Answer

Modify

Answer

DeployIfNotExists

Answer

Disabled

Question 15

You have a storage account that stores infrequently accessed data that must remain available immediately when requested. You need to minimize storage costs. Which access tier should you use?

Accepted Answer

Cool. The Cool access tier is designed for data that is infrequently accessed but still requires immediate availability when requested, offering lower storage costs than the Hot tier while maintaining low latency access. Since the data must remain available immediately, the Archive tier is unsuitable due to its multi-hour retrieval latency, and the Premium tier is optimized for high-performance scenarios, not cost minimization.

Answer

Premium

Answer

Hot

Answer