AZ-104 Practice Test 49 — 15 Questions

Question 1

Based on the exhibit, what should the administrator check first to resolve the backup failure for the Azure VM?

Accepted Answer

Verify that the Azure VM Agent is installed and running on the VM.. The Azure VM backup failure is most commonly caused by the Azure VM Agent (also known as the Windows Guest Agent or Linux Agent) not being installed, outdated, or in a non-responsive state. The backup extension relies on the VM Agent to execute snapshots and coordinate with the Azure Backup service; without a healthy agent, the backup process cannot initiate. Therefore, verifying the agent's installation and status is the first troubleshooting step.

Answer

Increase the backup retention period in the vault policy.

Answer

Move the VM to a different availability zone.

Answer

Change the storage account redundancy to ZRS.

Question 2

You need to collect performance counters and event logs from multiple Azure virtual machines and query the data centrally by using Kusto Query Language. Which Azure resource should you deploy?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the correct Azure resource because it ingests performance counters and event logs from Azure virtual machines via the Azure Monitor agent or the legacy Log Analytics agent, and stores them in a centralized repository. You can then query this data using Kusto Query Language (KQL) to perform real-time analysis, troubleshooting, and reporting across multiple VMs.

Answer

A Recovery Services vault

Answer

Azure Network Watcher

Answer

A load balancer

Question 3

A data-processing app reads blobs immediately after upload, and operations do not want any rehydration delay. Which three access tiers can be read directly? Select three.

Accepted Answer

Hot. The Hot, Cool, and Cold access tiers are designed for online data access, meaning blobs stored in these tiers can be read immediately without any rehydration delay. This is because the data is always stored on high-throughput, low-latency media and is immediately available for read operations. In contrast, the Archive tier requires a rehydration process (which can take hours) before data can be accessed, making it unsuitable for scenarios where blobs must be read immediately after upload.

Answer

Archive

Answer

Premium

Question 4

Based on the exhibit, which restore option should the administrator use to recover only the deleted file while keeping the VM online?

Accepted Answer

Use File Recovery from the Recovery Services vault.. Azure Backup's File Recovery feature allows you to mount a recovery point as a drive on the VM, enabling you to browse and restore individual files without affecting the running VM. This avoids the need to restore the entire VM or take it offline, which is essential for recovering only the deleted file while maintaining availability.

Answer

Restore the entire virtual machine to the latest recovery point.

Answer

Redeploy the VM from the original image.

Answer

Disable backup protection and then re-enable it.

Question 5

Your organization requires all storage accounts to allow access only from selected networks. You need a governance solution that automatically corrects noncompliant new storage accounts when possible instead of only reporting them. What policy effect should you choose?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists policy effect is correct because it can automatically remediate noncompliant storage accounts by deploying a network rules configuration that restricts access to selected networks. Unlike Audit, which only reports compliance status, DeployIfNotExists actively modifies the resource to meet the policy requirement when possible, aligning with the need for automatic correction.

Answer

Audit

Answer

Disabled

Answer

Append

Question 6

A platform team runs an internal automation tool that must restart VMs and read network interface settings in one resource group. Built-in roles available to the team are broader than the access they want to grant. What should the administrator create?

Accepted Answer

A custom role with only the required compute and read permissions, assigned at the resource group scope.. The team needs only specific actions (restart VMs and read network interface settings) within a single resource group. Creating a custom role with only the required compute and read permissions, assigned at the resource group scope, follows the principle of least privilege and avoids granting broader access than necessary. Built-in roles like Contributor or Network Contributor include extra permissions (e.g., write, delete) that are not needed.

Answer

The Contributor role assigned at the subscription scope.

Answer

The Reader role assigned at the resource group scope.

Answer

The Network Contributor role assigned at the resource group scope.

Question 7

A legacy application still authenticates to Azure Blob Storage by using the account key. Security now requires preventing any new requests that use shared key authorization, while leaving the storage account itself and Microsoft Entra-based access unchanged. Which setting should the administrator enable?

Accepted Answer

Disable shared key access on the storage account. Disabling shared key access on the storage account enforces that all incoming requests must use Microsoft Entra ID (formerly Azure AD) authorization instead of the account key. This directly meets the security requirement to block new requests using shared key authorization while leaving the storage account itself and Entra-based access unchanged. The setting is available under the storage account's Configuration blade as 'Allow storage account key access'.

Answer

Rotate the storage account keys every 24 hours

Answer

Require secure transfer for the storage account

Answer

Create a private endpoint for the storage account

Question 8

Help desk staff must start, stop, and restart virtual machines in one application resource group. They must not create or delete VMs or modify networking or disks. Which built-in role should you assign?

Accepted Answer

Virtual Machine Operator. The Virtual Machine Operator role allows starting, stopping, and restarting virtual machines, but explicitly denies creating, deleting, or modifying VMs, networking, or disks. This matches the help desk staff's required permissions exactly, making it the correct built-in role for this scenario.

Answer

Reader

Answer

Virtual Machine Contributor

Answer

Contributor

Question 9

Based on the exhibit, what should the administrator configure so the alert sends email and SMS when CPU stays above the threshold?

Accepted Answer

Associate an Azure Monitor action group with the alert rule.. An Azure Monitor action group defines the notification channels (e.g., email, SMS) and actions to trigger when an alert fires. Associating an action group with the alert rule enables the administrator to send both email and SMS when the CPU threshold is breached. Without an action group, the alert rule can only log the condition but cannot deliver notifications.

Answer

Create a diagnostic setting on the virtual machine and send metrics to a Log Analytics workspace.

Answer

Enable boot diagnostics on the virtual machine so the CPU threshold can be reported.

Answer

Apply a resource lock to the virtual machine to prevent the CPU from increasing further.

Question 10

A reporting application stores files in Azure Blob Storage. The business wants the secondary region to be readable if the primary region becomes unavailable. Which redundancy option should you use?

Accepted Answer

RA-GRS, because it provides geo-replication with read access to the secondary endpoint.. (RA-GRS) is correct because it provides geo-replication by asynchronously copying data to a secondary region and enables read access to that secondary endpoint. If the primary region becomes unavailable, the application can continue reading from the secondary region, meeting the business requirement for readable secondary access during a primary outage.

Answer

LRS, because it stores all copies in one region only.

Answer

ZRS, because it replicates across availability zones.

Answer

Archive, because archived blobs are stored cheaply for long-term retention.

Question 11

A storage account has public network access disabled. An app in a VNet must read and write blobs privately, and the team wants the blob endpoint name to resolve to a private IP without exposing the service publicly. What should the administrator configure?

Accepted Answer

A private endpoint for the storage account and a private DNS zone for blob name resolution.. A private endpoint assigns the storage account a private IP from the VNet, ensuring all traffic to the blob endpoint stays within Microsoft's backbone. A private DNS zone (e.g., `privatelink.blob.core.windows.net`) is required so that the blob endpoint name resolves to that private IP instead of the public IP, meeting the requirement for private name resolution without any public exposure.

Answer

A service endpoint on the subnet and a storage firewall allow rule.

Answer

A public IP address for the app and allow access from that IP in the storage firewall.

Answer

An NSG rule that allows outbound TCP 443 from the app subnet to storage.

Question 12

A legal team stores scanned contracts in Blob Archive. Auditors will need to open several files next week for about five days and then the documents should return to the lowest practical storage cost. Which two actions should the administrator plan? Select two.

Accepted Answer

Initiate a rehydration to the Cool tier before the review window.. Blobs in the Archive tier are offline and cannot be read directly; they must first be rehydrated to a hot or cool tier. Rehydrating to the Cool tier is appropriate for a five-day access window and avoids the higher cost of the Hot tier. After the review, moving the blobs back to Archive (Option D) ensures the lowest practical storage cost for long-term retention.

Answer

Download the blobs directly from Archive with a normal read operation.

Answer

Set the blobs to the Hot tier permanently as soon as the review starts.

Answer

Change the storage account redundancy to RA-GRS so the files can be read.

Question 13

Your company wants to know when an Azure service outage in the region might affect subscribed resources, even if no metric threshold has been crossed yet. Which alert type should you configure?

Accepted Answer

A Service Health alert. Service Health alerts are designed to notify you about Azure service incidents, maintenance, health advisories, and security advisories that may impact your subscribed resources. Unlike metric alerts, they trigger based on Azure's own health status rather than any metric threshold you configure, making them ideal for detecting region-wide outages before they affect your specific metrics.

Answer

A metric alert

Answer

A budget alert

Answer

A boot diagnostics alert

Question 14

A support engineer finds a blob that was moved to the Archive tier by a lifecycle rule and must download it today. Which two actions are required before the blob can be read? Select two.

Accepted Answer

Change the blob access tier from Archive to Hot or Cool.. A blob in the Archive tier is offline and cannot be read directly. You must change its access tier to Hot or Cool (a process called rehydration) to make it available for download. This tier change initiates an asynchronous operation that moves the blob from the archived state to an online tier.

Answer

Download the blob directly from Archive without any tier change.

Answer

Disable the lifecycle management policy for the storage account.

Answer

Create a new container and copy the archived blob into it.

Question 15

A subnet NSG contains a deny inbound rule for TCP 3389 from Any at priority 100 and an allow inbound rule for TCP 3389 from 10.4.1.0/24 at priority 200. Admin workstations in 10.4.1.0/24 cannot connect by RDP. What change should the administrator make?

Accepted Answer

Lower the allow rule priority number so it is evaluated before the deny rule.. NSG rules are evaluated in priority order, with lower numbers having higher priority. The deny rule at priority 100 blocks all TCP 3389 traffic from Any, and the allow rule at priority 200 is never reached. Lowering the allow rule's priority number (e.g., to 90) ensures it is evaluated before the deny rule, allowing RDP traffic from 10.4.1.0/24.

Answer

Replace the source IP range with an application security group in the allow rule.

Answer

Change the protocol from TCP to Any in the allow rule.

Answer

Add a user-defined route to the subnet so RDP traffic bypasses the NSG.