AZ-104 Practice Test 5 — 10 Questions

Question 1

Order the steps to set up Azure Site Recovery for on-premises to Azure.

Accepted Answer

Step 1: Create a Recovery Services vault, Step 2: Configure source and target settings, Step 3: Install the Mobility service agent on on-premises machines, Step 4: Enable replication, Step 5: Test failover. The correct sequence for setting up Azure Site Recovery for on-premises to Azure is: create a Recovery Services vault, configure source and target settings, install the Mobility service agent on on-premises machines, enable replication, and then test failover. This order ensures prerequisites are met and replication is active before testing.

Answer

Step 1: Install the Mobility service agent on on-premises machines, Step 2: Create a Recovery Services vault, Step 3: Configure source and target settings, Step 4: Enable replication, Step 5: Test failover

Answer

Step 1: Create a Recovery Services vault, Step 2: Configure source and target settings, Step 3: Enable replication, Step 4: Install the Mobility service agent on on-premises machines, Step 5: Test failover

Answer

Step 1: Create a Recovery Services vault, Step 2: Configure source and target settings, Step 3: Install the Mobility service agent on on-premises machines, Step 4: Test failover, Step 5: Enable replication

Question 2

Arrange the steps to create an Azure Storage account with a container and upload a blob.

Accepted Answer

Create storage account → Create container → Set access level → Upload blob → Generate SAS. Create storage account, create container, set access, upload blob, generate SAS.

Answer

Create container → Create storage account → Set access level → Upload blob → Generate SAS

Answer

Create storage account → Upload blob → Create container → Set access level → Generate SAS

Answer

Create storage account → Create container → Upload blob → Set access level → Generate SAS

Question 3

Based on the exhibit, what should the administrator do so VM-B resolves the storage account name to the private IP address?

Accepted Answer

Link the private DNS zone to VNet-B.. The private DNS zone for the storage account must be linked to VNet-B so that VM-B can resolve the storage account's fully qualified domain name (FQDN) to the private IP address of the private endpoint. Without this link, the DNS resolution will fall back to the public endpoint, bypassing the private connectivity. Linking the zone ensures Azure's default DNS servers return the private IP for the storage account within VNet-B.

Answer

Create a service endpoint on VNet-B and leave DNS unchanged.

Answer

Assign a public IP address to the private endpoint.

Answer

Add a route table with a next hop to the storage account.

Question 4

Based on the exhibit, a policy assigned at the subscription denies storage accounts that allow public network access. One existing storage account in RG-Legacy must remain publicly reachable for 30 days while a migration is completed. What should the administrator use?

Accepted Answer

Create a policy exemption for stlegacy01 at the resource scope.. A policy exemption at the resource scope is the correct approach because it allows the administrator to selectively exclude the specific storage account (stlegacy01) from the subscription-level policy that denies public network access. This exemption can be configured with an expiration date of 30 days, ensuring the legacy account remains publicly reachable during the migration while the policy continues to apply to all other resources. Policy exemptions are designed for exactly this scenario—temporary exceptions for compliance or migration needs—without altering the policy definition or assignment.

Answer

Remove the policy assignment from the subscription until the migration finishes.

Answer

Change the policy effect from Deny to Audit.

Answer

Move the legacy storage account to a separate subscription and assign the policy there.

Question 5

A customer-facing service needs to survive a single datacenter outage in a zone-supported region. You do not need cross-region failover, but you do need Azure to spread instances without manual placement errors. Which two deployment choices satisfy that goal? Select two.

Accepted Answer

Place the VMs in different availability zones within the same region.. Availability zones are physically separate datacenters within a region, each with independent power, cooling, and networking. Placing VMs in different zones ensures that a single datacenter outage does not affect all instances, meeting the survivability requirement without manual placement errors. Azure automatically distributes VMs across selected zones, eliminating human error in instance placement.

Answer

Use an availability set and expect it to cover a zone outage.

Answer

Keep all instances in one zone and rely on the load balancer.

Answer

Use a paired region for automatic in-region zone balancing.

Question 6

A contractor must import data into one blob container for six hours. The contractor should not receive the storage account key, and access must be limited to that container only. Which credential should the administrator generate?

Accepted Answer

A user delegation SAS, because it is signed with Microsoft Entra credentials and is time limited.. A user delegation SAS is signed with Microsoft Entra credentials (formerly Azure AD) and can be scoped to a specific blob container with a time limit. This meets the requirement of granting the contractor access only to that container for six hours without exposing the storage account key.

Answer

A storage account access key, because it can be copied into the import tool.

Answer

A shared key connection string, because it works with any tool that needs blob access.

Answer

A managed identity token, because the contractor can use it outside Azure directly.

Question 7

A customer wants official information about whether an Azure service issue is affecting their subscription or the wider Azure platform. Which two sources should they check? Select two.

Accepted Answer

Azure Service Health. Azure Service Health (B) provides personalized alerts and guidance when Azure service issues affect your subscription, including planned maintenance and health advisories. Azure Status (D) offers a global view of the health of all Azure services across regions, which is the official source for widespread platform issues. Together, they cover both subscription-specific and platform-wide service incidents.

Answer

Azure Advisor

Answer

Backup center

Answer

Resource Graph

Question 8

A finance application is deployed in a single resource group named rg-finance-app. The team must manage only the resources in that group and must not receive permissions for other resource groups in the subscription. Where should the Contributor role be assigned?

Accepted Answer

At the rg-finance-app resource group scope.. The Contributor role must be assigned at the rg-finance-app resource group scope to restrict permissions exclusively to that group. This ensures the team can manage only the resources within that resource group, without inheriting permissions to other resource groups in the subscription. Role assignments in Azure are inherited from higher scopes (management group, subscription) down to lower scopes, so assigning at the resource group scope is the most specific and restrictive level that meets the requirement.

Answer

At the management group that contains the subscription.

Answer

At the subscription scope.

Answer

At each individual resource in the resource group.

Question 9

A company wants to peer a new spoke virtual network to an existing hub VNet. The hub uses 10.40.0.0/16, and the new spoke was created with 10.40.128.0/17 because that range seemed available in the branch office plan. Peering creation fails. What should the administrator do?

Accepted Answer

Change the spoke VNet to a non-overlapping address space before peering.. VNet peering requires that the address spaces of the peered virtual networks do not overlap. The hub uses 10.40.0.0/16, and the spoke uses 10.40.128.0/17, which is a subset of the hub’s range. Azure blocks peering when there is any overlap to prevent routing conflicts. The correct fix is to change the spoke VNet to a non-overlapping address space, such as a different RFC 1918 range like 10.1.0.0/16, before attempting to peer.

Answer

Add a second address prefix to the spoke VNet and keep the overlapping range.

Answer

Enable gateway transit on the hub VNet before retrying peering.

Answer

Create custom DNS records for the spoke VNet so the address ranges no longer conflict.

Question 10

Before changing a production VM's data disk, you want a point-in-time copy that can be restored later without affecting the VM. What should you create?

Accepted Answer

Snapshot. A snapshot captures a point-in-time, read-only copy of a managed or unmanaged disk. It can be used to create a new disk or restore the original disk without affecting the running VM, making it the correct choice for a non-disruptive backup before a data disk change.

Answer

Availability set

Answer

Azure Policy assignment

Answer

Virtual network peering