AZ-104 Practice Test 50 — 15 Questions

Question 1

You need to collect guest operating system performance counters and Windows event logs from several Azure virtual machines into a central queryable platform. Which Azure component should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the correct Azure component for collecting guest OS performance counters and Windows event logs from Azure VMs. It serves as a central repository where diagnostic data from Azure Monitor agents (such as the Log Analytics agent or Azure Monitor Agent) is ingested, stored, and made available for querying via Kusto Query Language (KQL). This enables you to analyze performance metrics and event logs across multiple VMs in a unified, queryable platform.

Answer

A Recovery Services vault

Answer

An Azure Policy initiative

Answer

A route table

Question 2

You need to run a script inside an Azure virtual machine after deployment to install application prerequisites. Which feature should you use?

Accepted Answer

A Custom Script Extension. The Custom Script Extension (CSE) is the correct feature because it allows you to run a script inside an Azure VM after deployment, making it ideal for installing application prerequisites. CSE downloads and executes scripts on the VM, supporting both Windows (via PowerShell) and Linux (via Bash) environments, and can be applied during initial provisioning or to an existing VM.

Answer

Azure Policy

Answer

Boot diagnostics

Answer

A proximity placement group

Question 3

A managed data disk was accidentally deleted from a VM. A snapshot taken the day before is still available. Which two actions should the administrator perform to recover the data? Select two.

Accepted Answer

Create a new managed disk from the snapshot.. A snapshot is a point-in-time, read-only copy of a managed disk. To recover the data, you must create a new managed disk from the snapshot using the `az disk create --source` command or the Azure portal. This new disk will contain the exact data as it existed when the snapshot was taken.

Answer

Mount the snapshot directly as a data disk.

Answer

Redeploy the VM and reinstall the operating system.

Answer

Delete the snapshot after verifying it exists.

Question 4

VM-Web01 is connected to Subnet-Web in VNet-Prod. Users on the internet cannot access the website hosted on TCP port 443. You confirm that VM-Web01 has a public IP address and the web service is running. You need to allow inbound HTTPS traffic with the least administrative effort. What should you do?

Accepted Answer

Add an inbound NSG rule allowing TCP 443.. The VM has a public IP and the web service is running, but internet users cannot access it. The most common reason is that the Network Security Group (NSG) associated with the subnet or NIC is blocking inbound traffic. Adding an inbound NSG rule to allow TCP 443 is the least administrative effort to permit HTTPS traffic from the internet.

Answer

Create a user-defined route to the internet.

Answer

Configure VNet peering with another virtual network.

Answer

Create a private endpoint for VM-Web01.

Question 5

An enterprise has 30 Azure subscriptions. Production subscriptions need a common baseline of allowed regions, required tags, and approved SKU rules, and any new production subscription must inherit those rules automatically. Sandbox subscriptions should follow a separate, lighter baseline. Which Azure construct should the team use to organize this governance model?

Accepted Answer

A management group hierarchy with separate production and sandbox branches.. Management groups allow you to build a hierarchy of Azure subscriptions and apply Azure Policy at the management group scope. By creating separate management group branches for production and sandbox, you can assign distinct policy sets (allowed regions, required tags, approved SKUs) to each branch, and any new subscription placed under the production branch will automatically inherit those baseline rules.

Answer

A separate resource group for each business unit inside every subscription.

Answer

A set of resource locks applied directly to critical resources in each subscription.

Answer

A single policy exemption applied at the tenant root.

Question 6

An administrator is deploying a route-based site-to-site VPN gateway. The GatewaySubnet already exists, but validation fails because the public IP configuration is incompatible with the chosen gateway. Which public IP setup is required for the gateway?

Accepted Answer

A Standard SKU public IP with static allocation.. For a route-based site-to-site VPN gateway in Azure, the gateway must use a Standard SKU public IP address with static allocation. This is because route-based VPN gateways require the public IP to be statically assigned and the Standard SKU provides the necessary features like availability zones and zone resiliency, which are not supported by the Basic SKU. The Basic SKU public IP is incompatible with route-based VPN gateways, and a private IP from the GatewaySubnet cannot serve as the public endpoint for the VPN connection.

Answer

A Basic SKU public IP with dynamic allocation.

Answer

A Basic SKU public IP with static allocation.

Answer

A private IP address assigned directly from GatewaySubnet.

Question 7

You need to deploy a group of identical Azure virtual machines and ensure they are distributed across fault domains and update domains to reduce the impact of host failures and planned maintenance. Which feature should you use?

Accepted Answer

An availability set. An availability set is the correct feature because it logically groups VMs to isolate them from each other during host failures and planned maintenance. It distributes VMs across up to 3 fault domains (each with separate power, cooling, and network) and up to 20 update domains (which are rebooted sequentially during maintenance), ensuring that not all VMs are impacted simultaneously.

Answer

A proximity placement group

Answer

A private endpoint

Answer

A custom script extension

Question 8

An employee deleted one spreadsheet from a Windows VM that is protected by Azure Backup. The VM must stay online while the administrator recovers only that file. Which two restore methods are supported? Select two.

Accepted Answer

Use file recovery from the recovery point in the Azure portal.. Azure Backup's file-level recovery feature in the Azure portal allows you to mount a recovery point as a drive on the running Windows VM, enabling you to browse and copy individual files without restoring the entire VM. This method supports selective file recovery while the VM remains online, meeting the requirement. Option B is also correct because the file recovery script (or PowerShell mount workflow) performs the same mount operation programmatically, providing an alternative way to access and recover the specific spreadsheet from the recovery point.

Answer

Restore the entire VM to a new VM and copy the file back manually.

Answer

Restore the disks from backup and attach them to the running VM.

Answer

Use Azure Site Recovery failover to expose the file.

Question 9

An NSG outbound rule allows TCP 8443 traffic from ASG-Web to ASG-Api. The web VM NIC is in ASG-Web, but the API VM NICs were deployed into the correct subnet and never added to ASG-Api. The traffic still fails. What should the administrator do?

Accepted Answer

Add the API VM NICs to ASG-Api.. The NSG rule references ASG-Api as the destination, but the API VM NICs were never added to that application security group. ASGs are logical groupings of VM NICs; a rule targeting an ASG only applies to NICs that are members of that ASG. Since the API NICs are not in ASG-Api, the rule does not match them, and traffic fails. Adding the API VM NICs to ASG-Api resolves the issue by making them valid destinations for the rule.

Answer

Move the NSG to the web subnet so source membership is automatically detected.

Answer

Change the destination port to 443 because ASGs only work with common HTTPS traffic.

Answer

Create a service endpoint for the spoke subnet so the NSG rule becomes effective.

Question 10

A finance operations team manages virtual machines in RG-App. They must start, stop, deallocate, and view VM properties for any VM in that resource group. They must not be able to delete VMs, read NIC settings, or manage disks. What should the administrator do?

Accepted Answer

Create a custom role with only the required VM actions and assign it at the RG-App scope.. The required permissions (start, stop, deallocate, view properties) are a subset of the built-in Virtual Machine Contributor role, but that role also includes delete and other management actions. A custom role allows you to grant only the specific Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/read permissions, while explicitly excluding delete, NIC read, and disk management actions. Assigning this custom role at the RG-App scope ensures the team can manage VMs without broader access.

Answer

Assign the built-in Virtual Machine Contributor role at the subscription scope.

Answer

Assign the built-in Reader role at the RG-App scope and let the team use portal buttons.

Answer

Assign the built-in Contributor role at the resource group scope.

Question 11

A storage account must remain on its public endpoint, but only one Azure subnet named AppSubnet should be allowed to access it from Azure. No private IP is required. Which two actions should the administrator take? Select two.

Accepted Answer

Enable the Microsoft.Storage service endpoint on AppSubnet.. Enabling the Microsoft.Storage service endpoint on AppSubnet allows traffic from that subnet to the storage account over the Azure backbone network, using the public endpoint while restricting access to only that subnet. Option B is correct because configuring the storage account's networking firewall to allow the selected virtual network and subnet explicitly permits traffic from AppSubnet while blocking all other public access, meeting the requirement to keep the public endpoint but limit access to one subnet.

Answer

Create a private endpoint and disable public network access.

Answer

Link a private DNS zone to AppSubnet.

Answer

Assign the Reader RBAC role to AppSubnet.

Question 12

A reporting server will run an in-memory analytics workload that needs 8 vCPUs and 64 GiB RAM. CPU usage is expected to stay moderate, but the application benefits most from memory capacity. Which VM family should the administrator choose as the starting point?

Accepted Answer

E-series. The E-series (memory-optimized) VM family is designed for in-memory analytics workloads that require high memory-to-CPU ratios. With 8 vCPUs and 64 GiB RAM, the workload demands 8 GiB per vCPU, which aligns with E-series specifications (typically 8–16 GiB per vCPU). D-series offers a balanced ratio (4 GiB per vCPU) and would not provide sufficient memory capacity for this workload.

Answer

B-series

Answer

D-series

Answer

F-series

Question 13

An application needs more data disk capacity, but the VM can keep using the same managed disk. Which two statements are true when you resize a managed data disk? Select two.

Accepted Answer

You can increase the managed disk size without redeploying the VM.. Azure managed disks support online resizing: you can increase the size of a managed data disk while the VM remains running, without any need to stop, deallocate, or redeploy the VM. This is possible because the underlying Azure storage infrastructure can extend the virtual hard disk (VHD) file without disrupting the VM's I/O operations. After the resize, the guest OS sees the new capacity, but the partition and filesystem must be extended manually.

Answer

You must create a brand-new VM before resizing the disk.

Answer

Resizing a disk always shrinks it back to a smaller size.

Answer

The VM size must always change whenever disk capacity changes.

Question 14

You need to give a third-party auditor temporary read-only access to specific blobs in a container without sharing the storage account keys. Which feature should you use?

Accepted Answer

A shared access signature (SAS). A shared access signature (SAS) is the correct choice because it provides delegated, time-limited, and permission-restricted access to specific Azure Storage resources—in this case, blobs—without exposing the storage account keys. You can generate a service-level SAS token scoped to individual blobs with read-only permissions and an expiration time, allowing the auditor to access only the required blobs. This meets the requirement for temporary, read-only access while maintaining security and granular control.

Answer

A storage account key

Answer

A resource lock

Answer

Blob versioning

Question 15

A policy that requires secure transfer for storage accounts has been assigned to a subscription with the DeployIfNotExists effect. Several existing storage accounts are still noncompliant and have not changed. What should you do next to update those existing resources automatically?

Accepted Answer

Create and run a remediation task for the policy assignment. The DeployIfNotExists effect on a policy assignment automatically deploys a template to remediate noncompliant resources, but only for new or updated resources. Existing noncompliant resources require a manual remediation task to trigger the deployment of the template. Creating and running a remediation task for the policy assignment applies the required secure transfer configuration to all existing storage accounts, bringing them into compliance.

Answer

Assign a CanNotDelete lock to the storage accounts

Answer

Move the storage accounts into a new resource group

Answer

Grant the administrators a higher RBAC role on the subscription