AZ-104 Practice Test 50 — 15 Questions

Question 1

An application team needs Contributor access only for the resources in rg-app. They must not manage any other resources in the subscription. At what scope should you assign the role?

Accepted Answer

Resource group scope. The Contributor role assigned at the resource group scope grants the application team full management access to all resources within rg-app, but no access to resources in other resource groups or at the subscription level. This meets the requirement of restricting permissions to only that specific resource group.

Answer

Management group scope

Answer

Subscription scope

Answer

Resource scope

Question 2

A web app in VNet1 must access a storage account by using a private IP address, and the storage account has public network access disabled. The app resolves the storage FQDN from inside the VNet. What should you deploy?

Accepted Answer

A private endpoint for the storage account and the required private DNS zone linkage.. A private endpoint assigns the storage account a private IP address from the VNet, enabling access via a private IP while public network access is disabled. The required private DNS zone linkage ensures the storage FQDN resolves to that private IP from within the VNet, meeting both requirements.

Answer

A service endpoint on the subnet so the storage account gets a private IP.

Answer

A storage account firewall rule that allows the VNet and a public DNS record update.

Answer

A SAS token created for the application service principal.

Question 3

A subscription must block creation of resources in any region except East US and West US, and the security team also wants a nonblocking report of existing resources that are missing a CostCenter tag. Which two Azure Policy effects should you use? Select two.

Accepted Answer

Deny. Deny is correct because it actively blocks resource creation in regions outside East US and West US by evaluating the location property against an allowed list and rejecting non-compliant requests at deployment time. Audit is correct because it logs a compliance event for existing resources missing the CostCenter tag without blocking any operations, providing a nonblocking report for the security team.

Answer

Modify

Answer

DeployIfNotExists

Answer

Disabled

Question 4

You have a storage account that stores infrequently accessed data that must remain available immediately when requested. You need to minimize storage costs. Which access tier should you use?

Accepted Answer

Cool. The Cool access tier is designed for data that is infrequently accessed but still requires immediate availability when requested, offering lower storage costs than the Hot tier while maintaining low latency access. Since the data must remain available immediately, the Archive tier is unsuitable due to its multi-hour retrieval latency, and the Premium tier is optimized for high-performance scenarios, not cost minimization.

Answer

Premium

Answer

Hot

Answer

Archive

Question 5

You need to collect guest operating system performance counters and Windows event logs from several Azure virtual machines into a central queryable platform. Which Azure component should you configure?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the correct Azure component for collecting guest OS performance counters and Windows event logs from Azure VMs. It serves as a central repository where diagnostic data from Azure Monitor agents (such as the Log Analytics agent or Azure Monitor Agent) is ingested, stored, and made available for querying via Kusto Query Language (KQL). This enables you to analyze performance metrics and event logs across multiple VMs in a unified, queryable platform.

Answer

A Recovery Services vault

Answer

An Azure Policy initiative

Answer

A route table

Question 6

You need to run a script inside an Azure virtual machine after deployment to install application prerequisites. Which feature should you use?

Accepted Answer

A Custom Script Extension. The Custom Script Extension (CSE) is the correct feature because it allows you to run a script inside an Azure VM after deployment, making it ideal for installing application prerequisites. CSE downloads and executes scripts on the VM, supporting both Windows (via PowerShell) and Linux (via Bash) environments, and can be applied during initial provisioning or to an existing VM.

Answer

Azure Policy

Answer

Boot diagnostics

Answer

A proximity placement group

Question 7

A managed data disk was accidentally deleted from a VM. A snapshot taken the day before is still available. Which two actions should the administrator perform to recover the data? Select two.

Accepted Answer

Create a new managed disk from the snapshot.. A snapshot is a point-in-time, read-only copy of a managed disk. To recover the data, you must create a new managed disk from the snapshot using the `az disk create --source` command or the Azure portal. This new disk will contain the exact data as it existed when the snapshot was taken.

Answer

Mount the snapshot directly as a data disk.

Answer

Redeploy the VM and reinstall the operating system.

Answer

Delete the snapshot after verifying it exists.

Question 8

VM-Web01 is connected to Subnet-Web in VNet-Prod. Users on the internet cannot access the website hosted on TCP port 443. You confirm that VM-Web01 has a public IP address and the web service is running. You need to allow inbound HTTPS traffic with the least administrative effort. What should you do?

Accepted Answer

Add an inbound NSG rule allowing TCP 443.. The VM has a public IP and the web service is running, but internet users cannot access it. The most common reason is that the Network Security Group (NSG) associated with the subnet or NIC is blocking inbound traffic. Adding an inbound NSG rule to allow TCP 443 is the least administrative effort to permit HTTPS traffic from the internet.

Answer

Create a user-defined route to the internet.

Answer

Configure VNet peering with another virtual network.

Answer

Create a private endpoint for VM-Web01.

Question 9

An enterprise has 30 Azure subscriptions. Production subscriptions need a common baseline of allowed regions, required tags, and approved SKU rules, and any new production subscription must inherit those rules automatically. Sandbox subscriptions should follow a separate, lighter baseline. Which Azure construct should the team use to organize this governance model?

Accepted Answer

A management group hierarchy with separate production and sandbox branches.. Management groups allow you to build a hierarchy of Azure subscriptions and apply Azure Policy at the management group scope. By creating separate management group branches for production and sandbox, you can assign distinct policy sets (allowed regions, required tags, approved SKUs) to each branch, and any new subscription placed under the production branch will automatically inherit those baseline rules.

Answer

A separate resource group for each business unit inside every subscription.

Answer

A set of resource locks applied directly to critical resources in each subscription.

Answer

A single policy exemption applied at the tenant root.

Question 10

An administrator is deploying a route-based site-to-site VPN gateway. The GatewaySubnet already exists, but validation fails because the public IP configuration is incompatible with the chosen gateway. Which public IP setup is required for the gateway?

Accepted Answer

A Standard SKU public IP with static allocation.. For a route-based site-to-site VPN gateway in Azure, the gateway must use a Standard SKU public IP address with static allocation. This is because route-based VPN gateways require the public IP to be statically assigned and the Standard SKU provides the necessary features like availability zones and zone resiliency, which are not supported by the Basic SKU. The Basic SKU public IP is incompatible with route-based VPN gateways, and a private IP from the GatewaySubnet cannot serve as the public endpoint for the VPN connection.

Answer

A Basic SKU public IP with dynamic allocation.

Answer

A Basic SKU public IP with static allocation.

Answer

A private IP address assigned directly from GatewaySubnet.

Question 11

You need to deploy a group of identical Azure virtual machines and ensure they are distributed across fault domains and update domains to reduce the impact of host failures and planned maintenance. Which feature should you use?

Accepted Answer

An availability set. An availability set is the correct feature because it logically groups VMs to isolate them from each other during host failures and planned maintenance. It distributes VMs across up to 3 fault domains (each with separate power, cooling, and network) and up to 20 update domains (which are rebooted sequentially during maintenance), ensuring that not all VMs are impacted simultaneously.

Answer

A proximity placement group

Answer

A private endpoint

Answer

A custom script extension

Question 12

An employee deleted one spreadsheet from a Windows VM that is protected by Azure Backup. The VM must stay online while the administrator recovers only that file. Which two restore methods are supported? Select two.

Accepted Answer

Use file recovery from the recovery point in the Azure portal.. Azure Backup's file-level recovery feature in the Azure portal allows you to mount a recovery point as a drive on the running Windows VM, enabling you to browse and copy individual files without restoring the entire VM. This method supports selective file recovery while the VM remains online, meeting the requirement. Option B is also correct because the file recovery script (or PowerShell mount workflow) performs the same mount operation programmatically, providing an alternative way to access and recover the specific spreadsheet from the recovery point.

Answer

Restore the entire VM to a new VM and copy the file back manually.

Answer

Restore the disks from backup and attach them to the running VM.

Answer

Use Azure Site Recovery failover to expose the file.

Question 13

An NSG outbound rule allows TCP 8443 traffic from ASG-Web to ASG-Api. The web VM NIC is in ASG-Web, but the API VM NICs were deployed into the correct subnet and never added to ASG-Api. The traffic still fails. What should the administrator do?

Accepted Answer

Add the API VM NICs to ASG-Api.. The NSG rule references ASG-Api as the destination, but the API VM NICs were never added to that application security group. ASGs are logical groupings of VM NICs; a rule targeting an ASG only applies to NICs that are members of that ASG. Since the API NICs are not in ASG-Api, the rule does not match them, and traffic fails. Adding the API VM NICs to ASG-Api resolves the issue by making them valid destinations for the rule.

Answer

Move the NSG to the web subnet so source membership is automatically detected.

Answer

Change the destination port to 443 because ASGs only work with common HTTPS traffic.

Answer

Create a service endpoint for the spoke subnet so the NSG rule becomes effective.

Question 14

A finance operations team manages virtual machines in RG-App. They must start, stop, deallocate, and view VM properties for any VM in that resource group. They must not be able to delete VMs, read NIC settings, or manage disks. What should the administrator do?

Accepted Answer

Create a custom role with only the required VM actions and assign it at the RG-App scope.. The required permissions (start, stop, deallocate, view properties) are a subset of the built-in Virtual Machine Contributor role, but that role also includes delete and other management actions. A custom role allows you to grant only the specific Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/read permissions, while explicitly excluding delete, NIC read, and disk management actions. Assigning this custom role at the RG-App scope ensures the team can manage VMs without broader access.

Answer

Assign the built-in Virtual Machine Contributor role at the subscription scope.

Answer

Assign the built-in Reader role at the RG-App scope and let the team use portal buttons.

Answer

Assign the built-in Contributor role at the resource group scope.

Question 15

A storage account must remain on its public endpoint, but only one Azure subnet named AppSubnet should be allowed to access it from Azure. No private IP is required. Which two actions should the administrator take? Select two.

Accepted Answer

Enable the Microsoft.Storage service endpoint on AppSubnet.. Enabling the Microsoft.Storage service endpoint on AppSubnet allows traffic from that subnet to the storage account over the Azure backbone network, using the public endpoint while restricting access to only that subnet. Option B is correct because configuring the storage account's networking firewall to allow the selected virtual network and subnet explicitly permits traffic from AppSubnet while blocking all other public access, meeting the requirement to keep the public endpoint but limit access to one subnet.

Answer

Create a private endpoint and disable public network access.

Answer

Link a private DNS zone to AppSubnet.

Answer

Assign the Reader RBAC role to AppSubnet.