AZ-104 Practice Test 50 — 15 Questions

Question 1

A storage account is accessed from a VM in VNet A through a private endpoint. A VM in peered VNet B can connect to the storage account by IP, but when it uses the storage account name, it resolves to the public endpoint. What should the administrator configure?

Accepted Answer

Link the private DNS zone for the storage account to VNet B.. The VM in VNet B can reach the storage account by IP because the private endpoint is accessible over the VNet peering, but DNS resolution still returns the public IP because the private DNS zone (privatelink.blob.core.windows.net) is not linked to VNet B. By linking the private DNS zone to VNet B, the VM will resolve the storage account name to the private endpoint IP, ensuring connectivity over the Microsoft backbone instead of the public internet.

Answer

Enable a service endpoint on VNet B for Microsoft.Storage.

Answer

Assign the VM in VNet B a managed identity.

Answer

Create a route table that points storage traffic to the private endpoint subnet.

Question 2

A storage account must accept traffic only from a single subnet. The team wants to keep using the storage account's public endpoint and does not want to deploy a private endpoint. What should you configure?

Accepted Answer

A service endpoint on the subnet and a storage firewall rule that allows that subnet. Option B is correct because a service endpoint on the subnet extends the virtual network identity to the storage account, and a storage firewall rule that allows that subnet restricts access to only traffic originating from that subnet. This meets the requirement of using the public endpoint without deploying a private endpoint, as the storage account's public endpoint remains accessible but is locked down to the specified subnet via the firewall rule.

Answer

A private endpoint and private DNS zone

Answer

Read-access geo-redundant storage (RA-GRS)

Answer

Archive access tier for the container

Question 3

A storage account must be reachable only from Azure VMs in a single subnet. Public network access should not be used, and the team wants the storage service to keep using a private IP address inside the virtual network. Which feature should the administrator configure?

Accepted Answer

A private endpoint for the storage account in the subnet.. A private endpoint assigns the storage account a private IP address from the subnet's address space, using Azure Private Link to route traffic entirely over the Microsoft backbone network. This ensures the storage account is reachable only from VMs in that subnet and blocks all public internet access, meeting both requirements.

Answer

A service endpoint on the subnet, because it creates a private IP address for the storage account.

Answer

A shared access signature that is limited to the subnet.

Answer

Storage account access keys, because they bind access to one subnet automatically.

Question 4

A partner company needs to upload files to a single blob container for the next 24 hours. The partner should not receive the storage account key, and the access should be limited to that container only. Which access mechanism should you provide?

Accepted Answer

A container-level SAS token with write permission and a 24-hour expiry.. A container-level SAS token with write permission and a 24-hour expiry is correct because it provides time-limited, delegated access to a specific blob container without exposing the storage account key. The SAS token is generated with the container as the resource scope, write permission (add/create), and an expiry time of 24 hours, meeting all requirements: no key sharing, container-only access, and time-bound access.

Answer

The storage account key, because it is easier for external users to use.

Answer

A management group role assignment, because RBAC can restrict access to one blob container.

Answer

A private endpoint, because it grants the partner write access over a private IP.

Question 5

A stateless web application must automatically add VM instances during business hours and remove them at night based on CPU usage. Which Azure service should be deployed?

Accepted Answer

Virtual machine scale set. Virtual Machine Scale Sets (VMSS) are designed to automatically scale the number of VM instances in or out based on metrics like CPU usage, and they support scheduled scaling to align with business hours. This makes them the correct choice for a stateless web application that needs to add instances during business hours and remove them at night, as VMSS can integrate with Azure Autoscale to adjust capacity based on both performance metrics and time schedules.

Answer

Availability set

Answer

Azure Bastion

Answer

Proximity placement group

Question 6

A stateless API must automatically add or remove identical VM instances when CPU usage crosses thresholds. The team also wants Microsoft to distribute instances across fault domains when possible. Which service should the administrator deploy?

Accepted Answer

A virtual machine scale set. A virtual machine scale set (VMSS) is the correct choice because it provides built-in autoscaling capabilities that automatically add or remove identical VM instances based on CPU usage thresholds. VMSS also supports automatic distribution of instances across fault domains when configured with a fault domain count greater than 1, meeting the requirement for Microsoft to distribute instances across fault domains.

Answer

An availability set

Answer

Azure Load Balancer

Answer

Azure App Service

Question 7

A public web application runs on two identical VMs behind a load balancer. The region supports availability zones. The business wants the app to keep serving traffic if one datacenter in the region becomes unavailable. What should the administrator use?

Accepted Answer

Availability zones for the two VMs. Option B is correct because deploying the two VMs in different availability zones within the same region protects against a single datacenter failure. Each availability zone is a physically separate datacenter with independent power, cooling, and networking. If one zone goes down, the load balancer automatically routes traffic to the VM in the other zone, ensuring the application continues serving traffic.

Answer

An availability set with two VMs

Answer

A single virtual machine scale set instance

Answer

A proximity placement group

Question 8

A team needs an alert that emails the operations group whenever a VM's average CPU percentage stays above 85% for 10 minutes. Which two Azure Monitor components must you configure? Select two.

Accepted Answer

A metric alert rule on the VM CPU metric. A metric alert rule on the VM CPU metric is required because it continuously monitors the 'Percentage CPU' metric and triggers when the average value exceeds 85% for a duration of 10 minutes. This rule evaluates the condition using the aggregation type 'Average' and the window size set to PT10M (ISO 8601 format). Without this rule, no alert condition exists to detect the threshold breach.

Answer

A Recovery Services vault

Answer

A private endpoint for the virtual machine

Answer

A blob lifecycle management policy

Question 9

A web app running in Azure App Service must read blobs from a storage account. The app must authenticate without storing secrets or SAS tokens, and administrators should grant only blob data permissions, not storage management permissions. What should you configure?

Accepted Answer

A system-assigned managed identity for the app with Storage Blob Data Reader assigned at the storage scope.. Option B is correct because a system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any secrets or SAS tokens. By assigning the Storage Blob Data Reader role at the storage account scope, you grant only the necessary blob read permissions while explicitly excluding any storage management permissions (e.g., creating or deleting storage accounts). This aligns with the principle of least privilege and eliminates credential management overhead.

Answer

The storage account access key in an application setting, because it works with any blob operation.

Answer

The Contributor role on the storage account, because it includes both management and data permissions.

Answer

A service endpoint on the subnet, because service endpoints are used for application authentication.

Question 10

A storage account hosts application logs that security wants to search in Log Analytics for 30 days and keep in a separate retained copy for one year. They also want to monitor storage metrics in the same place for troubleshooting. What should be configured on the storage account?

Accepted Answer

Create a diagnostic setting that sends the storage resource logs and AllMetrics to Log Analytics and a storage account.. Option B is correct because a diagnostic setting on a storage account can send both resource logs (e.g., StorageRead, StorageWrite) and AllMetrics (e.g., transactions, ingress) to a Log Analytics workspace for querying and to a secondary storage account for long-term retention. This meets the requirement to search logs for 30 days in Log Analytics (which has its own retention setting) and keep a separate archived copy for one year in the storage account.

Answer

Enable only the activity log export because it already includes all storage telemetry.

Answer

Create an action group that archives storage events and forwards them to investigators.

Answer

Create a metric alert on the storage account and use it as the retention mechanism.

Question 11

Your organization requires all storage accounts to allow access only from selected networks. You need a governance solution that automatically corrects noncompliant new storage accounts when possible instead of only reporting them. What policy effect should you choose?

Accepted Answer

DeployIfNotExists. The DeployIfNotExists policy effect is correct because it can automatically remediate noncompliant storage accounts by deploying a network rules configuration that restricts access to selected networks. Unlike Audit, which only reports compliance status, DeployIfNotExists actively modifies the resource to meet the policy requirement when possible, aligning with the need for automatic correction.

Answer

Audit

Answer

Disabled

Answer

Append

Question 12

A storage account must stay reachable through its public endpoint, but only Azure workloads in AppSubnet should be allowed to access it. No private IP is required. What should you configure?

Accepted Answer

A service endpoint on AppSubnet and a storage firewall VNet rule.. A service endpoint on AppSubnet extends the Azure backbone network to the subnet, allowing traffic to the storage account's public endpoint without a private IP. The storage firewall VNet rule then restricts access to only traffic originating from that specific subnet, meeting the requirement of public endpoint reachability with Azure workload-only access.

Answer

A private endpoint in AppSubnet.

Answer

A VPN gateway between AppSubnet and the storage account.

Answer

A public IP address on the storage account.

Question 13

A team runs a Windows VM in Azure that uploads invoices to a blob container. Security policy forbids storing storage account keys or long-lived SAS tokens on the VM. The app must keep working until the VM is deleted, and access should disappear automatically when the VM is removed. What should the administrator configure?

Accepted Answer

Assign the VM's managed identity the Storage Blob Data Contributor role on the storage account or container.. Option A is correct because assigning the VM's managed identity the Storage Blob Data Contributor role on the storage account or container allows the VM to authenticate to Azure Blob Storage without storing any keys or tokens. Managed identities provide an automatically managed service principal in Azure AD, and the application can use the Azure Instance Metadata Service (IMDS) to obtain an access token. When the VM is deleted, the managed identity is automatically removed, and the role assignment becomes invalid, so access disappears immediately.

Answer

Create an account SAS token with write permissions and store it in a secure file on the VM.

Answer

Assign the Reader role on the storage account to the VM's computer account.

Answer

Enable shared key access and rotate the storage account keys regularly.

Question 14

A user deleted one Excel file from a file share backed up with Azure Backup. You want to restore only that file, not the entire share. What should you use?

Accepted Answer

A file-level restore from the backup recovery point. Azure Backup for Azure Files supports file-level restore from a recovery point. When you select a recovery point in the Azure portal, you can browse the file share contents and restore individual files or folders to the original or an alternate location, without restoring the entire share. This is achieved by mounting the recovery point as a read-only share via the SMB protocol, allowing you to copy the specific file.

Answer

A full VM restore

Answer

A metric alert rule

Answer

A private endpoint

Question 15

A support team must be able to start, stop, and restart virtual machines in one application resource group, but they must not create or delete VMs, modify disks, or manage networking. What is the best access approach?

Accepted Answer

Create a custom RBAC role with only the required VM power actions and assign it at the resource group scope.. Option B is correct because Azure RBAC allows you to create a custom role with specific actions like Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/restart/action, and Microsoft.Compute/virtualMachines/deallocate/action, and assign it at the resource group scope. This grants the support team exactly the permissions needed to start, stop, and restart VMs without allowing VM creation, deletion, disk modification, or networking changes, adhering to the principle of least privilege.

Answer

Assign Contributor at the subscription scope so the team can manage all resources.

Answer

Assign Reader at the resource group scope and use Azure Policy to permit VM restarts.

Answer

Apply a resource lock to the resource group so the team can only make approved changes.