AZ-104 Practice Questions 1 — 50 Questions

Question 1

A Modify policy adds CostCenter=042 to resources in RG-Finance. New resources are tagged correctly, but existing virtual machines remain untagged. What three requirements must be met for the assignment to update the existing resources? Select three.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a remediation task for the policy assignment.. A remediation task is required to apply a Modify effect policy to existing non-compliant resources. The Modify effect only tags new resources automatically; existing resources remain untagged until a remediation task is triggered, which uses the policy's managed identity to update the resource tags.

Answer

Recreate the virtual machines before the policy can evaluate them.

Answer

Change the effect from Modify to Audit to trigger the tag operation.

Question 2

A developer wants to keep application data separate from the operating system so the VM can be rebuilt without losing files. Before making a risky change, the administrator also wants a fast rollback point for that data disk. Which two actions should the administrator take? Select two.

Accepted Answer

Store the application data on a separate managed data disk. Storing application data on a separate managed data disk decouples the data from the OS disk. This allows the VM to be rebuilt or reimaged without affecting the application files, as the data disk persists independently. Option B is correct because a snapshot of the data disk provides a point-in-time, crash-consistent backup that can be used to quickly restore the data disk to its pre-change state, enabling fast rollback without needing to rebuild the entire VM.

Answer

Use an ephemeral OS disk for the application files

Answer

Keep the files only on the OS disk and rely on reimaging

Answer

Delete and recreate the VM from the same image

Question 3

Based on the exhibit, which Network Watcher tool should you use to determine whether an NSG allows or denies TCP 1433 traffic and which rule is responsible?

Accepted Answer

IP flow verify. IP flow verify tests a specific source/destination IP, port, and protocol (TCP 1433) against the effective NSG rules to report whether traffic is allowed or denied, and it identifies the exact NSG rule (name and priority) responsible for that decision. This makes it the correct tool for determining NSG rule impact on a specific traffic flow.

Answer

Connection troubleshoot

Answer

Packet capture

Answer

Next hop

Question 4

A policy initiative is assigned at the Corp management group to enforce allowed locations and required tags. A new subscription is added under Corp later. Which two statements are true? Select two.

Accepted Answer

The new subscription is automatically in scope because the assignment is at the management group.. Azure Policy assignments at a management group scope are inherited by all child subscriptions, including new ones added later. When the Corp management group has the initiative assigned, any subscription under Corp automatically falls within the policy's evaluation scope without requiring manual re-assignment.

Answer

The initiative must be copied to every resource group in the new subscription before it takes effect.

Answer

The initiative changes RBAC so users lose read access to the subscription.

Answer

Compliance results are only visible in Activity Log, not in Azure Policy.

Question 5

Arrange the steps to create a virtual network in Azure with a subnet and deploy a VM.

Accepted Answer

Step 1: Create the virtual network with address space. Step 2: Add a subnet. Step 3: Associate a Network Security Group (NSG) to the subnet. Step 4: Deploy a virtual machine into the subnet. Step 5: Verify network connectivity.. First create the VNet with address space, then add a subnet, associate NSG, deploy VM, then verify.

Answer

Step 1: Create the virtual network with address space. Step 2: Deploy the virtual machine. Step 3: Add a subnet. Step 4: Associate an NSG to the subnet. Step 5: Verify network connectivity.

Answer

Step 1: Create the virtual network with address space. Step 2: Add a subnet. Step 3: Deploy the virtual machine. Step 4: Associate an NSG to the subnet. Step 5: Verify network connectivity.

Answer

Step 1: Deploy the virtual machine. Step 2: Create the virtual network with address space. Step 3: Add a subnet. Step 4: Associate an NSG to the subnet. Step 5: Verify network connectivity.

Question 6

You need to ensure that junior administrators can view all resources in the Prod-Sub subscription but cannot create, modify, or delete any resources. Which Azure RBAC role should you assign?

Accepted Answer

Reader. The Reader role is the correct choice because it grants read-only access to all resources in a subscription, including their properties and status, but does not allow any create, modify, or delete operations. This aligns perfectly with the requirement for junior administrators to view resources without making changes.

Answer

Owner

Answer

Contributor

Answer

Monitoring Reader

Question 7

A Windows VM must run a bootstrap script during provisioning to install a monitoring agent and write configuration files. The administrator does not want to log in interactively, and the script must be runnable again after the VM is rebuilt. Which two Azure compute components should be used? Select two.

Accepted Answer

Azure VM Agent. The Azure VM Agent (A) is required because it enables the VM to run extensions, including the Custom Script Extension. The Custom Script Extension (B) is the correct mechanism to execute the bootstrap script during provisioning without interactive login, and it can be reapplied to a rebuilt VM by redeploying the same ARM template or CLI command.

Answer

Boot diagnostics

Answer

Availability zone

Answer

Ephemeral OS disk

Question 8

Match each Azure VM deployment concept to the description that best fits it.

Accepted Answer

VMSS: Provides auto-scaling of identical VMs. VMSS provides auto-scaling identical VMs; Availability Set groups VMs for redundancy; Availability Zone offers physical separation; Managed Disk is persistent block storage; Azure Bastion provides secure remote access; Dedicated Host gives single-tenant physical servers.

Answer

Availability Set: Offers physical separation within a region

Answer

Managed Disk: Provides secure remote access to VMs over SSL

Answer

Azure Bastion: Persistent block storage for Azure VMs

Question 9

Match each Azure VM administration requirement on the left with the most appropriate Azure CLI command on the right. Use each answer once.

Accepted Answer

Deploy a new virtual machine: az vm create. Azure CLI commands for VM administration: 'az vm create' deploys, 'az vm resize' changes size, 'az vm start/stop/restart' controls state, and 'az vm delete' removes the VM.

Answer

Stop a virtual machine: az vm delete

Answer

Delete a virtual machine: az vm restart

Answer

Restart a virtual machine: az vm stop

Question 10

Your operations team needs to run Kusto queries across collected sign-in logs, VM performance counters, and Azure Activity Log data in a central location. What should you deploy?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the central repository in Azure that ingests and stores diagnostic data from multiple sources, including sign-in logs (Azure AD), VM performance counters (Azure Monitor for VMs), and Azure Activity Logs. It supports Kusto Query Language (KQL) for running complex queries across all collected data, making it the correct choice for this requirement.

Answer

An availability zone

Answer

A NAT gateway

Answer

A standard public IP address

Question 11

One team needs to run a Linux container for about 15 minutes per request with no inbound traffic and no cluster to manage. Another team needs an internet-facing web app with built-in HTTPS, deployment slots, and autoscale. Which two Azure services should the administrator choose? Select two.

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice for the first team because it allows running a Linux container directly on Azure without managing any underlying infrastructure or cluster, and it supports a 15-minute execution time with no inbound traffic required. ACI is ideal for burstable, short-lived container workloads that do not need orchestration.

Answer

Azure Virtual Machines

Answer

Azure Kubernetes Service

Answer

Azure Batch

Question 12

Match each storage resiliency requirement to the Azure redundancy option that best satisfies it.

Accepted Answer

LRS: Locally redundant storage replicates data three times within a single datacenter in the primary region.. LRS replicates within a single datacenter; ZRS across zones; GRS across regions; RA-GRS adds read access to GRS; RA-ZRS adds read access to ZRS. LRS is cheapest, GRS is highest durability.

Answer

LRS: Provides synchronous replication across three availability zones.

Answer

GRS: Provides read access to the secondary region.

Question 13

Match each storage networking requirement to the Azure storage network control that should be used.

Accepted Answer

Enable secure access from a specific VNet: Use service endpoints. Azure storage network controls: service endpoints for VNet access, private endpoints for private connectivity, IP firewall for public IP restrictions, trusted services exception, route tables for custom routing, and disabling public access for complete lockdown.

Answer

Enable secure access from a specific VNet: Use private endpoints

Answer

Restrict access to a specific public IP address: Enable trusted services exception

Answer

Block all public network access: Use IP firewall rules

Question 14

A team is troubleshooting inbound access to Azure VMs. Match each NSG concept on the left with the most accurate behavior or troubleshooting implication on the right.

Accepted Answer

NSG: A distributed firewall that filters traffic based on rules.. NSG is a distributed firewall; default inbound rule denies all; UDR overrides routes; ASG groups VMs; flow logs record traffic; service tags represent Azure IPs.

Answer

Default inbound rule: Allows all inbound traffic by default.

Answer

Service tags: Override default system routes.

Question 15

Match each access scenario to the SAS or key type that best fits it.

Accepted Answer

Interactive logins: User delegation SAS. Interactive logins use user delegation SAS; automated backups use system-assigned managed identity; cross-tenant access requires a service principal with certificate; VM patching uses system-assigned managed identity; app access to SQL uses user-assigned managed identity; key rotation uses storage account access keys.

Answer

Interactive logins: Storage account access keys

Answer

Automated backups: User delegation SAS

Answer

Cross-tenant access: System-assigned managed identity

Question 16

You need to view recommendations about underutilized virtual machines, security improvements, and cost-saving opportunities in Azure. Which service should you use?

Accepted Answer

Azure Advisor. Azure Advisor provides personalized best-practice recommendations related to reliability, security, performance, operational excellence, and cost.

Answer

Azure Policy

Answer

Network Watcher

Answer

Azure Backup

Question 17

Your company has a hybrid infrastructure with Azure VMs and on-premises servers. You need to configure Azure Monitor to collect and analyze performance and event data from all servers in a centralized workspace. Which three of the following steps are required to achieve this? (Choose three.)

Accepted Answer

Configure Data Collection Rules (DCRs) to specify which performance counters and events to collect.. The Azure Monitor Agent (AMA) is the current recommended agent for collecting telemetry from both Azure VMs and on-premises servers, replacing the legacy Microsoft Monitoring Agent (MMA). A Log Analytics workspace is required as the centralized data repository, and Data Collection Rules (DCRs) define exactly which performance counters and events to collect, enabling granular, scalable data ingestion without manual configuration per machine.

Answer

Create a VM Insights solution in the Azure portal to automatically collect data from all Azure VMs.

Answer

Install the Microsoft Monitoring Agent (MMA) on all servers and connect to a Log Analytics workspace.

Answer

Enable Network Watcher to monitor network traffic between on-premises and Azure.

Question 18

You are designing an Azure virtual network for a three-tier application. The frontend, application, and database tiers each require their own subnet. You need to ensure that the frontend tier can communicate with the application tier, but the database tier must be isolated from direct inbound traffic from the internet. Which three of the following actions should you include in your design? (Choose three.)

Accepted Answer

Place all three tiers in the same virtual network using separate subnets.. Assigning a network security group (NSG) to the database subnet that denies all inbound traffic from the internet is correct because NSGs act as a distributed, stateful firewall at the subnet or NIC level. By default, NSGs allow all inbound traffic from within the virtual network, so you must explicitly add a deny rule for internet traffic (source 'Internet') to isolate the database tier. This ensures the database subnet is protected from direct inbound internet traffic while still allowing traffic from the application tier via the default allow rule for virtual network traffic.

Answer

Use Azure Firewall to inspect traffic between the frontend and application tiers.

Answer

Configure a virtual network peering to connect the frontend and database subnets.

Answer

Route traffic from the application tier to the database tier using a user-defined route (UDR) pointing to the Azure Firewall.

Question 19

Your organization has an Azure Active Directory (Azure AD) tenant with 500 users. You need to ensure that users can reset their own passwords without IT support, but only if they have registered for multi-factor authentication (MFA). Additionally, you want to prevent users from reusing their last 10 passwords. Which three of the following should you configure? (Choose three.)

Accepted Answer

Configure the 'Number of methods required to reset' to 2 and require MFA registration.. To allow users to reset their own passwords without IT support, you must enable the 'Self-service password reset' (SSPR) feature in Azure AD. To prevent password reuse, you set the 'Number of passwords remembered' policy to 10 in the Password reset blade, which enforces a password history of 10 unique passwords. Finally, to ensure that only users registered for MFA can reset their passwords, you configure the 'Number of methods required to reset' to 2 and require MFA registration, which forces users to provide two authentication methods (including MFA) before resetting.

Answer

Configure 'Password protection' with a custom banned password list.

Answer

Assign the 'Global Administrator' role to all users to allow password reset.

Answer

Enable 'Combined registration' for security info to simplify MFA and SSPR registration.

Question 20

You are an Azure administrator for a company that runs critical virtual machines (VMs) in Azure. You need to configure a monitoring solution that will alert you when the average CPU usage of a specific VM exceeds 90% for more than 15 minutes. Which three of the following actions should you take to set up this alert? (Choose three.)

Accepted Answer

Create a metric alert rule in Azure Monitor targeting the VM's 'Percentage CPU' metric.. A metric alert rule in Azure Monitor is the correct approach because it directly monitors a specific metric like 'Percentage CPU' from the VM without requiring additional data collection. Configuring the condition to fire when the average CPU usage exceeds 90% for a period of 15 minutes ensures the alert triggers only after sustained high usage, reducing noise. Defining an action group with email notification is necessary to alert the operations team when the alert fires, completing the monitoring solution.

Answer

Enable Azure Diagnostic Settings on the VM to send performance data to a storage account.

Answer

Create a log alert rule based on the VM's performance counters collected in Log Analytics.

Answer

Configure an Application Insights availability test to monitor the VM's CPU.