AZ-104 Practice Questions 2 — 50 Questions

Question 1

A customer wants official information about whether an Azure service issue is affecting their subscription or the wider Azure platform. Which two sources should they check? Select two.

Accepted Answer

Azure Service Health. Azure Service Health (B) provides personalized alerts and guidance when Azure service issues affect your subscription, including planned maintenance and health advisories. Azure Status (D) offers a global view of the health of all Azure services across regions, which is the official source for widespread platform issues. Together, they cover both subscription-specific and platform-wide service incidents.

Answer

Azure Advisor

Answer

Backup center

Answer

Resource Graph

Question 2

A finance application is deployed in a single resource group named rg-finance-app. The team must manage only the resources in that group and must not receive permissions for other resource groups in the subscription. Where should the Contributor role be assigned?

Accepted Answer

At the rg-finance-app resource group scope.. The Contributor role must be assigned at the rg-finance-app resource group scope to restrict permissions exclusively to that group. This ensures the team can manage only the resources within that resource group, without inheriting permissions to other resource groups in the subscription. Role assignments in Azure are inherited from higher scopes (management group, subscription) down to lower scopes, so assigning at the resource group scope is the most specific and restrictive level that meets the requirement.

Answer

At the management group that contains the subscription.

Answer

At the subscription scope.

Answer

At each individual resource in the resource group.

Question 3

A company wants to peer a new spoke virtual network to an existing hub VNet. The hub uses 10.40.0.0/16, and the new spoke was created with 10.40.128.0/17 because that range seemed available in the branch office plan. Peering creation fails. What should the administrator do?

Accepted Answer

Change the spoke VNet to a non-overlapping address space before peering.. VNet peering requires that the address spaces of the peered virtual networks do not overlap. The hub uses 10.40.0.0/16, and the spoke uses 10.40.128.0/17, which is a subset of the hub’s range. Azure blocks peering when there is any overlap to prevent routing conflicts. The correct fix is to change the spoke VNet to a non-overlapping address space, such as a different RFC 1918 range like 10.1.0.0/16, before attempting to peer.

Answer

Add a second address prefix to the spoke VNet and keep the overlapping range.

Answer

Enable gateway transit on the hub VNet before retrying peering.

Answer

Create custom DNS records for the spoke VNet so the address ranges no longer conflict.

Question 4

Before changing a production VM's data disk, you want a point-in-time copy that can be restored later without affecting the VM. What should you create?

Accepted Answer

Snapshot. A snapshot captures a point-in-time, read-only copy of a managed or unmanaged disk. It can be used to create a new disk or restore the original disk without affecting the running VM, making it the correct choice for a non-disruptive backup before a data disk change.

Answer

Availability set

Answer

Azure Policy assignment

Answer

Virtual network peering

Question 5

A container group must run an image from a private Azure Container Registry without embedding registry credentials in the deployment. The same authentication method should be reusable by future container groups, and the application must continue to work if the container group is recreated. Which identity approach should the administrator use?

Accepted Answer

A user-assigned managed identity assigned to the container group.. A user-assigned managed identity (B) is the correct approach because it is a persistent Azure AD identity that can be pre-created and assigned to any number of container groups. It decouples the identity from the container group's lifecycle, so if the container group is recreated, the same identity can be reassigned without reconfiguration. The container group uses this identity to authenticate to ACR via Azure AD token-based authentication, eliminating the need to embed registry credentials.

Answer

A system-assigned managed identity for the container group.

Answer

An ACR admin username and password stored in the container image.

Answer

A shared access signature token passed as an environment variable.

Question 6

Three application VMs in separate resource groups must use the same identity to read a configuration endpoint. The identity must keep working if any one VM is deleted and later recreated. Which three actions should the administrator take? Select three.

Accepted Answer

Create a user-assigned managed identity that can exist independently of any single VM.. A user-assigned managed identity is an Azure resource that exists independently of any VM, unlike a system-assigned identity which is tied to the VM lifecycle. This independence ensures the identity persists even when a VM is deleted and recreated, maintaining continuous access to the configuration endpoint. By creating a user-assigned managed identity, the administrator decouples the identity from any single VM, satisfying the requirement that the identity must keep working after VM deletion and recreation.

Answer

Use a system-assigned managed identity on only one VM and copy its access token to the other two VMs.

Answer

Store one application password locally on each VM and use it instead of Azure-managed identities.

Question 7

Based on the exhibit, the business wants two Azure VMs to stay available if a host is patched or fails. A full datacenter outage is not part of the requirement. What should you use?

Accepted Answer

Deploy the VMs in an availability set.. An availability set protects against failures within a single datacenter by distributing VMs across multiple fault domains (physical racks with separate power and network) and update domains (groups that are patched sequentially). This ensures that during host patching or a host failure, at least one VM remains available, meeting the requirement without needing to survive a full datacenter outage.

Answer

Deploy the VMs in the same availability zone.

Answer

Use a virtual machine scale set with autoscale only.

Answer

Place both VMs on a dedicated host.

Question 8

The platform team wants to block deployment of virtual machines that use any size except a small approved list. Operators already have Contributor access and should keep that access for other tasks. Which Azure control should the administrator use to enforce the size restriction?

Accepted Answer

Assign an Azure Policy with an allowed virtual machine size rule and the Deny effect at the subscription scope.. Azure Policy with the 'allowed virtual machine sizes' built-in policy and the Deny effect is the correct control because it enforces a deny action at the resource creation or update level, preventing any VM deployment that does not match the approved size list. This works independently of RBAC permissions, so operators retain their Contributor role for other tasks while the policy blocks non-compliant VM sizes. The policy is assigned at the subscription scope to cover all resource groups, ensuring consistent enforcement across the environment.

Answer

Create a custom RBAC role that excludes unsupported VM sizes from the Contributor role.

Answer

Apply a CanNotDelete lock to the resource group that contains the virtual machines.

Answer

Assign Reader permissions to the operators and rely on Azure portal validation.

Question 9

The team already exports subscription activity logs to a Log Analytics workspace and wants an alert that can ignore delete operations performed by a known automation account. What should they create?

Accepted Answer

A scheduled query alert in Log Analytics using the AzureActivity table. A scheduled query alert in Log Analytics can query the AzureActivity table to filter out delete operations performed by a specific automation account. This allows the alert to ignore those operations by excluding them in the query logic, which is not possible with activity log alerts that lack such granular filtering.

Answer

An activity log alert at the subscription scope

Answer

A metric alert on the subscription

Answer

A diagnostic setting on the resource group

Question 10

Your company has two subscriptions named Dev-Sub and Prod-Sub. A new administrator must be able to create resource groups only in Dev-Sub and must not have any permissions in Prod-Sub. What should you do?

Accepted Answer

Assign Contributor to the administrator at the Dev-Sub scope.. Assigning the Contributor role at the Dev-Sub scope grants the administrator full permissions to create and manage resource groups within that subscription, while the role assignment is scoped exclusively to Dev-Sub, ensuring no permissions in Prod-Sub. Azure RBAC is hierarchical, so a role assigned at a subscription scope applies to all resource groups within it, but does not cross subscription boundaries. This meets the requirement of allowing resource group creation only in Dev-Sub with no access to Prod-Sub.

Answer

Assign Contributor to the administrator at the management group scope.

Answer

Assign Owner to the administrator at the resource group scope in Dev-Sub.

Answer

Assign Reader to the administrator at the Prod-Sub scope and Contributor at the tenant root group.

Question 11

A Windows file server VM in Azure must mount an Azure file share by using existing Active Directory Domain Services credentials instead of a storage account key. The organization already has domain-joined Windows servers in the environment. What should the administrator configure on the storage account?

Accepted Answer

Enable Azure Files identity-based authentication with Active Directory Domain Services.. Azure Files supports identity-based authentication over SMB using Active Directory Domain Services (AD DS). By enabling this on the storage account, the administrator can mount the file share using existing domain credentials instead of a storage account key, provided the client VM is domain-joined and the share is configured with appropriate NTFS permissions. This eliminates the need to manage or expose storage account keys.

Answer

Enable blob soft delete and mount the share with a blob container SAS token.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet.

Answer

Create a shared access signature for the file share and map it as a local drive.

Question 12

VM-App01 is responding slowly and appears to be on a degraded Azure host. You must keep the VM resource, keep its disks and NIC, and move it to fresh infrastructure before further troubleshooting. Which two actions can achieve that goal? Select two.

Accepted Answer

Redeploy the VM.. Redeploying the VM (Option A) moves the VM to a new Azure host node while preserving the VM resource, its disks, and NIC. This is the correct action because it resolves host-level degradation without deleting or recreating the VM. Stopping/deallocating the VM (Option D) releases the underlying hardware lease, which forces the VM to be placed on a new host when started again, also preserving the VM resource, disks, and NIC.

Answer

Delete the VM and recreate it from the OS disk.

Answer

Capture the VM into a generalized image.

Answer

Convert the VM to an availability set.

Question 13

A security team needs to grant and remove RBAC access for a set of operators on resources in one resource group, but those operators must not create, modify, or delete the resources themselves. Which built-in role should be assigned?

Accepted Answer

User Access Administrator at the resource group scope.. The User Access Administrator role at the resource group scope grants the ability to manage RBAC role assignments for other users on resources within that resource group, but it does not grant permissions to create, modify, or delete the resources themselves. This meets the security team's requirement to grant and remove access without allowing resource management.

Answer

Reader, because it is the most restrictive role available.

Answer

Contributor, because it can manage resources and role assignments together.

Answer

Tag Contributor, because role management and tagging are both governance tasks.

Question 14

A contractor needs to upload data into one specific blob container for six hours. The administrator must avoid sharing the storage account key and should grant only the minimum permissions needed. Which access method should be used?

Accepted Answer

A service SAS scoped to the container with write permission and an expiry time in six hours.. A service SAS scoped to the container with write permission and an expiry time of six hours is correct because it provides time-limited, delegated access to a specific blob container without exposing the storage account key. This meets the requirement of granting only the minimum permissions needed (write) for the six-hour duration, and the SAS can be revoked by regenerating the storage account key if necessary.

Answer

The storage account access key, because it is easier to revoke later.

Answer

A shared key rotation policy, because it grants time-limited access to one container.

Answer

A user-assigned managed identity assigned to the contractor’s laptop.

Question 15

A container group runs a one-time import task and should stop after the task completes successfully. Which restart policy should you use?

Accepted Answer

Never. The 'Never' restart policy is correct because the container group is designed to run a one-time import task and should stop after successful completion. In Azure Container Instances (ACI), the 'Never' policy ensures the container runs exactly once and does not restart, regardless of the exit code. This is ideal for batch jobs or import tasks that should not be retried automatically.

Answer

Always

Answer

OnFailure

Answer

Manual

Question 16

An operations team wants to label resources by Department and Environment so they can search and report on ownership across many resource groups. Which two statements are correct? Select two.

Accepted Answer

Tags are key-value pairs that can be applied to resources and resource groups.. Azure tags are indeed key-value pairs that can be applied to resources and resource groups. This allows the operations team to label resources with metadata like Department and Environment, enabling efficient searching, filtering, and reporting across multiple resource groups without affecting resource functionality.

Answer

A ReadOnly lock is the best way to record department ownership.

Answer

Tags automatically encrypt the data in a resource.

Answer

Tags replace Azure Policy when compliance must be enforced.

Question 17

A platform team has a hardened Windows Server VM that was generalized after patching, agent installation, and baseline configuration. They must deploy the same build to development, test, and production subscriptions, and they want a controlled way to publish newer versions later without rebuilding the image each time. What should they create first?

Accepted Answer

An Azure Compute Gallery image version based on the generalized VM image.. An Azure Compute Gallery (formerly Shared Image Gallery) allows you to store and manage multiple versions of a generalized VM image, enabling controlled, incremental publishing of image updates across subscriptions. By creating an image version in a gallery, the team can deploy the same build to dev, test, and prod subscriptions while maintaining versioning and replication control, avoiding the need to rebuild the image from scratch for each update.

Answer

An availability set for the source VM so new virtual machines inherit the same configuration.

Answer

A managed disk snapshot of the OS disk so new VMs can be created from the captured state.

Answer

A proximity placement group so all future VMs land close to the current server.

Question 18

A web tier and an app tier run in separate subnets. Each VM NIC is placed in an application security group named WebASG or AppASG. The administrator must allow only the web tier to reach the app tier on TCP port 8443 and block all other inbound traffic to the app tier. Which NSG rule should be created on the app subnet?

Accepted Answer

Allow TCP 8443 from WebASG to AppASG with a priority lower number than the deny rule.. NSG rules are evaluated in priority order, with lower numbers having higher priority. By placing an Allow rule for TCP 8443 from WebASG to AppASG with a lower priority number than a subsequent Deny-All rule, only traffic from the web tier is permitted, and all other inbound traffic to the app subnet is blocked. This leverages application security groups (ASGs) to define fine-grained, role-based network security policies without relying on IP addresses.

Answer

Allow TCP 8443 from the entire virtual network to the app subnet with a lower priority than the deny rule.

Answer

Allow UDP 8443 from WebASG to AppASG with any priority below 65000.

Answer

Allow TCP 8443 from WebASG to AppASG with a priority higher number than the deny rule.

Question 19

A new Windows VM must be deployed with an application installed, a configuration file copied from a storage account, and a bootstrap script run automatically after the operating system is provisioned. The operations team does not want to log in manually after deployment. What should they use?

Accepted Answer

A Custom Script Extension attached to the VM during provisioning.. The Custom Script Extension (CSE) is the correct choice because it allows you to run a PowerShell or Bash script automatically after the VM is provisioned. This script can install applications, download configuration files from Azure Storage using a managed identity or SAS token, and execute bootstrap commands—all without any manual login. CSE is the standard Azure mechanism for post-deployment configuration automation on both Windows and Linux VMs.

Answer

Azure Bastion to connect through the browser and complete setup interactively.

Answer

A managed identity assigned to the VM without any extensions.

Answer

An availability set so the VM comes online faster during provisioning.

Question 20

A hub-and-spoke environment uses a DNS server VM in the hub VNet at 10.8.0.4 to resolve internal names such as app01.corp.local. The spoke VNet can reach hub VMs by IP after peering, but name resolution still fails from the spoke. What should the administrator configure so VMs in the spoke use the hub DNS server?

Accepted Answer

Configure the spoke VNet to use 10.8.0.4 as a custom DNS server.. In Azure, a spoke VNet must explicitly be configured with a custom DNS server address to use a non-default DNS resolver. By setting the spoke VNet's DNS server to 10.8.0.4, all VMs in the spoke will send their DNS queries to that hub VM, resolving internal names like app01.corp.local. Without this configuration, the spoke VNet uses Azure-provided DNS, which cannot resolve custom private DNS zones hosted on the hub VM.

Answer

Add an inbound NSG rule on the spoke subnet to allow UDP and TCP 53 to 10.8.0.4.

Answer

Create a service endpoint for Microsoft.Storage on the spoke subnet.

Answer

Add a user-defined route for 10.8.0.4/32 pointing to the virtual network gateway.