AZ-104 Practice Exam 51 — 20 Questions

Question 1

A reporting server will run an in-memory analytics workload that needs 8 vCPUs and 64 GiB RAM. CPU usage is expected to stay moderate, but the application benefits most from memory capacity. Which VM family should the administrator choose as the starting point?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

E-series. The E-series (memory-optimized) VM family is designed for in-memory analytics workloads that require high memory-to-CPU ratios. With 8 vCPUs and 64 GiB RAM, the workload demands 8 GiB per vCPU, which aligns with E-series specifications (typically 8–16 GiB per vCPU). D-series offers a balanced ratio (4 GiB per vCPU) and would not provide sufficient memory capacity for this workload.

Answer

B-series

Answer

D-series

Answer

F-series

Question 2

An application needs more data disk capacity, but the VM can keep using the same managed disk. Which two statements are true when you resize a managed data disk? Select two.

Accepted Answer

You can increase the managed disk size without redeploying the VM.. Azure managed disks support online resizing: you can increase the size of a managed data disk while the VM remains running, without any need to stop, deallocate, or redeploy the VM. This is possible because the underlying Azure storage infrastructure can extend the virtual hard disk (VHD) file without disrupting the VM's I/O operations. After the resize, the guest OS sees the new capacity, but the partition and filesystem must be extended manually.

Answer

You must create a brand-new VM before resizing the disk.

Answer

Resizing a disk always shrinks it back to a smaller size.

Answer

The VM size must always change whenever disk capacity changes.

Question 3

You need to give a third-party auditor temporary read-only access to specific blobs in a container without sharing the storage account keys. Which feature should you use?

Accepted Answer

A shared access signature (SAS). A shared access signature (SAS) is the correct choice because it provides delegated, time-limited, and permission-restricted access to specific Azure Storage resources—in this case, blobs—without exposing the storage account keys. You can generate a service-level SAS token scoped to individual blobs with read-only permissions and an expiration time, allowing the auditor to access only the required blobs. This meets the requirement for temporary, read-only access while maintaining security and granular control.

Answer

A storage account key

Answer

A resource lock

Answer

Blob versioning

Question 4

A policy that requires secure transfer for storage accounts has been assigned to a subscription with the DeployIfNotExists effect. Several existing storage accounts are still noncompliant and have not changed. What should you do next to update those existing resources automatically?

Accepted Answer

Create and run a remediation task for the policy assignment. The DeployIfNotExists effect on a policy assignment automatically deploys a template to remediate noncompliant resources, but only for new or updated resources. Existing noncompliant resources require a manual remediation task to trigger the deployment of the template. Creating and running a remediation task for the policy assignment applies the required secure transfer configuration to all existing storage accounts, bringing them into compliance.

Answer

Assign a CanNotDelete lock to the storage accounts

Answer

Move the storage accounts into a new resource group

Answer

Grant the administrators a higher RBAC role on the subscription

Question 5

Two Azure virtual machines run the same automation script and both need access to Key Vault and Storage. The script must keep working if one VM is redeployed, and the team wants the same identity to be usable by both VMs. What should the administrator use?

Accepted Answer

A user-assigned managed identity attached to both VMs. A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource and can be assigned to multiple VMs. This ensures both VMs share the same identity for accessing Key Vault and Storage, and the identity persists independently of any single VM's lifecycle, so redeploying one VM does not break access for the other.

Answer

A system-assigned managed identity on each VM

Answer

A service principal stored in a configuration file on the VMs

Answer

A storage account access key stored in the script

Question 6

A VM-hosted automation tool must call Azure Resource Manager APIs, but the team will not store a password, certificate, or client secret on the VM. The identity should also disappear automatically when the VM is deleted. Which identity should be assigned?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is the correct choice because it is tied directly to the lifecycle of the Azure VM—when the VM is deleted, the identity is automatically removed. It allows the automation tool to authenticate to Azure Resource Manager APIs without storing any credentials (password, certificate, or client secret) on the VM, using Azure AD tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint.

Answer

User-assigned managed identity

Answer

Service principal with a client secret

Answer

Shared access signature

Question 7

A stateless web service runs on identical VMs and must keep serving traffic if Microsoft takes one datacenter out of service in the region. The load must also scale out automatically during peak hours, and instances should be spread across independent zone boundaries. Which two configurations should the administrator use? Select two.

Accepted Answer

Virtual machine scale set. A is correct because Virtual Machine Scale Sets (VMSS) provide built-in autoscaling capabilities that automatically adjust the number of VM instances based on demand (e.g., CPU or memory metrics), ensuring the web service scales out during peak hours. Additionally, VMSS supports spreading instances across availability zones, which protects against a single datacenter failure by distributing VMs across independent zone boundaries within a region.

Answer

Availability set

Answer

Proximity placement group

Answer

Dedicated host

Question 8

Your company has two Azure subscriptions named Dev-Sub and Prod-Sub. You need to ensure that a user can create resource groups only in Dev-Sub and nowhere else. What should you do?

Accepted Answer

Assign the Contributor role at the Dev-Sub subscription scope.. The Contributor role allows a user to create and manage resources, including resource groups, within the assigned scope. By assigning this role at the Dev-Sub subscription scope, the user gains the necessary permissions to create resource groups only in that subscription, as Azure RBAC permissions are inherited downward but not across sibling scopes. This ensures the user cannot create resource groups in Prod-Sub or any other subscription.

Answer

Assign the Owner role at the tenant root scope.

Answer

Assign the Reader role at the Dev-Sub subscription scope.

Answer

Assign the Contributor role at the management group scope that contains both subscriptions.

Question 9

Based on the exhibit, what next hop will the VM use when it sends traffic to 10.30.5.10?

Accepted Answer

Virtual network gateway. The VM's effective route table shows a route for 10.30.5.0/24 with a next hop type of 'Virtual network gateway'. Since 10.30.5.10 falls within this prefix, the VM will use the virtual network gateway as the next hop. This overrides the default virtual network (local) route because it is a more specific prefix match.

Answer

Virtual appliance at the user-defined next hop

Answer

Internet

Answer

Virtual network

Question 10

You need to reduce compute cost for a development virtual machine that is used only during business hours on weekdays. Which option provides the most direct built-in cost optimization?

Accepted Answer

Enable auto-shutdown on the VM.. B is correct because enabling auto-shutdown on the VM directly stops the VM during non-business hours (e.g., evenings and weekends), eliminating compute costs (which are billed per second while the VM is running). This is a built-in Azure feature that requires no additional infrastructure or manual intervention, making it the most direct cost-optimization method for a development VM with a predictable usage schedule.

Answer

Place the VM in an availability set.

Answer

Convert the OS disk to premium SSD v2.

Answer

Create a site-to-site VPN.

Question 11

Your organization wants all subscriptions under the Corp-MG management group to inherit a policy that blocks deployment of resource types not on an approved list. Which Azure feature should you use?

Accepted Answer

Azure Policy assigned at the management group scope. Azure Policy assigned at the management group scope is the correct choice because it allows you to enforce governance rules across all subscriptions within a management group hierarchy. By creating a policy definition that blocks deployment of resource types not on an approved list and assigning it to the Corp-MG management group, the policy will be inherited by all child subscriptions, ensuring consistent compliance without manual configuration per subscription.

Answer

A custom RBAC role assigned at the tenant root

Answer

A ReadOnly lock on each subscription

Answer

A budget alert for each subscription

Question 12

Traffic from VM-App01 is taking an unexpected path to the internet through a network virtual appliance. You need to determine which routes are actually applied to the VM network interface. Which Azure feature should you use?

Accepted Answer

Effective routes for the network interface. Effective routes for a network interface show the actual routes applied to the VM's NIC after combining all route sources (system routes, BGP, and user-defined routes). This allows you to verify whether traffic is being forced through the NVA or taking an unexpected path, by inspecting the next hop type and IP address for the 0.0.0.0/0 route.

Answer

NSG flow logs

Answer

Azure Policy compliance

Answer

The subscription activity log

Question 13

You need to expose a web application running on several VMs and distribute traffic across them based on HTTP request attributes such as URL path. Which service should you use?

Accepted Answer

Azure Application Gateway. Azure Application Gateway is a Layer 7 load balancer that can route traffic based on HTTP request attributes such as URL path, host headers, or query strings. This allows you to distribute incoming web traffic across multiple VMs based on the specific URL path (e.g., /images to one backend pool, /api to another), which is exactly what the question requires.

Answer

Azure Load Balancer

Answer

Traffic Manager

Answer

Network Watcher

Question 14

You want Azure to identify security improvements, underutilized resources, and cost-saving opportunities across your subscriptions. Which Azure service should you use?

Accepted Answer

Azure Advisor. Azure Advisor is the correct service because it provides personalized recommendations across five categories: Reliability, Security, Performance, Operational Excellence, and Cost. It analyzes your deployed resources and usage patterns to identify security improvements (e.g., missing network security groups), underutilized resources (e.g., idle virtual machines), and cost-saving opportunities (e.g., reserved instance purchases). This aligns directly with the question's requirement for a unified service that delivers these insights across subscriptions.

Answer

Azure Policy

Answer

Azure Backup

Answer

Virtual network peering

Question 15

A subnet has a route table with a 0.0.0.0/0 user-defined route to an on-premises virtual appliance. The business now wants Azure VM outbound internet traffic to use a NAT gateway so the public source IP stays consistent, and the firewall appliance is no longer required for internet egress. What should the administrator do?

Accepted Answer

Remove the 0.0.0.0/0 UDR and associate the NAT gateway with the subnet.. Removing the 0.0.0.0/0 user-defined route (UDR) that points to the on-premises virtual appliance and associating a NAT gateway with the subnet ensures that all outbound internet traffic from Azure VMs uses the NAT gateway's public IP address. The NAT gateway automatically creates a default route (0.0.0.0/0) with a next hop type of 'Internet' for the subnet, overriding any conflicting UDRs. This provides a consistent source IP for internet egress without requiring the firewall appliance.

Answer

Keep the default route to the virtual appliance and add the NAT gateway to the subnet.

Answer

Change the route next hop to Virtual network gateway.

Answer

Create an NSG outbound rule that allows internet traffic from the subnet.

Question 16

Order the steps to configure Azure AD Connect for hybrid identity.

Accepted Answer

Install Azure AD Connect, then choose sync method, then connect to Azure AD, then filter domains/OUs, then finalize. Install, choose sync method, connect to Azure AD, filter domains, then finalize.

Answer

Install Azure AD Connect, then connect to Azure AD, then choose sync method, then filter domains/OUs, then finalize

Answer

Install Azure AD Connect, then choose sync method, then filter domains/OUs, then connect to Azure AD, then finalize

Answer

Install Azure AD Connect, then choose sync method, then connect to Azure AD, then finalize, then filter domains/OUs

Question 17

A backup administrator manages three Recovery Services vaults. They need a single place to review the latest job outcome across all vaults, and then drill into the failed job details for one VM. Which two Azure experiences should they use? Select two.

Accepted Answer

Azure Backup center. Azure Backup center provides a single, unified dashboard to monitor backup jobs across multiple Recovery Services vaults, enabling you to quickly view the latest job outcome for all protected workloads. From the Backup center, you can drill into a specific failed job for a VM by selecting it, which navigates to the detailed job view within the associated Recovery Services vault's Backup jobs blade. This combination meets the requirement for a centralized review and granular drill-down.

Answer

Azure Monitor metric chart

Answer

Azure Activity Log

Answer

Resource Health

Question 18

A virtual machine scale set must increase instance count when average CPU exceeds 75 percent and decrease when it stays below 30 percent. What Azure feature should you configure?

Accepted Answer

Autoscale settings. Autoscale settings are the correct feature because they allow you to define scale-out and scale-in rules based on performance metrics like average CPU percentage. In this scenario, you would configure a scale-out rule to increase the instance count when average CPU exceeds 75% and a scale-in rule to decrease it when CPU stays below 30%.

Answer

Availability zones

Answer

Azure Policy

Answer

Update management

Question 19

Which two settings can you configure in an Azure Backup policy for a virtual machine? Select two.

Accepted Answer

Backup schedule. An Azure Backup policy for a virtual machine includes a 'Backup schedule' setting that defines how often (e.g., daily or weekly) and at what time the backup job runs. This schedule controls the frequency of recovery point creation, which is essential for meeting recovery point objectives (RPOs).

Answer

Virtual network peering

Answer

Network security group rules

Answer

Public IP allocation

Question 20

You want to send a storage account's platform logs to a workspace so they can be queried with KQL later. Which two items are part of the required configuration? Select two.

Accepted Answer

Diagnostic settings on the storage account. A is correct because diagnostic settings on the storage account are the mechanism that defines which platform logs (e.g., storage read/write/delete operations) are collected and where they are sent. Without configuring diagnostic settings, the storage account does not emit logs to any destination. B is correct because a Log Analytics workspace is the required destination for storing the logs so they can be queried with KQL; it provides the ingestion and retention infrastructure for log analytics.

Answer

A network security group

Answer

A Recovery Services vault

Answer

An availability zone assignment