AZ-104 Practice Exam 52 — 20 Questions

Question 1

A Windows VM needs a one-time command run immediately after deployment, and a second VM must automatically install an agent and copy configuration files during provisioning. Which two Azure compute features should the administrator use? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Run Command. Run Command (A) is correct because it allows a one-time command to be executed immediately on a Windows VM after deployment, without requiring any agent or extension. Custom Script Extension (B) is correct because it enables automated installation of an agent and copying of configuration files during VM provisioning by running a script (e.g., PowerShell or Bash) as part of the deployment process.

Answer

Azure Monitor agent

Answer

Azure Policy assignment

Answer

Azure Bastion

Question 2

Your company uses Microsoft Entra ID. A new engineer must be able to create virtual machines in RG-Dev but must not be able to assign roles to other users. Which built-in role should you assign at the RG-Dev scope?

Accepted Answer

Virtual Machine Contributor. The Virtual Machine Contributor role provides the exact permissions needed: it allows creating and managing virtual machines within the specified scope (RG-Dev), but explicitly does not include the ability to assign roles to other users. This role grants write access to compute resources while preserving the principle of least privilege.

Answer

Owner

Answer

User Access Administrator

Answer

Reader

Question 3

You deploy several Windows virtual machines and need to install Microsoft Antimalware on each VM without logging on manually. What should you use?

Accepted Answer

A VM extension.. VM extensions are small applications that provide post-deployment configuration and automation tasks on Azure VMs. The Microsoft Antimalware extension can be deployed to multiple VMs at scale via Azure PowerShell, CLI, ARM templates, or policies, enabling silent installation without manual login.

Answer

An NSG application security group.

Answer

A route table.

Answer

A blob lifecycle rule.

Question 4

An app on a VM must connect to Azure SQL Database without using the public endpoint. The database name must resolve to a private IP inside the VNet, and public network access should be disabled. Which two actions should the administrator take? Select two.

Accepted Answer

Create a private endpoint for the Azure SQL server in the VNet.. A private endpoint assigns the Azure SQL Database server a private IP address from the VNet, allowing the VM to connect without using the public endpoint. This ensures traffic stays within the Microsoft backbone and the database name resolves to a private IP inside the VNet.

Answer

Enable a service endpoint for Microsoft.Sql on the subnet.

Answer

Grant the VM's managed identity Reader on the SQL server.

Answer

Keep public network access enabled and restrict the firewall to the VNet.

Question 5

A container group runs a nightly processing job in Azure Container Instances. The job should exit after completing successfully and should not restart automatically. Which restart policy should you configure?

Accepted Answer

Never. The 'Never' restart policy ensures that the container group runs once and does not restart after it exits, regardless of the exit code. This is ideal for a nightly batch job that should complete and then stop permanently without automatic restarts.

Answer

Always

Answer

OnFailure

Answer

Automatic

Question 6

You need to ensure that a contractor can manage virtual machines only in the RG-Test resource group and cannot access any other resource groups in the subscription. What is the best way to achieve this?

Accepted Answer

Assign the Virtual Machine Contributor role at the RG-Test scope. Assigning the Virtual Machine Contributor role at the RG-Test scope grants the contractor permissions to manage virtual machines within that specific resource group only, adhering to the principle of least privilege. This role includes actions like creating, starting, stopping, and deleting VMs, but does not allow access to other resource groups in the subscription because the role assignment is scoped to RG-Test.

Answer

Assign the Virtual Machine Contributor role at the subscription scope

Answer

Assign the Reader role at the RG-Test scope

Answer

Assign the Owner role at the RG-Test scope

Question 7

Two workloads have different resilience requirements. Workload A must stay available if a single datacenter in the region fails. Workload B only needs protection from planned maintenance and a single hardware host failure. Which two deployment models should the administrator use? Select two.

Accepted Answer

Availability Zones for Workload A. Workload A requires protection against a full datacenter failure within a region. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across multiple zones ensures that if one zone (datacenter) fails, the workload remains available in another zone. Workload B only needs protection from planned maintenance and a single hardware host failure. An Availability Set distributes VMs across multiple fault domains (hardware hosts) and update domains (planned maintenance cycles), providing resilience against these specific failure scenarios without requiring zone-level separation.

Answer

Virtual Machine Scale Set without zones

Answer

Proximity Placement Group

Answer

Single VM with premium SSD

Question 8

A help desk analyst needs to find Azure VM heartbeat records in Log Analytics and limit results to the last 30 minutes. Which two KQL elements should be used? Select two.

Accepted Answer

where. The `where` operator filters the result set based on a specified condition, which is essential for limiting records to those with a timestamp within the last 30 minutes. The `ago()` function returns a datetime value representing the current time minus a given timespan, allowing you to create a dynamic filter like `where TimeGenerated > ago(30m)`. Together, they enable precise time-based filtering in Kusto Query Language (KQL) for Log Analytics.

Answer

summarize

Answer

join

Answer

extend

Question 9

A finance VM is backed up daily. The team wants short-lived snapshots so recently changed files can be recovered quickly, but they also need daily recovery points retained for 30 days. Which two backup policy settings should be configured? Select two.

Accepted Answer

Retain instant restore snapshots for 2 days. Instant restore snapshots are short-lived, locally stored snapshots that allow quick recovery of recently changed files. Setting 'Retain instant restore snapshots for 2 days' ensures these snapshots are available for immediate restores without consuming long-term backup storage. Option B is correct because 'Retain daily recovery points for 30 days' meets the requirement for daily recovery points to be kept for the specified retention period, allowing recovery from any of the last 30 daily backups.

Answer

Run the backup job every 12 hours

Answer

Retain weekly recovery points for 30 days

Answer

Move backup data to Archive tier

Question 10

You need to allow a support engineer to restart virtual machines in the RG-App resource group, but the engineer must not be able to create, delete, or resize the virtual machines. What should you do?

Accepted Answer

Create a custom role that includes restart permissions and assign it at the RG-App scope. The Virtual Machine Contributor role includes permissions to restart VMs but also allows creating, deleting, and resizing VMs, which violates the requirement. A custom role with only the Microsoft.Compute/virtualMachines/restart/action permission assigned at the RG-App scope grants the exact restart capability without broader management rights.

Answer

Assign the Virtual Machine Contributor role at the RG-App scope

Answer

Assign the Contributor role at the subscription scope

Answer

Assign the Reader role at the RG-App scope

Question 11

A Linux VM deployed from a custom image shows only a black screen after reboot, and SSH never becomes available. The administrator needs to inspect the startup process without logging into the OS. Which two Azure features should be used? Select two.

Accepted Answer

Boot diagnostics. Boot diagnostics captures serial console output and screenshots of the VM during boot, allowing you to see kernel panics, driver failures, or bootloader errors even when the OS is unresponsive. Azure Serial Console provides a text-based console connection to the VM at the hypervisor layer, enabling interactive troubleshooting of the boot process (e.g., GRUB recovery, initramfs issues) without requiring network connectivity or SSH.

Answer

Azure Site Recovery

Answer

VM application health extension

Answer

Azure Backup restore point

Question 12

A team moved blob data to the Archive tier to minimize cost. They now need to restore a few files for an audit. Which two statements are true about accessing archived blobs? Select two.

Accepted Answer

Rehydration is required before the blob can be read or copied.. Archived blobs are in an offline state and cannot be read or copied directly. They must first be rehydrated to an online tier (Hot or Cool) through a process that changes the blob's tier or copies it to a new online blob. This rehydration process is asynchronous and takes time, depending on the priority set.

Answer

Archived blobs can be read immediately through normal blob reads.

Answer

Archive tier provides the fastest retrieval time.

Answer

Changing a blob from Archive to Hot completes instantly and synchronously.

Question 13

A company creates new Azure subscriptions every month. Central IT wants all production subscriptions to inherit the same governance baseline automatically, while sandbox subscriptions remain separate. What should the administrator implement?

Accepted Answer

Organize subscriptions under management groups and assign the baseline at the appropriate management group.. Management groups allow hierarchical organization of Azure subscriptions, enabling the assignment of Azure Policy and RBAC at the management group level. By placing all production subscriptions under a dedicated management group and assigning the governance baseline (e.g., Azure Policy initiatives) to that group, new subscriptions automatically inherit the baseline without manual intervention. Sandbox subscriptions remain separate by being placed in a different management group or at the root level without the baseline.

Answer

Apply all governance controls individually to each new subscription after it is created.

Answer

Use a resource lock on the subscription root.

Answer

Place all resources into one shared resource group per business unit.

Question 14

A team runs a Windows VM in Azure that uploads invoices to a blob container. Security policy forbids storing storage account keys or long-lived SAS tokens on the VM. The app must keep working until the VM is deleted, and access should disappear automatically when the VM is removed. What should the administrator configure?

Accepted Answer

Assign the VM's managed identity the Storage Blob Data Contributor role on the storage account or container.. Assigning the VM's managed identity the Storage Blob Data Contributor role on the storage account or container allows the VM to authenticate to Azure Blob Storage without storing any keys or tokens. Managed identities provide an automatically managed service principal in Microsoft Entra ID, and the application can use the Azure Instance Metadata Service (IMDS) to obtain an access token. When the VM is deleted, the managed identity is automatically removed, and the role assignment becomes invalid, so access disappears immediately.

Answer

Create an account SAS token with write permissions and store it in a secure file on the VM.

Answer

Assign the Reader role on the storage account to the VM's computer account.

Answer

Enable shared key access and rotate the storage account keys regularly.

Question 15

After applying a custom image, a Linux VM stops at a black screen before the sign-in prompt. The administrator cannot use RDP or SSH and needs the fastest way to inspect the boot process. Which two actions should they take? Select two.

Accepted Answer

Enable Boot diagnostics on the virtual machine.. Enabling Boot diagnostics on the virtual machine allows the administrator to capture serial console output and screenshots of the VM during boot. This is the fastest way to inspect the boot process without requiring network connectivity (RDP/SSH), as the serial log provides kernel-level messages and the screenshot shows the display state at the point of failure.

Answer

Reimage the VM immediately to a clean managed disk.

Answer

Increase the VM size to a larger SKU.

Answer

Reset the network interface configuration from the portal.

Question 16

Based on the exhibit, what should the administrator configure so the operations team receives an email when the VM's average CPU stays above 80% for 10 minutes?

Accepted Answer

Create an action group and attach it to the metric alert rule.. To send an email when a metric threshold is breached, you must first create an action group that defines the notification action (e.g., email, SMS). Then, when configuring the metric alert rule for 'Percentage CPU' with a condition of 'greater than 80%' for 10 minutes, you attach that action group to the alert rule. This ensures that when the alert fires, the defined email notification is sent to the operations team.

Answer

Create a diagnostic setting on the VM and send platform logs to Log Analytics.

Answer

Assign a Reader role to the operations team on the VM resource.

Answer

Enable a resource lock on the VM to prevent CPU spikes.

Question 17

A company wants to peer a new spoke virtual network with an existing hub VNet. The hub uses 10.20.0.0/16. The spoke was created with 10.20.1.0/24 because that range was still available in the IPAM spreadsheet. VNet peering creation fails. What should the administrator do first?

Accepted Answer

Change the spoke VNet address space to a non-overlapping range, then recreate or update peering.. VNet peering in Azure requires that the address spaces of the peered virtual networks do not overlap. The hub uses 10.20.0.0/16, and the spoke uses 10.20.1.0/24, which is a subset of the hub's range. This overlap causes the peering creation to fail. The administrator must first change the spoke's address space to a non-overlapping range (e.g., 10.21.0.0/24) and then recreate or update the peering.

Answer

Enable gateway transit on the hub and retry the peering.

Answer

Add a route table to the spoke subnet so the networks can communicate.

Answer

Configure a custom DNS server in the spoke to translate the overlapping range.

Question 18

Why is centralized logging especially helpful during incident investigation?

Accepted Answer

It helps investigators analyze related events from multiple devices in one place.. Centralized logging aggregates logs from multiple sources (servers, firewalls, applications) into a single repository, enabling investigators to correlate events across devices during an incident. This eliminates the need to manually access each device's local logs, speeding up root cause analysis and providing a unified timeline of activities.

Answer

It guarantees that no attack can ever succeed.

Answer

It replaces the need for access control.

Answer

It forces all devices to use the same VLAN.

Question 19

You need to run a PowerShell script inside a newly deployed Azure virtual machine to configure application settings immediately after deployment. Which feature should you use?

Accepted Answer

A Custom Script Extension. The Custom Script Extension (CSE) is the correct choice because it allows you to run a PowerShell script on an Azure VM after deployment, making it ideal for configuring application settings. CSE downloads and executes scripts on the VM using the Azure VM agent, and it can be invoked during VM creation or post-deployment via ARM templates, Azure CLI, or PowerShell.

Answer

Azure Policy

Answer

Boot diagnostics

Answer

An availability set

Question 20

VNet-Hub and VNet-Spoke1 are in the same region and subscription. Resources in the two VNets must communicate over the Microsoft backbone without using a VPN gateway. What should you configure?

Accepted Answer

VNet peering. VNet peering enables direct connectivity between two virtual networks in the same region and subscription over the Microsoft backbone, without requiring a VPN gateway or public internet. This is the correct solution because it provides low-latency, private communication using the Azure infrastructure, and it supports resources in both VNets to communicate as if they were on the same network.

Answer

A site-to-site VPN gateway in each VNet

Answer

A private endpoint

Answer

A service endpoint