AZ-104 Practice Exam 52 — 20 Questions

Question 1

An operations team must administer Windows and Linux VMs that have no public IP addresses. They want to connect from a browser without installing a VPN client and without exposing RDP or SSH to the internet. Which Azure service should they deploy?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP and SSH connectivity to virtual machines directly from the Azure portal over TLS, without requiring a public IP address on the VM, a VPN client, or exposing RDP/SSH ports to the internet. It uses a hardened bastion host inside the virtual network, proxying connections via the browser, which satisfies the requirement for browser-based access without additional client software.

Answer

Azure Load Balancer

Answer

VPN Gateway point-to-site only

Answer

Application Gateway

Question 2

A VM-hosted automation tool must call Azure APIs without storing a password or certificate on disk. The identity should disappear automatically when the VM is deleted. Which identity should the administrator assign?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is tied directly to the lifecycle of the Azure VM — when the VM is deleted, the identity is automatically removed. It allows the VM to authenticate to Azure APIs without storing any credentials (password or certificate) on disk, using Azure AD tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254.

Answer

A user-assigned managed identity

Answer

A service principal with a client secret

Answer

A storage account access key

Question 3

Based on the exhibit, where should the new subscription be placed so it inherits the production governance baseline automatically?

Accepted Answer

Place the subscription under Prod-MG.. Option A is correct because placing the new subscription under the Prod-MG management group ensures it automatically inherits the Azure Policy and RBAC assignments applied at that level. Management groups in Azure allow hierarchical governance, and any subscription within a management group inherits policies and role assignments from that group and all parent groups. This enables consistent enforcement of the production governance baseline without manual configuration.

Answer

Place the subscription under Sandbox-MG.

Answer

Create a resource group named Finance-Prod instead of assigning a management group.

Answer

Move the subscription to the tenant root and assign policies later.

Question 4

A company has 18 Azure subscriptions. Production subscriptions must inherit stricter governance than sandbox subscriptions, and central IT wants one place to target future policy assignments to each group. What should the administrator do?

Accepted Answer

Create management groups for Prod and Sandbox, then move subscriptions into them. Management groups allow you to organize Azure subscriptions hierarchically and apply Azure Policy and role-based access control (RBAC) at the management group level, which is inherited by all subscriptions within that group. By creating separate management groups for Prod and Sandbox and moving the respective subscriptions into them, central IT can assign policy assignments once to each management group, ensuring stricter governance for production subscriptions and a lighter touch for sandbox subscriptions.

Answer

Create resource groups named Prod and Sandbox in each subscription

Answer

Use tags on subscriptions to separate production from sandbox

Answer

Apply a CanNotDelete lock to each subscription

Question 5

A team runs a Windows service on an Azure virtual machine that uploads invoices to Blob storage every few minutes. Security policy forbids storing account keys or long-lived SAS tokens on the VM. The service must authenticate without human interaction. What should the administrator configure?

Accepted Answer

Assign the VM a managed identity and grant it Storage Blob Data Contributor on the container or storage account.. Option B is correct because assigning a managed identity to the VM allows it to authenticate to Azure Blob Storage without any secrets stored on the VM. The managed identity provides an automatically managed service principal in Azure AD, and by granting the Storage Blob Data Contributor role, the service obtains the necessary permissions to upload invoices. This satisfies the security policy forbidding account keys or long-lived SAS tokens and enables unattended authentication.

Answer

Generate a SAS token with a 1-year expiry and store it in an encrypted file on the VM.

Answer

Share the storage account access key with the service account and rotate it monthly.

Answer

Create a storage firewall rule that allows the VM's public IP address and keep using anonymous access.

Question 6

Backend virtual machines are rebuilt frequently and often receive different private IP addresses. An administrator must allow the frontend tier to reach the backend tier on TCP 8443 without editing NSG rules every time the backend IP changes. What should the administrator use in the NSG rule?

Accepted Answer

An Application Security Group that contains the backend VMs.. An Application Security Group (ASG) allows you to group backend VMs logically and reference that group in a Network Security Group (NSG) rule. When backend VMs are rebuilt and receive new private IPs, you simply add the new VMs to the same ASG, and the existing NSG rule (which references the ASG as the destination) automatically applies to the new IPs without any manual rule edits. This decouples security policy from dynamic IP addresses, making it the ideal solution for frequently changing backend IPs.

Answer

A static private IP address for each backend VM.

Answer

A user-defined route pointing frontend traffic to the backend subnet.

Answer

A private endpoint for the backend tier.

Question 7

A VM in VNet A can reach a storage account through a private endpoint, but when the VM resolves the storage account name it still gets the public IP address. What should you configure so name resolution returns the private endpoint address?

Accepted Answer

The private DNS zone linked to the VNet. When a private endpoint is created for a storage account, the DNS configuration must be updated so that the storage account's fully qualified domain name resolves to the private endpoint's private IP address instead of the public IP. Linking a private DNS zone (privatelink.blob.core.windows.net) to the virtual network and configuring a virtual network link ensures that the VM's DNS queries for the storage account are answered with the private endpoint IP. Without this, the VM continues to use the public IP from public DNS.

Answer

A user-defined route to the storage private endpoint

Answer

A resource lock on the storage account

Answer

A managed identity for the VM

Question 8

A VM in subnet S1 has two network security groups applied: one at the subnet and one directly on the NIC. The subnet NSG contains DenyAllInbound at priority 100 and AllowHTTPSFromOffice at priority 200. The NIC NSG contains AllowHTTPSFromOffice at priority 150 and no deny rules. Office users still cannot reach the VM on TCP 443. Which two statements are correct? Select two.

Accepted Answer

The subnet-level deny rule is evaluated before the later allow rule because lower priority numbers are processed first.. Option A is correct because Azure Network Security Groups (NSGs) process rules in order of priority, with lower numbers evaluated first. The subnet NSG's DenyAllInbound rule at priority 100 is evaluated before the AllowHTTPSFromOffice rule at priority 200, resulting in an immediate deny for all inbound traffic, including HTTPS from the office. Since the subnet NSG denies the traffic at priority 100, the NIC NSG's allow rule at priority 150 is never reached, as the packet is already blocked.

Answer

The NIC allow rule can override a deny decision already made by the subnet NSG.

Answer

The allow rule must use a private IP source range because public source ranges are not valid in NSG rules.

Answer

A user-defined route with next hop Internet would bypass the NSG deny and restore access.

Question 9

A user had a direct Reader assignment on a virtual machine, but that assignment was removed. The user can still open the VM blade and view its properties. Which two sources could still be granting access? Select two.

Accepted Answer

A Reader assignment at the parent resource group, subscription, or management group scope can still be inherited by the VM.. Option A is correct because Azure RBAC permissions are inherited from higher scopes. Even if a direct Reader assignment on the VM is removed, a Reader role assigned at the parent resource group, subscription, or management group scope will still grant the user read access to the VM through inheritance. This is a fundamental behavior of Azure RBAC, where permissions flow down the hierarchy.

Answer

A CanNotDelete lock on the VM is granting the user permission to view it.

Answer

An Azure Policy assignment that audits the VM is granting read access through compliance evaluation.

Answer

A private endpoint connected to the VM subnet is providing inherited read permission through networking.

Question 10

A VM must be backed up every day, and backups must be retained for several days after creation. Which two settings are configured in an Azure Backup policy? Select two.

Accepted Answer

Backup schedule. Option A is correct because an Azure Backup policy requires a backup schedule to define when the backup job runs (e.g., daily at a specific time). Option B is correct because retention rules specify how long each backup recovery point is kept (e.g., 7 days for daily backups, 30 days for weekly). Together, these two settings form the core of a backup policy, ensuring both the timing and lifespan of backups are controlled.

Answer

Network security group rules

Answer

Private DNS zone records

Answer

Availability set placement

Question 11

A VM named VM01 stopped sending Heartbeat records to Log Analytics 15 minutes ago. Which KQL query should you run to confirm the VM's recent heartbeat entries?

Accepted Answer

Heartbeat | where Computer == "VM01" and TimeGenerated > ago(15m). The Heartbeat table in Log Analytics stores records sent by the Azure Monitor Agent (AMA) or Log Analytics agent every 5 minutes by default. Querying Heartbeat with a filter for Computer == 'VM01' and TimeGenerated > ago(15m) directly checks if any heartbeat records were generated in the last 15 minutes, confirming whether the VM is still reporting. This is the correct approach because Heartbeat is the dedicated table for agent health, and the time filter matches the 15-minute window specified in the question.

Answer

AzureActivity | where ResourceProviderValue == "Microsoft.Compute/virtualMachines"

Answer

Heartbeat | summarize count() by Computer

Answer

Perf | where CounterName == "% Processor Time"

Question 12

A company wants to stop users from deploying resources in any region except East US and West US. Users still need to be able to create resources if they choose an approved region. Which Azure feature should the administrator use?

Accepted Answer

Azure Policy with a deny effect assigned at the appropriate scope.. Azure Policy with a deny effect can enforce that resource deployments are only allowed in specified regions (East US and West US) by evaluating the location property of the resource against a policy definition. When a user attempts to deploy a resource in a non-approved region, the policy engine rejects the request before any resource creation begins, ensuring compliance without blocking approved regions.

Answer

Azure RBAC with a Contributor role at the subscription scope.

Answer

A resource lock at the subscription level.

Answer

A tag requirement in Azure RBAC.

Question 13

A contractor is a member of an Entra security group that has a PIM-eligible Contributor assignment on a resource group. The contractor sees the role in the portal, but deployment fails with a role not active message. The activation policy requires justification, MFA, and manager approval. Which two actions are required before the deployment succeeds? Select two.

Accepted Answer

Activate the eligible role assignment in Privileged Identity Management.. Option A is correct because the contractor has a PIM-eligible role assignment, which means the role is not active until the user activates it through Privileged Identity Management. Activation is a prerequisite for the role to be effective, and without it, any deployment requiring the Contributor role will fail with a 'role not active' message.

Answer

Add the contractor directly to the subscription Owner role to bypass the eligibility workflow.

Answer

Wait for Azure Policy compliance evaluation to finish before trying again.

Answer

Remove the user from the security group and add them back so the role becomes active.

Question 14

A Windows VM in Azure has a public IP address, but administrators on the internet cannot connect by using Remote Desktop. You confirm that the VM is running and the guest firewall allows RDP. What is the most likely Azure-side cause?

Accepted Answer

The NSG does not allow inbound TCP 3389. The most likely Azure-side cause is that a Network Security Group (NSG) associated with the VM's subnet or network interface is blocking inbound traffic on TCP port 3389 (RDP). Even if the VM is running and the guest OS firewall allows RDP, an NSG rule must explicitly permit inbound TCP 3389 from the internet (or a specific source) for Remote Desktop connections to succeed. Without such a rule, the NSG silently drops the packets before they reach the VM.

Answer

The storage account uses LRS

Answer

Azure Advisor is not enabled

Answer

The VM is in an availability set

Question 15

A backup administrator manages three Recovery Services vaults. They need a single place to review the latest job outcome across all vaults, and then drill into the failed job details for one VM. Which two Azure experiences should they use? Select two.

Accepted Answer

Azure Backup center. Azure Backup center provides a single, unified dashboard to monitor backup jobs across multiple Recovery Services vaults, enabling you to quickly view the latest job outcome for all protected workloads. From the Backup center, you can drill into a specific failed job for a VM by selecting it, which navigates to the detailed job view within the associated Recovery Services vault's Backup jobs blade. This combination meets the requirement for a centralized review and granular drill-down.

Answer

Azure Monitor metric chart

Answer

Azure Activity Log

Answer

Resource Health

Question 16

A workload must keep storage available if one availability zone in the primary region fails. Geo-failover is optional, but the account must still meet the zone-failure requirement. Which two redundancy options satisfy this? Select two.

Accepted Answer

ZRS. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three availability zones within a single region, ensuring durability and availability even if one zone fails. This meets the requirement of keeping storage available during a zone failure without relying on geo-failover.

Answer

LRS

Answer

GRS

Answer

RA-GRS

Question 17

A finance application is deployed in a single resource group named rg-finance-app. The team must manage only the resources in that group and must not receive permissions for other resource groups in the subscription. Where should the Contributor role be assigned?

Accepted Answer

At the rg-finance-app resource group scope.. The Contributor role must be assigned at the rg-finance-app resource group scope to restrict permissions exclusively to that group. This ensures the team can manage only the resources within that resource group, without inheriting permissions to other resource groups in the subscription. Role assignments in Azure are inherited from higher scopes (management group, subscription) down to lower scopes, so assigning at the resource group scope is the most specific and restrictive level that meets the requirement.

Answer

At the management group that contains the subscription.

Answer

At the subscription scope.

Answer

At each individual resource in the resource group.

Question 18

A company needs to peer VNet-Prod, which uses 10.30.0.0/16, with VNet-Shared, which uses 10.30.64.0/18. The peering creation fails with an address-space overlap error. The team can renumber the shared environment, but they do not want to change any addresses in VNet-Prod. What should the administrator do before retrying the peering?

Accepted Answer

Reconfigure VNet-Shared to use a non-overlapping address range, then recreate its subnets and migrate workloads.. VNet peering requires that the address spaces of the two VNets do not overlap. VNet-Prod uses 10.30.0.0/16, which includes the range 10.30.64.0/18 used by VNet-Shared, causing the overlap error. The only way to resolve this without changing VNet-Prod is to reconfigure VNet-Shared to use a non-overlapping address range, which involves deleting and recreating its subnets and migrating workloads, as stated in option B.

Answer

Add an NSG that allows traffic between the two VNets.

Answer

Rename VNet-Shared so Azure treats it as a different network.

Answer

Enable gateway transit on both VNets so Azure can route around the overlap.

Question 19

Based on the exhibit, an administrator is trying to peer two VNets so workloads can communicate privately. The peering creation fails. What should the administrator do first?

Accepted Answer

Readdress one of the VNets so the address spaces no longer overlap.. VNet peering requires that the address spaces of the two virtual networks do not overlap. Overlapping address spaces cause routing conflicts and prevent the peering from being established. The administrator must readdress one of the VNets so their IP ranges are unique before retrying the peering.

Answer

Create a user-defined route in VNet-Prod to force traffic through a firewall.

Answer

Enable gateway transit on both VNets and retry the peering.

Answer

Add an NSG rule that allows traffic from the other VNet.

Question 20

A web application on a VM is failing on TCP 8443. The administrator wants to capture packets on the VM NIC to inspect retransmissions and handshake details after the test run. Which Network Watcher capability should be used?

Accepted Answer

Packet capture. Packet capture in Network Watcher allows you to capture network traffic to and from a VM, including TCP retransmissions and handshake details (SYN, SYN-ACK, ACK). This is the correct tool for inspecting raw packets after a test run to diagnose issues like failed connections on TCP 8443.

Answer

IP flow verify

Answer

Connection troubleshoot

Answer

Effective routes