AZ-104 Practice Exam 52 — 20 Questions

Question 1

A reporting team stores read-only analytics files in Azure Blob Storage. The files must replicate to a paired region so they survive a regional outage, and analysts want to read the secondary copy through the secondary endpoint without waiting for failover. Which redundancy option should the administrator choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

RA-GRS. RA-GRS (Read-Access Geo-Redundant Storage) is the correct choice because it replicates data to a paired secondary region (geo-redundancy) and enables read access to the secondary copy via the secondary endpoint without requiring a failover. This meets the requirement for both regional disaster recovery and immediate read access to the secondary copy.

Answer

LRS

Answer

ZRS

Answer

GRS

Question 2

An operations team needs one Azure identity that can be attached to several VMs and kept even if a VM is deleted. Which two statements about a user-assigned managed identity are correct? Select two.

Accepted Answer

It is created as a separate Azure resource.. A user-assigned managed identity is created as a separate Azure resource in its own right, independent of any VM. This means it has its own lifecycle and can be managed (created, deleted, assigned) independently from the VMs it is associated with.

Answer

It is automatically deleted when the first VM is deleted.

Answer

It requires a storage account access key to work.

Answer

It can only be attached to one VM at a time.

Question 3

You need to choose a storage redundancy option that provides the lowest cost and protects data against local hardware failure within a single datacenter only. Which redundancy option should you select?

Accepted Answer

LRS. LRS (Locally Redundant Storage) replicates data three times within a single datacenter (or availability zone) in the same region, protecting against local hardware failures such as disk or server crashes. It is the lowest-cost redundancy option because it does not incur the additional replication costs of cross-zone or cross-region copying. This meets the requirement of protecting data against local hardware failure within a single datacenter only.

Answer

ZRS

Answer

GRS

Answer

GZRS

Question 4

You need to retain Azure Firewall logs for long-term analysis in a Log Analytics workspace and also archive them in a storage account for compliance. What should you configure on the Azure Firewall resource?

Accepted Answer

Diagnostic settings. Diagnostic settings on the Azure Firewall resource allow you to stream platform logs and metrics to a Log Analytics workspace for long-term analysis and to a storage account for archival and compliance. This is the only configuration that simultaneously supports both destinations for the firewall's log data.

Answer

A resource lock

Answer

An availability set

Answer

A VNet peering connection

Question 5

A Windows VM needs a one-time command run immediately after deployment, and a second VM must automatically install an agent and copy configuration files during provisioning. Which two Azure compute features should the administrator use? Select two.

Accepted Answer

Run Command. Run Command (A) is correct because it allows a one-time command to be executed immediately on a Windows VM after deployment, without requiring any agent or extension. Custom Script Extension (B) is correct because it enables automated installation of an agent and copying of configuration files during VM provisioning by running a script (e.g., PowerShell or Bash) as part of the deployment process.

Answer

Azure Monitor agent

Answer

Azure Policy assignment

Answer

Azure Bastion

Question 6

Your company uses Microsoft Entra ID. A new engineer must be able to create virtual machines in RG-Dev but must not be able to assign roles to other users. Which built-in role should you assign at the RG-Dev scope?

Accepted Answer

Virtual Machine Contributor. The Virtual Machine Contributor role provides the exact permissions needed: it allows creating and managing virtual machines within the specified scope (RG-Dev), but explicitly does not include the ability to assign roles to other users. This role grants write access to compute resources while preserving the principle of least privilege.

Answer

Owner

Answer

User Access Administrator

Answer

Reader

Question 7

You deploy several Windows virtual machines and need to install Microsoft Antimalware on each VM without logging on manually. What should you use?

Accepted Answer

A VM extension.. VM extensions are small applications that provide post-deployment configuration and automation tasks on Azure VMs. The Microsoft Antimalware extension can be deployed to multiple VMs at scale via Azure PowerShell, CLI, ARM templates, or policies, enabling silent installation without manual login.

Answer

An NSG application security group.

Answer

A route table.

Answer

A blob lifecycle rule.

Question 8

An app on a VM must connect to Azure SQL Database without using the public endpoint. The database name must resolve to a private IP inside the VNet, and public network access should be disabled. Which two actions should the administrator take? Select two.

Accepted Answer

Create a private endpoint for the Azure SQL server in the VNet.. A private endpoint assigns the Azure SQL Database server a private IP address from the VNet, allowing the VM to connect without using the public endpoint. This ensures traffic stays within the Microsoft backbone and the database name resolves to a private IP inside the VNet.

Answer

Enable a service endpoint for Microsoft.Sql on the subnet.

Answer

Grant the VM's managed identity Reader on the SQL server.

Answer

Keep public network access enabled and restrict the firewall to the VNet.

Question 9

A container group runs a nightly processing job in Azure Container Instances. The job should exit after completing successfully and should not restart automatically. Which restart policy should you configure?

Accepted Answer

Never. The 'Never' restart policy ensures that the container group runs once and does not restart after it exits, regardless of the exit code. This is ideal for a nightly batch job that should complete and then stop permanently without automatic restarts.

Answer

Always

Answer

OnFailure

Answer

Automatic

Question 10

You need to ensure that a contractor can manage virtual machines only in the RG-Test resource group and cannot access any other resource groups in the subscription. What is the best way to achieve this?

Accepted Answer

Assign the Virtual Machine Contributor role at the RG-Test scope. Assigning the Virtual Machine Contributor role at the RG-Test scope grants the contractor permissions to manage virtual machines within that specific resource group only, adhering to the principle of least privilege. This role includes actions like creating, starting, stopping, and deleting VMs, but does not allow access to other resource groups in the subscription because the role assignment is scoped to RG-Test.

Answer

Assign the Virtual Machine Contributor role at the subscription scope

Answer

Assign the Reader role at the RG-Test scope

Answer

Assign the Owner role at the RG-Test scope

Question 11

Two workloads have different resilience requirements. Workload A must stay available if a single datacenter in the region fails. Workload B only needs protection from planned maintenance and a single hardware host failure. Which two deployment models should the administrator use? Select two.

Accepted Answer

Availability Zones for Workload A. Workload A requires protection against a full datacenter failure within a region. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across multiple zones ensures that if one zone (datacenter) fails, the workload remains available in another zone. Workload B only needs protection from planned maintenance and a single hardware host failure. An Availability Set distributes VMs across multiple fault domains (hardware hosts) and update domains (planned maintenance cycles), providing resilience against these specific failure scenarios without requiring zone-level separation.

Answer

Virtual Machine Scale Set without zones

Answer

Proximity Placement Group

Answer

Single VM with premium SSD

Question 12

You need an alert that emails administrators when CPU on VM-DB01 exceeds a threshold. Which two Azure Monitor components work together to achieve this?

Accepted Answer

A metric alert and an action group. A metric alert monitors a specific performance metric (like CPU percentage) on a target resource (VM-DB01) and triggers when the value crosses a defined threshold. An action group defines the notification actions (e.g., sending an email to administrators) that execute when the alert fires. Together, they form the core alerting workflow in Azure Monitor: the metric alert evaluates the condition, and the action group delivers the response.

Answer

A budget alert and a private DNS zone

Answer

A Recovery Services vault and a route table

Answer

An activity log export and a lock

Question 13

A help desk analyst needs to find Azure VM heartbeat records in Log Analytics and limit results to the last 30 minutes. Which two KQL elements should be used? Select two.

Accepted Answer

where. The `where` operator filters the result set based on a specified condition, which is essential for limiting records to those with a timestamp within the last 30 minutes. The `ago()` function returns a datetime value representing the current time minus a given timespan, allowing you to create a dynamic filter like `where TimeGenerated > ago(30m)`. Together, they enable precise time-based filtering in Kusto Query Language (KQL) for Log Analytics.

Answer

summarize

Answer

join

Answer

extend

Question 14

A finance VM is backed up daily. The team wants short-lived snapshots so recently changed files can be recovered quickly, but they also need daily recovery points retained for 30 days. Which two backup policy settings should be configured? Select two.

Accepted Answer

Retain instant restore snapshots for 2 days. Instant restore snapshots are short-lived, locally stored snapshots that allow quick recovery of recently changed files. Setting 'Retain instant restore snapshots for 2 days' ensures these snapshots are available for immediate restores without consuming long-term backup storage. Option B is correct because 'Retain daily recovery points for 30 days' meets the requirement for daily recovery points to be kept for the specified retention period, allowing recovery from any of the last 30 daily backups.

Answer

Run the backup job every 12 hours

Answer

Retain weekly recovery points for 30 days

Answer

Move backup data to Archive tier

Question 15

You need to allow a support engineer to restart virtual machines in the RG-App resource group, but the engineer must not be able to create, delete, or resize the virtual machines. What should you do?

Accepted Answer

Create a custom role that includes restart permissions and assign it at the RG-App scope. The Virtual Machine Contributor role includes permissions to restart VMs but also allows creating, deleting, and resizing VMs, which violates the requirement. A custom role with only the Microsoft.Compute/virtualMachines/restart/action permission assigned at the RG-App scope grants the exact restart capability without broader management rights.

Answer

Assign the Virtual Machine Contributor role at the RG-App scope

Answer

Assign the Contributor role at the subscription scope

Answer

Assign the Reader role at the RG-App scope

Question 16

A Linux VM deployed from a custom image shows only a black screen after reboot, and SSH never becomes available. The administrator needs to inspect the startup process without logging into the OS. Which two Azure features should be used? Select two.

Accepted Answer

Boot diagnostics. Boot diagnostics captures serial console output and screenshots of the VM during boot, allowing you to see kernel panics, driver failures, or bootloader errors even when the OS is unresponsive. Azure Serial Console provides a text-based console connection to the VM at the hypervisor layer, enabling interactive troubleshooting of the boot process (e.g., GRUB recovery, initramfs issues) without requiring network connectivity or SSH.

Answer

Azure Site Recovery

Answer

VM application health extension

Answer

Azure Backup restore point

Question 17

A team moved blob data to the Archive tier to minimize cost. They now need to restore a few files for an audit. Which two statements are true about accessing archived blobs? Select two.

Accepted Answer

Rehydration is required before the blob can be read or copied.. Archived blobs are in an offline state and cannot be read or copied directly. They must first be rehydrated to an online tier (Hot or Cool) through a process that changes the blob's tier or copies it to a new online blob. This rehydration process is asynchronous and takes time, depending on the priority set.

Answer

Archived blobs can be read immediately through normal blob reads.

Answer

Archive tier provides the fastest retrieval time.

Answer

Changing a blob from Archive to Hot completes instantly and synchronously.

Question 18

A team runs a Windows VM in Azure that uploads invoices to a blob container. Security policy forbids storing storage account keys or long-lived SAS tokens on the VM. The app must keep working until the VM is deleted, and access should disappear automatically when the VM is removed. What should the administrator configure?

Accepted Answer

Assign the VM's managed identity the Storage Blob Data Contributor role on the storage account or container.. Assigning the VM's managed identity the Storage Blob Data Contributor role on the storage account or container allows the VM to authenticate to Azure Blob Storage without storing any keys or tokens. Managed identities provide an automatically managed service principal in Azure AD, and the application can use the Azure Instance Metadata Service (IMDS) to obtain an access token. When the VM is deleted, the managed identity is automatically removed, and the role assignment becomes invalid, so access disappears immediately.

Answer

Create an account SAS token with write permissions and store it in a secure file on the VM.

Answer

Assign the Reader role on the storage account to the VM's computer account.

Answer

Enable shared key access and rotate the storage account keys regularly.

Question 19

After applying a custom image, a Linux VM stops at a black screen before the sign-in prompt. The administrator cannot use RDP or SSH and needs the fastest way to inspect the boot process. Which two actions should they take? Select two.

Accepted Answer

Enable Boot diagnostics on the virtual machine.. Enabling Boot diagnostics on the virtual machine allows the administrator to capture serial console output and screenshots of the VM during boot. This is the fastest way to inspect the boot process without requiring network connectivity (RDP/SSH), as the serial log provides kernel-level messages and the screenshot shows the display state at the point of failure.

Answer

Reimage the VM immediately to a clean managed disk.

Answer

Increase the VM size to a larger SKU.

Answer

Reset the network interface configuration from the portal.

Question 20

A company wants to peer a new spoke virtual network with an existing hub VNet. The hub uses 10.20.0.0/16. The spoke was created with 10.20.1.0/24 because that range was still available in the IPAM spreadsheet. VNet peering creation fails. What should the administrator do first?

Accepted Answer

Change the spoke VNet address space to a non-overlapping range, then recreate or update peering.. VNet peering in Azure requires that the address spaces of the peered virtual networks do not overlap. The hub uses 10.20.0.0/16, and the spoke uses 10.20.1.0/24, which is a subset of the hub's range. This overlap causes the peering creation to fail. The administrator must first change the spoke's address space to a non-overlapping range (e.g., 10.21.0.0/24) and then recreate or update the peering.

Answer

Enable gateway transit on the hub and retry the peering.

Answer

Add a route table to the spoke subnet so the networks can communicate.

Answer

Configure a custom DNS server in the spoke to translate the overlapping range.