AZ-104 Practice Exam 53 — 20 Questions

Question 1

A web app and a VM scale set both need the same Azure identity to read secrets from Key Vault. The identity must survive redeployment, and the team wants to remove it centrally without changing each resource individually. Which identity type should they use?

Accepted Answer

A user-assigned managed identity attached to both resources.. A user-assigned managed identity (B) is the correct choice because it is created as a standalone Azure resource, can be attached to multiple Azure resources (e.g., a web app and a VM scale set), and persists independently of those resources. This allows the identity to survive redeployment of either resource and enables centralized removal (by deleting the user-assigned identity) without needing to modify each resource individually.

Answer

A system-assigned managed identity on each resource.

Answer

A service principal with a client secret stored in application settings.

Answer

A resource lock on the Key Vault to preserve the secret access path.

Question 2

A Windows VM must automatically run a setup script after provisioning to install an agent, create a folder, and write configuration files. The administrator wants the script to be delivered through Azure management and run without a human signing in. What should be used?

Accepted Answer

Custom Script Extension. The Custom Script Extension (CSE) is the correct Azure feature to automatically run a setup script on a Windows VM after provisioning. It downloads and executes scripts from Azure Storage or GitHub, runs as the local system account, and requires no user sign-in, making it ideal for post-deployment configuration like installing agents and writing files.

Answer

Availability set

Answer

Azure Load Balancer

Answer

Route table

Question 3

A Windows VM must install a monitoring agent, run a bootstrap script during provisioning, and download a configuration file from an Azure resource without storing any credentials in the script or on disk. Which two Azure compute features should the administrator use? Select two.

Accepted Answer

Use a Custom Script Extension to run the bootstrap actions after provisioning.. The Custom Script Extension (CSE) is the correct Azure feature to run a bootstrap script after provisioning because it executes a script on the VM during or after deployment, enabling installation of the monitoring agent and other configuration tasks. It is the standard method for post-deployment automation on Azure VMs, and it can reference a script stored in Azure Storage or a public URL without embedding credentials.

Answer

Enable boot diagnostics and review the serial console output.

Answer

Attach a read-only managed disk to store the configuration file.

Answer

Use an availability set to keep the bootstrap script highly available.

Question 4

A Windows VM fails shortly after startup when a custom extension runs, and the administrator cannot use RDP to inspect the machine. The goal is to see what happened during boot and confirm whether the failure occurred before the guest OS finished loading. Which two features should be used first? Select two.

Accepted Answer

Boot diagnostics. Boot diagnostics captures serial console output and screenshots of the VM during the boot process, allowing you to see if the OS failed to load before the guest OS finished. Azure Serial Console provides text-based, keyboard-focused access to the VM even when RDP is unavailable, enabling you to inspect boot logs and interact with the OS during startup. Together, they let you determine whether the custom extension failure occurred before or after the OS fully loaded.

Answer

Availability set

Answer

Managed disk snapshots

Answer

Azure Monitor autoscale

Question 5

A company has a hub virtual network with a DNS server VM at 10.50.0.4 that hosts internal names such as app01.corp.local. A spoke virtual network is already peered to the hub. VMs in the spoke can reach resources in the hub by IP address, but they cannot resolve the internal host names. The company wants to keep DNS centralized and avoid deploying another DNS server in the spoke. What should the administrator configure?

Accepted Answer

Set the spoke virtual network to use 10.50.0.4 as a custom DNS server.. Option B is correct because the spoke virtual network must be configured to use the hub DNS server (10.50.0.4) as a custom DNS server. This ensures that all VMs in the spoke send DNS queries to the hub server, which hosts the internal zone for corp.local. Since the hub and spoke are already peered, DNS traffic can flow over the peering connection without additional routing, keeping DNS centralized.

Answer

Create a private DNS zone for corp.local and link it only to the spoke subnet.

Answer

Add a user-defined route in the spoke to send DNS traffic to the hub VNet.

Answer

Enable gateway transit on the peering and set use remote gateways on the spoke.

Question 6

An admin enables backup on a newly deployed Azure VM, but every backup job fails immediately with a message that the VM agent is not ready. What should the administrator verify first?

Accepted Answer

The Azure VM Agent is installed, running, and able to provision backup-related extensions.. The Azure VM Agent (also known as the Windows Guest Agent or Linux Agent) is required for the Azure Backup service to install the backup extension (e.g., IaaSBcdrExtension for Windows or SnapshotV2 for Linux). If the agent is not installed, not running, or is in a 'Not Ready' state, the backup extension cannot be provisioned, causing immediate failure. The administrator should first verify that the VM Agent is installed and its status is 'Ready' in the VM's properties.

Answer

The VM is placed in an availability zone that supports backup.

Answer

The VM has a public IP address assigned for outbound connectivity.

Answer

The VM is added to a load balancer backend pool.

Question 7

A web app running on an Azure VM must read files from Azure Blob Storage without storing any passwords, secrets, or access keys on the VM. The identity should be tied to that VM and removed automatically if the VM is deleted. What should you enable?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is the correct choice because it creates an identity in Azure AD that is tied directly to the lifecycle of the VM. When the VM is deleted, the identity is automatically removed. The VM can use this identity to authenticate to Azure Blob Storage via Azure AD without storing any credentials on the VM, using the Azure Instance Metadata Service (IMDS) to obtain tokens.

Answer

A shared storage account key in the application settings

Answer

A user account with a local password on the VM

Answer

A service endpoint on the VM subnet

Question 8

A Windows file server VM in Azure must mount an Azure file share by using existing Active Directory Domain Services credentials instead of a storage account key. The organization already has domain-joined Windows servers in the environment. What should the administrator configure on the storage account?

Accepted Answer

Enable Azure Files identity-based authentication with Active Directory Domain Services.. Option A is correct because Azure Files supports identity-based authentication over SMB using Active Directory Domain Services (AD DS). By enabling this on the storage account, the administrator can mount the file share using existing domain credentials instead of a storage account key, provided the client VM is domain-joined and the share is configured with appropriate NTFS permissions. This eliminates the need to manage or expose storage account keys.

Answer

Enable blob soft delete and mount the share with a blob container SAS token.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet.

Answer

Create a shared access signature for the file share and map it as a local drive.

Question 9

A Windows VM and a Linux VM in Azure need to use the same shared folder for application artifacts. The team wants a managed file service instead of running a separate file server VM, and both operating systems must be able to mount the share using a standard protocol. Which solution should the administrator implement?

Accepted Answer

Create an Azure Files share and mount it over SMB from both virtual machines.. Azure Files provides a fully managed file share that supports both SMB and NFS protocols. Since the question requires a managed file service accessible by both Windows and Linux VMs using a standard protocol, the correct solution is to create an Azure Files share and mount it over SMB from both VMs. Windows natively supports SMB, and Linux can mount SMB shares using the CIFS-utils package, meeting the requirement without running a separate file server VM.

Answer

Create a blob container and mount it as a file system from both virtual machines.

Answer

Use an Azure managed disk and attach it to both virtual machines.

Answer

Create an Azure Files share and force the Linux VM to use NFS while the Windows VM uses SMB.

Question 10

A Windows VM and a Linux VM are both joined to the same Active Directory Domain Services domain. Which two authentication methods can be used to mount the same Azure Files share over SMB? Select two.

Accepted Answer

Storage account key. Option A is correct because the storage account key provides administrative access to the Azure Files share, allowing any SMB client (Windows or Linux) to mount the share by using the key as the credential. Option B is correct because when both VMs are joined to the same Active Directory Domain Services domain, the Azure Files share can be enabled for AD DS authentication, allowing domain-joined clients to mount the share using their domain credentials.

Answer

Blob SAS token

Answer

Network security group rule

Answer

Azure resource lock

Question 11

A web front end must automatically add or remove instances based on demand. The application is stateless and all instances should be managed as one group. Which Azure service should you use?

Accepted Answer

Virtual Machine Scale Set. Virtual Machine Scale Sets (VMSS) automatically scale the number of VM instances in or out based on demand or a defined schedule, making them ideal for stateless, horizontally scalable applications. They manage all instances as a single group behind a load balancer, ensuring uniform configuration and seamless scaling without manual intervention.

Answer

A single Azure VM with a larger size

Answer

Availability set

Answer

Managed disk snapshots

Question 12

A reporting application needs an Azure VM with at least 8 vCPUs and 64 GiB of RAM. The workload is memory-heavy, and the team wants a reasonable starting point. Which VM family should the administrator choose?

Accepted Answer

E-series. The E-series (memory-optimized) VM family is designed for memory-intensive workloads, offering a high memory-to-CPU ratio. With a requirement of at least 8 vCPUs and 64 GiB of RAM, the E-series provides the necessary memory capacity (e.g., E8s_v3 offers 8 vCPUs and 64 GiB RAM) as a reasonable starting point for a memory-heavy reporting application.

Answer

B-series

Answer

D-series

Answer

F-series

Question 13

A Windows VM in Azure must upload log files to a blob container every hour. Security policy forbids storing the storage account key or any long-lived SAS token on the VM. Which two actions should the administrator take? Select two.

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity on the VM allows it to authenticate to Azure AD without storing any credentials. By assigning the Storage Blob Data Contributor role to that identity on the storage account or container, the VM can upload logs using Azure AD authentication, which satisfies the security policy forbidding storage account keys or long-lived SAS tokens.

Answer

Copy the storage account access key into a configuration file on the VM.

Answer

Assign the Reader role at the resource group scope to the VM identity.

Answer

Create a shared access signature that never expires and place it on the VM.

Question 14

A customer runs two Windows VMs in a region that does not support availability zones. The app can lose one VM but must keep running through planned maintenance and a single host failure. Which deployment pattern should you use?

Accepted Answer

Place both VMs in an availability set.. An availability set ensures that VMs are placed on different fault domains (separate physical hardware) and update domains (separate maintenance batches). This protects against both a single host failure and planned Azure maintenance, meeting the requirement that the app can lose one VM but keep running.

Answer

Use a single-instance deployment and add more backup jobs.

Answer

Use availability zones because they always exist in every region.

Answer

Put both VMs on the same dedicated host to avoid migration during maintenance.

Question 15

A branch office has a single edge device with a static public IP and must connect securely to Azure so users can reach private VMs in a virtual network. The company wants traffic encrypted across the internet and does not need point-to-site access from individual laptops. Which solution should the administrator deploy?

Accepted Answer

A site-to-site VPN gateway connection.. A site-to-site VPN gateway connection (Option B) is correct because it creates an encrypted tunnel over the internet between the branch office's edge device with a static public IP and an Azure VPN gateway, allowing users to securely access private VMs in the virtual network. This solution meets the requirement for encrypted traffic across the internet without needing point-to-site access for individual laptops, as the entire branch network is connected via the VPN tunnel.

Answer

A point-to-site VPN configuration for each user laptop.

Answer

A private endpoint to each virtual machine in Azure.

Answer

VNet peering between the branch and Azure.

Question 16

A finance department stores spreadsheets in an Azure file share. Yesterday a user deleted a subfolder tree, but other folders were modified after that point and must not be rolled back. The administrator wants to restore only the deleted subfolder tree to its state from yesterday. What should the administrator use?

Accepted Answer

Use the Azure Files snapshot taken before the deletion and copy back only the required folders.. Option B is correct because Azure Files supports snapshot-based restore at the share level. By taking a snapshot before the deletion, the administrator can mount that snapshot as a read-only copy of the share, then copy back only the deleted subfolder tree without affecting any modifications made to other folders after the snapshot was taken. This meets the requirement of restoring only the deleted content while preserving later changes.

Answer

Restore the entire share from Azure Backup to the yesterday recovery point.

Answer

Enable blob soft delete on the storage account and then recover the folders.

Answer

Create a new file share and use synchronization to merge the deleted content.

Question 17

A business stores audit exports in Blob Storage. The account must continue serving writes if one availability zone fails, and reporting users in the paired region must still be able to read the replicated data if the primary region becomes unavailable. Which redundancy option best meets the requirement?

Accepted Answer

RA-GZRS, because it combines zone redundancy in the primary region with read access to the secondary region.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it combines synchronous zone-redundant replication across three availability zones in the primary region (protecting against a single zone failure) with asynchronous geo-replication to a paired secondary region, and enables read access to the secondary region if the primary becomes unavailable. This satisfies both requirements: continued writes during a zone failure and readable replicated data from the paired region during a primary region outage.

Answer

ZRS, because it protects against a zone failure inside one region.

Answer

RA-GRS, because it provides read access to the secondary region but not zone redundancy.

Answer

GRS, because it keeps a full second copy in another region.

Question 18

A backup archive must survive a regional outage, and engineers need to read the secondary copy if the primary region is unavailable. Which two redundancy options meet both requirements? Select two.

Accepted Answer

RA-GRS. RA-GRS (Read-Access Geo-Redundant Storage) is correct because it provides geo-redundant replication (GRS) that replicates data to a secondary region, ensuring survival of a regional outage, and additionally enables read access to the secondary copy even when the primary region is unavailable. This meets both requirements: disaster recovery and read availability during primary region failure.

Answer

LRS

Answer

ZRS

Answer

GRS

Question 19

A Windows file server VM in Azure needs to mount an Azure file share by using existing Active Directory Domain Services credentials. The security team does not want to use storage account keys. Which authentication option should be configured for Azure Files?

Accepted Answer

Azure Files identity-based authentication using Active Directory Domain Services.. Azure Files supports identity-based authentication using Active Directory Domain Services (AD DS), which allows domain-joined VMs to mount Azure file shares using existing AD credentials without exposing storage account keys. This method leverages Kerberos authentication and enables fine-grained access control via NTFS permissions, meeting the security team's requirement to avoid storage account keys.

Answer

Shared key authorization, because it is the only method supported by Azure Files.

Answer

A user delegation SAS, because it maps the share automatically to domain accounts.

Answer

Anonymous access, because Windows file servers can mount Azure shares without authentication.

Question 20

An administrator assigns Contributor at the RG-Apps resource group scope and Reader at the subscription scope. A developer opens a VM inside RG-Apps and can change its settings, but a different VM in RG-Shared is read-only. Which statement best explains this behavior?

Accepted Answer

The VM in RG-Apps inherited Contributor from the resource group, while RG-Shared only inherits Reader.. Role assignments in Azure are inherited from higher scopes (subscription, management group) down to lower scopes (resource group, resource). The developer has Reader at the subscription scope, which is inherited by all resource groups, including RG-Shared. However, the Contributor assignment at the RG-Apps resource group scope overrides the inherited Reader for that specific resource group, granting write access to VMs within RG-Apps. RG-Shared has no direct role assignment, so it only inherits the subscription-level Reader, making its VMs read-only.

Answer

The VM in RG-Apps has a direct Contributor assignment that does not apply elsewhere.

Answer

Reader always overrides Contributor when both roles exist in the same subscription.

Answer

Azure Policy is granting write access only inside RG-Apps because the subscription has no policy.