AZ-104 Practice Exam 53 — 20 Questions

Question 1

After applying a custom image, a VM restarts to a black screen and never reaches the sign-in prompt. The administrator wants the fastest way to inspect the boot process without connecting to the guest OS. What should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Boot diagnostics. Boot diagnostics captures serial console output and screenshots of the VM during the boot process, allowing you to inspect boot failures like a black screen without needing to connect to the guest OS. This is the fastest method because it provides immediate, out-of-band access to boot logs and visual state, even when the OS is unresponsive.

Answer

Azure Advisor

Answer

Managed identity

Answer

Azure Policy

Question 2

Diagnostic settings on an Azure storage account must send logs to a destination storage account that has its firewall set to deny all public network access. The team cannot create a private endpoint, but the destination service is one of the Azure services that can bypass the firewall as a trusted Microsoft service. What should the administrator enable?

Accepted Answer

The Allow trusted Microsoft services to bypass this firewall setting. The 'Allow trusted Microsoft services to bypass this firewall' setting enables specific Azure services, such as Azure Monitor or Azure Backup, to write diagnostic logs to a storage account even when the storage account's firewall blocks all public network access. This bypass is controlled at the Azure platform level and does not require a private endpoint or public IP, making it the only viable solution when the destination storage account denies all public traffic.

Answer

A service endpoint on the destination storage account subnet

Answer

A shared access signature with read permission

Answer

A private DNS zone linked to the workspace virtual network

Question 3

Based on the exhibit, an Azure VM must read secrets from Azure Key Vault during startup. No passwords, certificates, or client secrets may be stored on the VM. What should you configure?

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity is the correct choice because it is tied directly to the VM's lifecycle, requires no credential storage, and can authenticate to Azure Key Vault without any secrets stored on the VM. When enabled, Azure automatically creates a service principal in Microsoft Entra ID for the VM, and the VM can request an access token from the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) to access Key Vault secrets. This satisfies the requirement of no passwords, certificates, or client secrets on the VM.

Answer

Assign a user-assigned managed identity to the VM so it can be shared later.

Answer

Create a service principal and store its client secret in the VM configuration.

Answer

Use a shared access signature in the startup script to authenticate to Key Vault.

Question 4

Traffic from Subnet-App to the internet is being routed through a virtual appliance unexpectedly. You need to identify which route is being applied to the network interface of VM-App01. Which Azure feature should you use?

Accepted Answer

Effective routes for the network interface. Effective routes for the network interface (NIC) shows the actual routes applied to a specific VM's NIC after evaluating all route tables, virtual network gateway routes, and BGP routes. Since traffic from Subnet-App to the internet is unexpectedly going through a virtual appliance, you need to see which route (e.g., a user-defined route with next hop type VirtualAppliance or VirtualNetworkGateway) is being selected based on the longest prefix match. This tool directly displays the effective next hop for each destination prefix, allowing you to identify the misconfigured route causing the traffic to be redirected.

Answer

NSG flow logs

Answer

Azure Policy compliance

Answer

The subscription activity log

Question 5

You need to redeploy an Azure virtual machine to a new host while keeping the VM configuration and attached disks. Which action should you use in the Azure portal?

Accepted Answer

Redeploy. The Redeploy action moves the VM to a new Azure host node while preserving the VM configuration, attached managed disks, and network resources. This is used to recover from underlying host failures or performance issues without losing the VM's state or data.

Answer

Resize

Answer

Capture

Answer

Reapply

Question 6

An operations team must enforce two rules across all subscriptions in a department: new resources must include a CostCenter tag, and deployments are allowed only in East US and West US. The team wants one assignment and automatic blocking of noncompliant deployments. Which three actions should the administrator take? Select three.

Accepted Answer

Create an Azure Policy initiative that contains both policy definitions.. An Azure Policy initiative (a set of policy definitions) allows combining the CostCenter tag requirement and the allowed region restriction into a single assignment, simplifying management. This ensures both rules are enforced together across all subscriptions in the department.

Answer

Grant Contributor at the subscription scope.

Answer

Apply a CanNotDelete lock to each resource group.

Question 7

Based on the exhibit, the team wants a single notification setup that can be reused by several alert rules across different subscriptions. What should the administrator create?

Accepted Answer

An action group. An action group is the correct choice because it is a reusable Azure Monitor resource that defines notification preferences (e.g., email, SMS, webhook, ITSM) and can be associated with multiple alert rules across different subscriptions. This allows the team to create a single notification setup once and reference it from any alert rule, ensuring consistent notification behavior without duplicating configuration.

Answer

A Log Analytics workspace with custom tables

Answer

A management group

Answer

A resource lock

Question 8

An on-premises application connects to Azure through an existing site-to-site VPN. The application must access an Azure Blob Storage account over a private IP, and the storage account must not accept public network traffic. Which configuration should the administrator deploy?

Accepted Answer

A private endpoint for the storage account in an Azure VNet reachable through the VPN.. A private endpoint assigns the storage account a private IP from an Azure VNet, making it accessible over the site-to-site VPN without traversing the public internet. This satisfies the requirement for private IP access and allows the storage account to block all public network traffic by disabling public network access in the firewall settings.

Answer

A service endpoint on the on-premises network and a storage account firewall exception.

Answer

A NAT gateway on the subnet that hosts the storage account.

Answer

An application security group applied to the storage account.

Question 9

A company has a virtual machine in a subnet that must access an Azure Storage account. The storage account should remain reachable through its public endpoint, but access must be limited to that subnet, and the traffic should stay on the Azure backbone rather than the internet. Which feature should the administrator configure on the subnet?

Accepted Answer

A service endpoint for Microsoft.Storage.. A service endpoint for Microsoft.Storage extends the virtual network identity to the storage account, allowing traffic from the subnet to the storage account's public endpoint to be routed over the Azure backbone network rather than the internet. This satisfies the requirement to limit access to the subnet while keeping the public endpoint reachable and traffic within Azure's infrastructure.

Answer

A private endpoint for the storage account.

Answer

A site-to-site VPN connection to the storage account.

Answer

An application security group assigned to the storage account.

Question 10

Based on the exhibit, what should the administrator configure so the container group can pull the private image without storing registry credentials?

Accepted Answer

Assign a managed identity to the container group and grant it AcrPull on the registry.. Azure Container Groups support managed identities, which allow the container group to authenticate to Azure Container Registry (ACR) without storing any credentials. By assigning a system-assigned or user-assigned managed identity to the container group and granting it the AcrPull role on the registry, the container runtime can use Microsoft Entra ID authentication to pull the private image. This eliminates the need to store registry admin credentials or SAS tokens in the container configuration.

Answer

Store the ACR admin account password in a container environment variable.

Answer

Use a SAS token for the container image reference.

Answer

Place the registry in the same resource group as the container group.

Question 11

Third-party support engineers connect from the public internet and need browser-based RDP and SSH access to Azure VMs that have only private IPs. The security team will not allow public IPs on the VMs, inbound 3389 or 22 from the internet, or a client VPN on each laptop. What should you deploy?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless browser-based RDP and SSH connectivity to Azure VMs directly from the Azure portal over TLS, without requiring public IPs on the VMs or exposing inbound RDP/SSH ports (3389/22) to the internet. It uses a hardened bastion host deployed in a dedicated subnet, which brokers the connection via the Azure portal, satisfying the security team's constraints of no public IPs on VMs, no inbound internet access to those ports, and no client VPN software.

Answer

VPN Gateway with point-to-site configuration

Answer

A public load balancer with inbound NAT rules

Answer

A NAT gateway attached to the VM subnet

Question 12

You need to ensure that administrators cannot accidentally delete a production virtual network, but they must still be able to update subnet settings. Which Azure feature should you apply?

Accepted Answer

A CanNotDelete lock. A CanNotDelete lock (Azure resource lock) prevents accidental deletion of the virtual network while allowing all other operations, including updates to subnet settings. This lock type blocks DELETE requests at the Azure Resource Manager level, but permits PUT and PATCH operations, so administrators can still modify subnet configurations.

Answer

A ReadOnly lock

Answer

An Azure Policy deny assignment

Answer

A budget alert

Question 13

Match each Azure VM access feature to the task it supports.

Accepted Answer

Azure Bastion: Provides secure RDP/SSH to VMs without public IP. Azure Bastion provides secure RDP/SSH without public IP; JIT restricts port access; NSGs filter traffic; Microsoft Entra ID authentication enables identity-based login; Private Link ensures private connectivity; Firewall offers centralized control.

Answer

Azure AD authentication: Provides secure RDP/SSH without public IP

Answer

Private Link: Manages firewall rules centrally

Question 14

A line-of-business app runs on a single Azure VM in a region that supports availability zones. The business wants the VM to keep running if one datacenter in the region becomes unavailable. Which deployment choice best meets this requirement?

Accepted Answer

Availability zone. An availability zone is a physically separate datacenter within an Azure region, with independent power, cooling, and networking. Deploying the VM to a specific zone ensures it remains operational if another zone's datacenter fails, meeting the requirement for single-VM resilience against a datacenter outage.

Answer

Availability set

Answer

Proximity placement group

Answer

Virtual machine scale set

Question 15

Based on the exhibit, the administrator cannot create VNet peering between the hub and spoke networks. What should be changed?

Accepted Answer

Change the spoke VNet address space so it does not overlap the hub.. VNet peering requires that the address spaces of the peered VNets do not overlap. Overlapping address spaces cause routing conflicts because Azure cannot distinguish between resources in the hub and spoke when IP addresses are identical or within the same CIDR range. Changing the spoke VNet address space to a non-overlapping range resolves this issue and allows peering to be established.

Answer

Change the hub VNet to use a smaller subnet mask.

Answer

Add a route table to the spoke VNet before creating peering.

Answer

Enable a service endpoint on both VNets.

Question 16

An operations team manages an Azure virtual machine scale set that hosts a stateless API. They already collect guest logs in Log Analytics, but they do not want to ingest extra performance data just to watch CPU. They need an alert when average CPU across the scale set stays above 80% for 10 minutes, and the notification must support email and a webhook. What should they configure?

Accepted Answer

Create an Azure Monitor metric alert on the scale set CPU metric and attach an action group.. Azure Monitor metric alerts can directly evaluate the 'Percentage CPU' metric from a virtual machine scale set without ingesting additional performance data into Log Analytics. By setting the aggregation to 'Average' and the threshold to 80% for a duration of 10 minutes, the alert triggers when the condition is met. An action group attached to the alert can send notifications via email and webhook simultaneously, meeting all requirements without extra data ingestion.

Answer

Create a diagnostic setting on the scale set and build a log query alert for CPU samples.

Answer

Configure an autoscale rule and rely on its notification settings for alerting.

Answer

Install a monitoring extension that writes CPU readings to storage for later review.

Question 17

You need to view recommendations about underutilized virtual machines, security improvements, and cost-saving opportunities in Azure. Which service should you use?

Accepted Answer

Azure Advisor. Azure Advisor is the personalized cloud consultant service that analyzes your deployed resources and produces recommendations across five categories: cost, security, reliability, operational excellence, and performance. It is exactly the service that surfaces underutilized VMs, security improvements, and cost-saving opportunities in one place.

Answer

Azure Policy

Answer

Network Watcher

Answer

Azure Backup

Question 18

After a Windows VM is created, the administrator wants IIS installed and a configuration script run automatically without signing in to the server. Which Azure feature should be used?

Accepted Answer

A virtual machine extension. A virtual machine extension (such as the Custom Script Extension for Windows) allows you to deploy and run scripts on an Azure VM after provisioning, without requiring any interactive sign-in. This is the correct Azure feature to automatically install IIS and execute a configuration script as part of the VM deployment or post-deployment automation.

Answer

An availability set

Answer

An Azure Policy assignment

Answer

A network security group rule

Question 19

A production application runs on three Azure VMs in a region that supports availability zones. The business wants the application to remain available if one datacenter in the region fails. What should the administrator use?

Accepted Answer

Availability zones. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying the three VMs across different zones ensures that if one datacenter fails, the application remains available because the other zones continue to operate. This directly meets the requirement for resilience against a single datacenter failure.

Answer

An availability set

Answer

A managed disk snapshot

Answer

A proximity placement group

Question 20

Security wants one assignment that enforces all of these controls across several subscriptions: allowed Azure regions, required tags, and disabling public network access on specific resources. Which Azure feature should you use?

Accepted Answer

An Azure Policy initiative that contains multiple related policy definitions. An Azure Policy initiative (also called a policy set) is the correct choice because it groups multiple independent policy definitions into a single assignable unit. This allows you to enforce all three distinct controls—allowed regions, required tags, and disabling public network access—across several subscriptions in one assignment, while keeping each rule as a separate policy definition for easier management and granular effect.

Answer

A single Azure Policy definition with one rule for all three controls

Answer

A management group lock applied to the subscriptions

Answer

A custom RBAC role assigned at the management group