AZ-104 Practice Exam 53 — 20 Questions

Question 1

A company wants encrypted connectivity between its on-premises network and an Azure VNet. The organization has one edge VPN device at headquarters, and the Azure design must support a classic site-to-site tunnel rather than individual user VPN connections. Which three prerequisites are required? Select three.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy a virtual network gateway in a dedicated GatewaySubnet.. A virtual network gateway must be deployed in a dedicated subnet called GatewaySubnet to host the VPN gateway resources. This subnet is required for the gateway to function and must be named exactly 'GatewaySubnet' to be recognized by Azure when creating a site-to-site VPN connection.

Answer

Create a private endpoint for the headquarters network.

Answer

Enable Microsoft peering on the virtual network gateway.

Question 2

VNet-Hub and VNet-Spoke1 are in the same region and subscription. Resources in the two VNets must communicate over the Microsoft backbone without using a VPN gateway. What should you configure?

Accepted Answer

VNet peering. VNet peering enables direct connectivity between two virtual networks in the same region and subscription over the Microsoft backbone, without requiring a VPN gateway or public internet. This is the correct solution because it provides low-latency, private communication using the Azure infrastructure, and it supports resources in both VNets to communicate as if they were on the same network.

Answer

A site-to-site VPN gateway in each VNet

Answer

A private endpoint

Answer

A service endpoint

Question 3

Your company wants every subscription under the Corp-MG management group to block the creation of resource groups unless the deployment includes the tags CostCenter and Environment. You need a centralized solution that is inherited by child subscriptions. What should you configure?

Accepted Answer

An Azure Policy assignment at the management group scope. Azure Policy at the management group scope is the correct centralized solution because it enforces a policy (e.g., requiring tags) that is inherited by all child subscriptions and resource groups. This ensures that any deployment without the required tags is denied, meeting the requirement for a governance rule that applies across the entire Corp-MG hierarchy.

Answer

A custom RBAC role at the tenant root

Answer

A CanNotDelete lock on each subscription

Answer

A subscription budget alert

Question 4

After applying a custom image, a VM restarts to a black screen and never reaches the sign-in prompt. The administrator wants the fastest way to inspect the boot process without connecting to the guest OS. What should be used?

Accepted Answer

Boot diagnostics. Boot diagnostics captures serial console output and screenshots of the VM during the boot process, allowing you to inspect boot failures like a black screen without needing to connect to the guest OS. This is the fastest method because it provides immediate, out-of-band access to boot logs and visual state, even when the OS is unresponsive.

Answer

Azure Advisor

Answer

Managed identity

Answer

Azure Policy

Question 5

Diagnostic settings on an Azure storage account must send logs to a destination storage account that has its firewall set to deny all public network access. The team cannot create a private endpoint, but the destination service is one of the Azure services that can bypass the firewall as a trusted Microsoft service. What should the administrator enable?

Accepted Answer

The Allow trusted Microsoft services to bypass this firewall setting. The 'Allow trusted Microsoft services to bypass this firewall' setting enables specific Azure services, such as Azure Monitor or Azure Backup, to write diagnostic logs to a storage account even when the storage account's firewall blocks all public network access. This bypass is controlled at the Azure platform level and does not require a private endpoint or public IP, making it the only viable solution when the destination storage account denies all public traffic.

Answer

A service endpoint on the destination storage account subnet

Answer

A shared access signature with read permission

Answer

A private DNS zone linked to the workspace virtual network

Question 6

Based on the exhibit, an Azure VM must read secrets from Azure Key Vault during startup. No passwords, certificates, or client secrets may be stored on the VM. What should you configure?

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity is the correct choice because it is tied directly to the VM's lifecycle, requires no credential storage, and can authenticate to Azure Key Vault without any secrets stored on the VM. When enabled, Azure automatically creates a service principal in Azure AD for the VM, and the VM can request an access token from the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) to access Key Vault secrets. This satisfies the requirement of no passwords, certificates, or client secrets on the VM.

Answer

Assign a user-assigned managed identity to the VM so it can be shared later.

Answer

Create a service principal and store its client secret in the VM configuration.

Answer

Use a shared access signature in the startup script to authenticate to Key Vault.

Question 7

Traffic from Subnet-App to the internet is being routed through a virtual appliance unexpectedly. You need to identify which route is being applied to the network interface of VM-App01. Which Azure feature should you use?

Accepted Answer

Effective routes for the network interface. Effective routes for the network interface (NIC) shows the actual routes applied to a specific VM's NIC after evaluating all route tables, virtual network gateway routes, and BGP routes. Since traffic from Subnet-App to the internet is unexpectedly going through a virtual appliance, you need to see which route (e.g., a user-defined route with next hop type VirtualAppliance or VirtualNetworkGateway) is being selected based on the longest prefix match. This tool directly displays the effective next hop for each destination prefix, allowing you to identify the misconfigured route causing the traffic to be redirected.

Answer

NSG flow logs

Answer

Azure Policy compliance

Answer

The subscription activity log

Question 8

You need to redeploy an Azure virtual machine to a new host while keeping the VM configuration and attached disks. Which action should you use in the Azure portal?

Accepted Answer

Redeploy. The Redeploy action moves the VM to a new Azure host node while preserving the VM configuration, attached managed disks, and network resources. This is used to recover from underlying host failures or performance issues without losing the VM's state or data.

Answer

Resize

Answer

Capture

Answer

Reapply

Question 9

An operations team must enforce two rules across all subscriptions in a department: new resources must include a CostCenter tag, and deployments are allowed only in East US and West US. The team wants one assignment and automatic blocking of noncompliant deployments. Which three actions should the administrator take? Select three.

Accepted Answer

Create an Azure Policy initiative that contains both policy definitions.. An Azure Policy initiative (a set of policy definitions) allows combining the CostCenter tag requirement and the allowed region restriction into a single assignment, simplifying management. This ensures both rules are enforced together across all subscriptions in the department.

Answer

Grant Contributor at the subscription scope.

Answer

Apply a CanNotDelete lock to each resource group.

Question 10

Based on the exhibit, the team wants a single notification setup that can be reused by several alert rules across different subscriptions. What should the administrator create?

Accepted Answer

An action group. An action group is the correct choice because it is a reusable Azure Monitor resource that defines notification preferences (e.g., email, SMS, webhook, ITSM) and can be associated with multiple alert rules across different subscriptions. This allows the team to create a single notification setup once and reference it from any alert rule, ensuring consistent notification behavior without duplicating configuration.

Answer

A Log Analytics workspace with custom tables

Answer

A management group

Answer

A resource lock

Question 11

Security wants one assignment that enforces all of these controls across several subscriptions: allowed Azure regions, required tags, and disabling public network access on specific resources. Which Azure feature should you use?

Accepted Answer

An Azure Policy initiative that contains multiple related policy definitions. An Azure Policy initiative (also called a policy set) is the correct choice because it groups multiple independent policy definitions into a single assignable unit. This allows you to enforce all three distinct controls—allowed regions, required tags, and disabling public network access—across several subscriptions in one assignment, while keeping each rule as a separate policy definition for easier management and granular effect.

Answer

A single Azure Policy definition with one rule for all three controls

Answer

A management group lock applied to the subscriptions

Answer

A custom RBAC role assigned at the management group

Question 12

Based on the exhibit, what should the administrator configure so the container group can pull the private image without storing registry credentials?

Accepted Answer

Assign a managed identity to the container group and grant it AcrPull on the registry.. Azure Container Groups support managed identities, which allow the container group to authenticate to Azure Container Registry (ACR) without storing any credentials. By assigning a system-assigned or user-assigned managed identity to the container group and granting it the AcrPull role on the registry, the container runtime can use Azure AD authentication to pull the private image. This eliminates the need to store registry admin credentials or SAS tokens in the container configuration.

Answer

Store the ACR admin account password in a container environment variable.

Answer

Use a SAS token for the container image reference.

Answer

Place the registry in the same resource group as the container group.

Question 13

Based on the exhibit, what should the administrator do so VM-B resolves the storage account name to the private IP address?

Accepted Answer

Link the private DNS zone to VNet-B.. The private DNS zone for the storage account must be linked to VNet-B so that VM-B can resolve the storage account's fully qualified domain name (FQDN) to the private IP address of the private endpoint. Without this link, the DNS resolution will fall back to the public endpoint, bypassing the private connectivity. Linking the zone ensures Azure's default DNS servers return the private IP for the storage account within VNet-B.

Answer

Create a service endpoint on VNet-B and leave DNS unchanged.

Answer

Assign a public IP address to the private endpoint.

Answer

Add a route table with a next hop to the storage account.

Question 14

You need to ensure that administrators cannot accidentally delete a production virtual network, but they must still be able to update subnet settings. Which Azure feature should you apply?

Accepted Answer

A CanNotDelete lock. A CanNotDelete lock (Azure resource lock) prevents accidental deletion of the virtual network while allowing all other operations, including updates to subnet settings. This lock type blocks DELETE requests at the Azure Resource Manager level, but permits PUT and PATCH operations, so administrators can still modify subnet configurations.

Answer

A ReadOnly lock

Answer

An Azure Policy deny assignment

Answer

A budget alert

Question 15

Match each Azure VM access feature to the task it supports.

Accepted Answer

Azure Bastion: Provides secure RDP/SSH to VMs without public IP. Azure Bastion provides secure RDP/SSH without public IP; JIT restricts port access; NSGs filter traffic; Azure AD authentication enables identity-based login; Private Link ensures private connectivity; Firewall offers centralized control.

Answer

Azure AD authentication: Provides secure RDP/SSH without public IP

Answer

Private Link: Manages firewall rules centrally

Question 16

A line-of-business app runs on a single Azure VM in a region that supports availability zones. The business wants the VM to keep running if one datacenter in the region becomes unavailable. Which deployment choice best meets this requirement?

Accepted Answer

Availability zone. An availability zone is a physically separate datacenter within an Azure region, with independent power, cooling, and networking. Deploying the VM to a specific zone ensures it remains operational if another zone's datacenter fails, meeting the requirement for single-VM resilience against a datacenter outage.

Answer

Availability set

Answer

Proximity placement group

Answer

Virtual machine scale set

Question 17

An operations team manages an Azure virtual machine scale set that hosts a stateless API. They already collect guest logs in Log Analytics, but they do not want to ingest extra performance data just to watch CPU. They need an alert when average CPU across the scale set stays above 80% for 10 minutes, and the notification must support email and a webhook. What should they configure?

Accepted Answer

Create an Azure Monitor metric alert on the scale set CPU metric and attach an action group.. Azure Monitor metric alerts can directly evaluate the 'Percentage CPU' metric from a virtual machine scale set without ingesting additional performance data into Log Analytics. By setting the aggregation to 'Average' and the threshold to 80% for a duration of 10 minutes, the alert triggers when the condition is met. An action group attached to the alert can send notifications via email and webhook simultaneously, meeting all requirements without extra data ingestion.

Answer

Create a diagnostic setting on the scale set and build a log query alert for CPU samples.

Answer

Configure an autoscale rule and rely on its notification settings for alerting.

Answer

Install a monitoring extension that writes CPU readings to storage for later review.

Question 18

After a Windows VM is created, the administrator wants IIS installed and a configuration script run automatically without signing in to the server. Which Azure feature should be used?

Accepted Answer

A virtual machine extension. A virtual machine extension (such as the Custom Script Extension for Windows) allows you to deploy and run scripts on an Azure VM after provisioning, without requiring any interactive sign-in. This is the correct Azure feature to automatically install IIS and execute a configuration script as part of the VM deployment or post-deployment automation.

Answer

An availability set

Answer

An Azure Policy assignment

Answer

A network security group rule

Question 19

You need to deploy 30 identical Azure virtual machines for a web application and scale the instance count automatically based on CPU demand. Which Azure compute feature should you use?

Accepted Answer

A Virtual Machine Scale Set. Virtual Machine Scale Sets (VMSS) are designed specifically to deploy and manage a group of identical, load-balanced VMs that can automatically scale in or out based on CPU demand or other metrics. This matches the requirement for 30 identical VMs and autoscaling, making B the correct choice.

Answer

An availability set

Answer

A Recovery Services vault

Answer

Boot diagnostics

Question 20

Your team wants every protected Azure VM in a vault to be backed up once each day and kept for 30 days. Which Recovery Services vault setting should you configure?

Accepted Answer

A backup policy. A backup policy defines the frequency and retention duration for backups. By configuring a backup policy with a daily backup schedule and a retention period of 30 days, you ensure that each protected Azure VM in the Recovery Services vault is backed up once per day and the backups are kept for 30 days. This is the correct setting to meet the team's requirements.

Answer

A diagnostic setting

Answer

A resource lock

Answer

An action group