AZ-104 Practice Exam 54 — 20 Questions

Question 1

A data disk on VM-Data01 was corrupted after a bad patch, and you already have a snapshot taken last night. The OS disk should remain unchanged. Which two actions should you take to restore only the data disk? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a managed disk from the snapshot.. A snapshot is a point-in-time copy of a disk that can be used to create a new managed disk. Since you have a snapshot of the corrupted data disk from last night, creating a managed disk from that snapshot restores the data to its state at the time of the snapshot, leaving the OS disk untouched.

Answer

Redeploy the VM and expect the data disk to revert automatically.

Answer

Generalize the VM and redeploy it from the snapshot.

Answer

Replace the snapshot with the current data disk to roll back the VM.

Question 2

A platform team wants to prevent engineers from creating VM sizes that are not approved, but they also need the engineers to be able to restart their own VMs. Which two statements are correct? Select two.

Accepted Answer

Use Azure Policy to deny creation of nonapproved VM sizes.. Azure Policy can enforce organizational standards by denying the creation of non-approved VM sizes through built-in policies like 'Allowed virtual machine SKUs'. This prevents engineers from provisioning unapproved VM sizes at the time of creation, ensuring compliance without blocking other actions. Option B is correct because Azure RBAC allows granular permission assignment, such as granting the 'Microsoft.Compute/virtualMachines/restart/action' to engineers, enabling them to restart their own VMs without granting broader management rights.

Answer

Use Azure Policy to grant restart permission when the VM is compliant.

Answer

Use a resource lock to approve only specific VM sizes.

Answer

Use tags to enforce the approved VM size list and restart action.

Question 3

After a Windows VM is deployed, an administrator must install IIS, copy application files, and run a post-deployment configuration script without connecting interactively to the server. Which Azure feature should be used?

Accepted Answer

Custom Script Extension.. The Custom Script Extension (CSE) is the correct Azure feature because it allows you to run scripts on an Azure VM after deployment without requiring interactive login. It is specifically designed for post-deployment configuration tasks like installing IIS, copying application files, and executing configuration scripts, all executed via the Azure VM agent.

Answer

An availability zone assignment.

Answer

A route table association.

Answer

A user-assigned managed identity alone.

Question 4

Based on the exhibit, which restart policy should be configured for the container group?

Accepted Answer

Never. The container group in the exhibit is configured with a restart policy of 'Never' because it is designed to run a batch job that should execute once and then terminate. Azure Container Instances supports three restart policies: Always, OnFailure, and Never. Since the task is a one-time job, 'Never' ensures the container does not restart after completion, which is the correct choice for a single-run workload.

Answer

Always

Answer

OnFailure

Answer

UnlessStopped

Question 5

A policy assigned at the management group denies creation of storage accounts with public network access enabled. One legacy storage account in RG-Pilot must stay publicly reachable for 45 days while an application is migrated. What should the administrator configure?

Accepted Answer

Create a policy exemption for the specific storage account with an expiration date.. A policy exemption is the correct tool when a specific resource must temporarily diverge from an enforced policy. The deny policy stays in place for the management group, but the exempted storage account is allowed to remain publicly reachable during the migration window. This keeps governance intact while documenting the exception and its expiration, which is much safer than removing the policy or trying to solve a compliance issue with RBAC.

Why others are wrong: Removing the policy assignment would disable governance for all resources under the management group, not just the one legacy storage account. A CanNotDelete lock protects against deletion only; it does not affect policy evaluation or network access settings. Granting Contributor does not help because Azure Policy is evaluated separately from RBAC, so more permission does not override a deny policy.

Answer

Remove the policy assignment from the management group until the migration is finished.

Answer

Apply a CanNotDelete lock to the storage account.

Answer

Assign a Contributor role to the migration team on the storage account.

Question 6

A backup job from an Azure service must write to a storage account that has the network firewall set to deny all public traffic. The team does not want to create a private endpoint for this workload. What should the administrator enable?

Accepted Answer

Allow trusted Microsoft services to access the storage account. Azure Storage firewalls include a special exception for 'Allow trusted Microsoft services to access this storage account'. When enabled, this exception permits Azure platform services—such as Azure Backup—to bypass the public network deny rule and write to the storage account without requiring a private endpoint. This works because the backup service runs on Microsoft-owned infrastructure that is authenticated and authorized at the control plane level, not via a public IP.

Answer

Add the backup server's public IP address to the storage firewall

Answer

Create a service endpoint on the subnet that hosts the backup job

Answer

Disable the storage account firewall temporarily during each backup window

Question 7

After a user-defined route and VNet peering were added, a VM in a spoke subnet still does not reach 10.20.4.8 as expected. You need to confirm which route Azure will actually select on that VM's NIC, including any propagated routes and the route that wins. Which Network Watcher tool should you use?

Accepted Answer

Effective routes. Effective routes displays the actual routes applied to a network interface, including user-defined routes (UDRs), BGP-propagated routes, and VNet peering routes, along with the route priority (based on the longest prefix match and route source precedence). This allows you to see exactly which route wins for the destination 10.20.4.8, resolving why the VM cannot reach it despite the configured UDR and peering.

Answer

Connection troubleshoot

Answer

IP flow verify

Answer

Packet capture

Question 8

An Azure Automation account runs PowerShell runbooks that must authenticate to Azure resources without embedded secrets. The automation account is recreated periodically during deployment, and the identity must continue to work after recreation without reissuing credentials. Which identity should you use?

Accepted Answer

A user-assigned managed identity.. A user-assigned managed identity (B) is the correct choice because it is an independent Azure resource that persists even when the Automation account is recreated. Unlike a system-assigned managed identity, which is tied to the lifecycle of the Automation account and is deleted when the account is deleted, a user-assigned managed identity can be reassigned to the new Automation account after recreation without requiring new credentials. This allows the runbooks to authenticate seamlessly using the same identity, avoiding embedded secrets.

Answer

A system-assigned managed identity.

Answer

A service principal with a client secret stored in Key Vault.

Answer

A shared access signature token.

Question 9

Based on the exhibit, which change should the administrator make so the application identity remains stable across VM redeployments without reapplying RBAC assignments?

Accepted Answer

Create a user-assigned managed identity and attach it to the VM template.. A user-assigned managed identity is decoupled from the VM lifecycle, so it persists independently of VM redeployments. By attaching the same user-assigned identity to the new VM instance, the application retains its Azure AD object ID and all existing RBAC role assignments remain valid without requiring reapplication.

Answer

Keep the system-assigned identity and reapply the same RBAC roles after each rebuild.

Answer

Store a local administrator password in Key Vault and use it for Azure resource access.

Answer

Replace the identity with a shared access signature so the VM can authenticate to Azure services.

Question 10

You need to connect VNet-Hub and VNet-Spoke so that resources in both virtual networks can communicate privately over the Microsoft backbone. Both virtual networks are in the same region. What should you configure?

Accepted Answer

Virtual network peering. Virtual network peering (A) is the correct solution because it enables direct, private connectivity between two virtual networks over the Microsoft backbone infrastructure. Since both VNets are in the same region, you can use standard VNet peering, which routes traffic between the peered networks using only private IP addresses, with no internet transit or gateway required. This meets the requirement for private communication without any additional VPN or gateway overhead.

Answer

A site-to-site VPN

Answer

A network security group

Answer

An Azure Policy assignment

Question 11

Based on the exhibit, three VMs in different resource groups must use the same Azure identity, and the identity must continue working if one VM is deleted and recreated. What should you use?

Accepted Answer

A user-assigned managed identity attached to all three VMs.. A user-assigned managed identity is an Azure resource that can be created independently and then assigned to multiple VMs. Because it persists as a separate resource in Azure, deleting and recreating a VM does not affect the identity; you simply reattach the same user-assigned identity to the new VM. This ensures the identity continues working across VM lifecycle changes, meeting the requirement for a shared, resilient identity.

Answer

A system-assigned managed identity on each VM.

Answer

A service principal stored in the VM image.

Answer

A shared access signature assigned to the resource group.

Question 12

You need a storage redundancy option that keeps data available if an entire availability zone in the primary region fails, but you do not need cross-region replication. Which redundancy option should you choose?

Accepted Answer

ZRS. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within a single region, ensuring data remains available if an entire zone fails. This meets the requirement of no cross-region replication while providing zone-level fault tolerance.

Answer

LRS

Answer

GRS

Answer

RA-GRS

Question 13

Based on the exhibit, why is TCP 8443 traffic from the web tier still denied to the app tier, and what should you do to allow only the web tier?

Accepted Answer

Add an inbound allow rule for TCP 8443 from ASG-Web to ASG-App with a priority lower than 100.. In Azure Network Security Groups (NSGs), rules are evaluated in priority order, with lower numbers evaluated first. The existing rule at priority 100 allows traffic from the web tier but does not explicitly allow TCP 8443, so a subsequent deny-all rule at priority 200 blocks it. To allow only the web tier, you must add an inbound allow rule for TCP 8443 from ASG-Web with a priority lower than 100 (e.g., 90). This new rule is evaluated before the existing rule at priority 100, permitting the desired traffic while still blocking other sources.

Answer

Change the deny-all rule at priority 200 to allow TCP 8443 from ASG-Web.

Answer

Add a route table entry for 8443 traffic from the web tier to the app tier.

Answer

Remove the AzureLoadBalancer rule because it is overriding the web tier traffic.

Question 14

Three Azure virtual machines in different resource groups must all use the same Azure identity to access a storage account. The identity should keep working even if one VM is rebuilt. What should you use?

Accepted Answer

A user-assigned managed identity. A user-assigned managed identity is created as a standalone Azure resource and can be assigned to multiple VMs, even across resource groups. It persists independently of any VM lifecycle, so rebuilding a VM does not affect the identity's availability or its permissions to access the storage account.

Answer

A system-assigned managed identity on each VM

Answer

A shared VM administrator password

Answer

A storage account SAS token

Question 15

A development team needs a single Azure Storage account for blob containers, Azure Files shares, and blob lifecycle rules. The account must support standard performance and allow future use of access tiers. Which account kind should you create?

Accepted Answer

StorageV2 because it supports blobs, Azure Files, lifecycle management, and access tiers.. StorageV2 (general-purpose v2) is the only account kind that supports blobs, Azure Files shares, lifecycle management policies, and all access tiers (hot, cool, archive) with standard performance. BlobStorage lacks Azure Files support, FileStorage is premium-only and does not support lifecycle rules, and BlockBlobStorage is premium-only and does not support Azure Files or lifecycle management.

Answer

BlobStorage because it is optimized for blobs and supports lifecycle management.

Answer

FileStorage because it is designed for file shares and can also host blob lifecycle rules.

Answer

BlockBlobStorage because it provides the best performance for lifecycle policies and file shares.

Question 16

You need to control inbound and outbound traffic to resources in a subnet by allowing or denying traffic based on IP address, port, and protocol. Which Azure feature should you use?

Accepted Answer

A network security group. A network security group (NSG) is the correct Azure feature because it contains security rules that allow or deny inbound and outbound traffic at the subnet or network interface level based on source/destination IP address, port, and protocol (TCP, UDP, or Any). This directly matches the requirement to control traffic by these three parameters.

Answer

A route table

Answer

A private DNS zone

Answer

Azure Advisor

Question 17

Based on the exhibit, the alert rule is firing, but the operations team is not receiving any notification. What should you change to make the alert send an email when the condition is met?

Accepted Answer

Attach an action group that includes the required email recipient.. An alert rule in Azure Monitor requires an action group to define the notification actions (e.g., email, SMS) when the alert fires. Without an action group attached to the alert rule, no notifications are sent, even if the condition is met. Option B correctly identifies that attaching an action group containing the required email recipient will enable email notifications.

Answer

Increase the evaluation frequency to 15 minutes so Azure sends a summary notification.

Answer

Create a diagnostic setting on the virtual machine and send logs to a storage account.

Answer

Move the virtual machine into a different resource group so the alert can notify the team.

Question 18

An analyst needs a blob that is currently in the Archive tier to be downloadable within the next hour. Which two actions should the administrator take? Select two.

Accepted Answer

Change the blob access tier from Archive to Hot or Cool.. To make a blob in the Archive tier accessible for download, you must first change its access tier to Hot or Cool. This initiates a rehydration process that moves the blob data from offline storage to an online tier, making it available for read operations. The rehydration can take up to 15 hours, but selecting High priority rehydration (Option B) can reduce this to under 1 hour, meeting the analyst's requirement.

Answer

Download the blob directly from the Archive tier without changing its tier.

Answer

Delete the blob and restore it from a soft delete snapshot.

Answer

Add a lifecycle rule to move the blob to Archive again after it is downloaded.

Question 19

Based on the exhibit, which feature should be enabled on the subnet so the storage account remains reachable through its public endpoint but only from that subnet?

Accepted Answer

Service endpoint. Service endpoints (B) extend the virtual network private address space and the identity of the VNet to Azure services over a direct connection. By enabling a Microsoft.Storage service endpoint on the subnet and configuring the storage account firewall to allow access only from that subnet's virtual network, the storage account remains reachable via its public endpoint but only from the specified subnet, without requiring a public IP on the subnet.

Answer

Private endpoint

Answer

Azure Bastion

Answer

VPN Gateway

Question 20

Your company must retain Azure Activity Log data beyond the built-in retention period and make it available for long-term analysis. Which configuration should you use?

Accepted Answer

Diagnostic settings for the Activity Log. Azure Activity Log is retained by default for 90 days. To store data beyond this period for long-term analysis, you must configure diagnostic settings to route the Activity Log to a Log Analytics workspace (for querying) or an Azure Storage account (for archival). This is the only native mechanism to extend retention and enable long-term analysis.

Answer

A ReadOnly lock on the subscription

Answer

An availability set

Answer

NSG flow logs only