AZ-104 Practice Exam 54 — 20 Questions

Question 1

A Windows VM must automatically run a setup script after provisioning to install an agent, create a folder, and write configuration files. The administrator wants the script to be delivered through Azure management and run without a human signing in. What should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Custom Script Extension. The Custom Script Extension (CSE) is the correct Azure feature to automatically run a setup script on a Windows VM after provisioning. It downloads and executes scripts from Azure Storage or GitHub, runs as the local system account, and requires no user sign-in, making it ideal for post-deployment configuration like installing agents and writing files.

Answer

Availability set

Answer

Azure Load Balancer

Answer

Route table

Question 2

A data disk on VM-Data01 was corrupted after a bad patch, and you already have a snapshot taken last night. The OS disk should remain unchanged. Which two actions should you take to restore only the data disk? Select two.

Accepted Answer

Create a managed disk from the snapshot.. A snapshot is a point-in-time copy of a disk that can be used to create a new managed disk. Since you have a snapshot of the corrupted data disk from last night, creating a managed disk from that snapshot restores the data to its state at the time of the snapshot, leaving the OS disk untouched.

Answer

Redeploy the VM and expect the data disk to revert automatically.

Answer

Generalize the VM and redeploy it from the snapshot.

Answer

Replace the snapshot with the current data disk to roll back the VM.

Question 3

A platform team wants to prevent engineers from creating VM sizes that are not approved, but they also need the engineers to be able to restart their own VMs. Which two statements are correct? Select two.

Accepted Answer

Use Azure Policy to deny creation of nonapproved VM sizes.. Azure Policy can enforce organizational standards by denying the creation of non-approved VM sizes through built-in policies like 'Allowed virtual machine SKUs'. This prevents engineers from provisioning unapproved VM sizes at the time of creation, ensuring compliance without blocking other actions. Option B is correct because Azure RBAC allows granular permission assignment, such as granting the 'Microsoft.Compute/virtualMachines/restart/action' to engineers, enabling them to restart their own VMs without granting broader management rights.

Answer

Use Azure Policy to grant restart permission when the VM is compliant.

Answer

Use a resource lock to approve only specific VM sizes.

Answer

Use tags to enforce the approved VM size list and restart action.

Question 4

After a Windows VM is deployed, an administrator must install IIS, copy application files, and run a post-deployment configuration script without connecting interactively to the server. Which Azure feature should be used?

Accepted Answer

Custom Script Extension.. The Custom Script Extension (CSE) is the correct Azure feature because it allows you to run scripts on an Azure VM after deployment without requiring interactive login. It is specifically designed for post-deployment configuration tasks like installing IIS, copying application files, and executing configuration scripts, all executed via the Azure VM agent.

Answer

An availability zone assignment.

Answer

A route table association.

Answer

A user-assigned managed identity alone.

Question 5

Based on the exhibit, which restart policy should be configured for the container group?

Accepted Answer

Never. The container group in the exhibit is configured with a restart policy of 'Never' because it is designed to run a batch job that should execute once and then terminate. Azure Container Instances supports three restart policies: Always, OnFailure, and Never. Since the task is a one-time job, 'Never' ensures the container does not restart after completion, which is the correct choice for a single-run workload.

Answer

Always

Answer

OnFailure

Answer

UnlessStopped

Question 6

After a user-defined route and VNet peering were added, a VM in a spoke subnet still does not reach 10.20.4.8 as expected. You need to confirm which route Azure will actually select on that VM's NIC, including any propagated routes and the route that wins. Which Network Watcher tool should you use?

Accepted Answer

Effective routes. Effective routes displays the actual routes applied to a network interface, including user-defined routes (UDRs), BGP-propagated routes, and VNet peering routes, along with the route priority (based on the longest prefix match and route source precedence). This allows you to see exactly which route wins for the destination 10.20.4.8, resolving why the VM cannot reach it despite the configured UDR and peering.

Answer

Connection troubleshoot

Answer

IP flow verify

Answer

Packet capture

Question 7

Based on the exhibit, which change should the administrator make so the application identity remains stable across VM redeployments without reapplying RBAC assignments?

Accepted Answer

Create a user-assigned managed identity and attach it to the VM template.. A user-assigned managed identity is decoupled from the VM lifecycle, so it persists independently of VM redeployments. By attaching the same user-assigned identity to the new VM instance, the application retains its Microsoft Entra ID object ID and all existing RBAC role assignments remain valid without requiring reapplication.

Answer

Keep the system-assigned identity and reapply the same RBAC roles after each rebuild.

Answer

Store a local administrator password in Key Vault and use it for Azure resource access.

Answer

Replace the identity with a shared access signature so the VM can authenticate to Azure services.

Question 8

A subnet uses a user-defined route that sends 0.0.0.0/0 to a firewall appliance. One server in the subnet must download updates directly from 40.90.10.25 over the Internet, while all other outbound traffic should continue through the firewall. What is the best change?

Accepted Answer

Add a more specific /32 route for 40.90.10.25 with next hop type Internet.. Adding a more specific /32 route for 40.90.10.25 with next hop type Internet overrides the default route (0.0.0.0/0) for traffic destined to that specific IP. User-defined routes (UDRs) follow the longest prefix match principle, so the /32 route takes precedence over the /0 route, allowing the server to reach the update site directly via the internet while all other outbound traffic continues through the firewall appliance.

Answer

Remove the default route so all traffic uses the system routes.

Answer

Create a service endpoint for the server and the update site.

Answer

Attach a NAT gateway to the subnet so the server can bypass the firewall.

Question 9

You have two virtual networks named VNet-Hub and VNet-Spoke1 in the same Azure region. Resources in the two VNets must communicate privately over the Microsoft backbone without using a VPN gateway. What should you configure?

Accepted Answer

VNet peering. VNet peering enables direct, private connectivity between two virtual networks in the same Azure region using the Microsoft backbone infrastructure. It does not require a VPN gateway, public IP addresses, or any internet transit, making it the correct choice for private communication between VNet-Hub and VNet-Spoke1.

Answer

A site-to-site VPN

Answer

A public load balancer

Answer

An NSG outbound deny rule

Question 10

A Windows VM in Azure must upload log files to a blob container every hour. Security policy forbids storing the storage account key or any long-lived SAS token on the VM. Which two actions should the administrator take? Select two.

Accepted Answer

Enable a system-assigned managed identity on the VM.. Option A is correct because enabling a system-assigned managed identity on the Azure VM creates a service principal in Microsoft Entra ID that the VM can use to obtain OAuth 2.0 tokens from the Instance Metadata Service (IMDS) without any stored credentials. Option B is correct because the identity must be granted a data-plane role such as Storage Blob Data Contributor on the storage account or container scope, which authorizes uploading blobs via Azure RBAC. Together, these actions let the VM authenticate to Blob Storage hourly without persisting the storage account key or a long-lived SAS token, satisfying the security policy. Option C is wrong because copying the access key into a VM configuration file is exactly the long-lived secret storage the policy forbids. Option D is wrong because the Reader role only permits control-plane read operations and does not grant blob data upload permissions. Option E is wrong because a non-expiring SAS token is a long-lived credential, which the policy explicitly prohibits storing on the VM.

Answer

Copy the storage account access key into a configuration file on the VM.

Answer

Assign the Reader role at the resource group scope to the VM identity.

Answer

Create a shared access signature that never expires and place it on the VM.

Question 11

Three Azure virtual machines in different resource groups must all use the same Azure identity to access a storage account. The identity should keep working even if one VM is rebuilt. What should you use?

Accepted Answer

A user-assigned managed identity. A user-assigned managed identity is created as a standalone Azure resource and can be assigned to multiple VMs, even across resource groups. It persists independently of any VM lifecycle, so rebuilding a VM does not affect the identity's availability or its permissions to access the storage account.

Answer

A system-assigned managed identity on each VM

Answer

A shared VM administrator password

Answer

A storage account SAS token

Question 12

A development team needs a single Azure Storage account for blob containers, Azure Files shares, and blob lifecycle rules. The account must support standard performance and allow future use of access tiers. Which account kind should you create?

Accepted Answer

StorageV2 because it supports blobs, Azure Files, lifecycle management, and access tiers.. StorageV2 (general-purpose v2) is the only account kind that supports blobs, Azure Files shares, lifecycle management policies, and all access tiers (hot, cool, archive) with standard performance. BlobStorage lacks Azure Files support, FileStorage is premium-only and does not support lifecycle rules, and BlockBlobStorage is premium-only and does not support Azure Files or lifecycle management.

Answer

BlobStorage because it is optimized for blobs and supports lifecycle management.

Answer

FileStorage because it is designed for file shares and can also host blob lifecycle rules.

Answer

BlockBlobStorage because it provides the best performance for lifecycle policies and file shares.

Question 13

A company has an Azure Storage account that stores application files in Blob Storage. VMs in AppSubnet must access the blobs by using the standard storage account name, but traffic must stay private and the public endpoint must not be used. Which two actions should the administrator take? Select two.

Accepted Answer

Create a private endpoint for the blob service in AppSubnet.. Option A is correct because creating a private endpoint for the blob service in AppSubnet assigns a private IP from the subnet to the storage account's blob service, so VMs reach the blob data over the Azure private backbone rather than the public endpoint. Option C is correct because the standard storage account name (e.g., contoso.blob.core.windows.net) must resolve to the private endpoint's private IP; linking the privatelink.blob.core.windows.net private DNS zone to the VNet creates the required CNAME/A record mapping. Together, the private endpoint plus the privatelink DNS zone let VMs use the normal storage account name while keeping traffic private and avoiding the public endpoint. Option B is incorrect because a service endpoint still routes traffic to the storage account's public IP address over the Azure backbone, so the public endpoint is still used. Option D is incorrect because a shared access signature is an authorization token, not a private network path, and does not prevent public endpoint usage. Option E is incorrect because keeping the public endpoint open and relying on virtual network rules does not satisfy the requirement that the public endpoint must not be used.

Answer

Enable a service endpoint for Microsoft.Storage on AppSubnet.

Answer

Generate a shared access signature and email it to the VMs.

Answer

Add a virtual network rule to the storage account and keep the public endpoint open.

Question 14

An analyst needs a blob that is currently in the Archive tier to be downloadable within the next hour. Which two actions should the administrator take? Select two.

Accepted Answer

Change the blob access tier from Archive to Hot or Cool.. To make a blob in the Archive tier accessible for download, you must first change its access tier to Hot or Cool. This initiates a rehydration process that moves the blob data from offline storage to an online tier, making it available for read operations. The rehydration can take up to 15 hours, but selecting High priority rehydration (Option B) can reduce this to under 1 hour, meeting the analyst's requirement.

Answer

Download the blob directly from the Archive tier without changing its tier.

Answer

Delete the blob and restore it from a soft delete snapshot.

Answer

Add a lifecycle rule to move the blob to Archive again after it is downloaded.

Question 15

Based on the exhibit, which feature should be enabled on the subnet so the storage account remains reachable through its public endpoint but only from that subnet?

Accepted Answer

Service endpoint. Service endpoints (B) extend the virtual network private address space and the identity of the VNet to Azure services over a direct connection. By enabling a Microsoft.Storage service endpoint on the subnet and configuring the storage account firewall to allow access only from that subnet's virtual network, the storage account remains reachable via its public endpoint but only from the specified subnet, without requiring a public IP on the subnet.

Answer

Private endpoint

Answer

Azure Bastion

Answer

VPN Gateway

Question 16

Your company must retain Azure Activity Log data beyond the built-in retention period and make it available for long-term analysis. Which configuration should you use?

Accepted Answer

Diagnostic settings for the Activity Log. Azure Activity Log is retained by default for 90 days. To store data beyond this period for long-term analysis, you must configure diagnostic settings to route the Activity Log to a Log Analytics workspace (for querying) or an Azure Storage account (for archival). This is the only native mechanism to extend retention and enable long-term analysis.

Answer

A ReadOnly lock on the subscription

Answer

An availability set

Answer

NSG flow logs only

Question 17

A Windows VM must install IIS after provisioning and then run a script that registers the server with an internal API by using the VM's managed identity. The same steps must run automatically whenever the VM is deployed from Bicep. What should be added to the deployment?

Accepted Answer

A Custom Script Extension on the VM. The Custom Script Extension (CSE) is the correct choice because it allows you to run PowerShell or Bash scripts on an Azure VM after provisioning, enabling the installation of IIS and execution of a registration script that leverages the VM's managed identity. Since the requirement specifies that these steps must run automatically whenever the VM is deployed from Bicep, the CSE can be declared as a resource in the Bicep template, ensuring it executes on every deployment. This directly addresses the need for post-deployment configuration without manual intervention.

Answer

A read-only resource lock on the VM resource group

Answer

An availability set containing the VM

Answer

A proximity placement group for the VM

Question 18

A reporting server will run an in-memory analytics application that needs 8 vCPUs and 64 GiB of RAM. The administrator wants a VM family that is a good fit for memory-heavy workloads. Which VM family should be chosen?

Accepted Answer

Memory-optimized VM family. Memory-optimized VM families (e.g., Azure E-series) are designed for workloads that require a high memory-to-vCPU ratio, such as in-memory analytics applications. The requirement of 64 GiB of RAM for 8 vCPUs (8:1 ratio) aligns with the memory-optimized profile, which offers up to 8 GiB per vCPU or more, ensuring the application's data fits entirely in RAM for low-latency processing.

Answer

Burstable VM family

Answer

Compute-optimized VM family

Answer

Storage-optimized VM family

Question 19

An organization wants a single Azure storage account that can host blob containers, Azure Files shares, and lifecycle management rules for blob data. Which storage account kind should the administrator create?

Accepted Answer

General-purpose v2 (StorageV2). General-purpose v2 (StorageV2) is the only storage account kind that supports blobs, Azure Files, and lifecycle management rules for blob data. It provides a unified account for all Azure Storage data services, including blobs, files, queues, and tables, and it natively supports lifecycle management policies to automatically tier or delete blob data based on age or other conditions.

Answer

BlobStorage

Answer

FileStorage

Answer

BlockBlobStorage

Question 20

RG-Prod hosts line-of-business workloads. The business wants to prevent accidental deletion of the resource group during change freezes and also ensure every new resource carries a CostCenter tag for chargeback. Which two governance controls should be used? Select two.

Accepted Answer

Apply a CanNotDelete lock to RG-Prod.. Applying a CanNotDelete lock to RG-Prod prevents the resource group from being deleted during change freezes, which directly meets the requirement to prevent accidental deletion. This lock type allows read and update operations but blocks delete operations, making it ideal for protecting critical resources without impacting ongoing workloads.

Answer

Apply a ReadOnly lock to RG-Prod.

Answer

Grant Reader to the finance team on the resource group.

Answer

Create a private endpoint for RG-Prod.