AZ-104 Practice Exam 54 — 20 Questions

Question 1

A Windows VM in VNet-App must access an Azure Files share over a private IP address. The storage account must not be reachable through its public endpoint, and the VM should resolve the file share name without custom host-file entries. Which three actions are required? Select three.

Accepted Answer

Create a private endpoint for the file service in VNet-App.. Option A is correct because a private endpoint assigns a private IP address from VNet-App to the Azure Files service, enabling the VM to access the file share over a private IP without traversing the public internet. This is required to meet the requirement that the storage account must not be reachable through its public endpoint.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet instead of a private endpoint.

Answer

Grant the VM's managed identity the Storage File Data SMB Share Reader role to create the private path.

Question 2

A Windows VM must install an agent and copy a configuration file automatically after provisioning. The administrator wants Azure to run the setup step without logging into the VM manually. Which feature should be used?

Accepted Answer

VM extension. VM extensions are the correct Azure feature to automatically install agents and apply configurations during or after provisioning without manual login. The Custom Script Extension (CSE) specifically can execute a PowerShell or Bash script to install the agent and copy the configuration file, running as a post-deployment task via Azure Resource Manager (ARM) templates, Azure CLI, or PowerShell.

Answer

Boot diagnostics

Answer

Managed disk encryption

Answer

Availability set

Question 3

A storage account has public network access disabled. A VM in VNet-App can reach a private endpoint for the account, but the storage name still resolves to the public IP address from the VM, and connections are denied. What should the administrator configure?

Accepted Answer

A private DNS zone for the storage blob endpoint linked to VNet-App.. When public network access is disabled on a storage account and a private endpoint is configured, the storage account's public DNS name must resolve to the private endpoint's private IP address within the virtual network. By default, the DNS name continues to resolve to the public IP address, causing connection failures. Linking a private DNS zone (privatelink.blob.core.windows.net) to VNet-App enables automatic resolution of the storage blob endpoint to the private IP address, allowing the VM to connect successfully.

Answer

A service endpoint on the subnet so the storage account uses a private IP address.

Answer

A storage account access key on the VM so the public endpoint will accept the connection.

Answer

A user-defined route sending storage traffic to the virtual network gateway.

Question 4

A company created a new spoke virtual network with the address space 10.40.1.0/24. The existing hub virtual network already uses 10.40.0.0/16. The administrator must peer the two VNets so resources can communicate normally. What must be changed before peering can succeed?

Accepted Answer

Change the spoke VNet address space to a range that does not overlap the hub.. Azure Virtual Network peering requires that the address spaces of the peered VNets do not overlap. The hub VNet uses 10.40.0.0/16, which includes the spoke's 10.40.1.0/24 range. Overlapping address spaces prevent successful peering because Azure cannot route traffic correctly between overlapping IP ranges. Therefore, the spoke VNet address space must be changed to a non-overlapping range before peering can succeed.

Answer

Create a route table on the spoke subnet before adding the peering.

Answer

Enable gateway transit on the hub peering to permit overlapping spaces.

Answer

Add an NSG rule that allows traffic between the hub and spoke address spaces.

Question 5

A branch office uses an on-premises firewall that supports IPsec/IKE and has a stable public IP. The office needs always-on private connectivity to an Azure VNet over the internet. Which Azure component should the administrator deploy?

Accepted Answer

A site-to-site connection using Azure VPN Gateway.. A site-to-site VPN connection using Azure VPN Gateway is the correct choice because it provides always-on, encrypted connectivity over the internet between an on-premises network with a stable public IP and an Azure VNet. Azure VPN Gateway supports IPsec/IKE protocols, which are compatible with the branch office's firewall, enabling a secure tunnel that meets the requirement for private connectivity.

Answer

VNet peering between the branch office and the Azure VNet.

Answer

Azure Bastion in the target VNet.

Answer

A private endpoint for the Azure VNet.

Question 6

An analyst needs a blob that is currently in the Archive tier to be downloadable within the next hour. Which two actions should the administrator take? Select two.

Accepted Answer

Change the blob access tier from Archive to Hot or Cool.. Option A is correct because to make a blob in the Archive tier accessible for download, you must first change its access tier to Hot or Cool. This initiates a rehydration process that moves the blob data from offline storage to an online tier, making it available for read operations. The rehydration can take up to 15 hours, but selecting High priority rehydration (Option B) can reduce this to under 1 hour, meeting the analyst's requirement.

Answer

Download the blob directly from the Archive tier without changing its tier.

Answer

Delete the blob and restore it from a soft delete snapshot.

Answer

Add a lifecycle rule to move the blob to Archive again after it is downloaded.

Question 7

After a user-defined route and VNet peering were added, a VM in a spoke subnet still does not reach 10.20.4.8 as expected. You need to confirm which route Azure will actually select on that VM's NIC, including any propagated routes and the route that wins. Which Network Watcher tool should you use?

Accepted Answer

Effective routes. Effective routes displays the actual routes applied to a network interface, including user-defined routes (UDRs), BGP-propagated routes, and VNet peering routes, along with the route priority (based on the longest prefix match and route source precedence). This allows you to see exactly which route wins for the destination 10.20.4.8, resolving why the VM cannot reach it despite the configured UDR and peering.

Answer

Connection troubleshoot

Answer

IP flow verify

Answer

Packet capture

Question 8

A company wants to peer a new spoke virtual network to an existing hub VNet. The hub uses 10.40.0.0/16, and the new spoke was created with 10.40.128.0/17 because that range seemed available in the branch office plan. Peering creation fails. What should the administrator do?

Accepted Answer

Change the spoke VNet to a non-overlapping address space before peering.. VNet peering requires that the address spaces of the peered virtual networks do not overlap. The hub uses 10.40.0.0/16, and the spoke uses 10.40.128.0/17, which is a subset of the hub’s range. Azure blocks peering when there is any overlap to prevent routing conflicts. The correct fix is to change the spoke VNet to a non-overlapping address space, such as a different RFC 1918 range like 10.1.0.0/16, before attempting to peer.

Answer

Add a second address prefix to the spoke VNet and keep the overlapping range.

Answer

Enable gateway transit on the hub VNet before retrying peering.

Answer

Create custom DNS records for the spoke VNet so the address ranges no longer conflict.

Question 9

An administrator needs two non-overlapping VNets in the same region to communicate directly over private IP addresses without deploying a gateway. What should be configured?

Accepted Answer

VNet peering between the two virtual networks.. VNet peering enables direct connectivity between two Azure virtual networks using private IP addresses across the Microsoft backbone, without requiring a gateway or public internet. It supports non-overlapping address spaces in the same region and provides low-latency, high-bandwidth communication. This matches the requirement exactly.

Answer

A site-to-site VPN gateway connection.

Answer

A service endpoint on both subnets.

Answer

A route table with default routes to each VNet.

Question 10

A contractor working from home needs temporary access to internal Azure resources. There is no on-premises network to connect, and you do not want to expose the resources publicly. Which connectivity option should you deploy?

Accepted Answer

Point-to-site VPN, because it connects an individual client to the virtual network.. A Point-to-Site (P2S) VPN is the correct choice because it allows an individual client computer to establish a secure, encrypted connection to an Azure virtual network over the public internet using SSTP, IKEv2, or OpenVPN protocols. This meets the requirement of temporary remote access without exposing resources publicly, as the connection is initiated from the client and authenticated via certificates or Azure AD.

Answer

Site-to-site VPN, because it is the standard option for any remote access.

Answer

VNet peering, because it can securely connect any remote device to Azure.

Answer

ExpressRoute, because it is the simplest option for temporary contractor access.

Question 11

An administrator grants the Helpdesk group the User Administrator role at the tenant scope. The team should be able to reset passwords only for users in the Europe-Users administrative unit. What should the administrator do?

Accepted Answer

Assign the User Administrator role to Helpdesk for the Europe-Users administrative unit only.. Option A is correct because Azure AD administrative units allow scoping of role assignments to a subset of users, groups, or devices. By assigning the User Administrator role to the Helpdesk group scoped to the Europe-Users administrative unit, the team can reset passwords only for users within that unit, meeting the requirement without granting broader tenant-wide permissions.

Answer

Create a Conditional Access policy that targets Helpdesk and Europe-Users.

Answer

Assign the Password Administrator role at the tenant scope and use Privileged Identity Management.

Answer

Create a custom RBAC role in the subscription and assign it to Helpdesk.

Question 12

A container group runs a one-time import job that writes data to an external system. If the job succeeds, the container must stop and stay stopped. If the job fails, it should automatically retry by restarting. Which restart policy should the administrator choose?

Accepted Answer

OnFailure. The OnFailure restart policy is correct because it instructs Azure Container Instances (ACI) to restart the container only when the process exits with a non-zero exit code, indicating failure. For a one-time import job that must stop permanently on success (exit code 0) and retry on failure, OnFailure matches this exact behavior without unnecessary restarts.

Answer

Always

Answer

Never

Answer

Manual

Question 13

An administrator wants a storage account to be accessible only from one subnet. The storage account should still use its public FQDN, the team does not want a private IP address in the VNet, and they do not want to manage private DNS zones. Which solution should be used?

Accepted Answer

Enable a service endpoint on the subnet and restrict the storage firewall to that subnet.. Option B is correct because a service endpoint allows the storage account to be accessed from a specific subnet while still using the public FQDN. By enabling a service endpoint on the subnet and configuring the storage firewall to allow traffic only from that subnet, the administrator meets all requirements: no private IP, no private DNS zones, and access restricted to one subnet.

Answer

Create a private endpoint and disable public network access.

Answer

Peer the subnet to a dedicated storage VNet and route traffic through peering.

Answer

Assign a route table with a host route to the storage account.

Question 14

A build agent VM is recreated from image every night. The OS can be lost on reimage, but build caches and artifacts must persist across rebuilds. The team also wants the cheapest OS storage option that supports this pattern. Which two choices should you make? Select two.

Accepted Answer

Use an ephemeral OS disk.. Option A is correct because an ephemeral OS disk uses the local VM storage or temp SSD, which is destroyed when the VM is deallocated or reimaged. This matches the requirement that the OS can be lost on reimage. Option B is correct because placing build caches and artifacts on a separate managed data disk ensures they persist independently of the OS disk lifecycle; data disks are not affected by OS reimaging and can be reattached to the new VM instance.

Answer

Use a Premium SSD OS disk so the reimage is preserved.

Answer

Store the caches only on the temporary resource disk.

Answer

Use an availability set to make the OS disk persistent.

Question 15

An administrator accidentally stopped protection for a critical VM and then deleted its backup item. The mistake was discovered a day later, and the organization wants deleted backup data to remain recoverable for a grace period. Which feature should be enabled on the Recovery Services vault?

Accepted Answer

Soft delete on the Recovery Services vault.. Soft delete on the Recovery Services vault provides a grace period (default 14 days) during which deleted backup data is retained in a soft-deleted state, allowing recovery even after a backup item is deleted. This feature is specifically designed to protect against accidental deletion, as it prevents permanent removal of backup data until the soft-delete period expires or is manually purged.

Answer

An action group attached to the vault alerts.

Answer

Diagnostic settings that export vault events to Log Analytics.

Answer

Cross-region restore for the vault.

Question 16

An administrator is deploying a route-based site-to-site VPN gateway. The GatewaySubnet already exists, but validation fails because the public IP configuration is incompatible with the chosen gateway. Which public IP setup is required for the gateway?

Accepted Answer

A Standard SKU public IP with static allocation.. For a route-based site-to-site VPN gateway in Azure, the gateway must use a Standard SKU public IP address with static allocation. This is because route-based VPN gateways require the public IP to be statically assigned and the Standard SKU provides the necessary features like availability zones and zone resiliency, which are not supported by the Basic SKU. The Basic SKU public IP is incompatible with route-based VPN gateways, and a private IP from the GatewaySubnet cannot serve as the public endpoint for the VPN connection.

Answer

A Basic SKU public IP with dynamic allocation.

Answer

A Basic SKU public IP with static allocation.

Answer

A private IP address assigned directly from GatewaySubnet.

Question 17

An operations team must apply three related policies to all subscriptions in a department: require a cost-center tag, allow only approved locations, and block certain VM SKUs. They want to assign and track these rules as one unit. What should they create?

Accepted Answer

An Azure Policy initiative.. An Azure Policy initiative is a collection of policy definitions designed to group related policies together for assignment and tracking as a single unit. By creating an initiative, the operations team can assign all three rules (cost-center tag, allowed locations, blocked VM SKUs) to all subscriptions in a department and track compliance at the initiative level, simplifying management and reporting.

Answer

A single Azure Policy definition containing all three rules.

Answer

A management group with no policy assignments.

Answer

An RBAC custom role with deny permissions.

Question 18

An administrator wants future VMs to start from the same approved server build as an existing generalized VM. Which two image sources can be used to create the new VM? Select two.

Accepted Answer

A managed image created from the approved server build.. A managed image captures the exact configuration of a generalized VM, including the OS and data disks, and can be used to deploy multiple identical VMs. This ensures that future VMs start from the same approved server build without needing to recreate the image each time.

Answer

A Marketplace image from the operating system vendor.

Answer

A single managed disk snapshot.

Answer

A public IP address assigned to the VM.

Question 19

An application runs on an Azure VM in a subnet and must access a storage account over the public endpoint without using a private IP address. The administrator wants to restrict access so only that subnet can reach the account. What should be configured?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account network rules.. Option B is correct because a service endpoint for Microsoft.Storage extends the virtual network identity to the subnet, allowing the storage account firewall to accept traffic from that subnet via its public endpoint. This meets the requirement of restricting access to the storage account's public endpoint without using a private IP address.

Answer

Create a private endpoint for the storage account and disable the public endpoint.

Answer

Allow trusted Microsoft services to bypass the firewall.

Answer

Add a user-defined route that points storage traffic to the virtual network gateway.

Question 20

An Azure administrator deploys a Linux VM that runs an application needing to read secrets from Azure Key Vault. The security policy forbids storing passwords, certificates, or access tokens on the VM. The application will run only on this single VM. What should be enabled on the VM?

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity enables the VM to authenticate to Azure Key Vault without storing any credentials on the VM. Azure automatically creates a service principal in Azure AD for the VM, and the application can obtain an access token from the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) using that identity. This satisfies the security policy forbidding stored secrets because the identity is managed entirely by Azure and no passwords, certificates, or tokens are stored locally.

Answer

Store a service principal secret in a protected file and use it at startup.

Answer

Create a user-assigned managed identity and avoid assigning it to the VM.

Answer

Use an SSH certificate to authenticate the app to Key Vault.