AZ-104 Practice Exam 55 — 20 Questions

Question 1

Based on the exhibit, which Azure service should you deploy to provide browser-based administrative access to the VM without assigning it a public IP address?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP/SSH connectivity to virtual machines directly in the Azure portal over TLS, without requiring a public IP address on the VM. It uses a hardened bastion host in your virtual network that brokers the connection, eliminating exposure of the VM to the internet.

Answer

Azure VPN Gateway

Answer

Public IP address on the VM

Answer

Azure Load Balancer

Question 2

Which two statements about application security groups and service tags are correct? Select two.

Accepted Answer

An application security group lets you reference a set of virtual machines in NSG rules.. An application security group (ASG) allows you to group virtual machines logically, and then reference that group as a source or destination in network security group (NSG) rules. This simplifies rule management by decoupling the rule from individual VM IP addresses or NICs, enabling dynamic membership based on application tiers.

Answer

Application security groups are used to assign Azure roles.

Answer

Service tags are custom labels you create for your own subscriptions.

Answer

Service tags create a private IP address for a service.

Question 3

Your company has an Azure subscription named Prod-Sub. You create a custom role that allows users to restart virtual machines but not create, delete, or resize them. You need to ensure that members of the VMOperators group can use this custom role only for virtual machines in the RG-Prod resource group. What should you do?

Accepted Answer

Assign the custom role to VMOperators at the RG-Prod scope.. Assigning the custom role at the RG-Prod scope restricts the role's permissions to only the virtual machines within that specific resource group. This meets the requirement that VMOperators can restart VMs but not create, delete, or resize them, and only within RG-Prod.

Answer

Assign the custom role to VMOperators at the subscription scope.

Answer

Assign the Virtual Machine Contributor role to VMOperators at the RG-Prod scope.

Answer

Assign the custom role to VMOperators at the management group scope.

Question 4

A developer packages an internal web app as a Linux container. The app must be published with built-in HTTPS, deployment slots, and autoscale, and the team does not want to manage OS patching or container hosts. Which Azure service should the administrator choose?

Accepted Answer

Azure App Service. Azure App Service is the correct choice because it natively supports Linux containers, built-in HTTPS via TLS/SSL, deployment slots for staging and production swaps, and autoscale based on metrics or schedules. It also abstracts OS patching and container host management, meeting the team's requirement to avoid managing infrastructure.

Answer

Azure Container Instances

Answer

Azure Virtual Machines

Answer

Azure Kubernetes Service

Question 5

Three application VMs in different resource groups must use the same Azure identity to read blobs from a storage account. The identity must continue to work if the VMs are redeployed. What should you use?

Accepted Answer

A user-assigned managed identity. A user-assigned managed identity is the correct choice because it is a standalone Azure resource that can be assigned to multiple VMs across different resource groups. It persists independently of the VM lifecycle, so it continues to work even if the VMs are redeployed, and it can be used to authenticate to Azure Storage for blob read operations via Microsoft Entra ID.

Answer

A system-assigned managed identity on each VM

Answer

A shared access signature stored in a configuration file

Answer

The local Administrator account on each VM

Question 6

A company wants to prevent users from creating storage accounts unless the resources include a costCenter tag. Which Azure feature should be used?

Accepted Answer

Azure Policy, because it can evaluate and enforce required resource properties.. Azure Policy is correct because it can enforce organizational standards by evaluating resource properties during creation and modification. By defining a policy that requires a 'costCenter' tag on all storage accounts, Azure Policy will deny creation of any storage account that does not include that tag, ensuring compliance without manual intervention.

Answer

Azure RBAC, because it controls whether users can create resources.

Answer

A resource lock, because it can force resources to use tags.

Answer

A service endpoint, because it can filter which resources are allowed in a subscription.

Question 7

A help desk group must use the Azure portal to start a virtual machine, stop or deallocate it, and see its current state, but they must not change any other VM settings. Which three Microsoft.Compute actions should be included in a custom role? Select three.

Accepted Answer

Microsoft.Compute/virtualMachines/read. The Microsoft.Compute/virtualMachines/read permission is required to view the current state of a virtual machine in the Azure portal. Without this read action, the help desk group would not be able to see the VM's status, which is essential for their task of monitoring and managing the VM lifecycle.

Answer

Microsoft.Compute/virtualMachines/write

Answer

Microsoft.Compute/virtualMachines/delete

Question 8

A development team needs one storage account to host blob containers, Azure Files shares, and blob lifecycle management rules. Which two statements about the account are correct? Select two.

Accepted Answer

It should be a General-purpose v2 storage account.. A General-purpose v2 (GPv2) storage account is required because it supports the latest storage features, including blob lifecycle management rules, blob containers, and Azure Files shares. GPv2 accounts provide the necessary REST API endpoints and management capabilities for lifecycle policies, which are not available in older account types like BlobStorage or General-purpose v1.

Answer

It must be a BlobStorage account.

Answer

It must use only zone-redundant storage to use lifecycle rules.

Answer

It cannot use lifecycle management for blobs.

Question 9

A line-of-business app requires protection against a datacenter outage in a region that supports zones. You want the strongest placement resilience available for the VMs. What should you choose?

Accepted Answer

Availability zone. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across zones provides the strongest resilience against a datacenter outage because if one zone fails, the other zones remain operational. This is the highest level of protection available within a single region for IaaS VMs.

Answer

Availability set

Answer

Virtual machine scale set

Answer

Resource lock

Question 10

A company has a hub virtual network that contains a custom DNS server at 10.20.0.4. A new spoke virtual network is peered to the hub. VMs in the spoke can reach other resources in Azure, but they cannot resolve internal names such as app01.corp.local. What should the administrator configure to fix name resolution for the spoke VMs?

Accepted Answer

Set the spoke virtual network's custom DNS server to 10.20.0.4.. The spoke virtual network must be configured to use the hub's custom DNS server (10.20.0.4) as its own DNS server. Azure virtual networks do not automatically inherit DNS settings from a peered hub; each virtual network must explicitly specify its DNS server. By setting the spoke's custom DNS server to 10.20.0.4, VMs in the spoke will send DNS queries to that server, enabling resolution of internal names like app01.corp.local.

Answer

Add a user-defined route that sends DNS traffic to the hub virtual network.

Answer

Create an NSG rule that allows UDP port 53 from the spoke subnet to the hub subnet.

Answer

Enable gateway transit on the hub peering so name resolution flows through the VPN gateway.

Question 11

A company has VNet-A with address space 10.20.0.0/16 and active workloads in several subnets. The team must peer VNet-A with VNet-B, but VNet-B currently uses 10.20.128.0/17 and cannot be rebuilt from scratch. What should the administrator do first to make peering possible without interrupting current workloads?

Accepted Answer

Add a new non-overlapping address space to VNet-B, create replacement subnets there, and migrate workloads gradually.. Azure Virtual Network peering requires that the address spaces of the peered VNets do not overlap. VNet-A uses 10.20.0.0/16, which fully contains VNet-B's 10.20.128.0/17, creating an overlap. Since VNet-B cannot be rebuilt, the correct first step is to add a new non-overlapping address space (e.g., 10.30.0.0/16) to VNet-B, create subnets in that new range, migrate workloads gradually, and then remove the overlapping address space before establishing the peering. This ensures no IP conflicts and avoids disrupting existing workloads.

Answer

Create the peering now and let Azure automatically route overlapping prefixes.

Answer

Attach a route table to VNet-B so traffic to VNet-A is forced through a firewall appliance.

Answer

Create a private endpoint between the two VNets so Azure ignores the overlap during connectivity checks.

Question 12

A shared resource group contains a VPN gateway and several virtual machines used by the finance department. Administrators must still be able to resize the VMs and update NSG rules, but no one should be able to delete the resource group or anything in it during the quarter-end freeze. Which lock should be applied?

Accepted Answer

CanNotDelete lock on the resource group. The CanNotDelete lock (option B) prevents deletion of the resource group and all resources within it, while still allowing read and update operations such as resizing VMs and modifying NSG rules. This meets the requirement to block deletions during the quarter-end freeze without hindering administrative changes. ReadOnly locks would block all write operations, including resizing and NSG rule updates, which is not desired.

Answer

ReadOnly lock on the resource group

Answer

Management group lock on the subscription

Answer

Azure Policy deny effect on the resource group

Question 13

You want Azure to identify underutilized virtual machines and recommend ways to reduce cost and improve security posture. Which service should you use?

Accepted Answer

Azure Advisor. Azure Advisor analyzes Azure resources and provides recommendations related to cost, security, reliability, performance, and operational excellence.

Answer

Azure Policy

Answer

Azure Backup

Answer

Virtual network peering

Question 14

A VM must be backed up every day, and backups must be retained for several days after creation. Which two settings are configured in an Azure Backup policy? Select two.

Accepted Answer

Backup schedule. An Azure Backup policy requires a backup schedule to define when the backup job runs (e.g., daily at a specific time). Option B is correct because retention rules specify how long each backup recovery point is kept (e.g., 7 days for daily backups, 30 days for weekly). Together, these two settings form the core of a backup policy, ensuring both the timing and lifespan of backups are controlled.

Answer

Network security group rules

Answer

Private DNS zone records

Answer

Availability set placement

Question 15

A compliance team keeps signed contract scans in blob storage. The files are usually not accessed, but when they are needed they must be available immediately without waiting for rehydration. The team wants the lowest-cost online tier that still allows immediate reads. Which access tier should you choose?

Accepted Answer

Cold. The Cold tier (C) is correct because it is the lowest-cost online access tier that provides immediate read access without requiring rehydration. Unlike the Archive tier, Cold tier data is always online and can be read instantly, while still offering lower storage costs than Cool or Hot tiers for data that is rarely accessed.

Answer

Hot

Answer

Cool

Answer

Archive

Question 16

The team needs alerts for VM CPU and storage capacity thresholds, but they want to keep telemetry ingestion costs as low as possible. Which approach is best?

Accepted Answer

Use Azure Monitor metric alerts for the threshold conditions.. Azure Monitor metric alerts are the most cost-effective approach because they evaluate lightweight, pre-collected platform metrics (e.g., CPU percentage, disk read/write operations) at regular intervals without ingesting or storing raw log data. This avoids the ingestion and retention costs associated with sending diagnostic logs to a Log Analytics workspace, making it ideal for simple threshold-based monitoring of VM CPU and storage capacity.

Answer

Send all VM diagnostic logs to Log Analytics and create only log search alerts.

Answer

Create a Recovery Services vault backup policy with a short retention period.

Answer

Assign Azure Policy to the subscription to audit CPU and storage trends.

Question 17

Based on the exhibit, which method should the administrator use to grant the partner time-limited access to one container?

Accepted Answer

Generate a user delegation SAS after authenticating with Microsoft Entra ID.. A user delegation SAS is secured with Microsoft Entra ID credentials and can be scoped to a specific container with a time-limited expiry, meeting the requirement for time-limited access to one container. Unlike a service SAS, which uses the storage account key and grants broader permissions, the user delegation SAS provides finer-grained control and does not expose the account key. This method is the recommended approach for granting delegated, time-bound access to Azure Storage resources.

Answer

Generate a service SAS by using the storage account key and email the URL to the partner.

Answer

Make the container public and remove the SAS requirement from the partner workflow.

Answer

Assign the partner Storage Blob Data Contributor on the storage account and let them sign in interactively.

Question 18

You need to allow a partner application to upload files to a blob container for the next 24 hours. The partner must not receive the storage account key. What should you provide?

Accepted Answer

A shared access signature (SAS). A shared access signature (SAS) provides delegated, time-limited access to a specific Azure Storage resource (like a blob container) without exposing the storage account key. By generating a SAS token with write permissions and a 24-hour expiry, you grant the partner application the ability to upload files while maintaining security and control over the access window.

Answer

The storage account access key

Answer

The connection string with the account key

Answer

A Recovery Services vault

Question 19

Based on the exhibit, you need to return only the failed operations from the log entries. Which KQL query should you use?

Accepted Answer

AzureActivity | where ActivityStatusValue == "Failed" | project TimeGenerated, OperationName, Caller. The KQL query filters the AzureActivity table using the `where` clause to return only rows where `ActivityStatusValue` equals 'Failed', then projects the relevant columns `TimeGenerated`, `OperationName`, and `Caller`. This directly meets the requirement to return only failed operations from the log entries.

Answer

AzureActivity | summarize count() by Caller

Answer

AzureActivity | top 10 by TimeGenerated

Answer

AzureActivity | where ActivityStatusValue == "Succeeded"

Question 20

A workload needs more CPU and memory than the current Azure VM size provides. The administrator wants to increase compute capacity without redeploying the application. What should be done?

Accepted Answer

Resize the VM to a larger size. Resizing the Azure VM to a larger size (option A) directly increases the CPU and memory resources allocated to the VM without requiring redeployment of the application. Azure supports resizing VMs within the same hardware family or to a different family, provided the new size is available in the current region and the VM is not part of a VMSS with overprovisioning constraints. The resize operation updates the VM's SKU, and after a reboot, the new resources are available to the OS and applications.

Answer

Move the VM into an availability set

Answer

Replace the VM with a snapshot

Answer

Assign a user-assigned managed identity