AZ-104 Practice Exam 55 — 20 Questions

Question 1

An administrator is deploying a new storage account for an application. The account must support blob containers, an Azure Files share, lifecycle rules for blobs, and standard access tiers. The application does not need premium performance for a single data service. Which storage account kind should be chosen?

Accepted Answer

General-purpose v2, because it supports blobs, files, access tiers, and lifecycle management.. General-purpose v2 (GPv2) storage accounts are the correct choice because they support all storage object types (blobs, files, queues, tables), standard access tiers (hot, cool, archive), and lifecycle management policies for blobs. This meets all the stated requirements without needing premium performance for a single data service.

Answer

BlobStorage, because it is optimized only for block blob workloads.

Answer

General-purpose v1, because it can host any storage object type.

Answer

BlockBlobStorage, because it is the best choice for any application that stores files.

Question 2

An employee accidentally deletes a critical document from an Azure file share. You need to restore only that file to its earlier state without restoring the entire share or using a vault-based backup job. Which feature should you use?

Accepted Answer

A file share snapshot, because it captures a point-in-time copy of the share for granular recovery.. File share snapshots are point-in-time, read-only copies of Azure file shares that allow you to recover individual files or folders without restoring the entire share. When a file is accidentally deleted, you can mount a previous snapshot, copy the deleted file from it, and restore it to the live share—no vault-based backup job or full share restore required.

Answer

A storage account access key, because it can retrieve deleted files from any share version.

Answer

An Azure VM snapshot, because it captures the file share state automatically.

Answer

A private endpoint to the file share, because it enables restore operations.

Question 3

An employee deleted one spreadsheet stored on a Windows VM that is protected by Azure Backup. The administrator must recover only that file without restoring the entire VM. What should be used?

Accepted Answer

The file recovery process from the Recovery Services vault recovery point.. Azure Backup for Azure VMs supports file-level recovery from a recovery point without restoring the entire VM. The file recovery process mounts the recovery point as an iSCSI target on the VM, allowing the administrator to browse and copy the deleted spreadsheet directly from the snapshot. This is the only option that provides granular, non-disruptive file restoration from a VM backup.

Answer

A full VM restore to replace the existing virtual machine.

Answer

Blob rehydration from Archive tier in the storage account.

Answer

A restore point collection operation in Azure Compute.

Question 4

An application runs in a subnet and must reach a storage account over the public endpoint, but only that subnet should be allowed. The team does not want to use a private endpoint. Which two configurations should the administrator use? Select two.

Accepted Answer

Enable the Microsoft.Storage service endpoint on the subnet.. Enabling the Microsoft.Storage service endpoint on the subnet (A) ensures that traffic from the subnet to the storage account's public endpoint is routed through the Azure backbone network and uses the source IP of the subnet's virtual network, allowing the storage account firewall to identify the traffic. Adding the subnet to the storage account's virtual network rules (B) then explicitly permits only that subnet's traffic, denying all other public endpoint access. Together, these two configurations restrict access to the storage account's public endpoint exclusively to the specified subnet without requiring a private endpoint.

Answer

Create a private endpoint for the storage account.

Answer

Assign the Reader role to the subnet.

Answer

Turn on blob soft delete.

Question 5

A Recovery Services vault currently keeps daily Azure VM recovery points for 7 days. The business changes the requirement to keep daily recovery points for 30 days. Where should the administrator change the setting?

Accepted Answer

In the backup policy associated with the Recovery Services vault.. The retention duration for Azure VM backups is configured within the backup policy that is associated with the Recovery Services vault. By modifying the backup policy (either the default policy or a custom policy), the administrator can change the retention setting from 7 days to 30 days for daily recovery points. This policy directly controls how long backup snapshots are retained, and the change takes effect for all VMs linked to that policy.

Answer

In the VM's network interface settings, because backup retention follows the NIC configuration.

Answer

In Azure Policy, by assigning a retention compliance initiative to the subscription.

Answer

In a storage account lifecycle rule attached to the VM disks.

Question 6

A platform team wants to investigate incidents involving Azure VM performance, storage failures, and subscription-level changes in one place. They want to minimize Log Analytics ingestion cost. Which telemetry approach should they use?

Accepted Answer

Send only the required platform diagnostic logs and Activity logs to one Log Analytics workspace, and use metric alerts for threshold-based signals. Option C is correct because it balances the need for centralized incident investigation with cost control. By sending only required platform diagnostic logs (e.g., from Azure Storage and VM metrics) and Activity logs to a single Log Analytics workspace, the team avoids unnecessary ingestion of verbose guest-level logs. Metric alerts provide threshold-based signals without log ingestion costs, enabling efficient monitoring of performance and failures.

Answer

Enable full guest-level logging on every VM, send all storage logs to the workspace, and add all activity logs from every subscription

Answer

Use metric alerts only and avoid Log Analytics because metrics are always cheaper than logs

Answer

Export all telemetry to a storage account and query it manually when an incident occurs

Question 7

An application needs more data disk capacity, but the VM can keep using the same managed disk. Which two statements are true when you resize a managed data disk? Select two.

Accepted Answer

You can increase the managed disk size without redeploying the VM.. Option A is correct because Azure managed disks support online resizing: you can increase the size of a managed data disk while the VM remains running, without any need to stop, deallocate, or redeploy the VM. This is possible because the underlying Azure storage infrastructure can extend the virtual hard disk (VHD) file without disrupting the VM's I/O operations. After the resize, the guest OS sees the new capacity, but the partition and filesystem must be extended manually.

Answer

You must create a brand-new VM before resizing the disk.

Answer

Resizing a disk always shrinks it back to a smaller size.

Answer

The VM size must always change whenever disk capacity changes.

Question 8

An analytics team keeps quarterly telemetry exports in Azure Blob Storage. The files are accessed only a few times per year, but when they are needed they must remain online and immediately readable without any rehydration delay. Which access tier should you use?

Accepted Answer

Cold, because it is intended for rarely accessed online data with lower storage cost.. The Cold tier is designed for data that is rarely accessed but must remain online with immediate read access, offering lower storage costs than Cool or Hot tiers while avoiding the rehydration delay of Archive. The scenario specifies files are accessed only a few times per year but must be immediately readable without any rehydration delay, which matches Cold tier's purpose of providing online access with no latency for infrequent reads.

Answer

Hot, because it is optimized for frequent reads and writes.

Answer

Cool, because it is designed for infrequently accessed data that still stays online.

Answer

Archive, because it is the cheapest tier and can be opened directly in the portal.

Question 9

An organization has one Azure subscription with separate resource groups for Development and Operations. A contractor must start, stop, and read the properties of virtual machines only in RG-Operations. The contractor must not have access to virtual machines in RG-Development. Where should the role assignment be created?

Accepted Answer

At the RG-Operations resource group scope. Role assignments in Azure are inherited from higher scopes (management group, subscription, resource group) down to lower scopes. To grant the contractor the Virtual Machine Contributor role (or a custom role with start/stop/read permissions) only on VMs in RG-Operations and explicitly deny access to RG-Development, the assignment must be scoped to the RG-Operations resource group. Assigning at a higher scope (subscription or management group) would grant access to all resource groups, including RG-Development, violating the requirement.

Answer

At the subscription scope

Answer

At the management group scope

Answer

At an individual virtual machine scope

Question 10

An Azure CLI script runs on a utility VM every night to create and tag resources in another subscription. The script cannot store a password or client secret, and the VM is regularly redeployed from a standard image. What is the best identity design?

Accepted Answer

Create a user-assigned managed identity and attach it to the utility VM. Option B is correct because a user-assigned managed identity can be created once, assigned to the utility VM, and used across redeployments without storing any credentials. The script can authenticate via Azure CLI using the managed identity's client ID, and the identity persists independently of the VM's lifecycle, satisfying the requirement of no password or client secret storage.

Answer

Assign a system-assigned managed identity to the utility VM

Answer

Create a service principal and store its secret in the VM configuration

Answer

Use a shared access signature to sign the Azure CLI session

Question 11

Based on the exhibit, every resource created in RG-Finance must automatically receive CostCenter=FIN, but deployments should not fail if the tag is omitted. What should you configure?

Accepted Answer

Assign an Azure Policy with the Modify effect at RG-Finance.. Option A is correct because the Azure Policy 'Modify' effect can automatically add the CostCenter=FIN tag to resources in RG-Finance without causing deployment failures if the tag is omitted. Unlike 'Deny', which blocks non-compliant deployments, 'Modify' uses a remediation task to append the missing tag after creation, ensuring compliance without disruption.

Answer

Assign an RBAC role that forces all users to enter the tag.

Answer

Apply a ReadOnly lock to the resource group.

Answer

Use Azure Policy with a Deny effect at the management group.

Question 12

An online transaction app uses two identical VMs in an Azure region that supports availability zones. The business wants the app to stay available if an entire datacenter in the region fails. What should the administrator deploy?

Accepted Answer

Two VMs placed in different availability zones within the region.. Option B is correct because deploying VMs in different availability zones protects against an entire datacenter failure. Each availability zone is a physically separate datacenter within an Azure region, with independent power, cooling, and networking. If one zone fails, the VM in the other zone remains available, ensuring business continuity for the app.

Answer

An availability set with the VMs placed in different update domains.

Answer

A proximity placement group so both VMs stay physically close together.

Answer

A single VM with Premium SSD storage and automatic restart.

Question 13

A build server in an on-premises datacenter must deploy ARM templates to Azure. The automation must not use a human account password, and Microsoft Entra conditional access for device sign-in is not available because the server is outside Azure. The security team allows a non-human credential but wants the strongest practical option for this scenario. What should the administrator configure?

Accepted Answer

A service principal authenticated with a certificate.. Option B is correct because a service principal authenticated with a certificate provides a non-human credential that does not require a human password and is the strongest practical option for an on-premises build server that cannot use managed identities (which are Azure-resource-scoped) or device-based conditional access. Certificate-based authentication for service principals uses asymmetric cryptography (X.509 certificates) with a private key stored securely on the build server, offering higher security than a client secret and meeting the requirement to avoid human account passwords.

Answer

A system-assigned managed identity on the build server.

Answer

A user-assigned managed identity shared with the build server.

Answer

A resource lock on the target resource group to permit template deployment.

Question 14

A central audit team needs Reader access on every current and future subscription under the company hierarchy. Which scope should you use for the role assignment?

Accepted Answer

Management group scope. A management group scope allows role assignments to be inherited by all subscriptions and resource groups within that management group hierarchy. By assigning the Reader role at the management group level, the central audit team automatically gains read access to every current subscription and any future subscription added under that management group, ensuring consistent governance without manual updates.

Answer

Subscription scope

Answer

Resource group scope

Answer

Resource scope

Question 15

A company wants an alert to be sent by email and SMS whenever a production virtual machine's CPU percentage goes above 80 percent. The administrator also wants the notification targets to be reusable by other alerts later. What should the administrator configure first?

Accepted Answer

An action group. An action group (B) is the correct first configuration because it defines the notification targets (email, SMS) that can be reused across multiple alert rules. In Azure Monitor, alert rules are decoupled from notification actions; you create an action group once and then reference it in any metric alert rule, including the CPU percentage threshold rule needed here. This ensures the administrator can meet the requirement for reusable notification targets.

Answer

A metric alert rule only

Answer

A service health alert

Answer

A diagnostic setting

Question 16

A Linux VM deployed from a custom image shows only a black screen after reboot, and SSH never becomes available. The administrator needs to inspect the startup process without logging into the OS. Which two Azure features should be used? Select two.

Accepted Answer

Boot diagnostics. Boot diagnostics captures serial console output and screenshots of the VM during boot, allowing you to see kernel panics, driver failures, or bootloader errors even when the OS is unresponsive. Azure Serial Console provides a text-based console connection to the VM at the hypervisor layer, enabling interactive troubleshooting of the boot process (e.g., GRUB recovery, initramfs issues) without requiring network connectivity or SSH.

Answer

Azure Site Recovery

Answer

VM application health extension

Answer

Azure Backup restore point

Question 17

A company is building a hub-and-spoke Azure network. The hub VNet already uses 10.50.0.0/16. A new spoke VNet will later be peered to the hub and connected to on-premises through VPN. What is the most important planning step before creating the peering?

Accepted Answer

Choose a non-overlapping address space for the spoke and reserve room for future subnets.. Option B is correct because Azure VNet peering requires non-overlapping address spaces to establish connectivity. If the spoke uses the same address space as the hub (10.50.0.0/16), routing conflicts will occur, and the peering will fail or cause unpredictable traffic behavior. Additionally, reserving room for future subnets ensures the spoke can scale without needing to re-architect the network.

Answer

Reuse 10.50.0.0/16 in the spoke so routing to the hub is simpler.

Answer

Create a route table first so peering can learn the spoke routes.

Answer

Enable a service endpoint to allow the spoke to communicate with the hub.

Question 18

An organization wants a single Azure storage account that can host blob containers, Azure Files shares, and lifecycle management rules for blob data. Which storage account kind should the administrator create?

Accepted Answer

General-purpose v2 (StorageV2). General-purpose v2 (StorageV2) is the only storage account kind that supports blobs, Azure Files, and lifecycle management rules for blob data. It provides a unified account for all Azure Storage data services, including blobs, files, queues, and tables, and it natively supports lifecycle management policies to automatically tier or delete blob data based on age or other conditions.

Answer

BlobStorage

Answer

FileStorage

Answer

BlockBlobStorage

Question 19

Based on the exhibit, a stateless web app must add VM instances during business hours and remove them at night based on CPU usage. Which Azure service should the administrator deploy?

Accepted Answer

An Azure virtual machine scale set.. An Azure virtual machine scale set (VMSS) is the correct choice because it automatically scales the number of VM instances in or out based on CPU usage metrics, and it supports scheduled scaling to add instances during business hours and remove them at night. This aligns with the stateless web app requirement for elastic, automated scaling without manual intervention.

Answer

An availability set with two virtual machines.

Answer

A single Azure VM with a larger size.

Answer

A recovery services vault.

Question 20

An operations team wants all internet-bound traffic from a workload subnet to pass through a network virtual appliance at 10.1.0.4 for inspection. Which next hop type should be used in a user-defined route for destination 0.0.0.0/0?

Accepted Answer

Virtual appliance. To force all internet-bound traffic from a subnet through a network virtual appliance (NVA) at 10.1.0.4, you must create a user-defined route (UDR) with destination 0.0.0.0/0 and next hop type 'Virtual appliance'. This directs traffic to the NVA's private IP for inspection, overriding Azure's default system route that would otherwise send 0.0.0.0/0 traffic directly to the Internet via the Azure backbone.

Answer

Internet

Answer

Virtual network gateway

Answer

None