AZ-104 Practice Exam 55 — 20 Questions

Question 1

A Windows VM must install IIS after provisioning and then run a script that registers the server with an internal API by using the VM's managed identity. The same steps must run automatically whenever the VM is deployed from Bicep. What should be added to the deployment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A Custom Script Extension on the VM. The Custom Script Extension (CSE) is the correct choice because it allows you to run PowerShell or Bash scripts on an Azure VM after provisioning, enabling the installation of IIS and execution of a registration script that leverages the VM's managed identity. Since the requirement specifies that these steps must run automatically whenever the VM is deployed from Bicep, the CSE can be declared as a resource in the Bicep template, ensuring it executes on every deployment. This directly addresses the need for post-deployment configuration without manual intervention.

Answer

A read-only resource lock on the VM resource group

Answer

An availability set containing the VM

Answer

A proximity placement group for the VM

Question 2

An employee accidentally deletes a critical document from an Azure file share. You need to restore only that file to its earlier state without restoring the entire share or using a vault-based backup job. Which feature should you use?

Accepted Answer

A file share snapshot, because it captures a point-in-time copy of the share for granular recovery.. File share snapshots are point-in-time, read-only copies of Azure file shares that allow you to recover individual files or folders without restoring the entire share. When a file is accidentally deleted, you can mount a previous snapshot, copy the deleted file from it, and restore it to the live share—no vault-based backup job or full share restore required.

Answer

A storage account access key, because it can retrieve deleted files from any share version.

Answer

An Azure VM snapshot, because it captures the file share state automatically.

Answer

A private endpoint to the file share, because it enables restore operations.

Question 3

An organization wants a single Azure storage account that can host blob containers, Azure Files shares, and lifecycle management rules for blob data. Which storage account kind should the administrator create?

Accepted Answer

General-purpose v2 (StorageV2). General-purpose v2 (StorageV2) is the only storage account kind that supports blobs, Azure Files, and lifecycle management rules for blob data. It provides a unified account for all Azure Storage data services, including blobs, files, queues, and tables, and it natively supports lifecycle management policies to automatically tier or delete blob data based on age or other conditions.

Answer

BlobStorage

Answer

FileStorage

Answer

BlockBlobStorage

Question 4

RG-Prod hosts line-of-business workloads. The business wants to prevent accidental deletion of the resource group during change freezes and also ensure every new resource carries a CostCenter tag for chargeback. Which two governance controls should be used? Select two.

Accepted Answer

Apply a CanNotDelete lock to RG-Prod.. Applying a CanNotDelete lock to RG-Prod prevents the resource group from being deleted during change freezes, which directly meets the requirement to prevent accidental deletion. This lock type allows read and update operations but blocks delete operations, making it ideal for protecting critical resources without impacting ongoing workloads.

Answer

Apply a ReadOnly lock to RG-Prod.

Answer

Grant Reader to the finance team on the resource group.

Answer

Create a private endpoint for RG-Prod.

Question 5

Based on the exhibit, what is the best way to simplify access management for the project team?

Accepted Answer

Assign the RBAC role to an Entra ID group and manage membership there.. The best practice is to assign the RBAC role to an Entra ID group instead of individual users. That way, access management is handled by adding or removing members from the group, which is much easier and less error-prone. The role assignment remains stable while team membership changes over time, which is exactly what the requirement describes.

Why others are wrong: A works initially but becomes difficult to maintain as team membership changes. C does not control access at all. D is a governance mechanism, not an authorization mechanism, so it cannot replace group-based RBAC.

Answer

Keep assigning RBAC roles directly to each user account.

Answer

Create a resource lock on RG-App.

Answer

Create an Azure Policy assignment for RG-App.

Question 6

Based on the exhibit, which Azure service should you deploy to provide browser-based administrative access to the VM without assigning it a public IP address?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP/SSH connectivity to virtual machines directly in the Azure portal over TLS, without requiring a public IP address on the VM. It uses a hardened bastion host in your virtual network that brokers the connection, eliminating exposure of the VM to the internet.

Answer

Azure VPN Gateway

Answer

Public IP address on the VM

Answer

Azure Load Balancer

Question 7

Which two statements about application security groups and service tags are correct? Select two.

Accepted Answer

An application security group lets you reference a set of virtual machines in NSG rules.. An application security group (ASG) allows you to group virtual machines logically, and then reference that group as a source or destination in network security group (NSG) rules. This simplifies rule management by decoupling the rule from individual VM IP addresses or NICs, enabling dynamic membership based on application tiers.

Answer

Application security groups are used to assign Azure roles.

Answer

Service tags are custom labels you create for your own subscriptions.

Answer

Service tags create a private IP address for a service.

Question 8

Your company has an Azure subscription named Prod-Sub. You create a custom role that allows users to restart virtual machines but not create, delete, or resize them. You need to ensure that members of the VMOperators group can use this custom role only for virtual machines in the RG-Prod resource group. What should you do?

Accepted Answer

Assign the custom role to VMOperators at the RG-Prod scope.. Assigning the custom role at the RG-Prod scope restricts the role's permissions to only the virtual machines within that specific resource group. This meets the requirement that VMOperators can restart VMs but not create, delete, or resize them, and only within RG-Prod.

Answer

Assign the custom role to VMOperators at the subscription scope.

Answer

Assign the Virtual Machine Contributor role to VMOperators at the RG-Prod scope.

Answer

Assign the custom role to VMOperators at the management group scope.

Question 9

A reporting application must run on an Azure VM with at least 8 vCPUs and 64 GiB of RAM. The team also wants headroom for short spikes without falling below the requirement. Which two VM sizes meet or exceed the requirement? Select two.

Accepted Answer

Standard_E8s_v5. Standard_E8s_v5 is correct because it provides 8 vCPUs and 64 GiB of RAM, meeting the minimum requirement exactly. The E-series is memory-optimized, offering a high memory-to-core ratio suitable for reporting workloads, and the v5 generation includes Intel Xeon Platinum 8370C processors with support for premium storage and accelerated networking, ensuring headroom for short spikes without dropping below the requirement.

Answer

Standard_D8s_v5

Answer

Standard_F8s_v2

Answer

Standard_B8ms

Question 10

A developer packages an internal web app as a Linux container. The app must be published with built-in HTTPS, deployment slots, and autoscale, and the team does not want to manage OS patching or container hosts. Which Azure service should the administrator choose?

Accepted Answer

Azure App Service. Azure App Service is the correct choice because it natively supports Linux containers, built-in HTTPS via TLS/SSL, deployment slots for staging and production swaps, and autoscale based on metrics or schedules. It also abstracts OS patching and container host management, meeting the team's requirement to avoid managing infrastructure.

Answer

Azure Container Instances

Answer

Azure Virtual Machines

Answer

Azure Kubernetes Service

Question 11

An administrator wants to let a help desk group start, stop, and restart virtual machines in one resource group, but the group must not be able to delete the VMs or any other resource in the group. Which two actions should the administrator take? Select two.

Accepted Answer

Create a custom RBAC role with only VM start, stop, restart, and read actions.. Creating a custom RBAC role with only VM start, stop, restart, and read actions ensures the help desk group can perform only those specific operations without any delete permissions. This role must be assigned at the resource group scope (Option B) to limit its effect to that resource group, preventing the group from modifying or deleting resources in other scopes. Together, these two actions fulfill the requirement precisely.

Answer

Assign Virtual Machine Contributor to the help desk group.

Answer

Apply a CanNotDelete lock to the resource group.

Answer

Use Azure Policy to block VM deletion and leave RBAC unchanged.

Question 12

A company wants to prevent users from creating storage accounts unless the resources include a costCenter tag. Which Azure feature should be used?

Accepted Answer

Azure Policy, because it can evaluate and enforce required resource properties.. Azure Policy is correct because it can enforce organizational standards by evaluating resource properties during creation and modification. By defining a policy that requires a 'costCenter' tag on all storage accounts, Azure Policy will deny creation of any storage account that does not include that tag, ensuring compliance without manual intervention.

Answer

Azure RBAC, because it controls whether users can create resources.

Answer

A resource lock, because it can force resources to use tags.

Answer

A service endpoint, because it can filter which resources are allowed in a subscription.

Question 13

An application runs on two identical VMs in a region that does not support availability zones. The app must keep running through planned maintenance and a single hardware fault, and the team does not want to add a second region. Which two deployment choices are appropriate? Select two.

Accepted Answer

Place the VMs in an availability set.. A is correct because an availability set distributes VMs across multiple fault domains (up to 3) and update domains (up to 20) within the same datacenter. This ensures that during planned maintenance (update domain isolation) or a hardware fault (fault domain isolation), at least one VM remains available, meeting the requirement without needing availability zones or a second region.

Answer

Put both VMs in the same fault domain to simplify patching.

Answer

Deploy the workload in availability zones anyway.

Answer

Use a second Azure region for the primary failover design.

Question 14

A help desk group must use the Azure portal to start a virtual machine, stop or deallocate it, and see its current state, but they must not change any other VM settings. Which three Microsoft.Compute actions should be included in a custom role? Select three.

Accepted Answer

Microsoft.Compute/virtualMachines/read. The Microsoft.Compute/virtualMachines/read permission is required to view the current state of a virtual machine in the Azure portal. Without this read action, the help desk group would not be able to see the VM's status, which is essential for their task of monitoring and managing the VM lifecycle.

Answer

Microsoft.Compute/virtualMachines/write

Answer

Microsoft.Compute/virtualMachines/delete

Question 15

A development team needs one storage account to host blob containers, Azure Files shares, and blob lifecycle management rules. Which two statements about the account are correct? Select two.

Accepted Answer

It should be a General-purpose v2 storage account.. A General-purpose v2 (GPv2) storage account is required because it supports the latest storage features, including blob lifecycle management rules, blob containers, and Azure Files shares. GPv2 accounts provide the necessary REST API endpoints and management capabilities for lifecycle policies, which are not available in older account types like BlobStorage or General-purpose v1.

Answer

It must be a BlobStorage account.

Answer

It must use only zone-redundant storage to use lifecycle rules.

Answer

It cannot use lifecycle management for blobs.

Question 16

A line-of-business app requires protection against a datacenter outage in a region that supports zones. You want the strongest placement resilience available for the VMs. What should you choose?

Accepted Answer

Availability zone. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across zones provides the strongest resilience against a datacenter outage because if one zone fails, the other zones remain operational. This is the highest level of protection available within a single region for IaaS VMs.

Answer

Availability set

Answer

Virtual machine scale set

Answer

Resource lock

Question 17

A company has a hub virtual network that contains a custom DNS server at 10.20.0.4. A new spoke virtual network is peered to the hub. VMs in the spoke can reach other resources in Azure, but they cannot resolve internal names such as app01.corp.local. What should the administrator configure to fix name resolution for the spoke VMs?

Accepted Answer

Set the spoke virtual network's custom DNS server to 10.20.0.4.. The spoke virtual network must be configured to use the hub's custom DNS server (10.20.0.4) as its own DNS server. Azure virtual networks do not automatically inherit DNS settings from a peered hub; each virtual network must explicitly specify its DNS server. By setting the spoke's custom DNS server to 10.20.0.4, VMs in the spoke will send DNS queries to that server, enabling resolution of internal names like app01.corp.local.

Answer

Add a user-defined route that sends DNS traffic to the hub virtual network.

Answer

Create an NSG rule that allows UDP port 53 from the spoke subnet to the hub subnet.

Answer

Enable gateway transit on the hub peering so name resolution flows through the VPN gateway.

Question 18

A company has VNet-A with address space 10.20.0.0/16 and active workloads in several subnets. The team must peer VNet-A with VNet-B, but VNet-B currently uses 10.20.128.0/17 and cannot be rebuilt from scratch. What should the administrator do first to make peering possible without interrupting current workloads?

Accepted Answer

Add a new non-overlapping address space to VNet-B, create replacement subnets there, and migrate workloads gradually.. Azure Virtual Network peering requires that the address spaces of the peered VNets do not overlap. VNet-A uses 10.20.0.0/16, which fully contains VNet-B's 10.20.128.0/17, creating an overlap. Since VNet-B cannot be rebuilt, the correct first step is to add a new non-overlapping address space (e.g., 10.30.0.0/16) to VNet-B, create subnets in that new range, migrate workloads gradually, and then remove the overlapping address space before establishing the peering. This ensures no IP conflicts and avoids disrupting existing workloads.

Answer

Create the peering now and let Azure automatically route overlapping prefixes.

Answer

Attach a route table to VNet-B so traffic to VNet-A is forced through a firewall appliance.

Answer

Create a private endpoint between the two VNets so Azure ignores the overlap during connectivity checks.

Question 19

After a custom image is applied, a VM restarts to a black screen and never reaches the login prompt. The administrator needs the fastest way to inspect what happened during boot without logging into the guest OS. What should be enabled or reviewed first?

Accepted Answer

Boot diagnostics. Boot diagnostics captures serial console output and screenshots of the VM during boot, allowing you to inspect boot failures like a black screen without guest OS access. This is the fastest method because it provides immediate, out-of-band visibility into the boot process, including kernel panics or driver issues, without requiring RDP or SSH connectivity.

Answer

Azure Monitor metric alert

Answer

VM extension status

Answer

Network Watcher IP flow verify

Question 20

A shared resource group contains a VPN gateway and several virtual machines used by the finance department. Administrators must still be able to resize the VMs and update NSG rules, but no one should be able to delete the resource group or anything in it during the quarter-end freeze. Which lock should be applied?

Accepted Answer

CanNotDelete lock on the resource group. The CanNotDelete lock (option B) prevents deletion of the resource group and all resources within it, while still allowing read and update operations such as resizing VMs and modifying NSG rules. This meets the requirement to block deletions during the quarter-end freeze without hindering administrative changes. ReadOnly locks would block all write operations, including resizing and NSG rule updates, which is not desired.

Answer

ReadOnly lock on the resource group

Answer

Management group lock on the subscription

Answer

Azure Policy deny effect on the resource group