AZ-104 Practice Exam 56 — 20 Questions

Question 1

Based on the exhibit, the alert rule is firing, but the operations team is not receiving any notification. What should you change to make the alert send an email when the condition is met?

Accepted Answer

Attach an action group that includes the required email recipient.. An alert rule in Azure Monitor requires an action group to define the notification actions (e.g., email, SMS) when the alert fires. Without an action group attached to the alert rule, no notifications are sent, even if the condition is met. Option B correctly identifies that attaching an action group containing the required email recipient will enable email notifications.

Answer

Increase the evaluation frequency to 15 minutes so Azure sends a summary notification.

Answer

Create a diagnostic setting on the virtual machine and send logs to a storage account.

Answer

Move the virtual machine into a different resource group so the alert can notify the team.

Question 2

You need to collect guest operating system performance counters and Windows event logs from several Azure virtual machines into a central queryable platform. Which Azure component should you configure?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the correct Azure component for collecting guest OS performance counters and Windows event logs from Azure VMs. It serves as a central repository where diagnostic data from Azure Monitor agents (such as the Log Analytics agent or Azure Monitor Agent) is ingested, stored, and made available for querying via Kusto Query Language (KQL). This enables you to analyze performance metrics and event logs across multiple VMs in a unified, queryable platform.

Answer

A Recovery Services vault

Answer

An Azure Policy initiative

Answer

A route table

Question 3

Based on the exhibit, an automation account must restart virtual machines and read network interface settings in RG-App. Built-in roles are too broad because they also allow actions the team does not want. What should the administrator do?

Accepted Answer

Create a custom role with only the required read and restart actions, then assign it at RG-App.. Option B is correct because built-in roles like Virtual Machine Contributor include actions beyond the required scope (e.g., write/delete operations), which the team wants to avoid. A custom role allows precise definition of only the needed actions: 'Microsoft.Compute/virtualMachines/restart/action' and 'Microsoft.Network/networkInterfaces/read'. Assigning this custom role at the RG-App scope ensures least privilege without exposing broader permissions.

Answer

Assign the Reader role at RG-App, because reading permissions automatically include restart actions.

Answer

Assign Virtual Machine Contributor at the subscription scope so the automation account can reach all resources.

Answer

Create a management group and move RG-App into it so only the needed actions are exposed.

Question 4

An on-premises ERP server connected to Azure through a site-to-site VPN must read and write blobs in a storage account by using the storage account's private IP address. Public network access must be blocked. Which storage configuration should the administrator implement?

Accepted Answer

Create a private endpoint for the storage account and disable public network access.. Option B is correct because a private endpoint assigns the storage account a private IP address from the on-premises subnet (connected via VPN), enabling the ERP server to communicate with the storage account over the private network. Disabling public network access ensures that all traffic must traverse the private endpoint, blocking any internet-based access. This meets the requirement of using the storage account's private IP address while preventing public exposure.

Answer

Configure a service endpoint on the on-premises subnet and leave public access enabled.

Answer

Issue a container SAS and publish the storage account public DNS name.

Answer

Enable SMB multichannel on the storage account.

Question 5

Why is centralized logging especially helpful during incident investigation?

Accepted Answer

It helps investigators analyze related events from multiple devices in one place.. Centralized logging aggregates logs from multiple sources (servers, firewalls, applications) into a single repository, enabling investigators to correlate events across devices during an incident. This eliminates the need to manually access each device's local logs, speeding up root cause analysis and providing a unified timeline of activities.

Answer

It guarantees that no attack can ever succeed.

Answer

It replaces the need for access control.

Answer

It forces all devices to use the same VLAN.

Question 6

Based on the exhibit, a site-to-site VPN gateway deployment fails. What prerequisite should the administrator provide so the gateway can be created successfully?

Accepted Answer

A public IP address resource that will be associated with the VPN gateway.. A site-to-site VPN gateway in Azure requires a public IP address resource to be associated with it for the tunnel to be established. The VPN gateway uses this public IP as the endpoint for on-premises VPN devices to connect to over the internet. Without a public IP, the gateway cannot be provisioned because it has no routable external address for IPsec/IKE negotiation.

Answer

A NAT gateway on the GatewaySubnet to translate tunnel traffic.

Answer

A private endpoint in the GatewaySubnet for tunnel termination.

Answer

A network security group that allows inbound TCP 443 to the subnet.

Question 7

Based on the exhibit, the team wants to validate that a protected Azure VM can be recovered without affecting production. Which restore approach best meets the requirement?

Accepted Answer

Restore the VM to a separate resource group or test environment from the latest recovery point.. Restoring the VM to a separate resource group or test environment from the latest recovery point creates an isolated copy of the VM that does not interact with production resources. This approach validates recoverability without risking production name conflicts, IP address overlaps, or accidental data modification. Azure Backup's restore-to-new-location option explicitly supports this isolation by allowing you to choose a different resource group, virtual network, and storage account.

Answer

Use Replace existing VM so the test uses the production name and disks.

Answer

Export a snapshot and assume that proves the VM can boot successfully.

Answer

Enable Site Recovery failover, because backup restore and failover are identical.

Question 8

Based on the exhibit, what is the best access change to let John download blobs from only the invoices container?

Accepted Answer

Assign Storage Blob Data Reader at the invoices container scope.. Option B is correct because assigning the Storage Blob Data Reader role at the invoices container scope grants John the minimum permissions needed to download blobs from that specific container. This role provides read access to blob data without allowing any write or management operations, and scoping it to the container ensures John cannot access other containers in the storage account.

Answer

Assign Reader at the storage account scope so John can view the storage account and its data.

Answer

Assign Storage Account Contributor at the resource group scope.

Answer

Make the invoices container public and keep John's existing Contributor role.

Question 9

A company has a virtual machine in a subnet that must access an Azure Storage account. The storage account should remain reachable through its public endpoint, but access must be limited to that subnet, and the traffic should stay on the Azure backbone rather than the internet. Which feature should the administrator configure on the subnet?

Accepted Answer

A service endpoint for Microsoft.Storage.. A service endpoint for Microsoft.Storage extends the virtual network identity to the storage account, allowing traffic from the subnet to the storage account's public endpoint to be routed over the Azure backbone network rather than the internet. This satisfies the requirement to limit access to the subnet while keeping the public endpoint reachable and traffic within Azure's infrastructure.

Answer

A private endpoint for the storage account.

Answer

A site-to-site VPN connection to the storage account.

Answer

An application security group assigned to the storage account.

Question 10

A company has a hub VNet and two peered spoke VNets, AppSpoke and DataSpoke. Both spokes can reach on-premises networks through the hub gateway. The app VM in AppSpoke must connect privately to the data VM in DataSpoke without using the internet or sending traffic on-premises first. What should the administrator do?

Accepted Answer

Create a direct VNet peering between AppSpoke and DataSpoke.. Option C is correct because a direct VNet peering between AppSpoke and DataSpoke establishes a private, low-latency connection between the two VNets without routing traffic through the hub gateway or on-premises networks. This satisfies the requirement for a private connection that does not use the internet or traverse on-premises, as VNet peering uses the Microsoft backbone infrastructure.

Answer

Add an NSG rule that allows traffic from AppSpoke to DataSpoke.

Answer

Enable gateway transit on both spoke peerings.

Answer

Add a user-defined route in AppSpoke pointing DataSpoke traffic to the hub gateway.

Question 11

A finance VM is backed up daily. The team wants short-lived snapshots so recently changed files can be recovered quickly, but they also need daily recovery points retained for 30 days. Which two backup policy settings should be configured? Select two.

Accepted Answer

Retain instant restore snapshots for 2 days. Option A is correct because instant restore snapshots are short-lived, locally stored snapshots that allow quick recovery of recently changed files. Setting 'Retain instant restore snapshots for 2 days' ensures these snapshots are available for immediate restores without consuming long-term backup storage. Option B is correct because 'Retain daily recovery points for 30 days' meets the requirement for daily recovery points to be kept for the specified retention period, allowing recovery from any of the last 30 daily backups.

Answer

Run the backup job every 12 hours

Answer

Retain weekly recovery points for 30 days

Answer

Move backup data to Archive tier

Question 12

Help desk staff must start, stop, and restart virtual machines in one application resource group. They must not create or delete VMs or modify networking or disks. Which built-in role should you assign?

Accepted Answer

Virtual Machine Operator. The Virtual Machine Operator role allows starting, stopping, and restarting virtual machines, but explicitly denies creating, deleting, or modifying VMs, networking, or disks. This matches the help desk staff's required permissions exactly, making it the correct built-in role for this scenario.

Answer

Reader

Answer

Virtual Machine Contributor

Answer

Contributor

Question 13

Based on the exhibit, which network feature should you use so only the subnet can reach the storage account while still using the public endpoint?

Accepted Answer

Enable a service endpoint on app-subnet and allow that subnet on the storage firewall.. Option B is correct because enabling a service endpoint on the app-subnet allows traffic from that subnet to reach the storage account over the Azure backbone network while still using the public endpoint. By then adding the subnet to the storage account firewall, you restrict access to only that subnet, ensuring no other internet traffic can reach the storage account. This approach leverages the public endpoint but with subnet-level access control, meeting the requirement.

Answer

Create a private endpoint and disable the storage account public endpoint.

Answer

Add a NAT gateway to app-subnet and use the NAT public IP for firewall rules.

Answer

Peer app-subnet with a new VNet and access the storage account through peering.

Question 14

Based on the exhibit, what should you do so the report can open the file tomorrow morning?

Accepted Answer

Change the blob to the Hot access tier and allow it to rehydrate before the report runs.. The blob is currently in the Archive access tier, which requires manual rehydration (changing the tier to Hot or Cool) before it can be read. Rehydration can take up to 15 hours, so changing the blob to the Hot access tier now and allowing it to complete rehydration before the report runs tomorrow ensures the file is available for reading.

Answer

Change the blob to the Cool access tier only, because Cool is always immediately readable.

Answer

Create a snapshot of the archived blob and use the snapshot instead.

Answer

Enable versioning on the storage account so the file becomes readable again.

Question 15

Based on the exhibit, which deployment choice should the administrator use to keep the application available if one datacenter in the Azure region fails?

Accepted Answer

Deploy the VMs across separate availability zones.. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across separate availability zones ensures that if one datacenter fails, the application remains available in the other zone, providing resilience against datacenter-level failures.

Answer

Place both VMs in the same availability set.

Answer

Use a proximity placement group for both VMs.

Answer

Use a larger VM size for each virtual machine.

Question 16

Based on the exhibit, which feature should you enable so the subnet can access the storage account without creating a private IP address in the VNet?

Accepted Answer

Service endpoint. Service endpoints allow a subnet to securely and privately connect to Azure PaaS services (like Storage Accounts) over the Azure backbone network without requiring a private IP address in the VNet. They extend the VNet identity to the service, enabling access via the service's public endpoint while restricting traffic to the subnet. This matches the requirement exactly: no private IP is created in the VNet, and the storage account is accessed directly.

Answer

Private endpoint

Answer

VPN Gateway

Answer

Azure Firewall

Question 17

Based on the exhibit, which change should you make so the VM reaches the blob service over a private IP address?

Accepted Answer

Create a private endpoint for the storage account and link the appropriate private DNS zone.. Option B is correct because a private endpoint assigns the storage account a private IP address from the VM's virtual network, enabling direct connectivity over a private IP. Linking the private endpoint to a private DNS zone ensures that the storage account's FQDN resolves to the private IP instead of the public endpoint, meeting the requirement without exposing traffic to the internet.

Answer

Enable a service endpoint on the subnet and keep the current DNS configuration.

Answer

Assign the VM a public IP address and allow it through the storage firewall.

Answer

Add the VM to a network security group that allows outbound TCP 443 to Azure Storage.

Question 18

Based on the exhibit, what should the administrator do first to restore the missing data disk?

Accepted Answer

Create a managed disk from the snapshot, then attach it to the VM.. The snapshot represents the missing data disk, not the OS disk. To restore it, you must first create a managed disk from the snapshot (using Azure CLI, PowerShell, or portal), then attach that disk to the VM. This preserves the existing VM configuration and applications without redeployment.

Answer

Recreate the VM from the marketplace image and restore applications manually.

Answer

Convert the snapshot directly into an operating system disk and replace the VM.

Answer

Increase the VM size so that Azure automatically recreates the missing disk.

Question 19

Based on the exhibit, what should the administrator use to temporarily allow the legacy storage account to remain noncompliant without changing the policy for everyone?

Accepted Answer

Create a policy exemption for the legacy storage account or its resource group.. A policy exemption allows the administrator to exclude a specific resource (the legacy storage account) or its resource group from the Azure Policy evaluation without modifying the underlying policy definition. This is the correct approach because it temporarily grants noncompliance for that resource while the policy remains enforced for all other resources, aligning with the requirement to avoid changing the policy for everyone.

Answer

Modify the policy definition so all storage accounts can use public network access.

Answer

Apply a ReadOnly lock to the storage account.

Answer

Move the storage account to another subscription so the policy no longer applies.

Question 20

A department has 12 subscriptions under a management group named Corp. New resources must be deployed only in East US or West US and must include a CostCenter tag. A pilot subscription must be exempt from these rules during testing. Which two actions should you take? Select two.

Accepted Answer

Assign an initiative containing both policy definitions at the Corp management-group scope.. Option A is correct because assigning an initiative (a collection of policy definitions) at the Corp management-group scope ensures that all 12 subscriptions inherit both the location restriction and the CostCenter tag requirement. This is the most efficient and scalable way to enforce governance across multiple subscriptions without repeating assignments.

Answer

Assign the policies individually at each resource group.

Answer

Use the Owner role at the management-group scope.

Answer

Use a resource lock instead of Azure Policy.

AZ-104 Practice Exam 56 — 20 Questions

Exhibit

AZ-104 Practice Exam 56 — 20 Questions

Exhibit