AZ-104 Practice Exam 56 — 20 Questions

Question 1

You want Azure to identify underutilized virtual machines and recommend ways to reduce cost and improve security posture. Which service should you use?

Accepted Answer

Azure Advisor. Azure Advisor analyzes Azure resources and provides recommendations related to cost, security, reliability, performance, and operational excellence.

Answer

Azure Policy

Answer

Azure Backup

Answer

Virtual network peering

Question 2

Based on the exhibit, a help desk engineer cannot RDP from an approved admin subnet to a VM in Azure. What change should the administrator make so the connection is allowed?

Accepted Answer

Move Allow-RDP-Admin to a priority lower than 100.. The exhibit shows a deny rule with priority 100 that blocks all inbound traffic from the approved admin subnet, and an allow rule for RDP with a priority lower than 100 (e.g., 200). Since Azure Network Security Group (NSG) rules are evaluated in priority order (lowest number first), the deny rule at priority 100 is evaluated before the allow rule at a lower priority, thus blocking the RDP connection. To allow the RDP traffic, the administrator must move the Allow-RDP-Admin rule to a priority lower than 100 (e.g., 90) so it is evaluated before the deny rule.

Answer

Change the deny rule to use UDP instead of TCP.

Answer

Add the VM NIC to an application security group and leave the rules unchanged.

Answer

Delete the default AllowVNetInBound rule.

Question 3

A VM must be backed up every day, and backups must be retained for several days after creation. Which two settings are configured in an Azure Backup policy? Select two.

Accepted Answer

Backup schedule. An Azure Backup policy requires a backup schedule to define when the backup job runs (e.g., daily at a specific time). Option B is correct because retention rules specify how long each backup recovery point is kept (e.g., 7 days for daily backups, 30 days for weekly). Together, these two settings form the core of a backup policy, ensuring both the timing and lifespan of backups are controlled.

Answer

Network security group rules

Answer

Private DNS zone records

Answer

Availability set placement

Question 4

A compliance team keeps signed contract scans in blob storage. The files are usually not accessed, but when they are needed they must be available immediately without waiting for rehydration. The team wants the lowest-cost online tier that still allows immediate reads. Which access tier should you choose?

Accepted Answer

Cold. The Cold tier (C) is correct because it is the lowest-cost online access tier that provides immediate read access without requiring rehydration. Unlike the Archive tier, Cold tier data is always online and can be read instantly, while still offering lower storage costs than Cool or Hot tiers for data that is rarely accessed.

Answer

Hot

Answer

Cool

Answer

Archive

Question 5

The team needs alerts for VM CPU and storage capacity thresholds, but they want to keep telemetry ingestion costs as low as possible. Which approach is best?

Accepted Answer

Use Azure Monitor metric alerts for the threshold conditions.. Azure Monitor metric alerts are the most cost-effective approach because they evaluate lightweight, pre-collected platform metrics (e.g., CPU percentage, disk read/write operations) at regular intervals without ingesting or storing raw log data. This avoids the ingestion and retention costs associated with sending diagnostic logs to a Log Analytics workspace, making it ideal for simple threshold-based monitoring of VM CPU and storage capacity.

Answer

Send all VM diagnostic logs to Log Analytics and create only log search alerts.

Answer

Create a Recovery Services vault backup policy with a short retention period.

Answer

Assign Azure Policy to the subscription to audit CPU and storage trends.

Question 6

Based on the exhibit, which method should the administrator use to grant the partner time-limited access to one container?

Accepted Answer

Generate a user delegation SAS after authenticating with Microsoft Entra ID.. A user delegation SAS is secured with Microsoft Entra ID credentials and can be scoped to a specific container with a time-limited expiry, meeting the requirement for time-limited access to one container. Unlike a service SAS, which uses the storage account key and grants broader permissions, the user delegation SAS provides finer-grained control and does not expose the account key. This method is the recommended approach for granting delegated, time-bound access to Azure Storage resources.

Answer

Generate a service SAS by using the storage account key and email the URL to the partner.

Answer

Make the container public and remove the SAS requirement from the partner workflow.

Answer

Assign the partner Storage Blob Data Contributor on the storage account and let them sign in interactively.

Question 7

You need to allow a partner application to upload files to a blob container for the next 24 hours. The partner must not receive the storage account key. What should you provide?

Accepted Answer

A shared access signature (SAS). A shared access signature (SAS) provides delegated, time-limited access to a specific Azure Storage resource (like a blob container) without exposing the storage account key. By generating a SAS token with write permissions and a 24-hour expiry, you grant the partner application the ability to upload files while maintaining security and control over the access window.

Answer

The storage account access key

Answer

The connection string with the account key

Answer

A Recovery Services vault

Question 8

Based on the exhibit, you need to return only the failed operations from the log entries. Which KQL query should you use?

Accepted Answer

AzureActivity | where ActivityStatusValue == "Failed" | project TimeGenerated, OperationName, Caller. The KQL query filters the AzureActivity table using the `where` clause to return only rows where `ActivityStatusValue` equals 'Failed', then projects the relevant columns `TimeGenerated`, `OperationName`, and `Caller`. This directly meets the requirement to return only failed operations from the log entries.

Answer

AzureActivity | summarize count() by Caller

Answer

AzureActivity | top 10 by TimeGenerated

Answer

AzureActivity | where ActivityStatusValue == "Succeeded"

Question 9

A workload needs more CPU and memory than the current Azure VM size provides. The administrator wants to increase compute capacity without redeploying the application. What should be done?

Accepted Answer

Resize the VM to a larger size. Resizing the Azure VM to a larger size (option A) directly increases the CPU and memory resources allocated to the VM without requiring redeployment of the application. Azure supports resizing VMs within the same hardware family or to a different family, provided the new size is available in the current region and the VM is not part of a VMSS with overprovisioning constraints. The resize operation updates the VM's SKU, and after a reboot, the new resources are available to the OS and applications.

Answer

Move the VM into an availability set

Answer

Replace the VM with a snapshot

Answer

Assign a user-assigned managed identity

Question 10

A customer-facing application has two goals: it must keep running if one datacenter in the region fails, and it must be able to scale out automatically during daily peaks. Which two Azure compute choices best match those requirements? Select two.

Accepted Answer

Deploy the workload across Availability Zones. Deploying across Availability Zones provides datacenter-level fault tolerance: each zone is an isolated physical datacenter with independent power, cooling, and networking. If one zone fails, the application continues running in the other zones. Option C is correct because a Virtual Machine Scale Set with autoscale automatically adjusts the number of VM instances based on CPU or memory metrics, enabling the application to scale out during daily peaks and scale in during off-peak hours.

Answer

Place all instances in one Availability Set

Answer

Run a single VM behind a load balancer

Answer

Use a proximity placement group

Question 11

A container group in Azure Container Instances must pull a private image from Azure Container Registry without embedding registry credentials in the template. What should you configure?

Accepted Answer

A managed identity for the container group and the AcrPull role on the registry. Azure Container Instances (ACI) can authenticate to Azure Container Registry (ACR) using a managed identity assigned to the container group. By granting the managed identity the AcrPull role on the registry, ACI can pull private images without embedding any credentials in the deployment template, leveraging Azure AD authentication and RBAC for secure access.

Answer

An admin user account on the Azure Container Registry

Answer

A shared access signature in a container environment variable

Answer

A public network access rule that allows all Azure services

Question 12

You need to run a PowerShell script inside a newly deployed Azure virtual machine to configure application settings immediately after deployment. Which feature should you use?

Accepted Answer

A Custom Script Extension. The Custom Script Extension (CSE) is the correct choice because it allows you to run a PowerShell script on an Azure VM after deployment, making it ideal for configuring application settings. CSE downloads and executes scripts on the VM using the Azure VM agent, and it can be invoked during VM creation or post-deployment via ARM templates, Azure CLI, or PowerShell.

Answer

Azure Policy

Answer

Boot diagnostics

Answer

An availability set

Question 13

A partner company needs write access to a single blob container for 24 hours. The partner does not have an Azure subscription in your tenant, and the team does not want to share the storage account key. Which access method is the best choice?

Accepted Answer

Create a user delegation SAS with write permission and a short expiration time. A user delegation SAS is the best choice because it provides time-limited, scoped write access to a specific blob container without exposing the storage account key. It is secured with Azure AD credentials and can be configured with a short expiration time (e.g., 24 hours), meeting the partner's requirement for temporary access. This method ensures the partner does not need an Azure subscription in your tenant and avoids sharing the account key.

Answer

Grant the partner Contributor access on the storage account

Answer

Share the storage account access key and let the partner create their own token

Answer

Enable anonymous public write access on the container

Question 14

You are managing an Azure Storage account that hosts a large number of blobs. You need to ensure that data can be recovered if blobs are accidentally deleted or overwritten. Which three of the following actions should you take? (Choose three.)

Accepted Answer

Enable soft delete for blobs.. Soft delete for blobs preserves deleted blobs for a specified retention period, allowing recovery from accidental deletion. Blob versioning maintains previous versions of a blob, enabling restoration if a blob is overwritten or deleted. Point-in-time restore for block blobs allows reverting the container to an earlier state, recovering from bulk accidental modifications or deletions. Together, these three features provide comprehensive protection against accidental data loss.

Answer

Set the default access tier to Archive.

Answer

Enable Azure Defender for Storage.

Answer

Configure a lifecycle management policy to move blobs to the Cool tier.

Question 15

An NSG rule allows TCP 8443 from ASG-Web to ASG-Api on the API subnet. The web VM NIC is already in ASG-Web, but the API VM was only placed in the subnet and not added to ASG-Api. Traffic still fails. What is the best fix?

Accepted Answer

Add the API VM's NIC to ASG-Api so the NSG rule can match the destination NIC.. The NSG rule specifies ASG-Api as the destination, but NSGs evaluate traffic based on the NIC membership in an ASG, not the subnet. Since the API VM's NIC is not added to ASG-Api, the rule cannot match the destination, so traffic is dropped by default (implicit deny). Adding the NIC to ASG-Api allows the NSG rule to correctly identify the destination and permit TCP 8443 traffic.

Answer

Add ASG-Api to the API subnet because ASGs are inherited from subnet membership.

Answer

Lower the rule priority number on the web subnet to make source traffic more specific.

Answer

Create a user-defined route from AppSubnet to API subnet to bypass the NSG.

Question 16

Two legacy application VMs must survive planned maintenance and a single host failure. The vendor requires both VMs to stay in the same region, and a datacenter outage is not part of the requirement. What should the administrator use?

Accepted Answer

An availability set that places the VMs in separate fault and update domains.. An availability set protects against planned maintenance and single host failures by placing VMs in separate fault domains (different physical hardware) and update domains (different maintenance windows). This ensures that during planned Azure maintenance, only one VM is rebooted at a time, and if a host fails, only VMs in that fault domain are affected. Since the requirement specifies a single host failure (not a datacenter outage) and both VMs must stay in the same region, an availability set is the correct choice.

Answer

Availability zones with one VM in each zone.

Answer

A virtual machine scale set in a single zone.

Answer

A proximity placement group for both VMs.

Question 17

You are deploying a stateless web application on Azure virtual machines. The solution must automatically add and remove instances based on CPU demand and allow all instances to be managed as one logical group. Which Azure compute feature should you deploy?

Accepted Answer

A Virtual Machine Scale Set. A Virtual Machine Scale Set (VMSS) is the correct Azure compute feature because it automatically manages a group of identical, load-balanced VMs that can scale in and out based on CPU demand using autoscale rules. It treats all instances as a single logical group, enabling unified management, patching, and application deployment, which is exactly what the stateless web application requires.

Answer

An availability set

Answer

A Recovery Services vault

Answer

Boot diagnostics

Question 18

A build pipeline starts a Linux container once per request. Each run lasts about 12 minutes, never needs inbound connections, and should not leave an always-on server running afterward. Which two configuration choices best fit Azure Container Instances? Select two.

Accepted Answer

Use Azure Container Instances for the workload.. Azure Container Instances (ACI) is the correct choice because it is a serverless container platform that starts containers on demand, runs them for the duration of the workload (here ~12 minutes), and automatically stops and deallocates resources when the container exits. It requires no always-on infrastructure, supports Linux containers, and does not need inbound connections, making it ideal for ephemeral build pipeline tasks.

Answer

Create an App Service plan with deployment slots.

Answer

Use a virtual machine scale set to host the container.

Answer

Place the workload in an availability set for host protection.

Question 19

A production VM is using too much CPU. You want Azure to notify the operations team by email when Average Percentage CPU stays above 80 percent for 5 minutes. What should you configure?

Accepted Answer

A metric alert rule linked to an action group. A metric alert rule monitors a specific metric (e.g., Percentage CPU) and triggers when a condition (e.g., above 80% for 5 minutes) is met. Linking the alert to an action group allows Azure to send email notifications to the operations team. This is the correct Azure Monitor feature for threshold-based, metric-driven notifications.

Answer

A diagnostic setting on the VM

Answer

A Log Analytics workspace only

Answer

An Azure Policy assignment

Question 20

A finance analyst needs read-only access to one storage account named stprod01. The analyst must not see other resources in the subscription. Where should you assign the Reader role?

Accepted Answer

At the storage account resource scope. Assigning the Reader role at the storage account resource scope (stprod01) grants read-only access exclusively to that specific storage account. This meets the requirement of restricting the analyst from seeing any other resources in the subscription, as role assignments at a higher scope (e.g., resource group, subscription, management group) would inherit permissions to all resources under that scope.

Answer

At the management group scope that contains the subscription

Answer

At the subscription scope that contains the storage account

Answer

At the resource group that contains the storage account