AZ-104 Practice Exam 56 — 20 Questions

Question 1

A customer-facing application has two goals: it must keep running if one datacenter in the region fails, and it must be able to scale out automatically during daily peaks. Which two Azure compute choices best match those requirements? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Deploy the workload across Availability Zones. Deploying across Availability Zones provides datacenter-level fault tolerance: each zone is an isolated physical datacenter with independent power, cooling, and networking. If one zone fails, the application continues running in the other zones. Option C is correct because a Virtual Machine Scale Set with autoscale automatically adjusts the number of VM instances based on CPU or memory metrics, enabling the application to scale out during daily peaks and scale in during off-peak hours.

Answer

Place all instances in one Availability Set

Answer

Run a single VM behind a load balancer

Answer

Use a proximity placement group

Question 2

A container group in Azure Container Instances must pull a private image from Azure Container Registry without embedding registry credentials in the template. What should you configure?

Accepted Answer

A managed identity for the container group and the AcrPull role on the registry. Azure Container Instances (ACI) can authenticate to Azure Container Registry (ACR) using a managed identity assigned to the container group. By granting the managed identity the AcrPull role on the registry, ACI can pull private images without embedding any credentials in the deployment template, leveraging Microsoft Entra ID authentication and RBAC for secure access.

Answer

An admin user account on the Azure Container Registry

Answer

A shared access signature in a container environment variable

Answer

A public network access rule that allows all Azure services

Question 3

A partner company needs write access to a single blob container for 24 hours. The partner does not have an Azure subscription in your tenant, and the team does not want to share the storage account key. Which access method is the best choice?

Accepted Answer

Create a user delegation SAS with write permission and a short expiration time. A user delegation SAS is the best choice because it provides time-limited, scoped write access to a specific blob container without exposing the storage account key. It is secured with Microsoft Entra ID credentials and can be configured with a short expiration time (e.g., 24 hours), meeting the partner's requirement for temporary access. This method ensures the partner does not need an Azure subscription in your tenant and avoids sharing the account key.

Answer

Grant the partner Contributor access on the storage account

Answer

Share the storage account access key and let the partner create their own token

Answer

Enable anonymous public write access on the container

Question 4

You are managing an Azure Storage account that hosts a large number of blobs. You need to ensure that data can be recovered if blobs are accidentally deleted or overwritten. Which three of the following actions should you take? (Choose three.)

Accepted Answer

Enable soft delete for blobs.. Soft delete for blobs preserves deleted blobs for a specified retention period, allowing recovery from accidental deletion. Blob versioning maintains previous versions of a blob, enabling restoration if a blob is overwritten or deleted. Point-in-time restore for block blobs allows reverting the container to an earlier state, recovering from bulk accidental modifications or deletions. Together, these three features provide comprehensive protection against accidental data loss.

Answer

Enable Azure Defender for Storage.

Answer

Configure a lifecycle management policy to move blobs to the Cool tier.

Answer

Set the default access tier to Archive.

Question 5

An NSG rule allows TCP 8443 from ASG-Web to ASG-Api on the API subnet. The web VM NIC is already in ASG-Web, but the API VM was only placed in the subnet and not added to ASG-Api. Traffic still fails. What is the best fix?

Accepted Answer

Add the API VM's NIC to ASG-Api so the NSG rule can match the destination NIC.. The NSG rule specifies ASG-Api as the destination, but NSGs evaluate traffic based on the NIC membership in an ASG, not the subnet. Since the API VM's NIC is not added to ASG-Api, the rule cannot match the destination, so traffic is dropped by default (implicit deny). Adding the NIC to ASG-Api allows the NSG rule to correctly identify the destination and permit TCP 8443 traffic.

Answer

Add ASG-Api to the API subnet because ASGs are inherited from subnet membership.

Answer

Lower the rule priority number on the web subnet to make source traffic more specific.

Answer

Create a user-defined route from AppSubnet to API subnet to bypass the NSG.

Question 6

Two legacy application VMs must survive planned maintenance and a single host failure. The vendor requires both VMs to stay in the same region, and a datacenter outage is not part of the requirement. What should the administrator use?

Accepted Answer

An availability set that places the VMs in separate fault and update domains.. An availability set protects against planned maintenance and single host failures by placing VMs in separate fault domains (different physical hardware) and update domains (different maintenance windows). This ensures that during planned Azure maintenance, only one VM is rebooted at a time, and if a host fails, only VMs in that fault domain are affected. Since the requirement specifies a single host failure (not a datacenter outage) and both VMs must stay in the same region, an availability set is the correct choice.

Answer

Availability zones with one VM in each zone.

Answer

A virtual machine scale set in a single zone.

Answer

A proximity placement group for both VMs.

Question 7

You are deploying a stateless web application on Azure virtual machines. The solution must automatically add and remove instances based on CPU demand and allow all instances to be managed as one logical group. Which Azure compute feature should you deploy?

Accepted Answer

A Virtual Machine Scale Set. A Virtual Machine Scale Set (VMSS) is the correct Azure compute feature because it automatically manages a group of identical, load-balanced VMs that can scale in and out based on CPU demand using autoscale rules. It treats all instances as a single logical group, enabling unified management, patching, and application deployment, which is exactly what the stateless web application requires.

Answer

An availability set

Answer

A Recovery Services vault

Answer

Boot diagnostics

Question 8

A production VM is using too much CPU. You want Azure to notify the operations team by email when Average Percentage CPU stays above 80 percent for 5 minutes. What should you configure?

Accepted Answer

A metric alert rule linked to an action group. A metric alert rule monitors a specific metric (e.g., Percentage CPU) and triggers when a condition (e.g., above 80% for 5 minutes) is met. Linking the alert to an action group allows Azure to send email notifications to the operations team. This is the correct Azure Monitor feature for threshold-based, metric-driven notifications.

Answer

A diagnostic setting on the VM

Answer

A Log Analytics workspace only

Answer

An Azure Policy assignment

Question 9

A finance analyst needs read-only access to one storage account named stprod01. The analyst must not see other resources in the subscription. Where should you assign the Reader role?

Accepted Answer

At the storage account resource scope. Assigning the Reader role at the storage account resource scope (stprod01) grants read-only access exclusively to that specific storage account. This meets the requirement of restricting the analyst from seeing any other resources in the subscription, as role assignments at a higher scope (e.g., resource group, subscription, management group) would inherit permissions to all resources under that scope.

Answer

At the management group scope that contains the subscription

Answer

At the subscription scope that contains the storage account

Answer

At the resource group that contains the storage account

Question 10

You need to notify the security team whenever anyone deletes a resource group in the subscription. Which alert type should you configure?

Accepted Answer

An activity log alert. An activity log alert monitors subscription-level events recorded in the Azure Activity Log, including resource group deletion operations. When a user deletes a resource group, the 'Microsoft.Resources/subscriptions/resourceGroups/delete' operation is logged, and an activity log alert can be configured to trigger on that specific operation, sending notifications to the security team.

Answer

A metric alert on CPU percentage

Answer

A budget alert

Answer

A log alert based only on guest OS event logs

Question 11

A development environment uses temporary test VMs that can be rebuilt at any time. The administrator wants the operating system disk to provide the lowest practical latency and does not need the disk data to survive a deallocate operation. Which OS disk option should be selected?

Accepted Answer

Ephemeral OS disk.. Ephemeral OS disks use the local VM storage (temporary disk) rather than remote managed storage, which provides the lowest possible latency because data is stored directly on the host node. Since the test VMs can be rebuilt at any time and the disk data does not need to survive a deallocate operation, the ephemeral disk is ideal—it is automatically deleted when the VM is deallocated or deleted, and it avoids the cost and performance overhead of managed disks.

Answer

Standard HDD managed disk.

Answer

Premium SSD managed disk.

Answer

Ultra Disk managed disk.

Question 12

A team wants to monitor average CPU on a small set of Linux VMs and OS disk free space, but they want the lowest telemetry ingestion cost possible. Which two actions should they take? Select two.

Accepted Answer

Use a metric alert for the VM CPU metric.. Metric alerts for VM CPU are based on platform metrics collected automatically by Azure, incurring no additional ingestion cost. This allows monitoring average CPU without any agent or data collection rule, making it the lowest-cost approach for that metric.

Answer

Enable full VM Insights for every guest performance counter.

Answer

Stream all syslog and event logs to a workspace before creating any alert.

Answer

Rely on Azure Resource Health to measure guest OS disk free space.

Question 13

A support engineer must download a blob that was moved to the Archive tier by a lifecycle rule. The file must be available as soon as possible for an investigation. What should the engineer do first?

Accepted Answer

Change the blob's tier to Hot or Cool and wait for rehydration to complete.. Blobs in the Archive tier are offline and must be rehydrated to a Hot or Cool tier before they can be accessed. Rehydration can take up to 15 hours, but setting the tier to Hot or Cool initiates the process, making the blob available as soon as possible for investigation.

Answer

Download the blob directly from the Archive tier because archived blobs are always online.

Answer

Move the blob to a different container in the same account to make it downloadable immediately.

Answer

Disable the lifecycle rule so the blob becomes immediately readable again.

Question 14

An application VM in a subnet without a public IP must access Azure Blob Storage. The storage account must not be reachable from the public internet, and DNS resolution should stay inside the virtual network. What should you implement?

Accepted Answer

Create a private endpoint for the storage account and link the appropriate private DNS zone.. A private endpoint assigns the storage account a private IP from the VM's virtual network, making it reachable without public internet exposure. Linking the private DNS zone ensures that DNS resolution for the storage account (e.g., `mystorageaccount.blob.core.windows.net`) resolves to the private IP within the VNet, meeting both requirements.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet and keep the public endpoint enabled.

Answer

Use a SAS token and allow access from any network for the storage account.

Answer

Assign a managed identity to the VM and remove all network restrictions from the storage account.

Question 15

A legal department keeps evidence files in Azure Blob Storage. The files are accessed only a few times per year, but they must stay online and be immediately readable when requested. The team wants the lowest-cost online tier and does not want a rehydration step. Which tier should you choose?

Accepted Answer

Cold, because it keeps data online and is intended for rarely accessed content.. The Cold tier is the correct choice because it is an online tier designed for rarely accessed data that must remain immediately readable without a rehydration step. It offers lower storage costs than Hot or Cool while still providing instant access, meeting the requirement for the lowest-cost online tier.

Answer

Hot, because it prioritizes immediate access over storage cost.

Answer

Cool, because it is an online tier for infrequent access.

Answer

Archive, because it has the lowest cost and can be opened instantly from the portal.

Question 16

An operations team must deploy 20 identical application VMs every sprint from source control and wants the deployment definition to be readable and repeatable. Which approach should they use?

Accepted Answer

Use a Bicep template stored in source control. B is correct because Bicep is a domain-specific language (DSL) for deploying Azure resources declaratively. Storing a Bicep template in source control ensures the deployment definition is readable (using concise syntax) and repeatable (via idempotent deployments), meeting the team's requirement for 20 identical VMs every sprint.

Answer

Manually create each VM in the Azure portal

Answer

Capture a screenshot of the portal settings for future reference

Answer

Use Azure Policy to create the VMs automatically

Question 17

A team deployed a private endpoint for an Azure Storage account in VNet-A. The private endpoint is healthy, but VMs in VNet-A still resolve the storage account name to the public IP address. What should the administrator configure next?

Accepted Answer

Link the appropriate private DNS zone to VNet-A.. When a private endpoint is deployed, the storage account's FQDN must resolve to the private IP address within the virtual network. By default, Azure Private DNS zones (privatelink.blob.core.windows.net) are not automatically linked to the virtual network. Linking the private DNS zone to VNet-A enables DNS resolution of the storage account name to the private endpoint's IP address instead of the public IP.

Answer

Add a route table that sends storage traffic to the private endpoint.

Answer

Create a network security group rule that allows outbound HTTPS.

Answer

Enable service endpoints for Microsoft.Storage on the subnet.

Question 18

You need to notify the operations team by email when average CPU utilization on VM-App01 exceeds 80 percent for 15 minutes. Which Azure Monitor components should you configure?

Accepted Answer

A metric alert and an action group. A metric alert monitors a specific performance metric (like CPU utilization) and triggers when a threshold is exceeded for a defined duration. An action group defines the notification action (e.g., sending an email) when the alert fires. Together, they meet the requirement to email the operations team when average CPU exceeds 80% for 15 minutes.

Answer

An activity log alert only

Answer

A resource lock and Azure Advisor

Answer

A budget alert

Question 19

You need to deploy 20 identical Azure virtual machines that host the same web application. The solution must support automatic scale-out based on CPU usage and should minimize administrative overhead. What should you deploy?

Accepted Answer

A Virtual Machine Scale Set.. A Virtual Machine Scale Set (VMSS) is the correct choice because it automates the deployment and management of identical VMs, supports autoscaling based on CPU usage metrics, and minimizes administrative overhead by handling VM creation, load balancing, and scaling policies as a single resource. This aligns with the requirement for 20 identical VMs with automatic scale-out based on CPU usage.

Answer

20 individual virtual machines in the same resource group.

Answer

An availability set.

Answer

Azure Container Instances.

Question 20

You need to run a stateless web workload on Azure virtual machines and automatically increase or decrease instance count based on demand. You also want a single management boundary for the VM instances. Which solution should you deploy?

Accepted Answer

A Virtual Machine Scale Set. A Virtual Machine Scale Set (VMSS) is the correct solution because it provides an autoscaling group of identical VMs that can automatically increase or decrease instance count based on demand (e.g., CPU or memory metrics). It also offers a single management boundary, allowing you to manage, monitor, and scale all instances as a unified resource rather than individually.

Answer

An availability set with individual VMs

Answer

Azure Backup

Answer

A Recovery Services vault