AZ-104 Practice Exam 57 — 20 Questions

Question 1

Which two statements about a Log Analytics workspace are correct? Select two.

Accepted Answer

It can store logs collected from Azure resources. A Log Analytics workspace is a centralized repository that can ingest and store log data from various Azure resources, including virtual machines, Azure Activity logs, and resource diagnostics, enabling monitoring and analysis. Option B is correct because Log Analytics workspaces support Kusto Query Language (KQL) queries, which allow users to perform complex searches, aggregations, and visualizations on the stored log data.

Answer

It creates backups of Azure virtual machines

Answer

It assigns permissions to Azure resources at scope

Answer

It blocks resource creation that violates a rule

Question 2

A production VM must generate an alert when average CPU exceeds 80 percent for 10 minutes. The alert must be evaluated continuously, but email notifications should be suppressed outside 08:00 to 18:00 on weekdays. What should the administrator configure?

Accepted Answer

A metric alert rule with an action group and an alert processing rule that suppresses actions outside business hours. It combines a metric alert rule (which continuously evaluates the CPU threshold) with an alert processing rule that suppresses notifications outside business hours. The metric alert rule evaluates every minute by default, meeting the 'continuously evaluated' requirement, while the alert processing rule (formerly action rule) allows you to suppress actions based on a schedule without altering the alert rule itself.

Answer

A log query alert only, with the query scheduled to run during business hours

Answer

A diagnostic setting that sends CPU logs to a storage account and a Logic App for email delivery

Answer

An action group with an email receiver and a virtual machine extension to pause the workload outside business hours

Question 3

Based on the exhibit, three VMs in different resource groups must use the same Azure identity, and the identity must continue working if one VM is deleted and recreated. What should you use?

Accepted Answer

A user-assigned managed identity attached to all three VMs.. A user-assigned managed identity is an Azure resource that can be created independently and then assigned to multiple VMs. Because it persists as a separate resource in Azure, deleting and recreating a VM does not affect the identity; you simply reattach the same user-assigned identity to the new VM. This ensures the identity continues working across VM lifecycle changes, meeting the requirement for a shared, resilient identity.

Answer

A system-assigned managed identity on each VM.

Answer

A service principal stored in the VM image.

Answer

A shared access signature assigned to the resource group.

Question 4

An analytics platform stores daily export files in Azure Blob Storage. The business wants the storage account to survive a failure of any one availability zone and also keep a replicated copy in a paired region for disaster recovery. No one needs to read from the secondary region unless a disaster recovery event occurs. Which redundancy option should be used?

Accepted Answer

GZRS. C is correct because GZRS (Geo-Zone-Redundant Storage) combines zone-redundant storage (ZRS) within the primary region, ensuring the storage account survives any single availability zone failure, with geo-redundant replication to a paired region for disaster recovery. The secondary region copy is read-only unless a failover is initiated, matching the requirement that no one reads from the secondary region unless a disaster recovery event occurs.

Answer

ZRS

Answer

GRS

Answer

RA-GRS

Question 5

An operations team monitors a group of Azure VMs and storage accounts. Match each Azure Monitor component to the behavior it provides in day-to-day operations.

Accepted Answer

Metrics: Collects numeric performance data from Azure resources.. Metrics give real-time performance; Logs store detailed events; Alerts trigger notifications; Workbooks visualize data; Autoscale adjusts capacity; Action Groups configure alert responses.

Answer

Action Groups: Automatically adjusts the number of instances.

Answer

Autoscale: Defines the notification preferences for alerts.

Answer

Workbooks: Stores log data for long-term retention.

Question 6

You need a storage redundancy option that keeps data available if an entire availability zone in the primary region fails, but you do not need cross-region replication. Which redundancy option should you choose?

Accepted Answer

ZRS. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within a single region, ensuring data remains available if an entire zone fails. This meets the requirement of no cross-region replication while providing zone-level fault tolerance.

Answer

LRS

Answer

GRS

Answer

RA-GRS

Question 7

A web app and a VM scale set both need the same Azure identity to read secrets from Key Vault. The identity must survive redeployment, and the team wants to remove it centrally without changing each resource individually. Which identity type should they use?

Accepted Answer

A user-assigned managed identity attached to both resources.. A user-assigned managed identity (B) is the correct choice because it is created as a standalone Azure resource, can be attached to multiple Azure resources (e.g., a web app and a VM scale set), and persists independently of those resources. This allows the identity to survive redeployment of either resource and enables centralized removal (by deleting the user-assigned identity) without needing to modify each resource individually.

Answer

A system-assigned managed identity on each resource.

Answer

A service principal with a client secret stored in application settings.

Answer

A resource lock on the Key Vault to preserve the secret access path.

Question 8

Based on the exhibit, a compliance team must read all current and future resources in every subscription under the Corp management group. Where should you assign the Reader role?

Accepted Answer

Assign Reader at the Corp management group scope.. Assigning the Reader role at the Corp management group scope applies the role to all current and future subscriptions and resource groups within that management group hierarchy. This is because Azure RBAC roles assigned at a management group scope are inherited by all child management groups, subscriptions, and resources, ensuring the compliance team can read all resources across the entire Corp hierarchy without needing separate assignments.

Answer

Assign Reader at the RG-Finance resource group scope.

Answer

Assign Reader separately at each subscription scope.

Answer

Assign Reader only at the individual resource scope.

Question 9

A backup engineer is reviewing policy-related settings in a Recovery Services vault. Match each backup setting to the behavior it controls.

Accepted Answer

Backup frequency: How often backups are performed (e.g., daily, weekly).. Backup frequency sets how often; retention range sets how long; snapshot retention keeps local copy; schedule sets time; tier defines storage type; alerts notify on issues.

Answer

Backup frequency: How long backups are retained.

Answer

Snapshot retention: How often backups are taken.

Question 10

Based on the exhibit, which restore option should the administrator choose?

Accepted Answer

File recovery, because it restores individual files or folders from the VM backup.. File recovery is the correct option because the administrator needs to restore a specific deleted file from a VM backup without restoring the entire VM. Azure Backup's file-level recovery allows mounting the backup as a drive (via iSCSI) to browse and copy individual files or folders, which directly addresses the requirement.

Answer

Recreate VM, because it restores the entire virtual machine from the backup point.

Answer

Backup policy, because it defines which files are included in the restore operation.

Answer

Recovery point, because it is the portal action used to mount a deleted file directly.

Question 11

A route table contains a user-defined route for 172.16.0.0/16 to a virtual appliance. The ExpressRoute circuit advertises 172.16.10.0/24. A VM in the subnet sends traffic to 172.16.10.20. Which route does Azure use?

Accepted Answer

The BGP route, because it has the more specific prefix length.. Azure uses the most specific prefix match to determine the next hop. The BGP route for 172.16.10.0/24 has a longer prefix length (24) than the user-defined route for 172.16.0.0/16 (16), so the BGP route is preferred regardless of route source priority. This follows the longest prefix match (LPM) algorithm, which overrides the default preference order of UDRs over BGP routes.

Answer

The user-defined route, because UDRs always beat BGP routes.

Answer

The system route to the virtual network, because system routes are preferred over learned routes.

Answer

No route is chosen because Azure does not support overlapping prefixes.

Question 12

A company is creating a new spoke virtual network that will be peered to an existing hub VNet. The hub uses 10.40.0.0/16, and an on-premises network already uses 10.41.0.0/16. The spoke must support about 120 endpoints now and should allow room for growth. Which address space should you assign to the new spoke VNet?

Accepted Answer

10.42.0.0/24. (10.42.0.0/24) is correct because it provides 256 IP addresses (251 usable) for the spoke, which exceeds the requirement of ~120 endpoints with room for growth, and it does not overlap with the hub VNet (10.40.0.0/16) or the on-premises network (10.41.0.0/16). This ensures successful VNet peering without IP address conflicts.

Answer

10.40.64.0/25

Answer

10.41.128.0/24

Answer

192.168.10.0/26

Question 13

A team needs an alert that emails the operations group whenever a VM's average CPU percentage stays above 85% for 10 minutes. Which two Azure Monitor components must you configure? Select two.

Accepted Answer

A metric alert rule on the VM CPU metric. A metric alert rule on the VM CPU metric is required because it continuously monitors the 'Percentage CPU' metric and triggers when the average value exceeds 85% for a duration of 10 minutes. This rule evaluates the condition using the aggregation type 'Average' and the window size set to PT10M (ISO 8601 format). Without this rule, no alert condition exists to detect the threshold breach.

Answer

A Recovery Services vault

Answer

A private endpoint for the virtual machine

Answer

A blob lifecycle management policy

Question 14

A company merged with another business, and two Azure virtual networks need to be peered for shared application access. One VNet uses 10.20.0.0/16 and the other uses 10.20.128.0/17. The administrator must make the peering work with minimal operational complexity. What should be done first?

Accepted Answer

Renumber one VNet to a non-overlapping address range before creating the peering.. Azure VNet peering requires non-overlapping address spaces. The two VNets (10.20.0.0/16 and 10.20.128.0/17) overlap because 10.20.128.0/17 is a subset of 10.20.0.0/16. Peering will fail with an error about overlapping address ranges. Renumbering one VNet to a non-overlapping range (e.g., 10.21.0.0/16) is the only way to satisfy the prerequisite for peering with minimal operational complexity.

Answer

Create a route table on both VNets and point the overlapping prefixes to a virtual appliance.

Answer

Enable gateway transit on both VNets so overlapping ranges can be routed around.

Answer

Create a private endpoint in each VNet for the applications that need access.

Question 15

The platform team wants to block deployment of Azure resources in any region except East US and West US. What should they configure?

Accepted Answer

An Azure Policy assignment that uses an allowed locations policy. Azure Policy's 'allowed locations' built-in policy definition enables you to restrict the regions where resources can be deployed. By assigning this policy at a management group or subscription scope with a parameter list containing only 'East US' and 'West US', any attempt to deploy resources in other regions will be denied at the Azure Resource Manager level, effectively blocking non-compliant deployments.

Answer

A Reader role assignment at the management group

Answer

A CanNotDelete lock on the subscription

Answer

A tag requirement enforced only by resource group naming

Question 16

A development team needs to run a Linux container for about 12 minutes each time a request is received. The team does not want to manage a server, cluster, or virtual machine. Which Azure service should the administrator use?

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice because it allows the team to run a Linux container directly in Azure without managing any underlying infrastructure, such as servers, clusters, or virtual machines. ACI is ideal for short-lived, event-driven workloads like this 12-minute request-based container, as it supports rapid startup and automatic shutdown, aligning with the 'serverless' requirement.

Answer

Azure Kubernetes Service

Answer

Azure Virtual Machines

Answer

Azure App Service

Question 17

A hub VNet already has a VPN gateway connected to on-premises networks. A new spoke VNet must reach those on-premises networks through the existing gateway without deploying another gateway. Which peering settings are required?

Accepted Answer

Enable gateway transit on the hub peering and use remote gateways on the spoke peering.. To allow a spoke VNet to use the hub VNet's VPN gateway without deploying its own, you must enable 'Use remote gateways' on the spoke peering and 'Gateway transit' on the hub peering. This configuration allows the spoke to route traffic destined for on-premises networks through the hub's VPN gateway, leveraging the existing site-to-site VPN connection.

Answer

Enable forwarded traffic on both peerings and leave gateway settings disabled.

Answer

Enable use remote gateways on the hub peering and gateway transit on the spoke peering.

Answer

Create a private endpoint between the two VNets.

Question 18

Based on the exhibit, which KQL clause should replace the blank to show only heartbeat records from the last 30 minutes?

Accepted Answer

where TimeGenerated >= ago(30m). The KQL clause `where TimeGenerated >= ago(30m)` filters the results to include only records where the `TimeGenerated` timestamp is within the last 30 minutes. The `ago()` function calculates a datetime value relative to the current time, and the `>=` operator ensures only records from that point forward are returned. This directly satisfies the requirement to show heartbeat records from the last 30 minutes.

Answer

project Computer, TimeGenerated

Answer

extend TimeWindow = 30m

Answer

sort by TimeGenerated desc

Question 19

You create a private endpoint for an Azure Storage account. Virtual machines in VNet-App must resolve the storage account name to the private IP address of the endpoint. What should you configure?

Accepted Answer

A private DNS zone linked to VNet-App. A private DNS zone linked to VNet-App is required because Azure Private Endpoint uses a private IP address from the virtual network, but the storage account's fully qualified domain name (FQDN) must resolve to that private IP within the VNet. By linking a private DNS zone (e.g., `privatelink.blob.core.windows.net`) to VNet-App and configuring an A record for the endpoint's private IP, VMs can resolve the storage account name to the correct private address. Without this, DNS resolution would fall back to the public IP, defeating the purpose of the private endpoint.

Answer

A user-defined route on the subnet

Answer

An additional public IP address

Answer

An Azure Firewall policy

Question 20

A build pipeline needs to run a Linux container for about 15 minutes whenever a request arrives. The job never needs inbound traffic, clustering, or persistent node management. A second workload is a public web app that needs built-in TLS, deployment slots, and autoscale. Which two Azure compute services should the administrator choose? Select two.

Accepted Answer

Azure Container Instances. Azure Container Instances (A) is correct because it provides the fastest way to run a Linux container on demand without provisioning or managing any nodes, which fits the 15-minute, request-triggered job that needs no inbound traffic, clustering, or persistent orchestration. Azure App Service (B) is correct because it is a fully managed PaaS web hosting platform that natively supports built-in TLS/SSL certificates, deployment slots for staging and swap, and autoscale rules for a public web app. Azure Kubernetes Service (C) is not appropriate because it requires managing a cluster and node pools, which is unnecessary for a short-lived, non-clustered container job. Azure Virtual Machines (D) would require manual OS patching, scaling, and TLS configuration, adding management overhead the scenario explicitly avoids. Azure Functions (E) is a serverless event-driven compute service that is not designed to host a continuously running public web app with deployment slots and built-in TLS.

Answer

Azure Kubernetes Service

Answer

Azure Virtual Machines

Answer

Azure Functions