AZ-104 Practice Exam 57 — 20 Questions

Question 1

A company has two application VMs in the same Azure region. The main requirement is to reduce downtime during planned host maintenance. The business does not require protection from a complete datacenter outage. Which option should you choose?

Accepted Answer

Availability set. An availability set distributes VMs across multiple fault domains and update domains within a single Azure datacenter. During planned host maintenance, Azure updates one update domain at a time, ensuring that only a subset of VMs are rebooted simultaneously, thereby reducing downtime. This meets the requirement of protecting against planned maintenance without needing cross-datacenter redundancy.

Answer

Availability zones

Answer

Virtual machine scale set

Answer

Proximity placement group

Question 2

A customer-facing service needs to survive a single datacenter outage in a zone-supported region. You do not need cross-region failover, but you do need Azure to spread instances without manual placement errors. Which two deployment choices satisfy that goal? Select two.

Accepted Answer

Place the VMs in different availability zones within the same region.. Option A is correct because availability zones are physically separate datacenters within a region, each with independent power, cooling, and networking. Placing VMs in different zones ensures that a single datacenter outage does not affect all instances, meeting the survivability requirement without manual placement errors. Azure automatically distributes VMs across selected zones, eliminating human error in instance placement.

Answer

Use an availability set and expect it to cover a zone outage.

Answer

Keep all instances in one zone and rely on the load balancer.

Answer

Use a paired region for automatic in-region zone balancing.

Question 3

Based on the exhibit, what should the administrator do to meet the performance requirement without rebuilding the server?

Accepted Answer

Resize the VM to a larger SKU that provides more vCPU and RAM.. Resizing the VM to a larger SKU with more vCPU and RAM directly addresses the performance requirement by providing additional compute and memory resources to the existing server without requiring a rebuild. This is the correct approach because the VM's current SKU is insufficient for the workload, and Azure allows resizing within the same hardware family or to a compatible series, preserving the OS and application state.

Answer

Attach an additional data disk and move the application binaries to it.

Answer

Redeploy the VM from a different marketplace image.

Answer

Place the VM in an availability set to spread processing across hosts.

Question 4

You have two virtual networks named VNet-Hub and VNet-Spoke1 in the same Azure region. Resources in the two VNets must communicate privately over the Microsoft backbone without using a VPN gateway. What should you configure?

Accepted Answer

VNet peering. VNet peering enables direct, private connectivity between two virtual networks in the same Azure region using the Microsoft backbone infrastructure. It does not require a VPN gateway, public IP addresses, or any internet transit, making it the correct choice for private communication between VNet-Hub and VNet-Spoke1.

Answer

A site-to-site VPN

Answer

A public load balancer

Answer

An NSG outbound deny rule

Question 5

Exhibit: A network engineer wants a subscription-based mechanism to stream operational updates from devices as values change, instead of polling over and over. Which approach best fits?

Accepted Answer

Model-driven telemetry. Model-driven telemetry uses a subscription-based push model to stream operational data from network devices to a collector as values change, eliminating the need for repeated polling. This approach reduces bandwidth and CPU overhead by delivering only relevant updates in real time, which aligns with the requirement for a subscription-based mechanism.

Answer

TFTP backup

Answer

Port security sticky learning

Answer

VTP pruning

Question 6

The platform team wants to block deployment of virtual machines that use any size except a small approved list. Operators already have Contributor access and should keep that access for other tasks. Which Azure control should the administrator use to enforce the size restriction?

Accepted Answer

Assign an Azure Policy with an allowed virtual machine size rule and the Deny effect at the subscription scope.. Azure Policy with the 'allowed virtual machine sizes' built-in policy and the Deny effect is the correct control because it enforces a deny action at the resource creation or update level, preventing any VM deployment that does not match the approved size list. This works independently of RBAC permissions, so operators retain their Contributor role for other tasks while the policy blocks non-compliant VM sizes. The policy is assigned at the subscription scope to cover all resource groups, ensuring consistent enforcement across the environment.

Answer

Create a custom RBAC role that excludes unsupported VM sizes from the Contributor role.

Answer

Apply a CanNotDelete lock to the resource group that contains the virtual machines.

Answer

Assign Reader permissions to the operators and rely on Azure portal validation.

Question 7

Three application VMs in separate resource groups must use the same identity to read a configuration endpoint. The identity must keep working if any one VM is deleted and later recreated. Which three actions should the administrator take? Select three.

Accepted Answer

Create a user-assigned managed identity that can exist independently of any single VM.. A user-assigned managed identity is an Azure resource that exists independently of any VM, unlike a system-assigned identity which is tied to the VM lifecycle. This independence ensures the identity persists even when a VM is deleted and recreated, maintaining continuous access to the configuration endpoint. By creating a user-assigned managed identity, the administrator decouples the identity from any single VM, satisfying the requirement that the identity must keep working after VM deletion and recreation.

Answer

Use a system-assigned managed identity on only one VM and copy its access token to the other two VMs.

Answer

Store one application password locally on each VM and use it instead of Azure-managed identities.

Question 8

Based on the exhibit, which deployment change best meets the resilience requirement for the application VMs?

Accepted Answer

Place each VM in a different availability zone and keep the load balancer in front.. Option B is correct because deploying each VM into a different availability zone ensures that the VMs are physically separated across distinct data centers within an Azure region, protecting against zone-level failures. The load balancer in front distributes traffic across the VMs, providing high availability even if one zone goes offline. This meets the resilience requirement by eliminating a single point of failure at the data center level.

Answer

Keep both VMs in the same availability set to spread them across update domains only.

Answer

Deploy both VMs into a proximity placement group to reduce latency between them.

Answer

Move the VMs into a single availability set and add more managed disks for redundancy.

Question 9

You have two virtual networks in the same Azure region named VNet-App and VNet-DB. Resources in the two networks must communicate privately over the Azure backbone without using VPN gateways. What should you configure?

Accepted Answer

Virtual network peering. Virtual network peering connects two Azure virtual networks in the same region via the Microsoft backbone infrastructure, enabling private IP communication without a VPN gateway or public internet. This is the correct solution because it meets the requirement for private, low-latency connectivity between VNet-App and VNet-DB using Azure's high-speed backbone.

Answer

A site-to-site VPN

Answer

A network security group

Answer

An Azure Firewall policy only

Question 10

Finance, HR, and Engineering each have their own subscriptions, and one production resource group must not be deleted by mistake. Which two Azure features should be used? Select two.

Accepted Answer

Create a management group for the subscriptions.. Option A is correct because a management group allows you to centrally manage governance, policy, and compliance across multiple Azure subscriptions. By placing the Finance, HR, and Engineering subscriptions under a single management group, you can apply Azure Policy or RBAC assignments that affect all subscriptions, ensuring consistent governance without needing to configure each subscription individually.

Answer

Assign Reader to everyone in the company.

Answer

Use a distribution list for the subscriptions.

Answer

Move the resource group into a different region.

Question 11

Based on the exhibit, which Network Watcher tool should the administrator use to identify the exact NSG rule that is blocking TCP 1433 traffic?

Accepted Answer

IP flow verify. IP flow verify is the correct Network Watcher tool because it tests whether a packet is allowed or denied to or from a specific virtual machine based on a 5-tuple (source IP, destination IP, source port, destination port, and protocol). By specifying TCP 1433 as the destination port, the tool evaluates all effective security rules (NSG and ASG) and returns the exact rule name and direction that is blocking the traffic.

Answer

Connection troubleshoot

Answer

Next hop

Answer

Packet capture

Question 12

Which two authentication methods let an app access blob data without storing the storage account key on the machine? Select two.

Accepted Answer

Microsoft Entra ID authorization with an appropriate Azure RBAC role.. Option A is correct because Microsoft Entra ID authorization with an appropriate Azure RBAC role (e.g., Storage Blob Data Contributor) allows an app to authenticate to blob storage using OAuth 2.0 tokens, eliminating the need to store the storage account key on the machine. Option B is correct because a user delegation SAS is signed with Microsoft Entra ID credentials and can be generated without the account key, providing time-limited, scoped access to blob data.

Answer

The storage account access key.

Answer

A service SAS generated directly from the account key.

Answer

Anonymous public access to the container.

Question 13

Based on the exhibit, which restore option should the administrator choose?

Accepted Answer

File recovery, because it restores individual files or folders from the VM backup.. File recovery is the correct option because the administrator needs to restore a specific deleted file from a VM backup without restoring the entire VM. Azure Backup's file-level recovery allows mounting the backup as a drive (via iSCSI) to browse and copy individual files or folders, which directly addresses the requirement.

Answer

Recreate VM, because it restores the entire virtual machine from the backup point.

Answer

Backup policy, because it defines which files are included in the restore operation.

Answer

Recovery point, because it is the portal action used to mount a deleted file directly.

Question 14

VM-App01 is responding slowly and appears to be on a degraded Azure host. You must keep the VM resource, keep its disks and NIC, and move it to fresh infrastructure before further troubleshooting. Which two actions can achieve that goal? Select two.

Accepted Answer

Redeploy the VM.. Redeploying the VM (Option A) moves the VM to a new Azure host node while preserving the VM resource, its disks, and NIC. This is the correct action because it resolves host-level degradation without deleting or recreating the VM. Stopping/deallocating the VM (Option D) releases the underlying hardware lease, which forces the VM to be placed on a new host when started again, also preserving the VM resource, disks, and NIC.

Answer

Delete the VM and recreate it from the OS disk.

Answer

Capture the VM into a generalized image.

Answer

Convert the VM to an availability set.

Question 15

Two application VMs run in the same Azure region. The business wants to reduce the chance that both VMs are rebooted during planned host maintenance, but a datacenter outage is not part of the requirement. What should the administrator configure?

Accepted Answer

Availability set. An availability set ensures that VMs are placed on different fault domains and update domains within the same Azure datacenter. This configuration guarantees that during planned host maintenance, only one update domain is rebooted at a time, reducing the chance that both VMs are rebooted simultaneously. Since the requirement explicitly excludes a datacenter outage, an availability set is the correct choice to protect against planned maintenance events.

Answer

Availability zone

Answer

Azure Load Balancer

Answer

Virtual machine scale set

Question 16

Users on the internet cannot reach an HTTPS application hosted on VM-Web01. The VM has a public IP address, the application is listening on TCP port 443, and the guest OS firewall allows the traffic. What is the most likely Azure-side cause?

Accepted Answer

The NSG blocks inbound TCP 443. The most likely Azure-side cause is that a Network Security Group (NSG) associated with the VM's subnet or NIC is blocking inbound TCP port 443. Even if the VM has a public IP, the application is listening, and the guest OS firewall allows traffic, an NSG rule denying inbound HTTPS traffic will prevent external users from reaching the application. NSGs act as a distributed firewall filtering traffic at the Azure network layer before it reaches the VM.

Answer

The VM uses Premium SSD

Answer

Azure Backup is not enabled

Answer

The storage account uses GRS

Question 17

The subscription activity log is being sent to a Log Analytics workspace. An alert must fire when any resource group is deleted, but delete operations initiated by the automation account rg-cleaner@contoso.com must be ignored. Which query should be used in the alert rule?

Accepted Answer

AzureActivity | where OperationNameValue == "Microsoft.Resources/subscriptions/resourceGroups/delete" | where ActivityStatusValue == "Succeeded" | where Caller != "rg-cleaner@contoso.com" | summarize Count = count(). Option B is correct because it filters for the exact operation that deletes a resource group (Microsoft.Resources/subscriptions/resourceGroups/delete), ensures the deletion succeeded, and excludes the caller 'rg-cleaner@contoso.com'. This meets the requirement to fire an alert only when a resource group is deleted by any user except the automation account.

Answer

AzureActivity | where ResourceProviderValue == "Microsoft.Resources" | where OperationName contains "delete"

Answer

Heartbeat | where Computer == "rg-cleaner@contoso.com" | where TimeGenerated > ago(1d)

Answer

SecurityEvent | where EventID == 4688 | where Account == "rg-cleaner@contoso.com"

Question 18

You deploy several Windows virtual machines and need to install Microsoft Antimalware on each VM without logging on manually. What should you use?

Accepted Answer

A VM extension.. VM extensions are small applications that provide post-deployment configuration and automation tasks on Azure VMs. The Microsoft Antimalware extension can be deployed to multiple VMs at scale via Azure PowerShell, CLI, ARM templates, or policies, enabling silent installation without manual login.

Answer

An NSG application security group.

Answer

A route table.

Answer

A blob lifecycle rule.

Question 19

A contractor from a partner company needs read-only access to one application resource group for 14 days. When the contractor leaves the project, access should be removed immediately by removing a single identity from a group. Which two actions should the administrator take? Select two.

Accepted Answer

Create an Entra ID security group for the contractor team.. Creating an Entra ID security group for the contractor team (Option A) allows the administrator to manage access centrally. By assigning the Reader role to that group at the application resource group scope (Option B), all members inherit read-only permissions. When the contractor leaves, removing their user object from the group immediately revokes access without needing to modify role assignments, satisfying the requirement for a single identity removal.

Answer

Assign Reader directly to the contractor's user object at the subscription scope.

Answer

Assign Contributor at the resource group scope and rely on discipline.

Answer

Use a resource lock to limit the contractor to read-only access.

Question 20

Before changing a managed data disk on a production VM, you want a point-in-time copy that you can keep and restore later if needed. What should you create?

Accepted Answer

A managed disk snapshot. A managed disk snapshot captures a point-in-time, read-only copy of a managed disk. You can use it to restore the VM to that exact state by creating a new disk from the snapshot and attaching it to the VM. Snapshots are independent of the source disk's lifecycle, so you can keep them indefinitely for backup or recovery purposes.

Answer

An availability set

Answer

A load balancer backend pool

Answer

A resource lock