AZ-104 Practice Exam 57 — 20 Questions

Question 1

A company merged with another business, and two Azure virtual networks need to be peered for shared application access. One VNet uses 10.20.0.0/16 and the other uses 10.20.128.0/17. The administrator must make the peering work with minimal operational complexity. What should be done first?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Renumber one VNet to a non-overlapping address range before creating the peering.. Azure VNet peering requires non-overlapping address spaces. The two VNets (10.20.0.0/16 and 10.20.128.0/17) overlap because 10.20.128.0/17 is a subset of 10.20.0.0/16. Peering will fail with an error about overlapping address ranges. Renumbering one VNet to a non-overlapping range (e.g., 10.21.0.0/16) is the only way to satisfy the prerequisite for peering with minimal operational complexity.

Answer

Create a route table on both VNets and point the overlapping prefixes to a virtual appliance.

Answer

Enable gateway transit on both VNets so overlapping ranges can be routed around.

Answer

Create a private endpoint in each VNet for the applications that need access.

Question 2

You need to notify the security team whenever anyone deletes a resource group in the subscription. Which alert type should you configure?

Accepted Answer

An activity log alert. An activity log alert monitors subscription-level events recorded in the Azure Activity Log, including resource group deletion operations. When a user deletes a resource group, the 'Microsoft.Resources/subscriptions/resourceGroups/delete' operation is logged, and an activity log alert can be configured to trigger on that specific operation, sending notifications to the security team.

Answer

A metric alert on CPU percentage

Answer

A budget alert

Answer

A log alert based only on guest OS event logs

Question 3

A development environment uses temporary test VMs that can be rebuilt at any time. The administrator wants the operating system disk to provide the lowest practical latency and does not need the disk data to survive a deallocate operation. Which OS disk option should be selected?

Accepted Answer

Ephemeral OS disk.. Ephemeral OS disks use the local VM storage (temporary disk) rather than remote managed storage, which provides the lowest possible latency because data is stored directly on the host node. Since the test VMs can be rebuilt at any time and the disk data does not need to survive a deallocate operation, the ephemeral disk is ideal—it is automatically deleted when the VM is deallocated or deleted, and it avoids the cost and performance overhead of managed disks.

Answer

Standard HDD managed disk.

Answer

Premium SSD managed disk.

Answer

Ultra Disk managed disk.

Question 4

A team wants to monitor average CPU on a small set of Linux VMs and OS disk free space, but they want the lowest telemetry ingestion cost possible. Which two actions should they take? Select two.

Accepted Answer

Use a metric alert for the VM CPU metric.. Metric alerts for VM CPU are based on platform metrics collected automatically by Azure, incurring no additional ingestion cost. This allows monitoring average CPU without any agent or data collection rule, making it the lowest-cost approach for that metric.

Answer

Enable full VM Insights for every guest performance counter.

Answer

Stream all syslog and event logs to a workspace before creating any alert.

Answer

Rely on Azure Resource Health to measure guest OS disk free space.

Question 5

A support engineer must download a blob that was moved to the Archive tier by a lifecycle rule. The file must be available as soon as possible for an investigation. What should the engineer do first?

Accepted Answer

Change the blob's tier to Hot or Cool and wait for rehydration to complete.. Blobs in the Archive tier are offline and must be rehydrated to a Hot or Cool tier before they can be accessed. Rehydration can take up to 15 hours, but setting the tier to Hot or Cool initiates the process, making the blob available as soon as possible for investigation.

Answer

Download the blob directly from the Archive tier because archived blobs are always online.

Answer

Move the blob to a different container in the same account to make it downloadable immediately.

Answer

Disable the lifecycle rule so the blob becomes immediately readable again.

Question 6

An application VM in a subnet without a public IP must access Azure Blob Storage. The storage account must not be reachable from the public internet, and DNS resolution should stay inside the virtual network. What should you implement?

Accepted Answer

Create a private endpoint for the storage account and link the appropriate private DNS zone.. A private endpoint assigns the storage account a private IP from the VM's virtual network, making it reachable without public internet exposure. Linking the private DNS zone ensures that DNS resolution for the storage account (e.g., `mystorageaccount.blob.core.windows.net`) resolves to the private IP within the VNet, meeting both requirements.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet and keep the public endpoint enabled.

Answer

Use a SAS token and allow access from any network for the storage account.

Answer

Assign a managed identity to the VM and remove all network restrictions from the storage account.

Question 7

A legal department keeps evidence files in Azure Blob Storage. The files are accessed only a few times per year, but they must stay online and be immediately readable when requested. The team wants the lowest-cost online tier and does not want a rehydration step. Which tier should you choose?

Accepted Answer

Cold, because it keeps data online and is intended for rarely accessed content.. The Cold tier is the correct choice because it is an online tier designed for rarely accessed data that must remain immediately readable without a rehydration step. It offers lower storage costs than Hot or Cool while still providing instant access, meeting the requirement for the lowest-cost online tier.

Answer

Hot, because it prioritizes immediate access over storage cost.

Answer

Cool, because it is an online tier for infrequent access.

Answer

Archive, because it has the lowest cost and can be opened instantly from the portal.

Question 8

An operations team must deploy 20 identical application VMs every sprint from source control and wants the deployment definition to be readable and repeatable. Which approach should they use?

Accepted Answer

Use a Bicep template stored in source control. B is correct because Bicep is a domain-specific language (DSL) for deploying Azure resources declaratively. Storing a Bicep template in source control ensures the deployment definition is readable (using concise syntax) and repeatable (via idempotent deployments), meeting the team's requirement for 20 identical VMs every sprint.

Answer

Manually create each VM in the Azure portal

Answer

Capture a screenshot of the portal settings for future reference

Answer

Use Azure Policy to create the VMs automatically

Question 9

Central IT wants to apply three related policy definitions—allowed Azure regions, required owner tag, and approved VM sizes—to all subscriptions in the Corp management group and report compliance as one package. What should the administrator create?

Accepted Answer

An initiative. An initiative (also known as a policy set) in Azure Policy allows you to group multiple related policy definitions into a single package. By assigning the initiative to the Corp management group, all subscriptions under that management group inherit the three policies (allowed regions, required owner tag, approved VM sizes) as a bundle, and compliance is reported collectively for the entire initiative.

Answer

A resource lock

Answer

A role assignment

Answer

A managed identity

Question 10

A team deployed a private endpoint for an Azure Storage account in VNet-A. The private endpoint is healthy, but VMs in VNet-A still resolve the storage account name to the public IP address. What should the administrator configure next?

Accepted Answer

Link the appropriate private DNS zone to VNet-A.. When a private endpoint is deployed, the storage account's FQDN must resolve to the private IP address within the virtual network. By default, Azure Private DNS zones (privatelink.blob.core.windows.net) are not automatically linked to the virtual network. Linking the private DNS zone to VNet-A enables DNS resolution of the storage account name to the private endpoint's IP address instead of the public IP.

Answer

Add a route table that sends storage traffic to the private endpoint.

Answer

Create a network security group rule that allows outbound HTTPS.

Answer

Enable service endpoints for Microsoft.Storage on the subnet.

Question 11

A production application runs on three Azure VMs in a region that supports availability zones. The business wants the application to remain available if one datacenter in the region fails. What should the administrator use?

Accepted Answer

Availability zones. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying the three VMs across different zones ensures that if one datacenter fails, the application remains available because the other zones continue to operate. This directly meets the requirement for resilience against a single datacenter failure.

Answer

An availability set

Answer

A managed disk snapshot

Answer

A proximity placement group

Question 12

You need to notify the operations team by email when average CPU utilization on VM-App01 exceeds 80 percent for 15 minutes. Which Azure Monitor components should you configure?

Accepted Answer

A metric alert and an action group. A metric alert monitors a specific performance metric (like CPU utilization) and triggers when a threshold is exceeded for a defined duration. An action group defines the notification action (e.g., sending an email) when the alert fires. Together, they meet the requirement to email the operations team when average CPU exceeds 80% for 15 minutes.

Answer

An activity log alert only

Answer

A resource lock and Azure Advisor

Answer

A budget alert

Question 13

You need to deploy 20 identical Azure virtual machines that host the same web application. The solution must support automatic scale-out based on CPU usage and should minimize administrative overhead. What should you deploy?

Accepted Answer

A Virtual Machine Scale Set.. A Virtual Machine Scale Set (VMSS) is the correct choice because it automates the deployment and management of identical VMs, supports autoscaling based on CPU usage metrics, and minimizes administrative overhead by handling VM creation, load balancing, and scaling policies as a single resource. This aligns with the requirement for 20 identical VMs with automatic scale-out based on CPU usage.

Answer

20 individual virtual machines in the same resource group.

Answer

An availability set.

Answer

Azure Container Instances.

Question 14

You need to run a stateless web workload on Azure virtual machines and automatically increase or decrease instance count based on demand. You also want a single management boundary for the VM instances. Which solution should you deploy?

Accepted Answer

A Virtual Machine Scale Set. A Virtual Machine Scale Set (VMSS) is the correct solution because it provides an autoscaling group of identical VMs that can automatically increase or decrease instance count based on demand (e.g., CPU or memory metrics). It also offers a single management boundary, allowing you to manage, monitor, and scale all instances as a unified resource rather than individually.

Answer

An availability set with individual VMs

Answer

Azure Backup

Answer

A Recovery Services vault

Question 15

Which two statements about a Log Analytics workspace are correct? Select two.

Accepted Answer

It can store logs collected from Azure resources. A Log Analytics workspace is a centralized repository that can ingest and store log data from various Azure resources, including virtual machines, Azure Activity logs, and resource diagnostics, enabling monitoring and analysis. Option B is correct because Log Analytics workspaces support Kusto Query Language (KQL) queries, which allow users to perform complex searches, aggregations, and visualizations on the stored log data.

Answer

It creates backups of Azure virtual machines

Answer

It assigns permissions to Azure resources at scope

Answer

It blocks resource creation that violates a rule

Question 16

A production VM must generate an alert when average CPU exceeds 80 percent for 10 minutes. The alert must be evaluated continuously, but email notifications should be suppressed outside 08:00 to 18:00 on weekdays. What should the administrator configure?

Accepted Answer

A metric alert rule with an action group and an alert processing rule that suppresses actions outside business hours. It combines a metric alert rule (which continuously evaluates the CPU threshold) with an alert processing rule that suppresses notifications outside business hours. The metric alert rule evaluates every minute by default, meeting the 'continuously evaluated' requirement, while the alert processing rule (formerly action rule) allows you to suppress actions based on a schedule without altering the alert rule itself.

Answer

A log query alert only, with the query scheduled to run during business hours

Answer

A diagnostic setting that sends CPU logs to a storage account and a Logic App for email delivery

Answer

An action group with an email receiver and a virtual machine extension to pause the workload outside business hours

Question 17

You are designing a governance strategy for an Azure environment that includes multiple subscriptions. You need to ensure that all resources deployed in the production subscription adhere to specific regulatory compliance requirements, such as encryption at rest and denying public network access. Which three of the following should you implement? (Choose three.)

Accepted Answer

Configure Azure Blueprints to include the custom policy assignment and assign the blueprint to the production subscription.. Creating a custom Azure Policy definition allows you to enforce specific regulatory requirements like encryption at rest and denying public network access. Assigning this custom policy at the management group that contains the production subscription ensures the policy is inherited by the subscription and all its resources. Configuring Azure Blueprints to include the custom policy assignment and assigning the blueprint to the production subscription provides a repeatable, versioned deployment of the policy along with other artifacts, ensuring consistent governance.

Answer

Use Azure Resource Graph to audit resources that do not meet compliance requirements.

Answer

Assign the built-in Azure Policy initiative 'ISO 27001:2013' to the production subscription.

Answer

Create an Azure role-based access control (RBAC) role to enforce encryption and network restrictions.

Question 18

An analytics platform stores daily export files in Azure Blob Storage. The business wants the storage account to survive a failure of any one availability zone and also keep a replicated copy in a paired region for disaster recovery. No one needs to read from the secondary region unless a disaster recovery event occurs. Which redundancy option should be used?

Accepted Answer

GZRS. C is correct because GZRS (Geo-Zone-Redundant Storage) combines zone-redundant storage (ZRS) within the primary region, ensuring the storage account survives any single availability zone failure, with geo-redundant replication to a paired region for disaster recovery. The secondary region copy is read-only unless a failover is initiated, matching the requirement that no one reads from the secondary region unless a disaster recovery event occurs.

Answer

ZRS

Answer

GRS

Answer

RA-GRS

Question 19

An operations team monitors a group of Azure VMs and storage accounts. Match each Azure Monitor component to the behavior it provides in day-to-day operations.

Accepted Answer

Metrics: Collects numeric performance data from Azure resources.. Metrics give real-time performance; Logs store detailed events; Alerts trigger notifications; Workbooks visualize data; Autoscale adjusts capacity; Action Groups configure alert responses.

Answer

Action Groups: Automatically adjusts the number of instances.

Answer

Autoscale: Defines the notification preferences for alerts.

Answer

Workbooks: Stores log data for long-term retention.

Question 20

A backup engineer is reviewing policy-related settings in a Recovery Services vault. Match each backup setting to the behavior it controls.

Accepted Answer

Backup frequency: How often backups are performed (e.g., daily, weekly).. Backup frequency sets how often; retention range sets how long; snapshot retention keeps local copy; schedule sets time; tier defines storage type; alerts notify on issues.

Answer

Backup frequency: How long backups are retained.

Answer

Snapshot retention: How often backups are taken.