AZ-104 Practice Exam 59 — 20 Questions

Question 1

Two workloads have different resilience requirements. Workload A must stay available if a single datacenter in the region fails. Workload B only needs protection from planned maintenance and a single hardware host failure. Which two deployment models should the administrator use? Select two.

Accepted Answer

Availability Zones for Workload A. Workload A requires protection against a full datacenter failure within a region. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across multiple zones ensures that if one zone (datacenter) fails, the workload remains available in another zone. Workload B only needs protection from planned maintenance and a single hardware host failure. An Availability Set distributes VMs across multiple fault domains (hardware hosts) and update domains (planned maintenance cycles), providing resilience against these specific failure scenarios without requiring zone-level separation.

Answer

Virtual Machine Scale Set without zones

Answer

Proximity Placement Group

Answer

Single VM with premium SSD

Question 2

Your company has two subscriptions named Dev-Sub and Prod-Sub. A new administrator must be able to create resource groups only in Dev-Sub and must not have any permissions in Prod-Sub. What should you do?

Accepted Answer

Assign Contributor to the administrator at the Dev-Sub scope.. Option B is correct because assigning the Contributor role at the Dev-Sub scope grants the administrator full permissions to create and manage resource groups within that subscription, while the role assignment is scoped exclusively to Dev-Sub, ensuring no permissions in Prod-Sub. Azure RBAC is hierarchical, so a role assigned at a subscription scope applies to all resource groups within it, but does not cross subscription boundaries. This meets the requirement of allowing resource group creation only in Dev-Sub with no access to Prod-Sub.

Answer

Assign Contributor to the administrator at the management group scope.

Answer

Assign Owner to the administrator at the resource group scope in Dev-Sub.

Answer

Assign Reader to the administrator at the Prod-Sub scope and Contributor at the tenant root group.

Question 3

You need to ensure that all new resources deployed to a subscription automatically receive a CostCenter tag with a default value if the tag is omitted during deployment. Which Azure governance feature should you use?

Accepted Answer

An Azure Policy with an append or modify effect. Azure Policy with an append or modify effect can automatically add a CostCenter tag with a default value to resources that are missing it during deployment. The append effect adds the tag and value at creation time, while the modify effect (using a 'addOrReplace' operation) can also update existing resources. This ensures governance compliance without manual intervention.

Answer

A resource lock

Answer

A management group lock

Answer

A custom RBAC role

Question 4

Your company wants to enforce a standard list of allowed Azure regions for all new resource deployments across several subscriptions. You need a centralized governance solution that can be assigned once and inherited by the child subscriptions. What should you use?

Accepted Answer

An Azure Policy assigned at the management group scope. Azure Policy assigned at the management group scope is the correct centralized governance solution because it enforces a standard list of allowed Azure regions across all subscriptions under that management group. Policies at the management group level are inherited by all child subscriptions, ensuring consistent compliance without requiring individual assignment per subscription.

Answer

A custom RBAC role assigned at each subscription

Answer

A CanNotDelete lock on each subscription

Answer

A budget alert on each subscription

Question 5

You create a private endpoint for an Azure SQL Database server. Virtual machines in VNet-Prod must resolve the server name to the private IP address of the endpoint. What should you configure?

Accepted Answer

A private DNS zone linked to VNet-Prod. A private endpoint uses a private IP address from your VNet, but DNS resolution must be configured to map the Azure SQL Database server name (e.g., `server.database.windows.net`) to that private IP. By creating a private DNS zone (privatelink.database.windows.net) and linking it to VNet-Prod, Azure automatically creates an A record for the private endpoint, ensuring VMs resolve the server name to the private IP instead of the public IP. This is the standard and required configuration for private endpoint name resolution.

Answer

A user-defined route on the subnet

Answer

An additional public IP address

Answer

A Recovery Services vault

Question 6

You need to restore a deleted file from a backed-up Azure virtual machine without restoring the entire VM. Which Azure Backup capability should you use?

Accepted Answer

File Recovery. Azure Backup's File Recovery capability allows you to mount the VM's recovery point as a drive on your local machine, enabling you to browse and restore individual files without restoring the entire VM. This is achieved by creating an iSCSI target from the recovery point snapshot, which you can connect to from a compatible OS. It is the correct choice for granular file-level recovery from a VM backup.

Answer

Cross-region restore

Answer

Azure Site Recovery failover

Answer

Boot diagnostics

Question 7

You need to deploy 25 identical Azure virtual machines for a web application and scale the number of instances automatically based on CPU demand. Which Azure compute feature should you use?

Accepted Answer

A Virtual Machine Scale Set. A Virtual Machine Scale Set (VMSS) is the correct Azure compute feature because it allows you to deploy and manage a group of identical, load-balanced VMs whose number can automatically increase or decrease in response to CPU demand using autoscale rules. This directly meets the requirement for 25 identical VMs with automatic scaling based on CPU metrics.

Answer

An availability set

Answer

A Recovery Services vault

Answer

Boot diagnostics

Question 8

A contractor needs temporary access to upload files into one Azure Blob container for six hours. The administrator does not want to share the storage account key. What should the administrator create?

Accepted Answer

A shared access signature scoped to the container and expiration time. A shared access signature (SAS) scoped to the container provides time-limited, delegated access to specific operations (e.g., upload) without exposing the storage account key. By setting an expiration time of six hours, the administrator ensures the contractor can upload files only during that window, after which the token becomes invalid. This meets the requirement for temporary, secure access.

Answer

A new storage account access key

Answer

A management group assignment

Answer

A private endpoint for the contractor

Question 9

Two VM scale sets named Web and App run in separate subnets. The App subnet NSG already contains Deny-All-Inbound at priority 300. The business wants only the Web tier to connect to the App tier on TCP 8443, and any new scale-out instances must be included automatically. What should the administrator add?

Accepted Answer

An inbound allow rule using source WebASG, destination AppASG, TCP 8443, with a priority lower than 300.. Option B is correct because it uses an Application Security Group (ASG) as the source and destination, which automatically includes all current and future VM instances in the Web and App scale sets. The rule allows TCP 8443 from WebASG to AppASG with a priority lower than 300 (e.g., 250) so it is evaluated before the Deny-All-Inbound rule at priority 300. This ensures that only the Web tier can connect to the App tier on the specified port, and new scale-out instances are included automatically without manual NSG updates.

Answer

A rule that allows TCP 8443 from the current Web subnet address range to the App subnet.

Answer

A load balancer NAT rule that maps port 8443 from the Internet to the App tier.

Answer

A service endpoint for Microsoft.Web on both subnets.

Question 10

You need to run a PowerShell script inside a newly deployed Azure virtual machine to configure application settings immediately after deployment. Which feature should you use?

Accepted Answer

A Custom Script Extension. The Custom Script Extension (CSE) is the correct choice because it allows you to run a PowerShell script on an Azure VM after deployment, making it ideal for configuring application settings. CSE downloads and executes scripts on the VM using the Azure VM agent, and it can be invoked during VM creation or post-deployment via ARM templates, Azure CLI, or PowerShell.

Answer

Azure Policy

Answer

Boot diagnostics

Answer

An availability set

Question 11

Your company has two Azure subscriptions named Dev-Sub and Prod-Sub. You need to ensure that a user can create resource groups only in Dev-Sub and nowhere else. What should you do?

Accepted Answer

Assign the Contributor role at the Dev-Sub subscription scope.. The Contributor role allows a user to create and manage resources, including resource groups, within the assigned scope. By assigning this role at the Dev-Sub subscription scope, the user gains the necessary permissions to create resource groups only in that subscription, as Azure RBAC permissions are inherited downward but not across sibling scopes. This ensures the user cannot create resource groups in Prod-Sub or any other subscription.

Answer

Assign the Owner role at the tenant root scope.

Answer

Assign the Reader role at the Dev-Sub subscription scope.

Answer

Assign the Contributor role at the management group scope that contains both subscriptions.

Question 12

You need to deploy 20 identical Azure virtual machines that host the same web application. The solution must support automatic scale-out based on CPU usage and should minimize administrative overhead. What should you deploy?

Accepted Answer

A Virtual Machine Scale Set.. A Virtual Machine Scale Set (VMSS) is the correct choice because it automates the deployment and management of identical VMs, supports autoscaling based on CPU usage metrics, and minimizes administrative overhead by handling VM creation, load balancing, and scaling policies as a single resource. This aligns with the requirement for 20 identical VMs with automatic scale-out based on CPU usage.

Answer

20 individual virtual machines in the same resource group.

Answer

An availability set.

Answer

Azure Container Instances.

Question 13

A development team runs Windows and Linux VMs in a single Azure subnet. The VMs must access an Azure Storage account, and the security team wants to restrict the storage account so only that subnet can reach it. The team does not want to create a private IP for the storage account or change DNS records. What should the administrator configure?

Accepted Answer

A service endpoint on the subnet and a storage account network rule allowing that subnet.. Option B is correct because a service endpoint extends the subnet's identity to the storage account, allowing the storage firewall to accept traffic from that subnet without assigning a private IP. This meets the security requirement of restricting access to only that subnet while avoiding private IPs or DNS changes.

Answer

A private endpoint for the storage account and a private DNS zone.

Answer

A site-to-site VPN between the subnet and the storage account.

Answer

A user-defined route that sends storage traffic to the default internet next hop.

Question 14

You need to ensure that all users in the HelpdeskAdmins group can reset passwords for cloud-only users in Microsoft Entra ID but cannot modify group memberships or delete users. Which role should you assign?

Accepted Answer

Helpdesk Administrator. The Helpdesk Administrator role is specifically designed to allow password resets for non-administrator users (including cloud-only users) while explicitly preventing modifications to group memberships or deletion of users. This aligns perfectly with the requirement to restrict the HelpdeskAdmins group to only password reset capabilities.

Answer

Global Administrator

Answer

User Administrator

Answer

Security Administrator

Question 15

A stateless web application needs a group of identical Azure VMs that can automatically add more instances during the workday and remove them at night based on CPU usage. What should the administrator deploy?

Accepted Answer

A virtual machine scale set with autoscale rules. A virtual machine scale set (VMSS) with autoscale rules is the correct solution because it provides a group of identical, load-balanced VMs that can automatically scale out (add instances) during high CPU usage in the workday and scale in (remove instances) at night based on CPU thresholds. This matches the stateless, elastic requirement perfectly, as VMSS is designed for horizontal scaling of identical instances with autoscale policies tied to metrics like CPU percentage.

Answer

An availability set with two VMs

Answer

A single VM with a larger disk

Answer

An Azure Policy assignment to increase CPU capacity

Question 16

A company wants to enable backup for an Azure virtual machine and later restore the VM if needed. Which Azure service should the administrator use to manage the backup plan and restores?

Accepted Answer

Recovery Services vault. The Recovery Services vault is the correct Azure service for managing backup plans and restores for Azure virtual machines. It provides a centralized management interface for configuring backup policies, performing on-demand backups, and initiating restore operations to recover VMs to a specific point in time.

Answer

Azure Monitor

Answer

Log Analytics workspace

Answer

Azure Front Door

Question 17

A stateless web app runs on two Ubuntu VMs behind an Azure Load Balancer. The region supports availability zones. The business wants the app to survive a full datacenter outage and also avoid having both VMs on the same maintenance boundary. Which deployment should you choose?

Accepted Answer

Place the VMs in separate availability zones in the same region.. Option C is correct because deploying the VMs in separate availability zones ensures they are placed in physically distinct datacenters within the same region, protecting against a full datacenter outage. Additionally, each availability zone has its own fault and update domains, so the VMs will never share the same maintenance boundary, meeting both business requirements.

Answer

Place both VMs in a single availability set.

Answer

Deploy one VM and rely on Azure Backup for recovery.

Answer

Deploy both VMs without any fault-domain configuration.

Question 18

A line-of-business web tier consists of two Azure VMs in a region that supports availability zones. The business requirement is to survive a full datacenter outage in that region without deploying to a second region. What should the administrator use?

Accepted Answer

Availability zones with the VMs placed in different zones. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Placing the two VMs in different zones ensures that if one entire datacenter fails, the other VM remains operational, meeting the requirement to survive a full datacenter outage without deploying to a second region.

Answer

An availability set with multiple update domains

Answer

A proximity placement group for both VMs

Answer

A single-zone virtual machine scale set

Question 19

A development VM is rebuilt often and does not need its operating system disk contents to survive deallocation. The team wants the lowest practical disk latency for the OS. Which disk option should the administrator choose?

Accepted Answer

Ephemeral OS disk. Ephemeral OS disks use the local VM storage (SSD) rather than Azure managed disks, providing the lowest latency for OS read/write operations. Since the VM is rebuilt often and disk persistence is not required, the ephemeral disk is ideal because its contents are lost when the VM is deallocated, eliminating the need for a separate managed disk.

Answer

Standard HDD managed disk

Answer

Geo-redundant storage for the OS disk

Answer

A data disk formatted as the boot disk

Question 20

A DevOps pipeline runs on an on-premises build server and must deploy ARM templates to a resource group in Azure without using a user password. The server is not in Azure, so managed identity is not available. What should the administrator create?

Accepted Answer

A service principal for the pipeline, with certificate-based or federated authentication.. Option C is correct because the on-premises build server cannot use Azure managed identities (which require an Azure resource). Instead, a service principal with certificate-based or federated authentication provides a secure, passwordless identity for the pipeline to authenticate to Azure AD and deploy ARM templates. This aligns with the principle of using Azure AD application credentials for non-Azure workloads.

Answer

A system-assigned managed identity on the build server.

Answer

A user-assigned managed identity attached to the on-premises server.

Answer

A shared access signature for the target resource group.