AZ-104 Practice Exam 59 — 20 Questions

Question 1

You need to restore a deleted file from a backed-up Azure virtual machine without restoring the entire VM. Which Azure Backup capability should you use?

Accepted Answer

File Recovery. Azure Backup's File Recovery capability allows you to mount the VM's recovery point as a drive on your local machine, enabling you to browse and restore individual files without restoring the entire VM. This is achieved by creating an iSCSI target from the recovery point snapshot, which you can connect to from a compatible OS. It is the correct choice for granular file-level recovery from a VM backup.

Answer

Cross-region restore

Answer

Azure Site Recovery failover

Answer

Boot diagnostics

Question 2

A stateless web app on Azure must add or remove instances automatically when CPU usage changes. Which service should you deploy?

Accepted Answer

Virtual machine scale set with autoscale. A virtual machine scale set (VMSS) with autoscale is the correct choice because it is designed to automatically increase or decrease the number of VM instances based on metrics like CPU usage. Autoscale rules can be configured to scale out when CPU exceeds a threshold (e.g., 75%) and scale in when it drops below a threshold, ensuring the stateless web app handles variable load without manual intervention.

Answer

Single virtual machine

Answer

Availability set

Answer

Managed disk

Question 3

A company hosts documents in Azure Blob Storage. The files must remain available if one availability zone in the region fails. Which redundancy option should the administrator choose?

Accepted Answer

ZRS, because it stores copies across multiple availability zones in the region.. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within a primary region, ensuring data remains accessible if one zone fails. This meets the requirement for high availability within a single region without relying on a secondary region.

Answer

LRS, because it keeps three copies within one datacenter.

Answer

GRS, because it automatically makes the account available in another region for reads.

Answer

RA-GRS, because it is the only option that keeps a secondary copy.

Question 4

You need to create a storage account that provides the lowest-cost redundant storage for non-critical data and only needs protection against local disk or server failure within a single datacenter. Which redundancy option should you choose?

Accepted Answer

LRS. A is correct because Locally Redundant Storage (LRS) replicates data three times within a single datacenter in the same region, protecting against local disk or server failures. It is the lowest-cost redundancy option, making it ideal for non-critical data that does not require protection against zone- or region-level outages.

Answer

ZRS

Answer

GRS

Answer

GZRS

Question 5

The operations team manages several Azure VMs in one resource group. They need an alert whenever average CPU percentage on any VM in the group stays above 80% for 10 minutes, and the alert must send email and SMS to the on-call team. What should the administrator configure?

Accepted Answer

Create an Azure Monitor metric alert rule at the resource-group scope and attach an action group.. Azure Monitor metric alerts can be created at the resource-group scope, which allows a single alert rule to monitor the 'Percentage CPU' metric across all VMs in that group. The alert triggers when the average CPU stays above 80% for 10 minutes (evaluated using a fixed aggregation window). An action group attached to the alert rule sends email and SMS notifications to the on-call team, meeting all requirements without manual intervention.

Answer

Create a Log Analytics query alert on the Activity log and manually notify the on-call team.

Answer

Export VM diagnostics to a storage account and have operators review the files after each incident.

Answer

Create a resource lock on the VMs and use Azure Policy to notify the team about CPU spikes.

Question 6

Three application VMs in different resource groups must use the same Azure identity to read blobs from a storage account. The identity must continue to work if the VMs are redeployed. What should you use?

Accepted Answer

A user-assigned managed identity. A user-assigned managed identity is the correct choice because it is a standalone Azure resource that can be assigned to multiple VMs across different resource groups. It persists independently of the VM lifecycle, so it continues to work even if the VMs are redeployed, and it can be used to authenticate to Azure Storage for blob read operations via Azure AD.

Answer

A system-assigned managed identity on each VM

Answer

A shared access signature stored in a configuration file

Answer

The local Administrator account on each VM

Question 7

Match each blob access method or setting to its best use case.

Accepted Answer

Public endpoint with anonymous access: Best use case for public content accessible without authentication. Public endpoint with anonymous access is for public content. Private endpoint with managed identity provides secure VM access. SAS tokens grant time-limited restricted access. Azure AD with RBAC centralizes identity management. Storage account key gives full admin control. Immutable storage with legal hold ensures data cannot be altered or deleted.

Answer

Private endpoint with managed identity: Best use case for public internet access from VMs

Answer

Immutable storage with legal hold: Best use case for temporary data that can be deleted

Question 8

You need to resize a VM to a larger size, but Azure says the target size is not available while the VM is running. What should you do first?

Accepted Answer

Deallocate the VM, then retry the resize.. When a VM is running, Azure may not have the target VM size available in the cluster hosting the VM. Deallocating the VM releases the underlying hardware resources and removes the VM from its current cluster, allowing Azure to select a new cluster that supports the desired size. After deallocation, the resize operation can succeed because the VM is no longer pinned to a specific host or cluster.

Answer

Delete the VM and recreate it from the image.

Answer

Attach a new data disk first.

Answer

Create an availability set for the VM.

Question 9

Based on the exhibit, every resource created in RG-Finance must automatically receive CostCenter=FIN, but deployments should not fail if the tag is omitted. What should you configure?

Accepted Answer

Assign an Azure Policy with the Modify effect at RG-Finance.. The Azure Policy 'Modify' effect can automatically add the CostCenter=FIN tag to resources in RG-Finance without causing deployment failures if the tag is omitted. Unlike 'Deny', which blocks non-compliant deployments, 'Modify' uses a remediation task to append the missing tag after creation, ensuring compliance without disruption.

Answer

Assign an RBAC role that forces all users to enter the tag.

Answer

Apply a ReadOnly lock to the resource group.

Answer

Use Azure Policy with a Deny effect at the management group.

Question 10

The subscription admin wants to receive an alert whenever anyone deletes a resource group, regardless of which resource type was inside it. Which alert type should be used?

Accepted Answer

An activity log alert targeting the delete resource group operation. The 'Delete Resource Group' operation is an Azure Resource Manager control-plane action that is automatically logged in the Azure Activity Log. An activity log alert can be configured to fire whenever this specific operation is recorded, regardless of the resource types inside the group. This is the only alert type that directly monitors management-plane events like resource group deletion.

Answer

A metric alert on the deleted resource group's CPU

Answer

A log alert on a custom KQL query in a workspace only

Answer

A backup alert from a Recovery Services vault

Question 11

You have a virtual machine scale set that must increase the number of instances automatically when average CPU utilization exceeds 75 percent and decrease when utilization drops below 30 percent. What should you configure?

Accepted Answer

An Azure Monitor autoscale rule on the scale set. Azure Monitor autoscale rules allow you to define conditions for automatically scaling out (increasing instances) when average CPU utilization exceeds a threshold (e.g., 75%) and scaling in (decreasing instances) when it drops below a lower threshold (e.g., 30%). These rules are applied directly to the virtual machine scale set, enabling dynamic scaling based on performance metrics.

Answer

A boot diagnostics configuration

Answer

An availability set

Answer

A custom script extension

Question 12

A security admin wants Key Vault audit logs and metrics sent to a Log Analytics workspace for later search. Which Azure setting should be configured on the vault?

Accepted Answer

Diagnostic settings. Diagnostic settings in Azure Key Vault allow you to stream platform logs and metrics to various destinations, including a Log Analytics workspace. By configuring diagnostic settings on the vault, you can send audit logs (e.g., AuditEvent) and metrics (e.g., ServiceApiLatency) to Log Analytics for querying with KQL, enabling security analysis and monitoring.

Answer

Azure Policy assignment

Answer

Network security group

Answer

Action group

Question 13

A web app running on an Azure VM must connect to an Azure SQL Database instance. The security team requires the database to be reachable through a private IP inside the VNet, and the application should keep using the normal SQL server name without any connection string change. What should the administrator implement?

Accepted Answer

A private endpoint for Azure SQL and the corresponding private DNS zone linked to the VNet.. A private endpoint assigns Azure SQL Database a private IP from the VNet, making it reachable via a private IP while preserving the normal SQL server FQDN. The corresponding private DNS zone (privatelink.database.windows.net) linked to the VNet ensures that DNS resolution of the SQL server name resolves to the private IP, so no connection string changes are needed. This meets the security requirement of private IP reachability and the application requirement of unchanged connection strings.

Answer

A service endpoint on the subnet and a firewall rule on the SQL server.

Answer

A public endpoint with selected network access and a network security group on the VM subnet.

Answer

A virtual network peering connection to the SQL service subnet.

Question 14

RG-Prod is locked during a change freeze with a CanNotDelete lock. Administrators still need to keep the environment healthy without removing the lock. Which three actions can still be completed? Select three.

Accepted Answer

Change the size of an existing virtual machine in the resource group.. A CanNotDelete lock prevents deletion of resources but allows all management operations that do not involve deletion. Changing the size of an existing virtual machine is a modification operation, not a deletion, so it is permitted under this lock type.

Answer

Delete an unused storage account from the resource group.

Answer

Delete the entire resource group to rebuild it from scratch.

Question 15

A web app and a VM scale set both need the same Azure identity to read secrets from Key Vault. The identity must survive redeployment, and the team wants to remove it centrally without changing each resource individually. Which identity type should they use?

Accepted Answer

A user-assigned managed identity attached to both resources.. A user-assigned managed identity (B) is the correct choice because it is created as a standalone Azure resource, can be attached to multiple Azure resources (e.g., a web app and a VM scale set), and persists independently of those resources. This allows the identity to survive redeployment of either resource and enables centralized removal (by deleting the user-assigned identity) without needing to modify each resource individually.

Answer

A system-assigned managed identity on each resource.

Answer

A service principal with a client secret stored in application settings.

Answer

A resource lock on the Key Vault to preserve the secret access path.

Question 16

A storage account must be accessible only from one virtual network, and the storage service must have a private IP address inside that network. Public network access should be disabled. Which solution should the administrator use?

Accepted Answer

Create a private endpoint for the storage account in the virtual network. A private endpoint assigns the storage account a private IP address from the virtual network's address space, using Azure Private Link to route traffic entirely over the Microsoft backbone. This ensures the storage account is accessible only from that virtual network and allows public network access to be disabled, meeting both requirements.

Answer

Add a storage firewall rule that allows the subnet's public IP range

Answer

Configure a service endpoint for the subnet and keep public access enabled

Answer

Peer the virtual network to the storage account's region

Question 17

Based on the exhibit, the help desk team must be able to restart virtual machines in RG-App, but they must not be able to create, delete, or resize VMs. What is the best action?

Accepted Answer

Create a custom RBAC role that allows VM start, restart, and deallocate actions, then assign it at RG-App.. The help desk team needs only specific actions (start, restart, deallocate) without the ability to create, delete, or resize VMs. The built-in Virtual Machine Contributor role includes write permissions that allow creating and deleting VMs, so a custom RBAC role that explicitly grants only the required actions (Microsoft.Compute/virtualMachines/start/action, restart/action, deallocate/action) and is assigned at the RG-App scope meets the requirement precisely.

Answer

Assign Virtual Machine Contributor to HelpDeskGroup at the subscription scope.

Answer

Assign Contributor to HelpDeskGroup at RG-App.

Answer

Assign Owner to HelpDeskGroup at RG-App and use Azure Policy to block unwanted changes.

Question 18

Why is centralized logging especially helpful during incident investigation?

Accepted Answer

It helps investigators analyze related events from multiple devices in one place.. Centralized logging aggregates logs from multiple sources (servers, firewalls, applications) into a single repository, enabling investigators to correlate events across devices during an incident. This eliminates the need to manually access each device's local logs, speeding up root cause analysis and providing a unified timeline of activities.

Answer

It guarantees that no attack can ever succeed.

Answer

It replaces the need for access control.

Answer

It forces all devices to use the same VLAN.

Question 19

A stateless web application is hosted on an Azure virtual machine scale set. Traffic is predictable: CPU usage stays below 20% overnight, then rises above 70% during business hours. The administrator wants the instance count to increase automatically when average CPU stays high for 10 minutes and to decrease after demand drops. What should be configured?

Accepted Answer

Autoscale rules on the virtual machine scale set.. Autoscale rules on the virtual machine scale set allow the administrator to define a scale-out condition (e.g., average CPU > 70% for 10 minutes) and a scale-in condition (e.g., average CPU < 20% for a specified duration). This matches the requirement for automatic, metric-based scaling based on predictable traffic patterns.

Answer

A proximity placement group for the scale set instances.

Answer

Manual scale operations only.

Answer

An availability set with three update domains.

Question 20

You need to prevent accidental deletion of a production resource group while still allowing administrators to update resources inside it. What should you apply to the resource group?

Accepted Answer

A CanNotDelete lock. A CanNotDelete lock (B) prevents the resource group from being deleted while still allowing all operations (including updates) on resources within it. This is the correct choice because the requirement is to block accidental deletion of the entire resource group, not to restrict modifications to its resources.

Answer

A ReadOnly lock

Answer

A deny assignment

Answer

A budget alert