AZ-104 Practice Test 6 — 10 Questions

Question 1

Based on the exhibit, which action should the administrator take so Contractor01 can manage the team membership without receiving Azure resource permissions?

Accepted Answer

Add Contractor01 as an owner of the AppOps-Admins group.. Adding Contractor01 as an owner of the AppOps-Admins group grants them the ability to manage group membership (add/remove members) without inheriting any Azure resource permissions. Group ownership is an Azure AD role that controls group administration only, not access to Azure resources like VMs or storage. This meets the requirement of managing team membership without resource permissions.

Answer

Add Contractor01 as a member of the AppOps-Admins group.

Answer

Assign Contractor01 the User Administrator role at the tenant scope.

Answer

Assign Contractor01 Contributor on the subscription.

Question 2

Based on the exhibit, the administrator needs to deploy a VM quickly using a preapproved hardened operating system image. Which source should be used when creating the VM?

Accepted Answer

An approved custom image in an Azure Compute Gallery.. An approved custom image in an Azure Compute Gallery (formerly Shared Image Gallery) is the correct source because it allows the administrator to deploy a VM quickly using a preapproved, hardened operating system image. The Azure Compute Gallery provides versioning, replication, and regional distribution of custom images, ensuring that the hardened OS is readily available for rapid deployment across multiple regions. This aligns with the requirement for a preapproved image that meets security and compliance standards.

Answer

A temporary public IP address.

Answer

A network security group rule.

Answer

An Azure Monitor alert rule.

Question 3

Why is centralized logging especially useful during security investigations?

Accepted Answer

It makes related events from multiple devices easier to review and correlate.. Centralized logging aggregates logs from multiple sources (e.g., firewalls, servers, Azure Network Watcher) into a single repository, such as Azure Log Analytics. During security investigations, this enables security analysts to correlate events across devices (e.g., matching a suspicious IP address in firewall logs with authentication failures in domain controller logs) without manually connecting to each device. This correlation is critical for reconstructing attack timelines and identifying lateral movement, which is impossible with siloed logs.

Answer

It guarantees that attacks cannot succeed.

Answer

It replaces the need for authentication and authorization.

Answer

It forces all devices to use the same VLAN.

Question 4

A business wants a line-of-business VM workload to keep running if one Azure datacenter in the region goes offline. Which two deployment choices should the administrator use? Select two.

Accepted Answer

Deploy the VMs in different availability zones.. Option A is correct because deploying VMs across different availability zones protects against a single datacenter failure. Each availability zone is a physically separate datacenter within an Azure region, with independent power, cooling, and networking. If one zone goes offline, the VM in the other zone remains operational, ensuring business continuity for the line-of-business workload.

Answer

Place the VMs in the same availability set.

Answer

Use a proximity placement group for the VMs.

Answer

Use a snapshot of the operating system disk.

Question 5

A subnet has a user-defined route for 10.0.0.0/8 with next hop Virtual appliance 10.1.1.4. The VNet is peered with VNet-Shared, whose address space is 10.12.0.0/16. A VM in the subnet sends traffic to 10.12.4.25. Which next hop will Azure use?

Accepted Answer

VNet peering, because the peered VNet prefix is more specific than the broader UDR.. Azure uses the most specific matching route to determine next hop. The user-defined route (UDR) for 10.0.0.0/8 has a broader prefix length (/8) than the VNet peering route for 10.12.0.0/16 (/16). Since 10.12.4.25 falls within the peered VNet's address space, the more specific /16 route from VNet peering takes precedence over the UDR, directing traffic through the peering connection.

Answer

Virtual appliance 10.1.1.4, because the user-defined route controls all 10.x.x.x traffic.

Answer

Internet, because traffic not explicitly matched by the UDR leaves through the default route.

Answer

None, because Azure cannot route to peered VNets when a UDR exists on the subnet.

Question 6

A subnet NSG contains a deny inbound rule for TCP 3389 from Any at priority 100 and an allow inbound rule for TCP 3389 from 10.4.1.0/24 at priority 200. Admin workstations in 10.4.1.0/24 cannot connect by RDP. What change should the administrator make?

Accepted Answer

Lower the allow rule priority number so it is evaluated before the deny rule.. The correct answer is C because NSG rules are evaluated in priority order, with lower numbers having higher priority. The deny rule at priority 100 blocks all TCP 3389 traffic from Any, and the allow rule at priority 200 is never reached. Lowering the allow rule's priority number (e.g., to 90) ensures it is evaluated before the deny rule, allowing RDP traffic from 10.4.1.0/24.

Answer

Replace the source IP range with an application security group in the allow rule.

Answer

Change the protocol from TCP to Any in the allow rule.

Answer

Add a user-defined route to the subnet so RDP traffic bypasses the NSG.

Question 7

Based on the exhibit, a workload must remain available even if one datacenter in an Azure region becomes unavailable. The region supports zone deployment. What should the administrator configure?

Accepted Answer

Availability zones.. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying the workload across two or more zones ensures that if one datacenter fails, the other zones continue to operate, maintaining availability. This directly meets the requirement of surviving a single datacenter outage within a region that supports zone deployment.

Answer

An availability set.

Answer

A resource lock.

Answer

A user-defined route.

Question 8

Based on the exhibit, HTTPS traffic from the admin workstation is still being blocked. What change should the administrator make?

Accepted Answer

Change Allow-HTTPS-Admin to priority 100.. The Deny-All-Inbound rule has a default priority of 65000, which is higher (lower priority) than the Allow-HTTPS-Admin rule at priority 200. Since Azure Network Security Group (NSG) rules are evaluated in priority order (lowest number = highest priority), the Deny-All-Inbound rule is evaluated first and blocks all traffic, including HTTPS from the admin workstation. By changing Allow-HTTPS-Admin to priority 100, it will be evaluated before the Deny-All-Inbound rule, allowing HTTPS traffic to pass.

Answer

Delete the Deny-All-Inbound rule.

Answer

Change Allow-HTTPS-Admin protocol from TCP to Any.

Answer

Move the allow rule to outbound traffic.

Question 9

Based on the exhibit, what does the query return?

Accepted Answer

Failed deallocate operations on virtual machines during the last 24 hours.. The query filters for 'Status' equal to 'Failed' and 'Operation' equal to 'Deallocate Virtual Machines', returning only failed deallocate operations. The time filter restricts results to the last 24 hours. Therefore, the query returns failed deallocate operations on virtual machines during the last 24 hours.

Answer

All successful deallocate operations on virtual machines during the last 24 hours.

Answer

Any operations related to starting or restarting virtual machines in the last 24 hours.

Answer

Administrative changes made only from the Azure portal in the last 24 hours.

Question 10

Based on the exhibit, the workload must keep running if an entire datacenter in the region becomes unavailable. The region supports availability zones. What should you deploy?

Accepted Answer

Availability zones with the VMs distributed across zones.. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying VMs across multiple zones ensures that if one entire datacenter fails, the workload continues running in the other zone(s), meeting the requirement for regional datacenter-level resilience.

Answer

An availability set with one update domain per VM.

Answer

A single VM with a premium SSD data disk.

Answer

An Azure proximity placement group.

AZ-104 Practice Test 6 — 10 Questions

Exhibit

AZ-104 Practice Test 6 — 10 Questions

Exhibit