AZ-104 Practice Exam 60 — 20 Questions

Question 1

Based on the exhibit, a subscription activity log is already being sent to Log Analytics. The operations team wants an alert that fires when any resource group is deleted, but it should ignore deletions performed by a known automation account. Which approach should the administrator use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a log alert using the AzureActivity table and filter out the automation caller.. The AzureActivity table in Log Analytics captures all control-plane operations, including resource group deletions. By creating a log alert query that filters on OperationNameValue='MICROSOFT.RESOURCES/SUBSCRIPTIONS/RESOURCEGROUPS/DELETE' and excludes Caller where it matches the automation account's service principal or object ID, the alert triggers only for non-automation deletions. This approach leverages the existing activity log stream to Log Analytics without additional configuration.

Answer

Create a metric alert on CPU percentage for the subscription.

Answer

Enable a diagnostic setting on the resource group object.

Answer

Apply an Azure Policy deny assignment to all deletions.

Question 2

A VM-hosted application must read blobs from Azure Storage without storing any keys or passwords. Which two identity types can the VM use to authenticate to Azure Storage? Select two.

Accepted Answer

System-assigned managed identity, because it is tied to one VM and can request tokens without stored secrets.. System-assigned managed identity is correct because it is directly tied to a single VM and can request tokens from Azure AD without storing any secrets or keys. The VM uses its managed identity to authenticate to Azure Storage by obtaining an OAuth 2.0 token, which is then passed to the storage service via the Authorization header. This eliminates the need for any stored credentials, meeting the requirement of not storing keys or passwords.

Answer

Storage account shared key, because it is the preferred credential when you want to avoid passwords.

Answer

Basic authentication with a storage account name and password, because Azure Storage supports that model directly.

Answer

Anonymous public access, because it lets the VM read blobs without any authentication at all.

Question 3

A Windows VM in Azure must upload log files to a blob container every hour. Security policy forbids storing the storage account key or any long-lived SAS token on the VM. Which two actions should the administrator take? Select two.

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity on the VM allows it to authenticate to Azure AD without storing any credentials. By assigning the Storage Blob Data Contributor role to that identity on the storage account or container, the VM can upload logs using Azure AD authentication, which satisfies the security policy forbidding storage account keys or long-lived SAS tokens.

Answer

Copy the storage account access key into a configuration file on the VM.

Answer

Assign the Reader role at the resource group scope to the VM identity.

Answer

Create a shared access signature that never expires and place it on the VM.

Question 4

A team already has a metric alert on a production VM. The alert should continue evaluating 24/7, but email notifications must be sent only Monday through Friday from 08:00 to 18:00 local time. What should the administrator add or change?

Accepted Answer

Create an alert processing rule that suppresses notifications outside business hours.. An alert processing rule (formerly action rule) can suppress notifications for a metric alert based on a schedule. By creating a rule with a suppression action that applies outside business hours (e.g., 18:00 to 08:00 and weekends), the alert continues to evaluate and fire, but email notifications are blocked during those times. This meets the requirement without altering the alert rule itself.

Answer

Replace the metric alert with a diagnostic setting and store the data in Log Analytics.

Answer

Lower the alert threshold so fewer alerts occur during the week.

Answer

Use an autoscale profile instead of an alert rule.

Question 5

A finance department shares a resource group containing a critical VM and a storage account. Administrators must still be able to update settings and apply patches, but no one should accidentally delete the resources. Which lock should be applied at the resource group level?

Accepted Answer

CanNotDelete lock.. The CanNotDelete lock (option B) is correct because it prevents users from deleting the resource group or its resources, while still allowing read and update operations. This meets the requirement that administrators can update settings and apply patches, but accidental deletion is blocked. ReadOnly locks would block all write operations, including patching, which is too restrictive for this scenario.

Answer

ReadOnly lock, because it is the most restrictive option.

Answer

A policy assignment that denies delete operations.

Answer

No lock, because RBAC permissions already prevent deletion.

Question 6

A subnet has an NSG with a custom inbound deny-all rule at priority 200. You need to allow HTTPS traffic to a VM in that subnet from any source. Which action should you take?

Accepted Answer

Create an inbound allow rule for TCP 443 with priority 100.. NSG rules are evaluated in priority order, with lower numbers evaluated first. The existing deny-all rule at priority 200 blocks all inbound traffic. To allow HTTPS (TCP 443) before the deny rule is evaluated, you must create an allow rule with a priority lower than 200, such as priority 100. This ensures the allow rule is processed first, permitting the traffic.

Answer

Create an inbound allow rule for TCP 443 with priority 300.

Answer

Change the deny-all rule to outbound instead of inbound.

Answer

Add a route table entry for port 443 traffic to the VM subnet.

Question 7

Based on the exhibit, compliance requires one backup every week to be kept for 52 weeks, in addition to the daily backups already configured. What should you change in the backup policy?

Accepted Answer

Add a weekly retention rule that keeps one weekly recovery point for 52 weeks.. The requirement is to retain one weekly backup for 52 weeks, in addition to the existing daily backups. Adding a weekly retention rule that keeps one recovery point per week for 52 weeks directly satisfies this requirement by ensuring that each weekly backup is retained for the full year, while daily backups remain unaffected. This is the correct approach because Azure Backup allows granular retention policies with multiple rules for different frequencies (daily, weekly, monthly, yearly).

Answer

Increase the daily retention from 30 days to 365 days.

Answer

Change the vault to use soft delete so backups are retained for 52 weeks.

Answer

Create a metric alert to warn the team when backups are older than seven days.

Question 8

The finance team wants every resource created in one resource group to carry the same CostCenter tag automatically. They want to reduce manual entry and keep the tag value consistent. What should you configure?

Accepted Answer

Use Azure Policy to inherit the CostCenter tag from the resource group. Azure Policy can enforce tag inheritance from a resource group to all resources within it using the 'Inherit a tag from the resource group' built-in policy effect. This ensures the CostCenter tag is automatically applied to every new or existing resource without manual entry, maintaining consistency and reducing administrative overhead.

Answer

Ask users to add the tag manually to every resource

Answer

Assign a Reader role to the finance team

Answer

Apply a CanNotDelete lock to the resource group

Question 9

A partner company needs to upload files to a single blob container for the next 24 hours. The partner should not receive the storage account key, and the access should be limited to that container only. Which access mechanism should you provide?

Accepted Answer

A container-level SAS token with write permission and a 24-hour expiry.. A container-level SAS token with write permission and a 24-hour expiry is correct because it provides time-limited, delegated access to a specific blob container without exposing the storage account key. The SAS token is generated with the container as the resource scope, write permission (add/create), and an expiry time of 24 hours, meeting all requirements: no key sharing, container-only access, and time-bound access.

Answer

The storage account key, because it is easier for external users to use.

Answer

A management group role assignment, because RBAC can restrict access to one blob container.

Answer

A private endpoint, because it grants the partner write access over a private IP.

Question 10

A development VM is recreated from scratch every week. The team wants the operating system disk to boot as quickly as possible and does not need the OS disk contents to survive deallocation. Which disk choice should the administrator make?

Accepted Answer

An ephemeral OS disk. An ephemeral OS disk is created on the local VM host storage, not on Azure managed storage, which eliminates network latency and provides significantly faster boot times. Since the team does not need the OS disk contents to survive deallocation and recreates the VM weekly, ephemeral disks are ideal as they are reset to the original image state on each deployment.

Answer

A Premium SSD managed OS disk

Answer

A Standard SSD managed OS disk

Answer

The VM temporary disk as the operating system disk

Question 11

A contractor needs temporary access to upload files into one Azure Blob container for six hours. The administrator does not want to share the storage account key. What should the administrator create?

Accepted Answer

A shared access signature scoped to the container and expiration time. A shared access signature (SAS) scoped to the container provides time-limited, delegated access to specific operations (e.g., upload) without exposing the storage account key. By setting an expiration time of six hours, the administrator ensures the contractor can upload files only during that window, after which the token becomes invalid. This meets the requirement for temporary, secure access.

Answer

A new storage account access key

Answer

A management group assignment

Answer

A private endpoint for the contractor

Question 12

A web application is made up of several Azure resources that are deployed, updated, and retired together. The team wants one container for applying access control, tags, and deletion protection consistently to the whole application. What should they use?

Accepted Answer

A resource group.. A resource group is the correct container because it is a logical grouping of Azure resources that share the same lifecycle, allowing you to apply access control (RBAC), tags, and deletion protection (resource locks) consistently to all resources within the group. This aligns with the requirement to deploy, update, and retire resources together as a single unit.

Answer

A subscription dedicated to the application.

Answer

A management group.

Answer

A tag value that names the application.

Question 13

Based on the exhibit, the spoke virtual network must use the hub's existing VPN gateway to reach on-premises networks. Which peering setting should be enabled on the spoke-to-hub peering?

Accepted Answer

Use remote gateways on the spoke peering.. The 'Use remote gateways' setting on the spoke-to-hub peering allows the spoke virtual network to use the hub's existing VPN gateway for connectivity to on-premises networks. This setting forwards traffic from the spoke through the hub's gateway, enabling transitive routing without deploying a separate gateway in the spoke. It requires the hub-to-spoke peering to have 'Allow gateway transit' enabled.

Answer

Allow forwarded traffic on the spoke peering.

Answer

Delete the peering and create a virtual network gateway in the spoke.

Answer

Enable service endpoints on the spoke subnet.

Question 14

Match each VM identity concept to its best use.

Accepted Answer

System-assigned managed identity: Tied to the VM lifecycle, automatically created and deleted with the VM, best for accessing Azure resources without managing credentials.. Managed identities (system or user-assigned) eliminate credential management; Azure AD app identity is for custom apps; IMDS provides tokens; role assignments grant access to resources.

Answer

System-assigned managed identity: Best when a pre-provisioned identity is needed before the VM is created, or the identity must be assigned to multiple resources.

Answer

User-assigned managed identity: Automatically created and deleted with the VM, best for a single VM requiring access to Azure resources.

Question 15

A platform team wants one Azure storage account for application logs in Blob containers and a shared working directory for a Windows admin VM and a Linux automation VM. The account must support blob lifecycle rules, standard performance, and future private endpoint access. Which storage account kind should the administrator create?

Accepted Answer

StorageV2 (general-purpose v2), because it supports blobs, Azure Files, lifecycle management, and modern network features.. StorageV2 (general-purpose v2) is the correct choice because it supports Blob storage, Azure Files (required for the shared working directory), blob lifecycle management rules, and advanced networking features like private endpoints. It also provides standard performance, meeting all stated requirements. Other storage kinds lack either Azure Files support or lifecycle management capabilities.

Answer

BlobStorage, because it is optimized for blob data and can store logs efficiently.

Answer

FileStorage, because it is the best option when Azure Files is required.

Answer

BlockBlobStorage, because it provides the highest performance for operational data.

Question 16

A help desk analyst wants a query in Log Analytics that returns Azure virtual machines that have stopped sending a heartbeat for more than 15 minutes. Which KQL query should the analyst run?

Accepted Answer

Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen < ago(15m). The Heartbeat table in Log Analytics records a heartbeat signal from Azure Monitor agents every 5 minutes by default. The query uses `summarize` to find the latest `TimeGenerated` per computer, then filters with `where LastSeen < ago(15m)` to identify VMs that have not sent a heartbeat in over 15 minutes, indicating they are likely offline or unresponsive.

Answer

AzureActivity | where OperationNameValue contains 'Heartbeat' | summarize count() by ResourceGroup

Answer

Perf | where CounterName == '% Processor Time' | summarize avg(CounterValue) by Computer

Answer

SecurityEvent | where EventID == 4624 | summarize count() by Computer

Question 17

A company already uses the address space 10.20.0.0/16 for a hub virtual network and 10.21.0.0/16 on-premises. A new spoke virtual network will be peered to the hub and may later connect to the on-premises network. Which address space should the administrator choose for the spoke to avoid future routing conflicts?

Accepted Answer

10.22.0.0/16. (10.22.0.0/16) is correct because it is a unique, non-overlapping address space that does not conflict with the existing hub VNet (10.20.0.0/16) or the on-premises network (10.21.0.0/16). When a spoke VNet is peered to the hub and later connected to on-premises via VPN or ExpressRoute, Azure requires that all peered and connected address spaces be unique to avoid routing conflicts. Choosing a completely separate /16 ensures no future overlap.

Answer

10.20.64.0/19

Answer

10.21.0.0/16

Answer

10.20.128.0/17

Question 18

A security team needs platform logs and metrics from an Azure Key Vault to be searchable later in a Log Analytics workspace so they can investigate administrative changes and access trends. What should you configure on the Key Vault?

Accepted Answer

A diagnostic setting that sends logs and metrics to the workspace. A diagnostic setting on Azure Key Vault allows you to stream platform logs (e.g., AuditEvent) and metrics (e.g., ServiceApiHit) to a Log Analytics workspace. This makes the data searchable via KQL queries for investigating administrative changes and access trends, fulfilling the security team's requirement.

Answer

Azure Monitor private link scope

Answer

An activity log alert on the subscription only

Answer

A resource lock on the Key Vault

Question 19

Based on the exhibit, which identity should be granted the Contributor role so access can be managed centrally as team members change?

Accepted Answer

Assign Contributor to a Microsoft Entra security group that contains the team members.. Assigning the Contributor role to a Microsoft Entra security group that contains the team members allows access to be managed centrally. As team members join or leave, you simply add or remove them from the group, and their permissions update automatically without needing to modify role assignments for each individual user. This aligns with Azure RBAC best practices for centralized identity governance.

Answer

Assign Contributor to each user account individually.

Answer

Assign Contributor to a managed identity.

Answer

Assign Contributor to the management group that contains rg-app.

Question 20

Administrators need to connect to Windows and Linux VMs from the Azure portal using a browser. The VMs do not have public IP addresses, and the security team does not want a VPN client installed on admin laptops. Which service should be deployed?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP and SSH connectivity to Azure VMs directly from the Azure portal over TLS, without requiring public IP addresses on the VMs or a VPN client on the admin's laptop. It uses a hardened bastion host deployed in the same virtual network, acting as a jump server that brokers browser-based connections, meeting both the security and connectivity requirements.

Answer

Azure VPN Gateway

Answer

Azure Load Balancer

Answer

A network security group with RDP and SSH rules