AZ-104 Practice Exam 60 — 20 Questions

Question 1

A company wants an Azure Storage account to be reachable privately from a virtual network. Which two statements about a private endpoint are correct? Select two.

Accepted Answer

The storage service gets a private IP address in the selected virtual network.. Option A is correct because an Azure Private Endpoint creates a network interface (NIC) in a chosen subnet of the virtual network and assigns the target PaaS service (here, Azure Storage) a private IP address from that subnet's address space, so traffic reaches the storage account over the private IP rather than the public endpoint. Option D is correct because clients normally address the storage account by its public FQDN (e.g., <account>.blob.core.windows.net), so a private DNS zone such as privatelink.blob.core.windows.net is linked to the virtual network to override that name and resolve it to the endpoint's private IP; without this, name resolution would still return the public address. Option B is wrong because the whole point of a private endpoint is private connectivity from within the VNet, and the client VM does not need a public IP address. Option C is wrong because DNS configuration is still required — a private endpoint does not automatically handle name resolution. Option E is wrong because a service endpoint extends the VNet identity to the service over the Azure backbone while the service keeps its public IP, whereas a private endpoint gives the service a private IP in the VNet; they are distinct features.

Answer

The virtual machine that reaches the service must have its own public IP address.

Answer

A private endpoint replaces the need for any DNS configuration.

Answer

A private endpoint and a service endpoint are the same feature.

Question 2

Based on the exhibit, what should you configure so the analysts can manage group membership without granting Azure resource permissions?

Accepted Answer

Add the service desk analysts as owners of the App-Support group.. Adding the service desk analysts as owners of the App-Support group grants them the ability to manage group membership directly within Microsoft Entra ID (formerly Azure AD) without assigning any Azure RBAC permissions on resources. Group owners can add or remove members from the group, but they do not inherit any permissions to manage Azure resources like VMs or storage accounts.

Answer

Assign the service desk analysts the User Administrator role in Microsoft Entra ID.

Answer

Create separate local administrator accounts for each analyst.

Answer

Assign Contributor on the subscription to the service desk analysts.

Question 3

The operations team manages several Azure VMs in one resource group. They need an alert whenever average CPU percentage on any VM in the group stays above 80% for 10 minutes, and the alert must send email and SMS to the on-call team. What should the administrator configure?

Accepted Answer

Create an Azure Monitor metric alert rule at the resource-group scope and attach an action group.. Azure Monitor metric alerts can be created at the resource-group scope, which allows a single alert rule to monitor the 'Percentage CPU' metric across all VMs in that group. The alert triggers when the average CPU stays above 80% for 10 minutes (evaluated using a fixed aggregation window). An action group attached to the alert rule sends email and SMS notifications to the on-call team, meeting all requirements without manual intervention.

Answer

Create a Log Analytics query alert on the Activity log and manually notify the on-call team.

Answer

Export VM diagnostics to a storage account and have operators review the files after each incident.

Answer

Create a resource lock on the VMs and use Azure Policy to notify the team about CPU spikes.

Question 4

A build server hosted in a company datacenter must deploy ARM templates to a target resource group in Azure without storing a user password. The server is not running in Azure, and the team wants to authorize deployments with Azure RBAC. What should be configured?

Accepted Answer

A service principal authenticated with a certificate and assigned RBAC on the target scope. A service principal authenticated with a certificate is the correct approach because it allows non-Azure resources (like an on-premises build server) to authenticate to Azure without storing a user password. The certificate-based authentication satisfies the requirement to avoid storing a password, and assigning RBAC on the target resource group grants the service principal the necessary permissions to deploy ARM templates. This method is secure, supports automation, and aligns with Microsoft Entra ID application registration best practices.

Answer

A system-assigned managed identity on the build server

Answer

A personal user account with multifactor authentication

Answer

A shared access signature for the resource group

Question 5

A business-critical application uses an Azure storage account. The company requires that data remain available even if an entire Azure region becomes unavailable. Which redundancy option should you choose?

Accepted Answer

GZRS. D (GZRS) is correct because it combines zone-redundant storage (ZRS) within a primary region with geo-redundant replication to a secondary region, ensuring data remains available even if an entire Azure region becomes unavailable. This meets the business-critical requirement for regional disaster recovery while maintaining high durability and availability.

Answer

LRS

Answer

ZRS

Answer

GRS

Question 6

A stateless Linux API should start with 2 instances, scale out to 6 when average CPU stays above 75 percent for 10 minutes, and scale back in when load drops. Which Azure compute resource should the administrator deploy?

Accepted Answer

A virtual machine scale set with autoscale rules.. A virtual machine scale set (VMSS) with autoscale rules is the correct choice because it natively supports scaling out and scaling in based on performance metrics like average CPU percentage. The requirement for a stateless Linux API with a minimum of 2 instances, scaling to 6 when CPU exceeds 75% for 10 minutes, and scaling back in when load drops is exactly the use case VMSS is designed for. Autoscale rules can be configured to use a scale-out and scale-in policy with a cool-down period, ensuring the application remains responsive while optimizing cost.

Answer

An availability set with manual VM resizing.

Answer

A single Standard D-series VM with scheduled shutdown.

Answer

A load balancer in front of two unmanaged VMs.

Question 7

You need to deploy several identical virtual machines and ensure that the failure of a single Azure host does not affect all of them. Which feature should you use?

Accepted Answer

An availability set. An availability set distributes virtual machines across multiple fault domains (physical hosts) and update domains within an Azure datacenter. By placing VMs in an availability set, you ensure that a failure of a single Azure host (fault domain) does not affect all VMs, as each VM is placed on a different physical host. This meets the requirement for isolation from a single host failure.

Answer

A proximity placement group

Answer

A private endpoint

Answer

A custom script extension

Question 8

A storage account has public network access disabled. A VM in a virtual network must access blob data privately, and the application must resolve the storage endpoint name to a private IP address. What should the administrator deploy?

Accepted Answer

A private endpoint for the storage account plus a private DNS zone linked to the virtual network. A private endpoint assigns the storage account a private IP from the VM's virtual network, enabling direct, secure access over the Microsoft backbone. A private DNS zone linked to the virtual network ensures the storage endpoint name (e.g., mystorageaccount.blob.core.windows.net) resolves to that private IP, meeting the requirement for private name resolution without relying on public DNS or hosts file entries.

Answer

A service endpoint for Microsoft.Storage and a custom hosts file entry on the VM

Answer

Allow trusted Microsoft services and keep using the public endpoint

Answer

A route table that sends traffic for the storage account's public IP to the VPN gateway

Question 9

A Python app running on an Azure VM must upload blobs to one container in a storage account. The app must not store a storage account key or SAS token on the VM. Which two actions should the administrator take? Select two.

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity on the VM allows Microsoft Entra ID authentication without storing any credentials on the VM. By assigning the Storage Blob Data Contributor role to that identity at the container scope, the app can use Microsoft Entra ID tokens to authenticate and upload blobs, eliminating the need for a storage account key or SAS token.

Answer

Store the storage account access key in an environment variable on the VM.

Answer

Generate a service SAS and copy it into the application configuration.

Answer

Assign the Contributor role on the resource group to the managed identity.

Question 10

A web app in Azure needs to upload files to a blob container. The development team wants the app to authenticate without storing a storage account key or password in code. Which approach should the administrator configure?

Accepted Answer

Assign a managed identity to the app and grant it storage permissions. Azure Managed Identity provides an automatically managed service principal in Microsoft Entra ID, allowing the web app to authenticate to Azure Blob Storage without storing any credentials in code or configuration. By assigning the managed identity to the app and granting it the appropriate RBAC role (e.g., Storage Blob Data Contributor), the app can obtain an Microsoft Entra ID token to securely access the blob container.

Answer

Embed the storage account key in the application settings

Answer

Use the public endpoint and anonymous access

Answer

Use an archive tier for the container

Question 11

You want Azure to recommend ways to reduce cost, improve performance, and strengthen security across your subscriptions. Which service should you use?

Accepted Answer

Azure Advisor. Azure Advisor is the correct service because it provides personalized recommendations across your Azure subscriptions to optimize for cost, performance, reliability, and security. It analyzes your resource configuration and usage telemetry, then generates actionable recommendations such as right-sizing underutilized VMs, enabling geo-redundant storage, or applying security rules. This directly matches the question's requirement for a unified tool that suggests improvements in all three areas.

Answer

Azure Policy

Answer

Azure Backup

Answer

Virtual network peering

Question 12

A storage account has public network access disabled. An application runs on a VM in a VNet and must access the storage account over a private IP address. The team also wants the storage name to resolve to a private address inside the VNet without changing application code. What should the administrator create?

Accepted Answer

A private endpoint for the storage account and a corresponding private DNS zone link.. A private endpoint assigns the storage account a private IP from the VNet, making it accessible over a private IP address. A corresponding private DNS zone link (e.g., privatelink.blob.core.windows.net) ensures the storage account name resolves to that private IP inside the VNet without modifying application code, meeting both requirements.

Answer

A service endpoint on the subnet and a storage account firewall rule allowing that subnet.

Answer

An account SAS token with read/write permissions for the application.

Answer

Allow trusted Microsoft services to bypass the storage firewall.

Question 13

A newly created VM must read secrets from Azure Key Vault. The solution must not store credentials on the VM, and the identity should disappear automatically when the VM is deleted. What should the administrator enable?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is automatically created and tied to the lifecycle of the Azure VM. When the VM is deleted, the identity is automatically removed, satisfying the requirement that the identity disappears. This identity can be granted access to Key Vault secrets via Azure RBAC or access policies, without storing any credentials on the VM.

Answer

User-assigned managed identity

Answer

A service principal with a stored client secret

Answer

A storage account access key

Question 14

A subnet has an NSG with these inbound rules: priority 100 denies TCP 443 from Any, and priority 200 allows TCP 443 from an Application Security Group named WebFrontEnd. A backend VM in the subnet still does not accept traffic from the frontend tier. What should the administrator change?

Accepted Answer

Move the allow rule to a lower priority number than the deny rule.. Network Security Group (NSG) rules are evaluated in priority order, with lower numbers evaluated first. Since the deny rule has priority 100 and the allow rule has priority 200, the deny rule is evaluated first and blocks TCP 443 traffic from any source, including the WebFrontEnd Application Security Group. To allow the frontend traffic, the allow rule must be moved to a lower priority number (e.g., 90) so it is evaluated before the deny rule.

Answer

Change the allow rule source from an Application Security Group to VirtualNetwork.

Answer

Attach a user-defined route to the subnet so traffic bypasses the NSG.

Answer

Place the backend VM in a different availability set so the rule is evaluated differently.

Question 15

A web application runs on three VMs in a backend subnet. The backend team wants the load balancer in the frontend tier to reach the VMs on TCP 8443, and they want the rule to keep working even if the backend VM IP addresses change. What should you use in the NSG rule?

Accepted Answer

Use an application security group for the frontend tier as the source and another ASG for the backend tier as the destination.. Application Security Groups (ASGs) allow you to define network security rules based on logical groupings of VMs, regardless of their IP addresses. By using an ASG for the frontend tier as the source and another ASG for the backend tier as the destination, the NSG rule remains valid even if backend VM IP addresses change, as ASGs are dynamically updated. This meets the requirement for the load balancer in the frontend tier to reach backend VMs on TCP 8443 without hardcoding IP addresses.

Answer

Use the individual private IP addresses of each backend VM as the source.

Answer

Use the VirtualNetwork service tag for both source and destination.

Answer

Create a route table entry that sends TCP 8443 traffic to the backend subnet.

Question 16

An administrator wants to run a one-time Azure CLI command from inside a VM to create a resource in Azure, but the administrator does not want to store credentials on the VM. What should be used for authentication?

Accepted Answer

The VM's managed identity. Azure Managed Identity provides an automatically managed identity in Microsoft Entra ID that allows a VM to authenticate to any service that supports Microsoft Entra ID authentication, including Azure Resource Manager, without storing any credentials on the VM. When the administrator runs the Azure CLI command from within the VM, the CLI can use the managed identity's token endpoint (169.254.169.254/metadata/identity/oauth2/token) to obtain an access token, enabling secure, credential-free resource creation.

Answer

A local administrator password

Answer

A network security group rule

Answer

An Azure region paired with the VM

Question 17

An enterprise has a management group named Corp. Corp contains two child management groups: Prod and Sandbox. A compliance auditor is a member of an Entra ID group and must have read-only access to every current and future resource in all subscriptions that are under Prod. The auditor must not see resources in Sandbox, and the admin does not want to maintain separate assignments for each new subscription. What should the administrator do?

Accepted Answer

Assign the Reader role to the group at the Prod management group scope.. Assigning the Reader role at the Prod management group scope applies that permission to all current and future subscriptions and resources within Prod, satisfying the requirement for read-only access without needing separate assignments. Management groups in Azure provide a hierarchical scope that inherits role assignments to all child subscriptions and resource groups, making this the most efficient and future-proof approach.

Answer

Assign the Reader role to the group at each subscription scope under Prod.

Answer

Assign the Reader role to the group at the Corp management group scope.

Answer

Assign the Reader role to the group at one resource group in each Prod subscription.

Question 18

Your application stores compliance documents in Azure Blob Storage. The documents must be kept in a write-once-read-many state for five years and must not be altered or removed during that time. What should you configure?

Accepted Answer

Immutable blob storage with a time-based retention policy. Immutable blob storage with a time-based retention policy enforces a write-once-read-many (WORM) state, ensuring that blobs cannot be modified or deleted for a specified retention period. This directly meets the requirement of keeping compliance documents unaltered for five years, as the policy locks the data at the storage level, overriding any user permissions or delete operations.

Answer

Blob soft delete

Answer

Blob lifecycle management to move data to Cool tier

Answer

A shared access signature

Question 19

You are designing a disaster recovery strategy for Azure Blob Storage. The storage account is configured with geo-redundant storage (GRS). Which three of the following statements about GRS and failover are true? (Choose three.)

Accepted Answer

GRS provides three copies of your data within the primary region and three additional copies in the secondary region.. Geo-redundant storage (GRS) replicates data asynchronously to a paired secondary region, ensuring durability even during a regional outage. In such an outage, you can initiate a customer-managed failover to promote the secondary region as the new primary. GRS maintains three copies (LRS) in the primary region and three additional copies in the secondary region, providing six total replicas.

Answer

GRS guarantees zero data loss if a failover is triggered.

Answer

Once a failover is completed, you cannot fail back to the original primary region.

Answer

After a failover, the secondary region becomes the new primary and replication to the original primary is automatically established.

Question 20

A help desk analyst needs a KQL query that identifies each VM's most recent heartbeat so computers can be flagged if their last check-in is older than 20 minutes. Which two KQL elements should be used? Select two.

Accepted Answer

Query the Heartbeat table, because it stores the heartbeat records for Azure VMs.. The Heartbeat table in Azure Monitor Logs (Log Analytics) is specifically designed to store heartbeat records from Azure Monitor Agent (AMA) or the legacy Log Analytics agent. Each heartbeat record contains a TimeGenerated timestamp, making it the authoritative source for determining when a VM last reported its health status.

Answer

Join the results to AzureActivity to calculate service health.

Answer

Filter where TimeGenerated is older than 20 minutes before summarizing.

Answer

Use the Perf table because it stores heartbeat timestamps.