AZ-104 Practice Exam 61 — 20 Questions

Question 1

A hub VNet contains a VPN gateway that provides access to on-premises resources. A spoke VNet is peered to the hub and must send on-premises traffic through the hub gateway without deploying its own gateway. What peering configuration is required?

Accepted Answer

Enable gateway transit on the hub peering and Use remote gateways on the spoke peering.. Option B is correct because to route spoke VNet traffic through the hub VPN gateway without deploying a separate gateway in the spoke, you must enable 'Use remote gateways' on the spoke peering and 'Gateway transit' on the hub peering. This configuration allows the spoke to use the hub's VPN gateway for on-premises connectivity, leveraging the transitive routing capability of VNet peering.

Answer

Enable forwarded traffic on both peerings and disable gateway transit.

Answer

Create a second VPN gateway in the spoke and peer the two gateways.

Answer

Configure the spoke subnet with a service endpoint to the hub gateway subnet.

Question 2

A web tier must use identical VMs, keep the desired instance count if one instance becomes unhealthy, and allow future horizontal expansion without creating VMs one by one. What should the administrator deploy?

Accepted Answer

A virtual machine scale set with health-based instance management.. A virtual machine scale set with health-based instance management is correct because it automatically maintains a desired number of identical VM instances, replaces unhealthy instances based on health probes, and supports horizontal scaling without manual VM creation. This aligns with the requirements for identical VMs, automatic instance replacement, and future expansion.

Answer

An availability set because it automatically replaces unhealthy instances.

Answer

An Azure Dedicated Host to keep the VMs on one physical server.

Answer

A proximity placement group to ensure the VMs are distributed evenly.

Question 3

A finance department wants several Windows virtual machines to map the same shared drive letter and work with the same files at the same time. Which Azure Storage service should you configure?

Accepted Answer

Azure Files share. Azure Files provides fully managed file shares in the cloud that support the SMB protocol, allowing multiple Windows VMs to mount the same share with a consistent drive letter (e.g., Z:) and access the same files concurrently. This meets the finance department's requirement for shared access with a mapped drive letter, which Azure Blob storage cannot provide because it uses REST APIs rather than SMB.

Answer

Azure Blob container

Answer

Archive blob tier

Answer

Storage account access key only

Question 4

A managed data disk on a VM was deleted by mistake. You have a snapshot from before the deletion and want to restore the data with minimal impact to the VM's operating system disk. What should you do?

Accepted Answer

Create a new managed disk from the snapshot and attach it to the VM. Option A is correct because you can create a new managed disk from the snapshot and attach it as a data disk to the existing VM. This restores the data without affecting the OS disk or requiring a VM redeployment, minimizing downtime and impact.

Answer

Redeploy the VM from the marketplace image

Answer

Convert the snapshot directly into an OS disk and boot from it

Answer

Resize the VM to a larger size and the deleted disk will reappear

Question 5

A platform team maintains a hardened Windows VM with IIS, an agent, and local configuration files. They need to deploy 40 identical VMs in two regions, preserve version history, and roll back quickly if a new image causes problems. Which two actions should they take? Select two.

Accepted Answer

Generalize the source VM before capture by removing machine-specific state.. Option A is correct because generalizing the source VM with Sysprep (for Windows) removes machine-specific state like security identifiers (SIDs) and hostnames, making the VM suitable for creating a reusable, generalized image. This is a prerequisite for capturing an image that can be deployed to multiple VMs without conflicts. Without generalization, each VM would retain the original machine's identity, causing domain join and licensing issues.

Answer

Place the target virtual machines in an availability set.

Answer

Attach a user-assigned managed identity to the source VM.

Answer

Enable boot diagnostics on the target virtual machines.

Question 6

An administrator needs to deploy a VM quickly using the same hardened operating system image that was approved by the security team. What should the administrator use as the source for the new VM?

Accepted Answer

A managed image. A managed image captures a fully configured, hardened OS disk (including installed software and settings) as a reusable snapshot. When deploying a new VM, specifying this managed image as the source ensures the VM boots with the exact, security-approved OS configuration, meeting the requirement for a quick, consistent deployment.

Answer

A network interface

Answer

A resource lock

Answer

A public IP address

Question 7

A finance team stores monthly invoice PDFs in Azure and wants the data to remain available if an entire availability zone in the region fails. They do not need read access to a secondary region, and they want to keep the storage service simple. Which redundancy option should they choose for the storage account?

Accepted Answer

Zone-redundant storage (ZRS), because it replicates data across zones in the same region.. Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones within the same region, ensuring durability even if an entire zone fails. This meets the requirement for intra-region zone failure protection without needing a secondary region, and it keeps the storage service simple by avoiding the complexity of geo-replication.

Answer

Locally redundant storage (LRS), because it protects against a single disk failure inside one datacenter.

Answer

Geo-redundant storage (GRS), because it automatically provides the lowest-cost cross-region protection.

Answer

Geo-zone-redundant storage (GZRS), because it is required whenever zone resilience is needed.

Question 8

A help desk engineer must be able to start, stop, and resize only VM-App01. The engineer must not gain access to any other virtual machines or resource groups in the subscription. What scope should you use for the Azure RBAC role assignment?

Accepted Answer

Assign the role at the virtual machine scope for VM-App01 only.. Option B is correct because Azure RBAC allows you to assign a role at the virtual machine scope, which restricts permissions to that specific resource only. By assigning a role like 'Virtual Machine Contributor' at the scope of VM-App01, the help desk engineer can start, stop, and resize only that VM without gaining access to any other VMs or resource groups in the subscription.

Answer

Assign the role at the subscription scope so the engineer can manage any VM in the subscription.

Answer

Assign the role at the resource group scope that contains VM-App01.

Answer

Assign the role at a management group scope so the team can standardize access.

Question 9

A finance web app in AppSubnet must connect to Azure SQL Database over the service's public endpoint. Only AppSubnet should be allowed, and the security team does not want to deploy any private IPs or change DNS. What should you configure?

Accepted Answer

Enable the Microsoft.Sql service endpoint on AppSubnet and add a virtual network rule on the SQL server.. Option B is correct because enabling the Microsoft.Sql service endpoint on AppSubnet allows traffic from that subnet to reach Azure SQL Database's public endpoint without requiring public IP addresses or DNS changes. Adding a virtual network rule on the SQL server restricts access exclusively to that subnet, meeting the security requirement without deploying private IPs.

Answer

A private endpoint for the SQL server and a private DNS zone linked to AppSubnet.

Answer

Create an NSG rule on AppSubnet to allow outbound TCP 1433 traffic to the SQL server's public IP address.

Answer

Publish the AppSubnet public IP address range in the SQL server firewall as an allow list.

Question 10

A finance operations team manages virtual machines in RG-App. They must start, stop, deallocate, and view VM properties for any VM in that resource group. They must not be able to delete VMs, read NIC settings, or manage disks. What should the administrator do?

Accepted Answer

Create a custom role with only the required VM actions and assign it at the RG-App scope.. Option B is correct because the required permissions (start, stop, deallocate, view properties) are a subset of the built-in Virtual Machine Contributor role, but that role also includes delete and other management actions. A custom role allows you to grant only the specific Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/read permissions, while explicitly excluding delete, NIC read, and disk management actions. Assigning this custom role at the RG-App scope ensures the team can manage VMs without broader access.

Answer

Assign the built-in Virtual Machine Contributor role at the subscription scope.

Answer

Assign the built-in Reader role at the RG-App scope and let the team use portal buttons.

Answer

Assign the built-in Contributor role at the resource group scope.

Question 11

A finance team stores PDF statements in Azure Blob Storage. The workload must survive a zone failure in the primary region, and if the entire region becomes unavailable, auditors still need read-only access to the copies in the secondary region. Which redundancy option should you choose?

Accepted Answer

RA-GZRS, because it combines zone redundancy with geo-replication and read access to the secondary region.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it combines zone redundancy (synchronous replication across Azure availability zones within the primary region) with geo-replication (asynchronous replication to a secondary region), and crucially enables read access to the secondary region even when the primary is unavailable. This meets the requirement to survive a zone failure (via ZRS) and provide read-only access during a full regional outage (via the read-access geo-replication endpoint).

Answer

ZRS, because it keeps copies across zones but does not replicate to another region.

Answer

LRS, because it keeps three copies in a single datacenter and is sufficient for regional resilience.

Answer

GRS, because it provides geo-replication and always allows direct reads from the secondary region.

Question 12

A Windows VM must install IIS after provisioning and then run a script that registers the server with an internal API by using the VM's managed identity. The same steps must run automatically whenever the VM is deployed from Bicep. What should be added to the deployment?

Accepted Answer

A Custom Script Extension on the VM. The Custom Script Extension (CSE) is the correct choice because it allows you to run PowerShell or Bash scripts on an Azure VM after provisioning, enabling the installation of IIS and execution of a registration script that leverages the VM's managed identity. Since the requirement specifies that these steps must run automatically whenever the VM is deployed from Bicep, the CSE can be declared as a resource in the Bicep template, ensuring it executes on every deployment. This directly addresses the need for post-deployment configuration without manual intervention.

Answer

A read-only resource lock on the VM resource group

Answer

An availability set containing the VM

Answer

A proximity placement group for the VM

Question 13

A release team needs to deploy the same hardened Windows image to VMs in three regions. They must keep approved versions, replicate images to each region, and be able to roll back to an earlier approved version without uploading a new VHD. What should they use as the image source?

Accepted Answer

An Azure Compute Gallery image definition with image versions. Azure Compute Gallery (formerly Shared Image Gallery) allows you to store multiple versions of a custom image definition, replicate them across regions, and manage rollbacks by simply changing which image version is referenced during deployment. This meets all requirements: hardened Windows image, multi-region replication, version control, and rollback without uploading a new VHD.

Answer

A managed disk snapshot captured from one reference VM

Answer

A single unmanaged VHD stored in a storage account

Answer

A custom script extension that installs the operating system settings after deployment

Question 14

A hub VNet already has a VPN gateway connected to on-premises. A spoke VNet must send on-premises traffic through the hub gateway without deploying its own gateway. Which peering settings are needed?

Accepted Answer

Enable gateway transit on the hub peering and use remote gateways on the spoke peering.. Option B is correct because it enables gateway transit on the hub-side peering connection and uses remote gateways on the spoke-side peering connection. This configuration allows the spoke VNet to route on-premises traffic through the hub's VPN gateway without deploying its own gateway, leveraging the hub as a transit point.

Answer

Enable forwarded traffic on both peerings and add a route table to the spoke subnet.

Answer

Create a private endpoint in the spoke VNet and route on-premises traffic through it.

Answer

Deploy a second VPN gateway in the spoke and connect it in active-active mode.

Question 15

After applying a custom image, a VM boots to a black screen with a blinking cursor. The OS never reaches the login prompt. The administrator needs the fastest way to inspect the boot process and view serial console output. What should be enabled or checked?

Accepted Answer

Boot diagnostics. Boot diagnostics captures serial console output and screenshots of the VM during boot. When a VM boots to a black screen with a blinking cursor, the serial console log provides the exact kernel or bootloader messages (e.g., GRUB, initramfs errors) without requiring OS-level access. This is the fastest way to inspect the boot process because it works even when the OS is unresponsive.

Answer

Azure Monitor metrics for the VM

Answer

Network watcher packet capture

Answer

Azure Advisor recommendations

Question 16

A Linux VM restarts after a configuration change and now stops before the sign-in prompt. The administrator cannot use SSH. Which Azure feature should be checked first to inspect the startup process?

Accepted Answer

Boot diagnostics. Boot diagnostics captures serial console output and screenshots of the VM, allowing you to view kernel messages, boot logs, and the exact point where the startup process halts. Since SSH is unavailable and the VM stops before the sign-in prompt, this is the first Azure feature to check for troubleshooting the boot sequence.

Answer

Network Watcher packet capture

Answer

Azure Advisor

Answer

Managed identity

Question 17

A security team needs platform logs and metrics from an Azure Key Vault to be searchable later in a Log Analytics workspace so they can investigate administrative changes and access trends. What should you configure on the Key Vault?

Accepted Answer

A diagnostic setting that sends logs and metrics to the workspace. A diagnostic setting on Azure Key Vault allows you to stream platform logs (e.g., AuditEvent) and metrics (e.g., ServiceApiHit) to a Log Analytics workspace. This makes the data searchable via KQL queries for investigating administrative changes and access trends, fulfilling the security team's requirement.

Answer

Azure Monitor private link scope

Answer

An activity log alert on the subscription only

Answer

A resource lock on the Key Vault

Question 18

A hub VNet has a VPN gateway connected to on-premises networks. A new spoke VNet must reach on-premises resources through the existing hub gateway without deploying another gateway. What peering configuration should the administrator use?

Accepted Answer

Enable gateway transit on the hub peering and use remote gateways on the spoke peering.. Option B is correct because it enables the hub VNet's VPN gateway to be shared with the spoke VNet without deploying a separate gateway. 'Gateway transit' on the hub peering allows the hub to advertise routes from its VPN gateway to the spoke, while 'Use remote gateways' on the spoke peering allows the spoke to use the hub's gateway for outbound traffic to on-premises. This configuration ensures the spoke can reach on-premises resources through the hub's VPN tunnel.

Answer

Enable forwarded traffic on both peerings and create a route table in the spoke.

Answer

Deploy a private endpoint in the spoke for each on-premises subnet.

Answer

Create a service endpoint on the spoke subnet for Microsoft.Network.

Question 19

An application runs on two identical VMs in a region that does not support availability zones. The app must keep running through planned maintenance and a single hardware fault, and the team does not want to add a second region. Which two deployment choices are appropriate? Select two.

Accepted Answer

Place the VMs in an availability set.. A is correct because an availability set distributes VMs across multiple fault domains (up to 3) and update domains (up to 20) within the same datacenter. This ensures that during planned maintenance (update domain isolation) or a hardware fault (fault domain isolation), at least one VM remains available, meeting the requirement without needing availability zones or a second region.

Answer

Put both VMs in the same fault domain to simplify patching.

Answer

Deploy the workload in availability zones anyway.

Answer

Use a second Azure region for the primary failover design.

Question 20

A hub VNet already has a VPN gateway connected to on-premises networks. A new spoke VNet must reach those on-premises networks through the existing gateway without deploying another gateway. Which peering settings are required?

Accepted Answer

Enable gateway transit on the hub peering and use remote gateways on the spoke peering.. Option A is correct because to allow a spoke VNet to use the hub VNet's VPN gateway without deploying its own, you must enable 'Use remote gateways' on the spoke peering and 'Gateway transit' on the hub peering. This configuration allows the spoke to route traffic destined for on-premises networks through the hub's VPN gateway, leveraging the existing site-to-site VPN connection.

Answer

Enable forwarded traffic on both peerings and leave gateway settings disabled.

Answer

Enable use remote gateways on the hub peering and gateway transit on the spoke peering.

Answer

Create a private endpoint between the two VNets.