AZ-104 Practice Exam 61 — 20 Questions

Question 1

Based on the exhibit, which Azure Policy construct should the administrator use to deploy and manage these guardrails as one unit across the department?

Accepted Answer

Create an Azure Policy initiative and assign it at the management group scope.. An Azure Policy initiative is a collection of policy definitions designed to group related policies together for deployment as a single unit. By assigning the initiative at the management group scope, the administrator can enforce consistent guardrails across all subscriptions within that management group, ensuring centralized governance and compliance for the entire department.

Answer

Create an Azure RBAC role assignment at the management group scope.

Answer

Apply a ReadOnly lock to each subscription.

Answer

Move all resources into one resource group.

Question 2

Based on the exhibit, a stateless web app must add VM instances during business hours and remove them at night based on CPU usage. Which Azure service should the administrator deploy?

Accepted Answer

An Azure virtual machine scale set.. An Azure virtual machine scale set (VMSS) is the correct choice because it automatically scales the number of VM instances in or out based on CPU usage metrics, and it supports scheduled scaling to add instances during business hours and remove them at night. This aligns with the stateless web app requirement for elastic, automated scaling without manual intervention.

Answer

An availability set with two virtual machines.

Answer

A single Azure VM with a larger size.

Answer

A recovery services vault.

Question 3

Based on the exhibit, what should you configure so the analysts can manage group membership without granting Azure resource permissions?

Accepted Answer

Add the service desk analysts as owners of the App-Support group.. Adding the service desk analysts as owners of the App-Support group grants them the ability to manage group membership directly within Microsoft Entra ID (formerly Azure AD) without assigning any Azure RBAC permissions on resources. Group owners can add or remove members from the group, but they do not inherit any permissions to manage Azure resources like VMs or storage accounts.

Answer

Assign the service desk analysts the User Administrator role in Microsoft Entra ID.

Answer

Create separate local administrator accounts for each analyst.

Answer

Assign Contributor on the subscription to the service desk analysts.

Question 4

You have two virtual networks named VNet-Hub and VNet-Spoke1 in the same Azure region. Resources in the two VNets must communicate privately over the Microsoft backbone without using a VPN gateway. What should you configure?

Accepted Answer

VNet peering. VNet peering enables direct, private connectivity between two virtual networks in the same Azure region using the Microsoft backbone infrastructure. It does not require a VPN gateway, public IP addresses, or any internet transit, making it the correct choice for private communication between VNet-Hub and VNet-Spoke1.

Answer

A site-to-site VPN

Answer

A public load balancer

Answer

An NSG outbound deny rule

Question 5

Based on the exhibit, which identity type should be used so the on-premises build server can authenticate to Azure without using a human account password?

Accepted Answer

Service principal. A service principal is the correct identity type for an on-premises build server to authenticate to Azure without a human account password because it represents a non-human identity that can be assigned to applications, services, and automation tools. Service principals authenticate using client secrets or certificates, enabling secure, password-less authentication via OAuth 2.0 client credentials grant flow, which is ideal for automated build pipelines.

Answer

System-assigned managed identity

Answer

User-assigned managed identity

Answer

Azure Storage access key

Question 6

A company has an Azure Storage account that stores application files in Blob Storage. VMs in AppSubnet must access the blobs by using the standard storage account name, but traffic must stay private and the public endpoint must not be used. Which two actions should the administrator take? Select two.

Accepted Answer

Create a private endpoint for the blob service in AppSubnet.. A private endpoint assigns the blob service a private IP address from the AppSubnet, allowing VMs to access the storage account using the standard storage account name (e.g., mystorageaccount.blob.core.windows.net) while keeping all traffic within the Microsoft Azure backbone network and bypassing the public endpoint entirely. This satisfies the requirement that traffic must stay private and the public endpoint must not be used.

Answer

Enable a service endpoint for Microsoft.Storage on AppSubnet.

Answer

Generate a shared access signature and email it to the VMs.

Answer

Add a virtual network rule to the storage account and keep the public endpoint open.

Question 7

Which two statements accurately describe the value of centralized DHCP in enterprise networks?

Accepted Answer

It can reduce the need to maintain separate DHCP servers in every subnet or site.. Centralized DHCP can simplify operations by keeping address assignment services in a more controlled central location rather than distributing separate servers everywhere. In practical terms, this can reduce administration overhead and make policy changes easier. The tradeoff is that Layer 3 boundaries must then be handled properly so client requests can still reach the server.

This is why DHCP relay becomes important in many campus and branch designs.

Answer

It removes the need for relay across Layer 3 boundaries.

Answer

It eliminates the need for default gateways.

Answer

It is useful only on wireless networks.

Question 8

A build server hosted in a company datacenter must deploy ARM templates to a target resource group in Azure without storing a user password. The server is not running in Azure, and the team wants to authorize deployments with Azure RBAC. What should be configured?

Accepted Answer

A service principal authenticated with a certificate and assigned RBAC on the target scope. A service principal authenticated with a certificate is the correct approach because it allows non-Azure resources (like an on-premises build server) to authenticate to Azure without storing a user password. The certificate-based authentication satisfies the requirement to avoid storing a password, and assigning RBAC on the target resource group grants the service principal the necessary permissions to deploy ARM templates. This method is secure, supports automation, and aligns with Azure AD application registration best practices.

Answer

A system-assigned managed identity on the build server

Answer

A personal user account with multifactor authentication

Answer

A shared access signature for the resource group

Question 9

A business-critical application uses an Azure storage account. The company requires that data remain available even if an entire Azure region becomes unavailable. Which redundancy option should you choose?

Accepted Answer

GZRS. D (GZRS) is correct because it combines zone-redundant storage (ZRS) within a primary region with geo-redundant replication to a secondary region, ensuring data remains available even if an entire Azure region becomes unavailable. This meets the business-critical requirement for regional disaster recovery while maintaining high durability and availability.

Answer

LRS

Answer

ZRS

Answer

GRS

Question 10

A compliance report must show which department and environment owns each Azure resource, even when the resources are spread across many resource groups and subscriptions. Which feature should the administrator use?

Accepted Answer

Resource tags.. Resource tags are metadata key-value pairs that can be attached to Azure resources, resource groups, and subscriptions. They allow administrators to logically organize resources by department, environment, cost center, or any custom category, and this metadata is included in compliance reports. Unlike resource group names or management groups, tags are flexible and can be applied across multiple resource groups and subscriptions, making them the correct choice for this requirement.

Answer

Resource group names only.

Answer

Management groups.

Answer

Resource locks.

Question 11

A stateless Linux API should start with 2 instances, scale out to 6 when average CPU stays above 75 percent for 10 minutes, and scale back in when load drops. Which Azure compute resource should the administrator deploy?

Accepted Answer

A virtual machine scale set with autoscale rules.. A virtual machine scale set (VMSS) with autoscale rules is the correct choice because it natively supports scaling out and scaling in based on performance metrics like average CPU percentage. The requirement for a stateless Linux API with a minimum of 2 instances, scaling to 6 when CPU exceeds 75% for 10 minutes, and scaling back in when load drops is exactly the use case VMSS is designed for. Autoscale rules can be configured to use a scale-out and scale-in policy with a cool-down period, ensuring the application remains responsive while optimizing cost.

Answer

An availability set with manual VM resizing.

Answer

A single Standard D-series VM with scheduled shutdown.

Answer

A load balancer in front of two unmanaged VMs.

Question 12

A line-of-business app runs on two VMs in an Azure region that supports availability zones. The business wants protection from a datacenter failure and wants the VMs placed in different physical locations within the region. Which deployment choice should be used?

Accepted Answer

Two availability zones with one VM in each zone. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Placing one VM in each of two zones ensures that if one datacenter fails, the other VM remains available. This directly meets the requirement for protection from a datacenter failure with VMs in different physical locations.

Answer

An availability set with two fault domains

Answer

A proximity placement group for both VMs

Answer

A single larger VM size with Premium SSD

Question 13

You need to deploy several identical virtual machines and ensure that the failure of a single Azure host does not affect all of them. Which feature should you use?

Accepted Answer

An availability set. An availability set distributes virtual machines across multiple fault domains (physical hosts) and update domains within an Azure datacenter. By placing VMs in an availability set, you ensure that a failure of a single Azure host (fault domain) does not affect all VMs, as each VM is placed on a different physical host. This meets the requirement for isolation from a single host failure.

Answer

A proximity placement group

Answer

A private endpoint

Answer

A custom script extension

Question 14

A storage account has public network access disabled. A VM in a virtual network must access blob data privately, and the application must resolve the storage endpoint name to a private IP address. What should the administrator deploy?

Accepted Answer

A private endpoint for the storage account plus a private DNS zone linked to the virtual network. A private endpoint assigns the storage account a private IP from the VM's virtual network, enabling direct, secure access over the Microsoft backbone. A private DNS zone linked to the virtual network ensures the storage endpoint name (e.g., mystorageaccount.blob.core.windows.net) resolves to that private IP, meeting the requirement for private name resolution without relying on public DNS or hosts file entries.

Answer

A service endpoint for Microsoft.Storage and a custom hosts file entry on the VM

Answer

Allow trusted Microsoft services and keep using the public endpoint

Answer

A route table that sends traffic for the storage account's public IP to the VPN gateway

Question 15

A Python app running on an Azure VM must upload blobs to one container in a storage account. The app must not store a storage account key or SAS token on the VM. Which two actions should the administrator take? Select two.

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity on the VM allows Azure AD authentication without storing any credentials on the VM. By assigning the Storage Blob Data Contributor role to that identity at the container scope, the app can use Azure AD tokens to authenticate and upload blobs, eliminating the need for a storage account key or SAS token.

Answer

Store the storage account access key in an environment variable on the VM.

Answer

Generate a service SAS and copy it into the application configuration.

Answer

Assign the Contributor role on the resource group to the managed identity.

Question 16

Finance wants every resource created in one production resource group to receive the tag CostCenter=FINSVC automatically, but deployments should not be blocked if a template omits the tag. Existing resources should be updated when possible. Which two actions should the administrator take? Select two.

Accepted Answer

Assign a Modify policy that adds or updates the CostCenter tag.. A Modify effect policy definition can automatically add or update the CostCenter tag on resources during creation or update, without blocking deployments if the tag is missing. This satisfies the requirement that deployments should not be blocked, as the Modify effect only applies the tag rather than denying non-compliant requests.

Answer

Apply a ReadOnly lock to the resource group to keep tags consistent.

Answer

Assign Reader to the resource group to ensure tag visibility.

Answer

Use only an Audit policy so teams can see missing tags.

Question 17

A web app in Azure needs to upload files to a blob container. The development team wants the app to authenticate without storing a storage account key or password in code. Which approach should the administrator configure?

Accepted Answer

Assign a managed identity to the app and grant it storage permissions. Azure Managed Identity provides an automatically managed service principal in Azure AD, allowing the web app to authenticate to Azure Blob Storage without storing any credentials in code or configuration. By assigning the managed identity to the app and granting it the appropriate RBAC role (e.g., Storage Blob Data Contributor), the app can obtain an Azure AD token to securely access the blob container.

Answer

Embed the storage account key in the application settings

Answer

Use the public endpoint and anonymous access

Answer

Use an archive tier for the container

Question 18

You want Azure to recommend ways to reduce cost, improve performance, and strengthen security across your subscriptions. Which service should you use?

Accepted Answer

Azure Advisor. Azure Advisor is the correct service because it provides personalized recommendations across your Azure subscriptions to optimize for cost, performance, reliability, and security. It analyzes your resource configuration and usage telemetry, then generates actionable recommendations such as right-sizing underutilized VMs, enabling geo-redundant storage, or applying security rules. This directly matches the question's requirement for a unified tool that suggests improvements in all three areas.

Answer

Azure Policy

Answer

Azure Backup

Answer

Virtual network peering

Question 19

A storage account has public network access disabled. An application runs on a VM in a VNet and must access the storage account over a private IP address. The team also wants the storage name to resolve to a private address inside the VNet without changing application code. What should the administrator create?

Accepted Answer

A private endpoint for the storage account and a corresponding private DNS zone link.. A private endpoint assigns the storage account a private IP from the VNet, making it accessible over a private IP address. A corresponding private DNS zone link (e.g., privatelink.blob.core.windows.net) ensures the storage account name resolves to that private IP inside the VNet without modifying application code, meeting both requirements.

Answer

A service endpoint on the subnet and a storage account firewall rule allowing that subnet.

Answer

An account SAS token with read/write permissions for the application.

Answer

Allow trusted Microsoft services to bypass the storage firewall.

Question 20

A newly created VM must read secrets from Azure Key Vault. The solution must not store credentials on the VM, and the identity should disappear automatically when the VM is deleted. What should the administrator enable?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is automatically created and tied to the lifecycle of the Azure VM. When the VM is deleted, the identity is automatically removed, satisfying the requirement that the identity disappears. This identity can be granted access to Key Vault secrets via Azure RBAC or access policies, without storing any credentials on the VM.

Answer

User-assigned managed identity

Answer

A service principal with a stored client secret

Answer

A storage account access key