AZ-104 Practice Exam 61 — 20 Questions

Question 1

You are designing a containerized application deployment in Azure. Which three options must you consider when choosing between Azure Container Instances (ACI) and Azure Kubernetes Service (AKS)? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

ACI supports mounting an Azure Files share as a persistent volume.. ACI is correct because it is designed for simple, short-lived tasks or burst workloads that do not require orchestration, making it ideal for scenarios like batch processing or event-driven applications. AKS is correct because it provides built-in auto-scaling, service discovery, and rolling update capabilities, which are essential for managing complex microservices architectures. ACI is correct because it supports mounting an Azure Files share as a persistent volume, enabling stateful workloads to share data across container instances.

Answer

AKS supports only Linux-based container images and cannot run Windows containers.

Answer

AKS requires you to manage the underlying virtual machine infrastructure, including patching the OS.

Answer

ACI automatically manages container orchestration, including load balancing and scaling across nodes.

Question 2

Based on the exhibit, what should the administrator create so the storage account is reachable only by private IP from AppSubnet?

Accepted Answer

A private endpoint in AppSubnet for the storage account.. A private endpoint assigns a private IP address from the AppSubnet to the storage account, making it reachable only via private IP within that subnet. This ensures all traffic to the storage account stays within the Microsoft Azure backbone network, eliminating public internet exposure. The private endpoint uses Azure Private Link to map the storage account's PaaS resource to a network interface in the virtual network.

Answer

A service endpoint on AppSubnet for Microsoft.Storage.

Answer

A user-defined route to the storage account public IP.

Answer

An application security group that contains the storage account.

Question 3

A backend tier runs on three Azure VMs. The VMs are rebuilt frequently and receive new private IP addresses during redeployment. The administrator must allow inbound TCP 1433 from the app tier without rewriting the NSG rule each time the backend VMs change. What should be used?

Accepted Answer

An application security group referenced by the NSG rule. An application security group (ASG) allows you to group VMs logically (e.g., by tier) and reference that group in a network security group (NSG) rule. When backend VMs are rebuilt and receive new private IPs, the ASG membership is automatically updated, so the NSG rule continues to apply without manual changes. This makes ASG the correct choice for dynamic environments where IP addresses change frequently.

Answer

Individual private IP addresses assigned directly in the NSG rule

Answer

A service endpoint enabled on the subnet

Answer

A load balancer inbound NAT rule on port 1433

Question 4

An Azure subscription contains several resource groups. You need to ensure that users can create virtual machines only in regions approved by the security team. Existing noncompliant VMs can remain unchanged. What should you do?

Accepted Answer

Assign a policy that denies resources in disallowed locations.. Azure Policy can enforce organizational standards by evaluating resources for compliance. The built-in 'Not allowed locations' policy denies the creation of resources in specified regions, ensuring users can only deploy VMs in approved regions. Since the requirement is to allow existing noncompliant VMs to remain unchanged, a deny effect policy (without a 'DeployIfNotExists' or 'Modify' effect) will only affect new deployments, leaving existing resources untouched.

Answer

Apply a ReadOnly lock to each resource group.

Answer

Create an action group in Azure Monitor.

Answer

Move all existing VMs to approved regions.

Question 5

Finance wants every resource created in one production resource group to receive the tag CostCenter=FINSVC automatically, but deployments should not be blocked if a template omits the tag. Existing resources should be updated when possible. Which two actions should the administrator take? Select two.

Accepted Answer

Assign a Modify policy that adds or updates the CostCenter tag.. Option A is correct because an Azure Policy with the Modify effect can automatically add or update the CostCenter=FINSVC tag on resources created in the production resource group, and its remediation capability allows existing resources to be brought into compliance without blocking deployments. Option B is correct because after assigning a Modify policy, a remediation task is required to apply the tag to existing noncompliant resources, satisfying the requirement to update existing resources when possible. Option C is incorrect because a ReadOnly lock prevents modifications, including tag updates, and does not enforce tagging. Option D is incorrect because Reader only grants read access and has no effect on tag creation or enforcement. Option E is incorrect because an Audit policy only reports noncompliance and does not automatically add the tag or update existing resources.

Answer

Apply a ReadOnly lock to the resource group to keep tags consistent.

Answer

Assign Reader to the resource group to ensure tag visibility.

Answer

Use only an Audit policy so teams can see missing tags.

Question 6

Based on the exhibit, what should the administrator do first to restore the missing data disk?

Accepted Answer

Create a managed disk from the snapshot, then attach it to the VM.. The snapshot represents the missing data disk, not the OS disk. To restore it, you must first create a managed disk from the snapshot (using Azure CLI, PowerShell, or portal), then attach that disk to the VM. This preserves the existing VM configuration and applications without redeployment.

Answer

Recreate the VM from the marketplace image and restore applications manually.

Answer

Convert the snapshot directly into an operating system disk and replace the VM.

Answer

Increase the VM size so that Azure automatically recreates the missing disk.

Question 7

A support engineer must start, stop, and restart only one virtual machine named vm-app01. The engineer should not gain permissions on any other virtual machine in the subscription. What is the best scope for the role assignment?

Accepted Answer

The vm-app01 virtual machine resource itself.. Azure RBAC allows role assignments to be scoped to individual resources, such as a specific virtual machine. By assigning a role like 'Virtual Machine Contributor' at the vm-app01 resource scope, the support engineer will have permissions to start, stop, and restart only that VM, and no other resources in the subscription or resource group.

Answer

The entire subscription that contains vm-app01.

Answer

The resource group that contains vm-app01.

Answer

The management group that contains the subscription.

Question 8

A subnet is associated with a NAT gateway, but outbound traffic from the VMs still leaves through a network virtual appliance because the subnet has a user-defined route for 0.0.0.0/0 with next hop type Virtual appliance. The workload must use the NAT gateway for internet-bound traffic while keeping more specific routes intact. What should the administrator change?

Accepted Answer

Remove the 0.0.0.0/0 user-defined route from the subnet route table.. The NAT gateway is designed to provide outbound connectivity for VMs in the subnet, but a user-defined route (UDR) for 0.0.0.0/0 with next hop type Virtual appliance overrides the default route to the NAT gateway. By removing that UDR, the subnet's default route reverts to the system route, which directs internet-bound traffic to the NAT gateway's public IP. More specific routes (e.g., to on-premises networks) remain intact because they are not affected by the removal of the 0.0.0.0/0 route.

Answer

Disable the subnet's network security group so the NAT gateway can take effect.

Answer

Enable gateway route propagation on the route table.

Answer

Attach a public IP address to each virtual machine NIC.

Question 9

You need to suppress alert notifications for a group of virtual machines every Sunday during a planned maintenance window, without deleting the underlying alert rules. What should you configure?

Accepted Answer

Create an alert processing rule for the maintenance window.. An alert processing rule (formerly action rule) allows you to apply actions or suppress notifications for specific alert rules during defined time windows without modifying the underlying alert rules. By configuring a suppression action rule for the maintenance window (every Sunday), you can prevent notifications from being sent while the alert rules remain active and continue to evaluate conditions.

Answer

Disable diagnostic settings during the maintenance window.

Answer

Delete and recreate the alert rules every week.

Answer

Move the VMs to a different subscription on Sundays.

Question 10

An Azure Automation account runs PowerShell runbooks that must authenticate to Azure resources without embedded secrets. The automation account is recreated periodically during deployment, and the identity must continue to work after recreation without reissuing credentials. Which identity should you use?

Accepted Answer

A user-assigned managed identity.. A user-assigned managed identity (B) is the correct choice because it is an independent Azure resource that persists even when the Automation account is recreated. Unlike a system-assigned managed identity, which is tied to the lifecycle of the Automation account and is deleted when the account is deleted, a user-assigned managed identity can be reassigned to the new Automation account after recreation without requiring new credentials. This allows the runbooks to authenticate seamlessly using the same identity, avoiding embedded secrets.

Answer

A system-assigned managed identity.

Answer

A service principal with a client secret stored in Key Vault.

Answer

A shared access signature token.

Question 11

A legal team stores archived case files in Azure Blob Storage. The files are rarely read, but they must remain online and available immediately when needed. Which access tier should the administrator use?

Accepted Answer

Cool tier. The Cool tier is designed for data that is infrequently accessed but must remain online with low-latency retrieval. Archived case files that are rarely read but need immediate availability fit this profile, as Cool tier offers lower storage costs than Hot tier while still providing millisecond access times.

Answer

Hot tier

Answer

Archive tier

Answer

Premium tier

Question 12

A workload uses Azure Blob Storage for customer uploads. The team wants protection against a datacenter failure within the primary region and wants data copied to a paired region for disaster recovery, but they do not need to read from the secondary region during normal operations. Which redundancy option fits best?

Accepted Answer

GZRS. GZRS (Geo-Zone-Redundant Storage) is correct because it combines ZRS within the primary region (synchronously replicating data across three Azure availability zones) with asynchronous geo-replication to a paired secondary region. This provides protection against both a datacenter failure (via ZRS) and a full region failure (via geo-replication), while the lack of read access from the secondary during normal operations matches the requirement exactly.

Answer

ZRS

Answer

RA-GZRS

Answer

GRS

Question 13

Based on the exhibit, what does the query return?

Accepted Answer

Failed deallocate operations on virtual machines during the last 24 hours.. The query filters for 'Status' equal to 'Failed' and 'Operation' equal to 'Deallocate Virtual Machines', returning only failed deallocate operations. The time filter restricts results to the last 24 hours. Therefore, the query returns failed deallocate operations on virtual machines during the last 24 hours.

Answer

All successful deallocate operations on virtual machines during the last 24 hours.

Answer

Any operations related to starting or restarting virtual machines in the last 24 hours.

Answer

Administrative changes made only from the Azure portal in the last 24 hours.

Question 14

Based on the exhibit, which lock should the administrator apply so resources can still be updated but cannot be deleted by mistake?

Accepted Answer

CanNotDelete lock. The CanNotDelete lock (option B) is correct because it allows all operations including updates and reads, but explicitly prevents deletion of the resource. This meets the requirement that resources can still be updated but cannot be deleted by mistake. Azure resource locks operate at the scope level and override any role-based permissions, ensuring that even users with Contributor or Owner roles cannot delete the resource while the lock is active.

Answer

ReadOnly lock

Answer

Subscription lock

Answer

Management group lock

Question 15

Backend VMs are rebuilt often and get new private IP addresses. Frontend VMs must reach them only on TCP 8443, and the rule should keep working after rebuilds. Which two actions should the administrator take? Select two.

Accepted Answer

Place the backend NICs in an ASG named ASG-Backend.. An Application Security Group (ASG) allows you to group backend VMs by their NICs, regardless of their private IP addresses. When backend VMs are rebuilt and receive new IPs, the ASG membership remains intact, so NSG rules referencing the ASG continue to work without manual updates. This decouples security rules from dynamic IP addresses.

Answer

Create a static route for the backend subnet to preserve the same IPs.

Answer

Use a service endpoint between the two subnets.

Answer

Add a load balancer health probe rule on TCP 8443 only.

Question 16

A business stores audit exports in Blob Storage. The account must continue serving writes if one availability zone fails, and reporting users in the paired region must still be able to read the replicated data if the primary region becomes unavailable. Which redundancy option best meets the requirement?

Accepted Answer

RA-GZRS, because it combines zone redundancy in the primary region with read access to the secondary region.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it combines synchronous zone-redundant replication across three availability zones in the primary region (protecting against a single zone failure) with asynchronous geo-replication to a paired secondary region, and enables read access to the secondary region if the primary becomes unavailable. This satisfies both requirements: continued writes during a zone failure and readable replicated data from the paired region during a primary region outage.

Answer

ZRS, because it protects against a zone failure inside one region.

Answer

RA-GRS, because it provides read access to the secondary region but not zone redundancy.

Answer

GRS, because it keeps a full second copy in another region.

Question 17

A stateless API must run 4 to 12 identical Windows VMs, scale out automatically when average CPU stays above 70% for 10 minutes, and distribute instances to improve resiliency. Deployments are defined in Bicep. Which Azure compute service should be used?

Accepted Answer

A virtual machine scale set with autoscale enabled. A virtual machine scale set (VMSS) with autoscale enabled is the correct choice because it supports running multiple identical Windows VMs, can automatically scale out when average CPU exceeds 70% for 10 minutes, and distributes instances across fault domains and availability zones for resiliency. Bicep deployments natively define VMSS configurations, making it the ideal compute service for stateless, scalable API workloads.

Answer

A single Azure VM with an autoscale setting

Answer

An availability set with manual VM resizing

Answer

Azure Container Instances running one container per request

Question 18

A batch job fails with a blob read error after the administrator moved a 200-GB blob to the archive tier. The file must be available again within a few hours, and the administrator wants the least disruptive recovery. What should be done?

Accepted Answer

Change the blob tier to Hot or Cool and wait for the rehydration process to finish.. Moving a blob to the archive tier makes it offline; to read it, you must first rehydrate it by changing the tier to Hot or Cool. Rehydration typically completes within a few hours (up to 15 hours for archive), meeting the requirement. This is the least disruptive method as it avoids data loss or additional uploads.

Answer

Delete the archived blob and upload a new copy from backup.

Answer

Enable soft delete on the storage account and retry the read operation.

Answer

Convert the storage account to premium performance.

Question 19

Match each image or placement term to the administrator need it supports.

Accepted Answer

Availability Set: protects against rack failures. Availability Set protects against rack failures; Availability Zone protects against datacenter failures; Proximity Placement Group reduces latency; Scale Set provides auto-scaling; VNet isolates network; Load Balancer distributes traffic.

Answer

Scale Set: distributes traffic

Answer

VNet: provides auto-scaling

Answer

Load Balancer: isolates network

Question 20

A company has many subscriptions arranged under a management group named Corp. The audit team needs Reader access to every current and future subscription in Corp, and the administrator wants only one role assignment to maintain. Which two actions should be taken? Select two.

Accepted Answer

Assign Reader at the Corp management group scope.. Option A is correct because assigning the Reader role at the Corp management group scope grants inherited access to every subscription currently under that management group, satisfying the requirement for a single role assignment to maintain. Option B is correct because Azure RBAC inheritance flows from the management group down to subscriptions, so any existing or future subscription must remain (or be placed) under Corp for that single assignment to cover it. Option C is wrong because per-subscription assignments would require many role assignments, contradicting the one-assignment requirement. Option D is wrong because assigning at the tenant root would grant access far beyond Corp and removing the management group defeats the intended scope. Option E is wrong because resource-group-level assignments do not cover entire subscriptions and would require many assignments.

Answer

Assign Reader separately on each subscription.

Answer

Assign Reader at the tenant root and remove the management group.

Answer

Create a resource group for each subscription and assign Reader there.