AZ-104 Practice Exam 62 — 20 Questions

Question 1

A subnet has an NSG with these inbound rules: priority 100 denies TCP 443 from Any, and priority 200 allows TCP 443 from an Application Security Group named WebFrontEnd. A backend VM in the subnet still does not accept traffic from the frontend tier. What should the administrator change?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Move the allow rule to a lower priority number than the deny rule.. Network Security Group (NSG) rules are evaluated in priority order, with lower numbers evaluated first. Since the deny rule has priority 100 and the allow rule has priority 200, the deny rule is evaluated first and blocks TCP 443 traffic from any source, including the WebFrontEnd Application Security Group. To allow the frontend traffic, the allow rule must be moved to a lower priority number (e.g., 90) so it is evaluated before the deny rule.

Answer

Change the allow rule source from an Application Security Group to VirtualNetwork.

Answer

Attach a user-defined route to the subnet so traffic bypasses the NSG.

Answer

Place the backend VM in a different availability set so the rule is evaluated differently.

Question 2

A 180-GB blob was moved to the Archive tier last week. A legal team now needs the file available later today for repeated review, and they are willing to pay more to shorten the wait. Which action should the administrator take first?

Accepted Answer

Rehydrate the blob to Hot tier by using High priority.. The Archive tier requires rehydration (changing the blob tier) before the data can be accessed. Rehydrating to the Hot tier with High priority is the fastest method, typically completing within 1 hour, which meets the legal team's need for later today. Standard priority rehydration can take up to 15 hours, making it too slow for the required timeline.

Answer

Rehydrate the blob to Cool tier by using Standard priority.

Answer

Copy the blob into another Archive tier container and wait for replication.

Answer

Change the storage account redundancy to ZRS so the blob becomes accessible faster.

Question 3

Based on the exhibit, what should the administrator do first to restore the missing data disk?

Accepted Answer

Create a managed disk from the snapshot, then attach it to the VM.. The snapshot represents the missing data disk, not the OS disk. To restore it, you must first create a managed disk from the snapshot (using Azure CLI, PowerShell, or portal), then attach that disk to the VM. This preserves the existing VM configuration and applications without redeployment.

Answer

Recreate the VM from the marketplace image and restore applications manually.

Answer

Convert the snapshot directly into an operating system disk and replace the VM.

Answer

Increase the VM size so that Azure automatically recreates the missing disk.

Question 4

A web application runs on three VMs in a backend subnet. The backend team wants the load balancer in the frontend tier to reach the VMs on TCP 8443, and they want the rule to keep working even if the backend VM IP addresses change. What should you use in the NSG rule?

Accepted Answer

Use an application security group for the frontend tier as the source and another ASG for the backend tier as the destination.. Application Security Groups (ASGs) allow you to define network security rules based on logical groupings of VMs, regardless of their IP addresses. By using an ASG for the frontend tier as the source and another ASG for the backend tier as the destination, the NSG rule remains valid even if backend VM IP addresses change, as ASGs are dynamically updated. This meets the requirement for the load balancer in the frontend tier to reach backend VMs on TCP 8443 without hardcoding IP addresses.

Answer

Use the individual private IP addresses of each backend VM as the source.

Answer

Use the VirtualNetwork service tag for both source and destination.

Answer

Create a route table entry that sends TCP 8443 traffic to the backend subnet.

Question 5

A user deleted a file from an Azure VM, and the administrator wants to use Azure Backup file-level recovery rather than restore the whole VM. Which two prerequisites are required before mounting the recovery point from the portal? Select two.

Accepted Answer

Download the vault credentials file. Vault credentials are required to authenticate the portal session to the Recovery Services vault when performing file-level recovery. Option B is correct because you must select a specific recovery point (snapshot) from which to mount the files; the portal uses this point to create an iSCSI target on the VM.

Answer

Provide the storage account access key

Answer

Assign a public IP address to the VM

Answer

Create an Azure AD application secret

Question 6

A records team stores blobs that are read often during the first month and then rarely accessed later, but the files must stay online the whole time. Which two access tiers should they use for the active and inactive data sets? Select two.

Accepted Answer

Hot, because it is optimized for frequent reads and online access to active data.. The Hot access tier is optimized for frequent reads and provides low-latency online access, making it ideal for the active data set that is read often during the first month. Option B is correct because the Cool access tier is designed for infrequently accessed data that must remain online, with lower storage costs but higher access costs, perfectly matching the rarely accessed but always online requirement.

Answer

Archive, because it is best for data that must be opened immediately by users.

Answer

Premium block blob, because it is the standard tier for long-term retention and low-cost storage.

Answer

Cold, because it is intended for data that can stay offline until someone requests it.

Question 7

Based on the exhibit, what should the administrator configure so the operations team receives an email when the VM's average CPU stays above 80% for 10 minutes?

Accepted Answer

Create an action group and attach it to the metric alert rule.. To send an email when a metric threshold is breached, you must first create an action group that defines the notification action (e.g., email, SMS). Then, when configuring the metric alert rule for 'Percentage CPU' with a condition of 'greater than 80%' for 10 minutes, you attach that action group to the alert rule. This ensures that when the alert fires, the defined email notification is sent to the operations team.

Answer

Create a diagnostic setting on the VM and send platform logs to Log Analytics.

Answer

Assign a Reader role to the operations team on the VM resource.

Answer

Enable a resource lock on the VM to prevent CPU spikes.

Question 8

Your application stores compliance documents in Azure Blob Storage. The documents must be kept in a write-once-read-many state for five years and must not be altered or removed during that time. What should you configure?

Accepted Answer

Immutable blob storage with a time-based retention policy. Immutable blob storage with a time-based retention policy enforces a write-once-read-many (WORM) state, ensuring that blobs cannot be modified or deleted for a specified retention period. This directly meets the requirement of keeping compliance documents unaltered for five years, as the policy locks the data at the storage level, overriding any user permissions or delete operations.

Answer

Blob soft delete

Answer

Blob lifecycle management to move data to Cool tier

Answer

A shared access signature

Question 9

You are designing a disaster recovery strategy for Azure Blob Storage. The storage account is configured with geo-redundant storage (GRS). Which three of the following statements about GRS and failover are true? (Choose three.)

Accepted Answer

With GRS, data is replicated asynchronously to a paired secondary region.. Geo-redundant storage (GRS) replicates data asynchronously to a paired secondary region, ensuring durability even during a regional outage. In such an outage, you can initiate a customer-managed failover to promote the secondary region as the new primary. GRS maintains three copies (LRS) in the primary region and three additional copies in the secondary region, providing six total replicas.

Answer

After a failover, the secondary region becomes the new primary and replication to the original primary is automatically established.

Answer

Once a failover is completed, you cannot fail back to the original primary region.

Answer

GRS guarantees zero data loss if a failover is triggered.

Question 10

A help desk analyst needs a KQL query that identifies each VM's most recent heartbeat so computers can be flagged if their last check-in is older than 20 minutes. Which two KQL elements should be used? Select two.

Accepted Answer

Query the Heartbeat table, because it stores the heartbeat records for Azure VMs.. The Heartbeat table in Azure Monitor Logs (Log Analytics) is specifically designed to store heartbeat records from Azure Monitor Agent (AMA) or the legacy Log Analytics agent. Each heartbeat record contains a TimeGenerated timestamp, making it the authoritative source for determining when a VM last reported its health status.

Answer

Join the results to AzureActivity to calculate service health.

Answer

Filter where TimeGenerated is older than 20 minutes before summarizing.

Answer

Use the Perf table because it stores heartbeat timestamps.

Question 11

A team wants an Azure Storage account to be reachable only from one subnet, but they do not want to use a private endpoint. Which two configurations should they use? Select two.

Accepted Answer

Enable a Microsoft.Storage service endpoint on the subnet so the subnet can reach the storage service privately over the Azure backbone.. Enabling a Microsoft.Storage service endpoint on the subnet extends the virtual network identity to the storage service, allowing traffic from that subnet to reach the storage account over the Azure backbone network without using a public IP. This ensures private connectivity from the subnet to the storage account while keeping the storage account's public endpoint enabled but restricted.

Answer

Create a private endpoint and leave the firewall open to all networks so the subnet can be filtered later.

Answer

Assign Contributor on the storage account to the subnet, because Azure roles control which networks can connect.

Answer

Disable the public endpoint and rely on Internet routing, because that is the only way to limit access to one subnet.

Question 12

You want to let a support engineer restart only the virtual machines in the Prod-Apps resource group, and any VM added later to that group should also be covered. Where should you assign the role?

Accepted Answer

At the Prod-Apps resource group scope, because the assignment will inherit to all VMs in that group.. Assigning the 'Virtual Machine Contributor' role at the Prod-Apps resource group scope ensures that the support engineer can restart all current and future VMs within that group. Role assignments in Azure RBAC are inherited by all child resources, so any VM added later to the resource group automatically receives the same permissions. This is the most efficient and maintainable approach for managing access to a dynamic set of resources.

Answer

At the subscription scope, because it will cover the resource group and future VMs.

Answer

At each VM resource scope, because role assignments never inherit.

Answer

At the management group scope, because it is the only scope that applies to VMs.

Question 13

A media archive contains video files that are accessed only a few times per year, but they must remain online and readable immediately whenever an investigator requests them. Which blob access tier should the administrator choose to minimize storage cost?

Accepted Answer

Cold. The Cold tier is the correct choice because it provides online, immediately readable storage for data accessed only a few times per year, while offering lower storage costs than the Cool tier. Unlike the Archive tier, Cold tier data does not require a rehydration delay, ensuring instant access for investigators.

Answer

Hot

Answer

Cool

Answer

Archive

Question 14

You are designing a containerized application deployment in Azure. Which three options must you consider when choosing between Azure Container Instances (ACI) and Azure Kubernetes Service (AKS)? (Choose three.)

Accepted Answer

AKS provides built-in auto-scaling, service discovery, and rolling update capabilities.. ACI is correct because it is designed for simple, short-lived tasks or burst workloads that do not require orchestration, making it ideal for scenarios like batch processing or event-driven applications. AKS is correct because it provides built-in auto-scaling, service discovery, and rolling update capabilities, which are essential for managing complex microservices architectures. ACI is correct because it supports mounting an Azure Files share as a persistent volume, enabling stateful workloads to share data across container instances.

Answer

AKS supports only Linux-based container images and cannot run Windows containers.

Answer

ACI automatically manages container orchestration, including load balancing and scaling across nodes.

Answer

AKS requires you to manage the underlying virtual machine infrastructure, including patching the OS.

Question 15

Based on the exhibit, what should the administrator create so the storage account is reachable only by private IP from AppSubnet?

Accepted Answer

A private endpoint in AppSubnet for the storage account.. A private endpoint assigns a private IP address from the AppSubnet to the storage account, making it reachable only via private IP within that subnet. This ensures all traffic to the storage account stays within the Microsoft Azure backbone network, eliminating public internet exposure. The private endpoint uses Azure Private Link to map the storage account's PaaS resource to a network interface in the virtual network.

Answer

A service endpoint on AppSubnet for Microsoft.Storage.

Answer

A user-defined route to the storage account public IP.

Answer

An application security group that contains the storage account.

Question 16

A backend tier runs on three Azure VMs. The VMs are rebuilt frequently and receive new private IP addresses during redeployment. The administrator must allow inbound TCP 1433 from the app tier without rewriting the NSG rule each time the backend VMs change. What should be used?

Accepted Answer

An application security group referenced by the NSG rule. An application security group (ASG) allows you to group VMs logically (e.g., by tier) and reference that group in a network security group (NSG) rule. When backend VMs are rebuilt and receive new private IPs, the ASG membership is automatically updated, so the NSG rule continues to apply without manual changes. This makes ASG the correct choice for dynamic environments where IP addresses change frequently.

Answer

Individual private IP addresses assigned directly in the NSG rule

Answer

A service endpoint enabled on the subnet

Answer

A load balancer inbound NAT rule on port 1433

Question 17

A subnet uses a user-defined route that sends 0.0.0.0/0 to a firewall appliance. One server in the subnet must download updates directly from 40.90.10.25 over the Internet, while all other outbound traffic should continue through the firewall. What is the best change?

Accepted Answer

Add a more specific /32 route for 40.90.10.25 with next hop type Internet.. Adding a more specific /32 route for 40.90.10.25 with next hop type Internet overrides the default route (0.0.0.0/0) for traffic destined to that specific IP. User-defined routes (UDRs) follow the longest prefix match principle, so the /32 route takes precedence over the /0 route, allowing the server to reach the update site directly via the internet while all other outbound traffic continues through the firewall appliance.

Answer

Remove the default route so all traffic uses the system routes.

Answer

Create a service endpoint for the server and the update site.

Answer

Attach a NAT gateway to the subnet so the server can bypass the firewall.

Question 18

A contractor needs Contributor on only VM1 and VM2 in rg-prod. Other resources in rg-prod must remain untouched, and the contractor must not gain access to any other resource groups or subscriptions. Which two role-assignment scopes meet the requirement? Select two.

Accepted Answer

Assign the role at the VM1 resource scope.. Assigning the Contributor role at the VM1 resource scope grants the contractor permissions exclusively to that virtual machine, leaving all other resources in rg-prod and other scopes untouched. This meets the requirement of limiting access to only VM1 and VM2 within rg-prod.

Answer

Assign the role at the rg-prod resource group scope.

Answer

Assign the role at the subscription scope.

Answer

Assign the role at the management group scope.

Question 19

An Azure subscription contains several resource groups. You need to ensure that users can create virtual machines only in regions approved by the security team. Existing noncompliant VMs can remain unchanged. What should you do?

Accepted Answer

Assign a policy that denies resources in disallowed locations.. Azure Policy can enforce organizational standards by evaluating resources for compliance. The built-in 'Not allowed locations' policy denies the creation of resources in specified regions, ensuring users can only deploy VMs in approved regions. Since the requirement is to allow existing noncompliant VMs to remain unchanged, a deny effect policy (without a 'DeployIfNotExists' or 'Modify' effect) will only affect new deployments, leaving existing resources untouched.

Answer

Apply a ReadOnly lock to each resource group.

Answer

Create an action group in Azure Monitor.

Answer

Move all existing VMs to approved regions.

Question 20

You have already deployed a Windows Server VM. After provisioning, you need to run a PowerShell script once to configure an application and create a registry setting without logging in interactively. Which Azure feature should you use?

Accepted Answer

Custom Script Extension. The Custom Script Extension (CSE) is the correct choice because it allows you to run a PowerShell script on a Windows VM after provisioning, without requiring interactive logon. It executes the script as the local system account, making it ideal for one-time configuration tasks like setting registry keys or installing applications. This aligns with the requirement to run a script once non-interactively.

Answer

cloud-init

Answer

Azure Policy

Answer

Recovery Services vault