AZ-104 Practice Exam 62 — 20 Questions

Question 1

A subnet contains several application servers. You need to allow inbound TCP 3389 only from a management subnet named Subnet-Mgmt and deny RDP from all other sources. What should you do?

Accepted Answer

Create an NSG rule allowing TCP 3389 from the Subnet-Mgmt address range and rely on the default deny afterward.. Network Security Groups (NSGs) in Azure filter traffic based on rules that are evaluated in priority order. By creating an inbound rule that allows TCP 3389 (RDP) from the Subnet-Mgmt address range, and relying on the default implicit deny rule that blocks all other inbound traffic, you effectively restrict RDP access to only the management subnet. No additional configuration is needed to deny traffic from other sources, as the default deny handles that automatically.

Answer

Create a route table that sends RDP traffic to the management subnet.

Answer

Deploy a private endpoint for each application server.

Answer

Enable service endpoints on the application subnet.

Question 2

You need to allow RDP access from the internet to a Windows VM named VM-Admin01 in Azure. The VM already has a public IP address. Which additional configuration is required?

Accepted Answer

An NSG rule allowing inbound TCP 3389. An NSG (Network Security Group) rule allowing inbound TCP port 3389 is required to permit Remote Desktop Protocol (RDP) traffic from the internet to reach the Windows VM. Even though the VM has a public IP address, Azure NSGs act as a stateful firewall at the subnet or NIC level, and by default all inbound traffic is denied unless explicitly allowed. Without this rule, RDP connection attempts will be blocked.

Answer

A private DNS zone

Answer

A user-defined route to Azure Monitor

Answer

A blob lifecycle management rule

Question 3

Administrators need to manage Linux virtual machines that do not have public IP addresses. They want to connect from a browser without installing a VPN client. Which Azure service should they use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP/SSH connectivity to virtual machines directly from the Azure portal over TLS, without requiring public IP addresses or a VPN client. It uses a browser-based HTML5 client, making it ideal for administrators who need to manage Linux VMs without exposing them to the internet or installing additional software.

Answer

VPN Gateway

Answer

Load Balancer

Answer

Private endpoint

Question 4

A network team centralizes DHCP in a data center. Users in a remote branch stop receiving addresses after the branch router is replaced. Which missing configuration on the branch gateway is the strongest suspect?

Accepted Answer

DHCP relay or helper configuration on the client-facing gateway interface. When a DHCP server is centralized in a data center, remote clients rely on the branch gateway to forward their broadcast DHCP requests as unicast to the server. This is achieved by configuring a DHCP relay agent (ip helper-address) on the client-facing interface of the branch router. Without this configuration, DHCP broadcasts are dropped at the router, and clients never receive IP addresses.

Answer

A spanning-tree priority change on the branch switch

Answer

A CAPWAP tunnel from the branch PCs to the data center

Answer

A voice VLAN configuration on the WAN interface

Question 5

Which three of the following are valid ways to achieve high availability for a virtual machine workload running in Azure? (Choose three.)

Accepted Answer

Configure a VM Scale Set with a minimum instance count of 2 and spread across fault domains.. Deploying a VM inside an Availability Set with two or more VMs ensures high availability by placing the VMs across multiple fault domains and update domains within a single Azure datacenter. This protects against hardware failures and planned maintenance events, as at least one VM remains available during an outage or update cycle.

Answer

Assign a public IP address to each VM to enable load balancing.

Answer

Set the VM’s operating system disk to a Premium SSD tier to reduce disk latency.

Answer

Enable Azure Backup on the VM to protect against regional disasters.

Question 6

You need to ensure that all users in the HelpdeskAdmins group can reset passwords for cloud-only users in Microsoft Entra ID but cannot modify group memberships or delete users. Which role should you assign?

Accepted Answer

Helpdesk Administrator. The Helpdesk Administrator role is specifically designed to allow password resets for non-administrator users (including cloud-only users) while explicitly preventing modifications to group memberships or deletion of users. This aligns perfectly with the requirement to restrict the HelpdeskAdmins group to only password reset capabilities.

Answer

Global Administrator

Answer

User Administrator

Answer

Security Administrator

Question 7

A storage account already has a private endpoint for Blob service in a VNet. Virtual machines in AppSubnet still resolve the account name to the public endpoint, so traffic never reaches the private IP. Which two actions should the administrator take? Select two.

Accepted Answer

Create a private DNS zone for privatelink.blob.core.windows.net.. A private DNS zone for `privatelink.blob.core.windows.net` is required to override the default public DNS resolution for the storage account. When a private endpoint is created, the storage account's FQDN (e.g., `mystorageaccount.blob.core.windows.net`) must resolve to the private IP address of the endpoint within the VNet. Without this DNS zone, the VM in AppSubnet will continue to resolve the name to the public IP via Azure's public DNS servers, bypassing the private endpoint.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet.

Answer

Set the storage account firewall to Selected networks without a private endpoint.

Answer

Assign a static public IP to the private endpoint.

Question 8

A line-of-business app runs on two VMs in an Azure region that supports availability zones. The business wants protection from a datacenter failure and wants the VMs placed in different physical locations within the region. Which deployment choice should be used?

Accepted Answer

Two availability zones with one VM in each zone. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Placing one VM in each of two zones ensures that if one datacenter fails, the other VM remains available. This directly meets the requirement for protection from a datacenter failure with VMs in different physical locations.

Answer

An availability set with two fault domains

Answer

A proximity placement group for both VMs

Answer

A single larger VM size with Premium SSD

Question 9

A help desk analyst wants a query in Log Analytics that returns Azure virtual machines that have stopped sending a heartbeat for more than 15 minutes. Which KQL query should the analyst run?

Accepted Answer

Heartbeat | summarize LastSeen=max(TimeGenerated) by Computer | where LastSeen < ago(15m). The Heartbeat table in Log Analytics records a heartbeat signal from Azure Monitor agents every 5 minutes by default. The query uses `summarize` to find the latest `TimeGenerated` per computer, then filters with `where LastSeen < ago(15m)` to identify VMs that have not sent a heartbeat in over 15 minutes, indicating they are likely offline or unresponsive.

Answer

AzureActivity | where OperationNameValue contains 'Heartbeat' | summarize count() by ResourceGroup

Answer

Perf | where CounterName == '% Processor Time' | summarize avg(CounterValue) by Computer

Answer

SecurityEvent | where EventID == 4624 | summarize count() by Computer

Question 10

You need to keep Azure activity log data for longer than the default retention period and make it available for analysis. What should you configure?

Accepted Answer

Diagnostic settings for the activity log. The default retention period for Azure activity logs is 90 days. To retain activity log data beyond this period and make it available for analysis (e.g., in a Log Analytics workspace, storage account, or Event Hubs), you must configure diagnostic settings for the activity log. This allows you to stream the log data to a destination of your choice, where you can set custom retention policies.

Answer

A resource lock on the subscription

Answer

An availability zone

Answer

A scale set autoscale policy

Question 11

A user deleted several files from an Azure VM, and the administrator wants to use Azure Backup file recovery. Which two items are needed to start the recovery process? Select two.

Accepted Answer

A recovery point. Azure Backup file recovery requires a recovery point (A) because it represents the snapshot of the VM's data at a specific time from which files can be restored. The file recovery script (C) is downloaded from the Recovery Services vault and mounts the recovery point as a drive on the VM, enabling file-level access. Without both, the recovery process cannot proceed.

Answer

An application security group

Answer

A metric alert rule

Answer

A user-assigned managed identity

Question 12

A business stores audit logs in Azure Blob Storage. The account must remain available if an entire availability zone in the primary region fails, and analysts must still be able to read the data from the paired region if the primary region becomes unavailable. Which replication option should the administrator select?

Accepted Answer

Read-access geo-zone-redundant storage (RA-GZRS). C is correct because Read-access geo-zone-redundant storage (RA-GZRS) combines zone-redundancy within the primary region (surviving an entire zone failure) with geo-replication to a paired region, and crucially provides read access to the secondary region data even if the primary region is unavailable. This meets both requirements: availability during a zone failure and readable data from the paired region during a primary region outage.

Answer

Zone-redundant storage (ZRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 13

Based on the exhibit, a workload must remain available even if one datacenter in an Azure region becomes unavailable. The region supports zone deployment. What should the administrator configure?

Accepted Answer

Availability zones.. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying the workload across two or more zones ensures that if one datacenter fails, the other zones continue to operate, maintaining availability. This directly meets the requirement of surviving a single datacenter outage within a region that supports zone deployment.

Answer

An availability set.

Answer

A resource lock.

Answer

A user-defined route.

Question 14

A cloud operations team in the Corp business unit needs to read all Azure resources in every current and future subscription under the Corp management group to prepare monthly governance reports. They must not gain access to subscriptions that belong to other business units. What scope should the administrator use when assigning the Reader role?

Accepted Answer

Management group scope. The Reader role assigned at the management group scope grants read-only access to all subscriptions within that management group, including future subscriptions, because Azure RBAC permissions are inherited by child resources. This meets the requirement to cover all current and future subscriptions under the Corp management group while excluding subscriptions in other business units.

Answer

Subscription scope

Answer

Resource group scope

Answer

Resource scope

Question 15

A branch office with a fixed public IP needs encrypted access to private Azure virtual machines and internal services in a VNet. Traffic must travel across the public internet in an encrypted tunnel, and the connection should use a route-based design. What should the administrator deploy in Azure?

Accepted Answer

A VPN gateway with a site-to-site connection.. A VPN gateway with a site-to-site connection is the correct choice because it establishes an encrypted IPSec tunnel over the public internet between the branch office's fixed public IP and Azure, using a route-based (IKEv2) configuration. This allows the branch office to securely access private Azure VMs and internal services in the VNet, meeting the requirement for encrypted traffic across the internet.

Answer

An Azure Virtual Network peering connection to the branch office network.

Answer

A service endpoint on the target subnet.

Answer

An Azure private endpoint for the virtual machines.

Question 16

An administrator is comparing Azure monitoring data sources and destinations during an investigation. Match each item to the best operational use.

Accepted Answer

Activity Log: Tracks management events such as resource creation and deletion. Activity Log tracks management events; Metrics provide numeric performance data; Logs workspace enables cross-resource log analysis; Application Insights monitors app performance; Alerts trigger notifications; Workbooks combine data into dashboards.

Answer

Activity Log: Numeric performance data for resources

Answer

Metrics: Tracks management events such as resource creation and deletion

Question 17

Which statement best explains why centralized logging is valuable in security operations?

Accepted Answer

It improves visibility by collecting events from multiple devices in one place for review and investigation.. Centralized logging aggregates security events (e.g., Windows Event Log, syslog, Azure Activity Log) from multiple sources into a single repository like Azure Log Analytics or a SIEM. This consolidation enables security analysts to correlate events across devices, detect patterns indicative of attacks, and perform efficient forensic investigations without needing to access each device individually.

Answer

It guarantees that no unauthorized action can occur.

Answer

It replaces the need for NTP and authentication.

Answer

It automatically assigns IP addresses to monitoring systems.

Question 18

Users on the internet cannot access an HTTPS website hosted on VM-Web01. The VM has a public IP address, the web service is running, and the guest OS firewall allows TCP 443. What is the most likely Azure-side issue?

Accepted Answer

The NSG does not allow inbound TCP 443. The most likely Azure-side issue is that the Network Security Group (NSG) associated with the VM's subnet or NIC does not have an inbound rule allowing TCP 443. Even if the guest OS firewall permits HTTPS and the web service is running, the NSG acts as a distributed firewall that filters traffic at the Azure network boundary. Without an explicit inbound security rule for TCP 443, all HTTPS traffic from the internet is dropped before reaching the VM.

Answer

The VM uses managed disks

Answer

Azure Backup is not enabled

Answer

The storage account uses the Cool tier

Question 19

An engineering team stores build artifacts that are downloaded every day by developers for a week after release, then rarely after that. Which tier should the administrator choose for the period when the artifacts are still actively used?

Accepted Answer

Hot. The Hot tier is the correct choice for the period when build artifacts are actively used because it provides the lowest access latency and highest throughput, which is essential for daily downloads by developers. Azure Blob Storage's Hot tier is optimized for frequent access patterns (e.g., multiple times per day) and incurs no data retrieval costs, making it cost-effective for this high-access phase.

Answer