AZ-104 Practice Exam 63 — 20 Questions

Question 1

An organization must retain Azure Key Vault audit data for 18 months, search the data in Log Analytics, and keep a second copy if the workspace retention policy is later shortened. The operations team already has an action group for notifications. What should be configured on the Key Vault?

Accepted Answer

Create a diagnostic setting that streams AuditEvent logs to Log Analytics and a storage account.. Option B is correct because Azure Key Vault audit data is captured via the AuditEvent category in diagnostic settings. By configuring a diagnostic setting to stream AuditEvent logs to both a Log Analytics workspace (for querying and long-term retention up to 18 months) and a storage account (for a second copy independent of workspace retention policy changes), the organization meets all requirements. The existing action group is not needed for this data retention and search scenario.

Answer

Create an activity log alert and point it at the existing action group.

Answer

Create a metric alert on the Key Vault and archive the alert history.

Answer

Enable only resource metrics and rely on workspace retention for compliance.

Question 2

A storage account named stfinance01 contains critical data. Administrators must still be able to read and modify the data, but no one should be able to delete the storage account accidentally. What should you configure?

Accepted Answer

A CanNotDelete lock on stfinance01.. A CanNotDelete lock on stfinance01 prevents the storage account from being deleted while still allowing administrators to read and modify data. This lock type blocks delete operations at the resource level, but does not restrict read or write access, which is exactly what the requirement specifies.

Answer

A ReadOnly lock on stfinance01.

Answer

A policy assignment that audits storage accounts.

Answer

An NSG rule denying outbound traffic from the subnet.

Question 3

A security team needs to grant and remove RBAC access for a set of operators on resources in one resource group, but those operators must not create, modify, or delete the resources themselves. Which built-in role should be assigned?

Accepted Answer

User Access Administrator at the resource group scope.. Option C is correct because the User Access Administrator role at the resource group scope grants the ability to manage RBAC role assignments for other users on resources within that resource group, but it does not grant permissions to create, modify, or delete the resources themselves. This meets the security team's requirement to grant and remove access without allowing resource management.

Answer

Reader, because it is the most restrictive role available.

Answer

Contributor, because it can manage resources and role assignments together.

Answer

Tag Contributor, because role management and tagging are both governance tasks.

Question 4

A storage account should use a private IP address inside a virtual network, and workloads in that VNet must resolve the storage name to the private address. Which two items are required? Select two.

Accepted Answer

Create a private endpoint for the storage account in the virtual network so the service gets a private IP.. Option A is correct because a private endpoint assigns a private IP address from the virtual network to the storage account, enabling secure, direct connectivity over the Microsoft backbone without traversing the public internet. This is achieved by creating a network interface in the VNet that receives a private IP from the subnet range, which then routes traffic to the storage service via a private link.

Answer

Enable a service endpoint on the subnet, because service endpoints create a private IP for the storage service.

Answer

Assign a Reader role on the storage account, because RBAC determines the private address used by clients.

Answer

Disable the storage account firewall, because private endpoints only work when the public endpoint is open.

Question 5

A platform team must enforce three governance rules across every subscription in a management group: allowed Azure regions, required Environment tags, and approved VM sizes. They want one assignment that groups the rules together and gives a single compliance view. What should they use?

Accepted Answer

An Azure Policy initiative assigned at the management group.. An Azure Policy initiative (also known as a policy set) allows you to group multiple individual policy definitions—such as allowed regions, required tags, and approved VM sizes—into a single assignment. When assigned at the management group scope, the initiative enforces all three rules across every subscription within that group and provides a unified compliance view in the Azure Policy dashboard, meeting the team's requirement for consolidated governance.

Answer

A single RBAC role assignment at the management group.

Answer

A management lock on each subscription.

Answer

A private endpoint for Azure Resource Manager.

Question 6

A ReadOnly lock is applied to RG-App. Which two requested changes will fail because of the lock? Select two.

Accepted Answer

Resize a virtual machine to a larger SKU.. A ReadOnly lock on a resource group prevents any operations that modify existing resources or create/delete resources within that group. Resizing a VM to a larger SKU requires a write operation to the VM resource (specifically, updating the hardware profile), which is blocked by the lock. Deleting an unused public IP address is also a write operation (delete), which is blocked. Read operations, such as listing resources or viewing tags, are allowed.

Answer

List the resources currently in the resource group.

Answer

Read the current tag values on the resource group.

Answer

View the VM power state in the portal.

Question 7

A subnet has a NAT gateway attached, but outbound internet traffic from the VMs is still leaving through a network virtual appliance. The subnet's route table includes a user-defined route for 0.0.0.0/0 with the next hop set to Virtual appliance. The business wants internet traffic to use the NAT gateway while keeping any required specific routes to on-premises networks. What should the administrator do?

Accepted Answer

Remove the 0.0.0.0/0 user-defined route and keep only specific routes for private prefixes.. Option B is correct because the user-defined route (UDR) for 0.0.0.0/0 with next hop Virtual appliance is overriding the NAT gateway's default route. NAT gateways require a default route (0.0.0.0/0) with next hop 'Internet' to direct outbound traffic through them. By removing the conflicting UDR and keeping only specific routes for on-premises prefixes, the subnet will use the NAT gateway for internet traffic while maintaining connectivity to on-premises networks via the remaining UDRs.

Answer

Keep the default route and add a second NAT gateway to the subnet.

Answer

Disable network security groups on the subnet so the NAT gateway becomes active.

Answer

Set gateway route propagation to Disabled so the NAT gateway is preferred.

Question 8

A security team needs to investigate future configuration changes on a storage account and subscription-level control-plane changes in one place by using KQL. The team already created a Log Analytics workspace. What else must the administrator configure so the required logs are queryable in that workspace?

Accepted Answer

Configure diagnostic settings on the storage account and export the subscription Activity log to the same workspace.. Option B is correct because the Azure Activity log captures subscription-level control-plane events (e.g., resource creation, policy changes), and diagnostic settings on the storage account capture resource-level control-plane and data-plane changes. By exporting both to the same Log Analytics workspace, the security team can query all future configuration changes in one place using KQL, meeting the requirement without needing separate workspaces or agents.

Answer

Enable only the Azure Activity log export and skip resource diagnostic settings.

Answer

Install the Azure Monitor Agent on the storage account so it can send its own logs.

Answer

Create separate workspaces for each resource and query them independently.

Question 9

A subnet has a route table with a 0.0.0.0/0 user-defined route to an on-premises virtual appliance. The business now wants Azure VM outbound internet traffic to use a NAT gateway so the public source IP stays consistent, and the firewall appliance is no longer required for internet egress. What should the administrator do?

Accepted Answer

Remove the 0.0.0.0/0 UDR and associate the NAT gateway with the subnet.. Option B is correct because removing the 0.0.0.0/0 user-defined route (UDR) that points to the on-premises virtual appliance and associating a NAT gateway with the subnet ensures that all outbound internet traffic from Azure VMs uses the NAT gateway's public IP address. The NAT gateway automatically creates a default route (0.0.0.0/0) with a next hop type of 'Internet' for the subnet, overriding any conflicting UDRs. This provides a consistent source IP for internet egress without requiring the firewall appliance.

Answer

Keep the default route to the virtual appliance and add the NAT gateway to the subnet.

Answer

Change the route next hop to Virtual network gateway.

Answer

Create an NSG outbound rule that allows internet traffic from the subnet.

Question 10

A VM-hosted application must read blobs from an Azure Storage account without storing any secret in code or configuration. Which identity should you enable on the VM?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity (B) is the correct choice because it allows the VM to authenticate to Azure Storage without storing any credentials in code or configuration. Azure automatically manages the identity's lifecycle and provides a token that the VM can use to access the storage account via Azure AD authentication, eliminating the need for secrets.

Answer

A storage account access key

Answer

A shared access signature (SAS) token

Answer

A local administrator account on the VM

Question 11

A VM in VNet-Prod must connect to Azure SQL Database over a private IP address. The SQL server must not be reachable through its public endpoint, and the VM should resolve the server name automatically without manual DNS entries. Which three actions are required? Select three.

Accepted Answer

Create a private endpoint for the Azure SQL server in VNet-Prod.. Option A is correct because a private endpoint assigns a private IP address from VNet-Prod to the Azure SQL server, enabling connectivity over a private IP while blocking the public endpoint. This ensures the SQL server is not reachable through its public endpoint, meeting the requirement for private connectivity.

Answer

Enable a service endpoint for Microsoft.Sql on the subnet instead of using a private endpoint.

Answer

Leave public network access enabled and add the VNet as an allowed firewall rule.

Question 12

A team needs Reader access to exactly two Azure resources that are in the same resource group, and they must not gain access to other resources in that group. Which two scope choices are appropriate? Select two.

Accepted Answer

Assign the role at the storage account scope.. Assigning the Reader role at the storage account scope (Option A) grants read-only access to exactly that storage account, and no other resources in the resource group. This is because Azure RBAC scopes are hierarchical, and a role assignment at a specific resource scope limits permissions to only that resource. Therefore, this meets the requirement of providing access to exactly two resources without granting access to others in the same resource group.

Answer

Assign the role at the resource group scope.

Answer

Assign the role at the subscription scope.

Answer

Assign the role at the management group scope.

Question 13

A subnet is connected to a NAT gateway, but outbound connections to a public software update site are still leaving through a network virtual appliance. The route table contains a 0.0.0.0/0 user-defined route to the appliance, and the business wants the NAT gateway to handle internet traffic while preserving private routes to the appliance. What is the best fix?

Accepted Answer

Remove the default UDR to the appliance and leave only the private-prefix routes in place.. The 0.0.0.0/0 user-defined route (UDR) to the network virtual appliance (NVA) has a higher priority than the NAT gateway's default route, so all internet-bound traffic is forced through the appliance. Removing that UDR while keeping private-prefix routes (e.g., 10.0.0.0/8) ensures that only private traffic uses the appliance, and internet traffic follows the NAT gateway's default route. This satisfies the business requirement of using the NAT gateway for internet traffic while preserving private routes through the NVA.

Answer

Increase the priority of the NSG rules on the subnet.

Answer

Associate the NAT gateway with the virtual network instead of the subnet.

Answer

Enable service endpoints on the subnet to bypass the appliance.

Question 14

A troubleshooting team wants to investigate a storage account write failure and subscription-level role assignment changes in a single Log Analytics workspace. They want to ingest only the telemetry needed for those investigations. Which two sources should they enable? Select two.

Accepted Answer

Configure diagnostic settings on the storage account to send resource logs to the workspace.. Option A is correct because diagnostic settings on a storage account can be configured to send resource logs (such as storage write operations, including details of failed writes) to a Log Analytics workspace. This allows the team to investigate write failures directly from the storage account's telemetry.

Answer

Enable guest-level Windows event collection on a random virtual machine.

Answer

Turn on NSG flow logs for every subnet in the subscription.

Answer

Use Azure Advisor recommendations as the source of telemetry.

Question 15

An alert must start automated responses when a metric threshold is reached. Which two resources can an Azure Monitor action group invoke? Select two.

Accepted Answer

An Azure Automation runbook. Azure Monitor action groups can invoke an Azure Automation runbook to execute automated remediation or response tasks when a metric alert fires. This allows you to trigger scripts or workflows in response to specific conditions, such as scaling resources or restarting services, without manual intervention.

Answer

A virtual network peering connection

Answer

A resource lock

Answer

A storage account access tier

Question 16

An Azure VM backup job starts failing immediately after protection is enabled. The error states that the VM agent is not ready. The VM was created from a custom image and no extensions have ever installed successfully. What should the administrator verify first?

Accepted Answer

That the Azure VM Agent service is installed and running inside the guest OS.. The error 'VM agent not ready' indicates that the Azure Backup extension cannot communicate with the VM agent inside the guest OS. Since the VM was created from a custom image and no extensions have ever installed successfully, the most likely cause is that the Azure VM Agent service is not installed or not running. The agent is required for backup extensions to function, so verifying its status inside the guest OS is the first troubleshooting step.

Answer

That the Recovery Services vault is in the same resource group as the VM.

Answer

That soft delete is enabled on the vault.

Answer

That the subscription has enough free Azure Backup storage capacity.

Question 17

A support engineer needs to restart only one virtual machine named VM-App01. The engineer must not gain access to any other VM, storage account, or network resource in the resource group. At which scope should you assign the required RBAC role?

Accepted Answer

At the specific virtual machine resource scope. Option B is correct because assigning the Virtual Machine Contributor role at the specific VM resource scope (VM-App01) grants the engineer permissions to restart only that VM, with no access to other VMs, storage accounts, or network resources in the same resource group. RBAC roles applied at a narrower scope (resource level) override broader scopes and limit permissions to that exact resource.

Answer

At the management group scope that contains the subscription

Answer

At the resource group scope that contains the virtual machine

Answer

At the subscription scope that contains the resource group

Question 18

A VM suddenly stops responding, and the operations team needs to determine whether the issue is caused by a Microsoft platform problem or is isolated to that specific VM. Which two Azure portal features should be reviewed? Select two.

Accepted Answer

Service Health. Service Health (A) provides a global view of Azure platform-wide issues, such as regional outages or service degradation, that could affect multiple resources. Resource Health (B) reports the health of a specific VM instance, indicating whether the VM is available, degraded, or unavailable, and whether the issue is due to a platform event or a user-initiated action. Together, these two features allow the operations team to differentiate between a Microsoft platform problem and an isolated VM issue.

Answer

Azure Advisor

Answer

Diagnostic setting

Answer

Action group

Question 19

A web tier and API tier run in different subnets. The API subnet NSG currently has Deny-8443 from Any at priority 200 and Allow-8443-WebToApi from ASG-Web to ASG-Api at priority 300. Web requests on TCP 8443 are failing. Which two changes should the administrator make? Select two.

Accepted Answer

Move the allow rule to a lower priority number than 200.. B is correct because NSG rules are evaluated in priority order, with lower numbers having higher priority. The Deny-8443 rule at priority 200 is evaluated before the Allow-8443-WebToApi rule at priority 300, so the deny rule blocks the traffic. Moving the allow rule to a lower priority number (e.g., 100) ensures it is evaluated first, allowing the traffic. C is correct because the allow rule uses application security groups (ASGs); if the web and API NICs are not assigned to the respective ASGs, the rule will not match any traffic, effectively making it a no-op.

Answer

Move the allow rule to a higher priority number than 200.

Answer

Change the rule protocol from TCP to Any.

Answer

Attach a route table to the API subnet to override the deny behavior.

Question 20

A web workload in a subnet must use a NAT gateway for outbound internet traffic so the source IP is stable. The subnet currently has a route table with a 0.0.0.0/0 user-defined route to a virtual appliance. What should the administrator change?

Accepted Answer

Remove or replace the 0.0.0.0/0 UDR to the virtual appliance and associate the NAT gateway with the subnet.. The current route table has a 0.0.0.0/0 user-defined route (UDR) pointing to a virtual appliance, which forces all outbound traffic through that appliance. To use a NAT gateway for outbound internet traffic with a stable source IP, the administrator must remove or replace that UDR (so the default route no longer points to the appliance) and associate the NAT gateway with the subnet. The NAT gateway automatically creates a default route (0.0.0.0/0) with a next hop of 'Internet', overriding the appliance route, ensuring traffic egresses via the NAT gateway's public IP.

Answer

Add an NSG outbound allow rule for TCP 80 and TCP 443.

Answer

Create a private endpoint for the web workload.

Answer

Enable VNet peering to a hub network with a firewall.