AZ-104 Practice Exam 63 — 20 Questions

Question 1

A team wants a storage option that stays available if one availability zone in the primary region fails. Which two redundancy options meet that requirement? Select two.

Accepted Answer

Zone-redundant storage (ZRS).. Zone-redundant storage (ZRS) synchronously replicates data across three Azure availability zones within the primary region. If one zone fails, the data remains accessible from the other zones, ensuring high availability without requiring failover to a secondary region.

Answer

Locally redundant storage (LRS).

Answer

Geo-redundant storage (GRS).

Answer

Read-access geo-redundant storage (RA-GRS).

Question 2

Your company hosts an internal web app in Azure App Service. Access must be limited to users connecting from the corporate virtual network over private IP addresses only. What should you configure?

Accepted Answer

A private endpoint for the web app.. A private endpoint assigns a private IP address from your virtual network to the web app, making it accessible only over the corporate network via private IPs. This ensures traffic never traverses the public internet, meeting the requirement for private IP-only access.

Answer

An App Service Environment only.

Answer

Access restrictions based on public IP ranges only.

Answer

A public load balancer in front of the web app.

Question 3

You plan to run a web application on Azure virtual machines and need protection against a single datacenter failure within an Azure region. Which deployment option should you use?

Accepted Answer

Availability zones. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying your VMs across two or more zones protects against a single datacenter failure because if one zone goes down, the application continues running in the other zone. This meets the requirement for datacenter-level fault tolerance within a single region.

Answer

An availability set only

Answer

A proximity placement group

Answer

A single VM with premium SSD

Question 4

Your company has multiple applications deployed across separate production and nonproduction subscriptions. Finance wants cost reporting by application, and each app team should manage only its own resources. Which two design choices best satisfy both requirements? Select two.

Accepted Answer

Place each application's Azure resources in a dedicated resource group.. Resource groups are the logical container for grouping Azure resources by application, enabling each app team to manage its own resources via Azure RBAC at the resource group scope. Option B is correct because tagging resources with an application or cost-center identifier allows Azure Cost Management to filter and report costs by application, satisfying the finance requirement for cost reporting by application.

Answer

Create one subscription per virtual machine to simplify chargeback reporting.

Answer

Use resource names only for cost reporting because names are always unique and queryable.

Answer

Place all applications in one management group and use it as the access boundary for each app team.

Question 5

Based on the exhibit, why does a query against AzureDiagnostics return no rows after the storage account diagnostic setting was changed?

Accepted Answer

The logs are written to resource-specific tables instead of AzureDiagnostics.. When you change a diagnostic setting for a storage account from 'AzureDiagnostics' mode to 'Resource-specific' mode, logs are no longer sent to the AzureDiagnostics table. Instead, they are written to dedicated resource-specific tables (e.g., StorageReadLogs, StorageWriteLogs). Since the query targets AzureDiagnostics, it returns no rows because the logs are now stored in the new table format.

Answer

The storage account cannot send logs to Log Analytics when public network access is disabled.

Answer

The diagnostic setting only sends metrics, not logs, to the workspace.

Answer

The workspace retention period automatically deletes all records after one hour.

Question 6

An enterprise uses one management group to contain five subscriptions for a business unit. A compliance auditor in an Entra ID group needs read-only access to every current and future resource in all five subscriptions, but must not see resources in other business units. What is the best scope for the Reader role assignment?

Accepted Answer

Assign Reader at the management group that contains the five subscriptions.. Assigning the Reader role at the management group scope grants inherited read-only access to all current and future resources within every subscription under that management group, while preventing access to resources in other business units that are in separate management groups. This satisfies the auditor's requirement for a single, scalable assignment that automatically covers new subscriptions added to the management group.

Answer

Assign Reader separately at each subscription in the business unit.

Answer

Assign Reader at a single resource group within one subscription.

Answer

Assign Reader directly to each resource that the auditor should see.

Question 7

You need to grant an external partner temporary read access to a single blob in an Azure storage account without giving access to the account key. What should you create?

Accepted Answer

A shared access signature (SAS). A shared access signature (SAS) is the correct solution because it provides delegated, time-limited access to a specific Azure storage resource (such as a single blob) without exposing the storage account key. You can configure the SAS with read-only permissions, an expiration time, and apply it to a specific blob URL, meeting the requirement for temporary external read access.

Answer

A storage account access key

Answer

A resource lock

Answer

A private endpoint

Question 8

An administrator moved old log blobs to the Archive tier last month. An auditor now needs one blob for review later today. What must happen before the blob can be opened?

Accepted Answer

Change the blob to Hot or Cool and wait for rehydration to complete. Blobs in the Archive tier are offline and cannot be read directly. To access the data, you must first change the blob's access tier to Hot or Cool (rehydrate it), which can take up to 15 hours depending on the rehydration priority. Only after rehydration completes can the blob be downloaded and opened.

Answer

Download the blob directly from the Archive tier and open it immediately

Answer

Create a snapshot of the blob and open the snapshot instead

Answer

Copy the blob to another container without changing its tier

Question 9

A company has frontend and backend VMs in the same subnet. Security rules must allow the frontend tier to reach only the backend tier on TCP 443, without assigning rules to individual VM IP addresses. What should the administrator use in the NSG rule?

Accepted Answer

Application security groups for the frontend and backend VMs.. Application Security Groups (ASGs) allow you to group VMs logically by their application tier (e.g., frontend, backend) without relying on individual IP addresses. You can then create an NSG rule that uses the frontend ASG as the source and the backend ASG as the destination, restricting traffic to TCP 443. This meets the requirement of not assigning rules to individual VM IPs while ensuring only frontend VMs can reach backend VMs within the same subnet.

Answer

A user-defined route that sends frontend traffic to the backend subnet.

Answer

A network security group rule that references both subnets by address prefix only.

Answer

A VNet peering connection between the two tiers.

Question 10

A records team wants blobs to be replicated to a secondary region, and the secondary copy must be readable if the primary region becomes unavailable. Which redundancy option should you choose?

Accepted Answer

Read-access geo-redundant storage (RA-GRS). RA-GRS (Read-access geo-redundant storage) is correct because it provides geo-redundant replication (GRS) to a secondary region, plus read access to the secondary copy even if the primary region is unavailable. This ensures the blob data is replicated asynchronously to a paired secondary region, and the secondary endpoint can be read immediately during a primary outage, meeting the team's requirement for readable secondary copies.

Answer

Locally redundant storage (LRS)

Answer

Zone-redundant storage (ZRS)

Answer

Geo-redundant storage (GRS)

Question 11

A team manages a production VM and its supporting storage account. Match each operational requirement to the Azure Monitor component that should be configured.

Accepted Answer

Azure Monitor Metrics: Stores numerical performance data. Azure Monitor Metrics stores numerical performance data, Log Analytics enables KQL queries, Alerts notify on conditions, Workbooks provide dashboards, the Azure Monitor Agent collects guest OS logs, and Storage analytics logs capture storage access data.

Answer

Azure Monitor Metrics: Enables KQL queries against collected log data

Answer

Log Analytics: Stores numerical performance data

Question 12

Based on the exhibit, which Azure feature best meets the file-sharing requirement?

Accepted Answer

Azure File Sync, because it synchronizes local servers with a central Azure file share and keeps hot data cached.. Azure File Sync is the correct choice because it enables hybrid file sharing by synchronizing on-premises Windows file servers with a central Azure file share, while also keeping frequently accessed (hot) data cached locally for low-latency access. This directly meets the requirement to replace branch server shares with a cloud-backed solution that maintains local performance.

Answer

Azure Files only, because a cloud file share can replace every branch server share directly.

Answer

Azure Backup, because it can restore files after a WAN outage occurs.

Answer

Azure NetApp Files, because it is the only service that supports SMB access from Windows servers.

Question 13

A storage account must be reachable only from one subnet. The team does not want to deploy a private endpoint or manage private DNS zones, and they are acceptable with the storage account continuing to use its public endpoint. Which feature should be configured on the subnet?

Accepted Answer

A service endpoint for Microsoft.Storage. A service endpoint for Microsoft.Storage allows a subnet to restrict access to a storage account's public endpoint without deploying a private endpoint or managing private DNS zones. When enabled, Azure adds the subnet's identity to traffic from that subnet, and the storage account's firewall can be configured to allow only that specific subnet, keeping the public endpoint active.

Answer

A private endpoint for the storage account

Answer

A route table with a default route to the storage account

Answer

An application security group containing the subnet

Question 14

A production workload must continue running if one entire Azure datacenter in the region becomes unavailable. The region supports availability zones, and you want the strongest placement option for a single VM. What should you choose?

Accepted Answer

Availability zone. An availability zone protects against an entire datacenter failure by placing the VM in a physically separate zone within the region, each with independent power, cooling, and networking. This is the strongest placement option for a single VM because it guarantees isolation from other zones, ensuring the workload continues if one datacenter fails. Availability sets only protect against rack-level failures within the same datacenter, not a full datacenter outage.

Answer

Availability set

Answer

Proximity placement group

Answer

Managed disk snapshot

Question 15

A VM has both a default route from a VPN gateway and a user-defined route to an on-premises firewall. Traffic is still not reaching the expected next hop. The administrator wants to see the exact routes currently applied to the VM NIC. Which tool should be used?

Accepted Answer

Effective routes. Effective routes is the correct tool because it displays the actual, consolidated routing table applied to a specific network interface, including user-defined routes (UDRs), BGP routes from the VPN gateway, and system default routes. When traffic fails to reach the expected next hop despite having both a VPN default route and a UDR, the administrator must verify which route is actually active and has the highest priority (based on prefix length and route preference). Effective routes shows the exact next-hop IP and route source for each prefix, allowing the administrator to confirm whether the UDR to the on-premises firewall is being honored or overridden.

Answer

IP flow verify

Answer

Packet capture

Answer

Connection troubleshoot

Question 16

An operations team must apply three related policies to all subscriptions in a department: require a cost-center tag, allow only approved locations, and block certain VM SKUs. They want to assign and track these rules as one unit. What should they create?

Accepted Answer

An Azure Policy initiative.. An Azure Policy initiative is a collection of policy definitions designed to group related policies together for assignment and tracking as a single unit. By creating an initiative, the operations team can assign all three rules (cost-center tag, allowed locations, blocked VM SKUs) to all subscriptions in a department and track compliance at the initiative level, simplifying management and reporting.

Answer

A single Azure Policy definition containing all three rules.

Answer

A management group with no policy assignments.

Answer

An RBAC custom role with deny permissions.

Question 17

A network engineer wants device logs from routers and switches sent to a central server for long-term retention and analysis. Which service should be configured?

Accepted Answer

Syslog. Syslog is the standard protocol for sending device logs (e.g., from routers and switches) to a central server for long-term retention and analysis. It operates over UDP port 514 (or TCP 6514 for reliable delivery) and allows network devices to forward event messages to a syslog collector, which can store, filter, and analyze them. This directly meets the requirement for centralized logging and analysis.

Answer

NTP

Answer

DNS

Answer

NetFlow

Question 18

Match each network design requirement or limitation on the left with the best Azure behavior or corrective action on the right.

Accepted Answer

High availability across regions: Use multiple regions with Traffic Manager. Ly matches high availability across regions with deploying to multiple Azure regions and using Traffic Manager, which provides geo-redundancy and failover. Option B correctly matches latency-sensitive applications with performance routing, which directs traffic to the closest endpoint to minimize latency. Option C correctly matches data residency requirements with Azure Policy, which can enforce region restrictions. Option D is incorrect because autoscale handles scaling based on demand, not high availability across regions. Option E is incorrect because deploying to multiple regions with Traffic Manager is for high availability, not for reducing latency.

Answer

High availability across regions: Use autoscale

Answer

Latency-sensitive apps: Use multiple regions with Traffic Manager

Question 19

Finance, HR, and Engineering each use separate subscriptions. The compliance team wants a simple hierarchy that lets them apply governance to groups of subscriptions and produce resource ownership reports by department and environment. Which two features should the administrator use? Select two.

Accepted Answer

Management groups to organize the subscriptions into a hierarchy.. Management groups (A) are the correct Azure construct for building a hierarchy above subscriptions, so Finance, HR, and Engineering subscriptions can be nested under a department structure and inherit governance (Azure Policy, RBAC) at each level. Tags (B) are key-value metadata that let the team record department and environment on resources, enabling cost and ownership reports filtered by those values. Resource locks (C) only prevent modification or deletion of individual resources and cannot group subscriptions by business unit. Availability sets (D) are a compute construct for VM fault/update domain resiliency within a region, not an organizational grouping. Private endpoints (E) provide private network connectivity to PaaS services and do not separate or organize subscriptions.

Answer

Resource locks to group subscriptions by business unit.

Answer

Availability sets to group applications by department.

Answer

Private endpoints to separate Finance from HR.

Question 20

A VM in a subnet must send traffic to 10.50.0.0/16 through an on-premises VPN gateway, while all other destinations should use the Internet. Which route should be added to the subnet's route table?

Accepted Answer

Destination 10.50.0.0/16 with next hop type Virtual network gateway.. The VM needs to send traffic destined for 10.50.0.0/16 through the on-premises VPN gateway. Adding a user-defined route (UDR) with destination 10.50.0.0/16 and next hop type 'Virtual network gateway' forces that specific traffic to be routed over the VPN tunnel, while the default route (0.0.0.0/0) to the Internet remains unchanged, allowing all other traffic to egress via the Internet.

Answer

Destination 0.0.0.0/0 with next hop type Virtual network gateway.

Answer

Destination 10.50.0.0/16 with next hop type Service endpoint.

Answer

Destination 10.50.0.0/16 with next hop type Internet.