AZ-104 Practice Exam 63 — 20 Questions

Question 1

A support engineer must start, stop, and restart only one virtual machine named vm-app01. The engineer should not gain permissions on any other virtual machine in the subscription. What is the best scope for the role assignment?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The vm-app01 virtual machine resource itself.. Azure RBAC allows role assignments to be scoped to individual resources, such as a specific virtual machine. By assigning a role like 'Virtual Machine Contributor' at the vm-app01 resource scope, the support engineer will have permissions to start, stop, and restart only that VM, and no other resources in the subscription or resource group.

Answer

The entire subscription that contains vm-app01.

Answer

The resource group that contains vm-app01.

Answer

The management group that contains the subscription.

Question 2

A branch office with a static public IP needs encrypted connectivity to an Azure virtual network so users can access private Azure VMs and internal services. The connection should support a site-to-site design and not rely on public IPs for the Azure resources themselves. Which service should the administrator deploy?

Accepted Answer

VPN gateway with a site-to-site connection. A VPN gateway with a site-to-site connection (option C) is the correct choice because it provides encrypted connectivity over the public internet between an on-premises branch office with a static public IP and an Azure virtual network. This design uses IPsec/IKE (RFC 4301) to secure traffic, and Azure resources remain private within the VNet, not requiring public IPs. The site-to-site connection establishes a tunnel from the on-premises VPN device to the Azure VPN gateway, enabling users to access private VMs and services securely.

Answer

Azure VNet peering

Answer

Service endpoint

Answer

Azure Front Door

Question 3

A subnet is associated with a NAT gateway, but outbound traffic from the VMs still leaves through a network virtual appliance because the subnet has a user-defined route for 0.0.0.0/0 with next hop type Virtual appliance. The workload must use the NAT gateway for internet-bound traffic while keeping more specific routes intact. What should the administrator change?

Accepted Answer

Remove the 0.0.0.0/0 user-defined route from the subnet route table.. The NAT gateway is designed to provide outbound connectivity for VMs in the subnet, but a user-defined route (UDR) for 0.0.0.0/0 with next hop type Virtual appliance overrides the default route to the NAT gateway. By removing that UDR, the subnet's default route reverts to the system route, which directs internet-bound traffic to the NAT gateway's public IP. More specific routes (e.g., to on-premises networks) remain intact because they are not affected by the removal of the 0.0.0.0/0 route.

Answer

Disable the subnet's network security group so the NAT gateway can take effect.

Answer

Enable gateway route propagation on the route table.

Answer

Attach a public IP address to each virtual machine NIC.

Question 4

You need to suppress alert notifications for a group of virtual machines every Sunday during a planned maintenance window, without deleting the underlying alert rules. What should you configure?

Accepted Answer

Create an alert processing rule for the maintenance window.. An alert processing rule (formerly action rule) allows you to apply actions or suppress notifications for specific alert rules during defined time windows without modifying the underlying alert rules. By configuring a suppression action rule for the maintenance window (every Sunday), you can prevent notifications from being sent while the alert rules remain active and continue to evaluate conditions.

Answer

Disable diagnostic settings during the maintenance window.

Answer

Delete and recreate the alert rules every week.

Answer

Move the VMs to a different subscription on Sundays.

Question 5

A legal team stores archived case files in Azure Blob Storage. The files are rarely read, but they must remain online and available immediately when needed. Which access tier should the administrator use?

Accepted Answer

Cool tier. The Cool tier is designed for data that is infrequently accessed but must remain online with low-latency retrieval. Archived case files that are rarely read but need immediate availability fit this profile, as Cool tier offers lower storage costs than Hot tier while still providing millisecond access times.

Answer

Hot tier

Answer

Archive tier

Answer

Premium tier

Question 6

A storage account has public network access disabled. A VM in VNet-App can reach a private endpoint for the account, but the storage name still resolves to the public IP address from the VM, and connections are denied. What should the administrator configure?

Accepted Answer

A private DNS zone for the storage blob endpoint linked to VNet-App.. When public network access is disabled on a storage account and a private endpoint is configured, the storage account's public DNS name must resolve to the private endpoint's private IP address within the virtual network. By default, the DNS name continues to resolve to the public IP address, causing connection failures. Linking a private DNS zone (privatelink.blob.core.windows.net) to VNet-App enables automatic resolution of the storage blob endpoint to the private IP address, allowing the VM to connect successfully.

Answer

A service endpoint on the subnet so the storage account uses a private IP address.

Answer

A storage account access key on the VM so the public endpoint will accept the connection.

Answer

A user-defined route sending storage traffic to the virtual network gateway.

Question 7

An administrator is deploying a site-to-site VPN gateway in Azure. The GatewaySubnet already exists, but the deployment fails because no public-facing address is available for the gateway. What is required for the gateway to deploy and accept the on-premises connection?

Accepted Answer

Create and associate a public IP address with the VPN gateway.. A site-to-site VPN gateway in Azure requires a public IP address to establish the encrypted tunnel with the on-premises VPN device. The public IP address is assigned to the gateway's frontend configuration, enabling it to send and receive IPsec/IKE traffic over the internet. Without this public-facing address, the gateway cannot be provisioned or accept the on-premises connection.

Answer

Assign a standard Load Balancer to the GatewaySubnet.

Answer

Create a private endpoint for the virtual network gateway.

Answer

Delegate the GatewaySubnet to Microsoft.Network/privateEndpoints.

Question 8

Based on the exhibit, what does the query return?

Accepted Answer

Failed deallocate operations on virtual machines during the last 24 hours.. The query filters for 'Status' equal to 'Failed' and 'Operation' equal to 'Deallocate Virtual Machines', returning only failed deallocate operations. The time filter restricts results to the last 24 hours. Therefore, the query returns failed deallocate operations on virtual machines during the last 24 hours.

Answer

All successful deallocate operations on virtual machines during the last 24 hours.

Answer

Any operations related to starting or restarting virtual machines in the last 24 hours.

Answer

Administrative changes made only from the Azure portal in the last 24 hours.

Question 9

Based on the exhibit, which lock should the administrator apply so resources can still be updated but cannot be deleted by mistake?

Accepted Answer

CanNotDelete lock. The CanNotDelete lock (option B) is correct because it allows all operations including updates and reads, but explicitly prevents deletion of the resource. This meets the requirement that resources can still be updated but cannot be deleted by mistake. Azure resource locks operate at the scope level and override any role-based permissions, ensuring that even users with Contributor or Owner roles cannot delete the resource while the lock is active.

Answer

ReadOnly lock

Answer

Subscription lock

Answer

Management group lock

Question 10

An engineering team stores build artifacts that are downloaded every day by developers for a week after release, then rarely after that. Which tier should the administrator choose for the period when the artifacts are still actively used?

Accepted Answer

Hot. The Hot tier is the correct choice for the period when build artifacts are actively used because it provides the lowest access latency and highest throughput, which is essential for daily downloads by developers. Azure Blob Storage's Hot tier is optimized for frequent access patterns (e.g., multiple times per day) and incurs no data retrieval costs, making it cost-effective for this high-access phase.

Answer

Archive

Answer

Cool

Answer

Cold

Question 11

You need to ensure that a user can view cost data for Azure resources but cannot create or modify those resources. Which built-in role should you assign at the required scope?

Accepted Answer

Reader. The correct role for viewing cost data without managing resources is Cost Management Reader or Billing Reader, neither of which is listed among the options. The Reader role does not include cost data permissions.

Answer

Owner

Answer

Contributor

Answer

User Access Administrator

Question 12

Backend VMs are rebuilt often and get new private IP addresses. Frontend VMs must reach them only on TCP 8443, and the rule should keep working after rebuilds. Which two actions should the administrator take? Select two.

Accepted Answer

Place the backend NICs in an ASG named ASG-Backend.. An Application Security Group (ASG) allows you to group backend VMs by their NICs, regardless of their private IP addresses. When backend VMs are rebuilt and receive new IPs, the ASG membership remains intact, so NSG rules referencing the ASG continue to work without manual updates. This decouples security rules from dynamic IP addresses.

Answer

Create a static route for the backend subnet to preserve the same IPs.

Answer

Use a service endpoint between the two subnets.

Answer

Add a load balancer health probe rule on TCP 8443 only.

Question 13

A business stores audit exports in Blob Storage. The account must continue serving writes if one availability zone fails, and reporting users in the paired region must still be able to read the replicated data if the primary region becomes unavailable. Which redundancy option best meets the requirement?

Accepted Answer

RA-GZRS, because it combines zone redundancy in the primary region with read access to the secondary region.. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is the correct choice because it combines synchronous zone-redundant replication across three availability zones in the primary region (protecting against a single zone failure) with asynchronous geo-replication to a paired secondary region, and enables read access to the secondary region if the primary becomes unavailable. This satisfies both requirements: continued writes during a zone failure and readable replicated data from the paired region during a primary region outage.

Answer

ZRS, because it protects against a zone failure inside one region.

Answer

RA-GRS, because it provides read access to the secondary region but not zone redundancy.

Answer

GRS, because it keeps a full second copy in another region.

Question 14

A stateless API must run 4 to 12 identical Windows VMs, scale out automatically when average CPU stays above 70% for 10 minutes, and distribute instances to improve resiliency. Deployments are defined in Bicep. Which Azure compute service should be used?

Accepted Answer

A virtual machine scale set with autoscale enabled. A virtual machine scale set (VMSS) with autoscale enabled is the correct choice because it supports running multiple identical Windows VMs, can automatically scale out when average CPU exceeds 70% for 10 minutes, and distributes instances across fault domains and availability zones for resiliency. Bicep deployments natively define VMSS configurations, making it the ideal compute service for stateless, scalable API workloads.

Answer

A single Azure VM with an autoscale setting

Answer

An availability set with manual VM resizing

Answer

Azure Container Instances running one container per request

Question 15

A batch job fails with a blob read error after the administrator moved a 200-GB blob to the archive tier. The file must be available again within a few hours, and the administrator wants the least disruptive recovery. What should be done?

Accepted Answer

Change the blob tier to Hot or Cool and wait for the rehydration process to finish.. Moving a blob to the archive tier makes it offline; to read it, you must first rehydrate it by changing the tier to Hot or Cool. Rehydration typically completes within a few hours (up to 15 hours for archive), meeting the requirement. This is the least disruptive method as it avoids data loss or additional uploads.

Answer

Delete the archived blob and upload a new copy from backup.

Answer

Enable soft delete on the storage account and retry the read operation.

Answer

Convert the storage account to premium performance.

Question 16

Match each image or placement term to the administrator need it supports.

Accepted Answer

Availability Set: protects against rack failures. Availability Set protects against rack failures; Availability Zone protects against datacenter failures; Proximity Placement Group reduces latency; Scale Set provides auto-scaling; VNet isolates network; Load Balancer distributes traffic.

Answer

Scale Set: distributes traffic

Answer

VNet: provides auto-scaling

Answer

Load Balancer: isolates network

Question 17

A subnet contains several application servers. You need to allow inbound TCP 3389 only from a management subnet named Subnet-Mgmt and deny RDP from all other sources. What should you do?

Accepted Answer

Create an NSG rule allowing TCP 3389 from the Subnet-Mgmt address range and rely on the default deny afterward.. Network Security Groups (NSGs) in Azure filter traffic based on rules that are evaluated in priority order. By creating an inbound rule that allows TCP 3389 (RDP) from the Subnet-Mgmt address range, and relying on the default implicit deny rule that blocks all other inbound traffic, you effectively restrict RDP access to only the management subnet. No additional configuration is needed to deny traffic from other sources, as the default deny handles that automatically.

Answer

Create a route table that sends RDP traffic to the management subnet.

Answer

Deploy a private endpoint for each application server.

Answer

Enable service endpoints on the application subnet.

Question 18

You need to deploy 20 identical Azure virtual machines for a web application and automatically scale the number of instances based on CPU demand. Which Azure feature should you use?

Accepted Answer

A Virtual Machine Scale Set. A Virtual Machine Scale Set (VMSS) is the correct Azure feature because it allows you to deploy and manage a group of identical, load-balanced VMs that can automatically scale in or out based on CPU demand using autoscale rules. This directly meets the requirement for deploying 20 identical VMs with automatic scaling based on a performance metric like CPU utilization.

Answer

An availability set

Answer

A Recovery Services vault

Answer

Boot diagnostics

Question 19

An administrator moved old log blobs to the Archive tier last month. An auditor now needs one blob for review later today. What must happen before the blob can be opened?

Accepted Answer

Change the blob to Hot or Cool and wait for rehydration to complete. Blobs in the Archive tier are offline and cannot be read directly. To access the data, you must first change the blob's access tier to Hot or Cool (rehydrate it), which can take up to 15 hours depending on the rehydration priority. Only after rehydration completes can the blob be downloaded and opened.

Answer

Download the blob directly from the Archive tier and open it immediately

Answer

Create a snapshot of the blob and open the snapshot instead

Answer

Copy the blob to another container without changing its tier

Question 20

You need to allow RDP access from the internet to a Windows VM named VM-Admin01 in Azure. The VM already has a public IP address. Which additional configuration is required?

Accepted Answer

An NSG rule allowing inbound TCP 3389. An NSG (Network Security Group) rule allowing inbound TCP port 3389 is required to permit Remote Desktop Protocol (RDP) traffic from the internet to reach the Windows VM. Even though the VM has a public IP address, Azure NSGs act as a stateful firewall at the subnet or NIC level, and by default all inbound traffic is denied unless explicitly allowed. Without this rule, RDP connection attempts will be blocked.

Answer

A private DNS zone

Answer

A user-defined route to Azure Monitor

Answer

A blob lifecycle management rule