AZ-104 Practice Exam 64 — 20 Questions

Question 1

A Windows VM must install an agent and copy a configuration file automatically after provisioning. The administrator wants Azure to run the setup step without logging into the VM manually. Which feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

VM extension. VM extensions are the correct Azure feature to automatically install agents and apply configurations during or after provisioning without manual login. The Custom Script Extension (CSE) specifically can execute a PowerShell or Bash script to install the agent and copy the configuration file, running as a post-deployment task via Azure Resource Manager (ARM) templates, Azure CLI, or PowerShell.

Answer

Boot diagnostics

Answer

Managed disk encryption

Answer

Availability set

Question 2

An operations team wants to deploy the same set of Azure VMs every month from source control. The deployment should be readable, repeatable, and stored as code. What should they use?

Accepted Answer

Bicep template. Bicep is a domain-specific language (DSL) that uses declarative syntax to deploy Azure resources as code. It provides readability, repeatability, and version control integration, making it ideal for deploying the same set of VMs monthly from source control. Unlike ARM templates, Bicep offers cleaner syntax and modularity, but both are valid infrastructure-as-code solutions.

Answer

Manual portal deployment

Answer

Azure Advisor recommendation

Answer

Azure Resource Explorer

Question 3

A contractor from a partner company needs read-only access to one application resource group for 14 days. When the contractor leaves the project, access should be removed immediately by removing a single identity from a group. Which two actions should the administrator take? Select two.

Accepted Answer

Create an Entra ID security group for the contractor team.. Creating an Entra ID security group for the contractor team (Option A) allows the administrator to manage access centrally. By assigning the Reader role to that group at the application resource group scope (Option B), all members inherit read-only permissions. When the contractor leaves, removing their user object from the group immediately revokes access without needing to modify role assignments, satisfying the requirement for a single identity removal.

Answer

Assign Reader directly to the contractor's user object at the subscription scope.

Answer

Assign Contributor at the resource group scope and rely on discipline.

Answer

Use a resource lock to limit the contractor to read-only access.

Question 4

A compliance report must show which department and environment owns each Azure resource, even when the resources are spread across many resource groups and subscriptions. Which feature should the administrator use?

Accepted Answer

Resource tags.. Resource tags are metadata key-value pairs that can be attached to Azure resources, resource groups, and subscriptions. They allow administrators to logically organize resources by department, environment, cost center, or any custom category, and this metadata is included in compliance reports. Unlike resource group names or management groups, tags are flexible and can be applied across multiple resource groups and subscriptions, making them the correct choice for this requirement.

Answer

Resource group names only.

Answer

Management groups.

Answer

Resource locks.

Question 5

A developer has the Reader role assigned at the subscription scope. Later, the developer is assigned Contributor at the RG-Web resource group scope. Which permission is inherited by a storage account inside RG-Web?

Accepted Answer

The Contributor role from RG-Web is inherited by the storage account.. In Azure RBAC, permissions are inherited from higher scopes to lower scopes. The Contributor role assigned at the RG-Web resource group scope is inherited by all resources within that resource group, including the storage account. The Reader role from the subscription scope is also inherited, but the more permissive Contributor role at the resource group scope takes precedence for actions allowed by Contributor. Therefore, the storage account effectively has Contributor permissions.

Answer

Only the Reader role from the subscription scope is inherited by the storage account.

Answer

Neither role is inherited because storage accounts require a direct assignment.

Answer

Both roles are merged into a new custom role automatically.

Question 6

Based on the exhibit, a subscription policy must add CostCenter=042 to new resources, and deployments must not fail if the tag is missing. Which policy effect should you use?

Accepted Answer

Modify. The 'Modify' effect (option D) is correct because it can add the CostCenter=042 tag to new resources without causing deployment failures if the tag is missing. Unlike 'Deny', which blocks non-compliant resources, 'Modify' uses a 'merge' operation to add tags during resource creation or update, and its 'conflictEffect' can be set to 'audit' to allow deployments to succeed. 'Append' is not deprecated and can also add tags, but 'Modify' is the recommended effect for tag management because it supports conflict resolution and can update existing tags.

Answer

Deny

Answer

Audit

Answer

Append

Question 7

You have already deployed a Windows Server VM. After provisioning, you need to run a PowerShell script once to configure an application and create a registry setting without logging in interactively. Which Azure feature should you use?

Accepted Answer

Custom Script Extension. The Custom Script Extension (CSE) is the correct choice because it allows you to run a PowerShell script on a Windows VM after provisioning, without requiring interactive logon. It executes the script as the local system account, making it ideal for one-time configuration tasks like setting registry keys or installing applications. This aligns with the requirement to run a script once non-interactively.

Answer

cloud-init

Answer

Azure Policy

Answer

Recovery Services vault

Question 8

A team wants to restrict a storage account so only one Azure subnet can reach it. They do not need a private IP address, and they are fine with the storage account still using its public endpoint. Which configuration should the administrator use?

Accepted Answer

Enable a service endpoint on the subnet and allow that subnet in the storage account firewall.. A service endpoint extends the virtual network identity to the storage account over the public endpoint, allowing the administrator to restrict access to only traffic originating from that specific subnet via the storage account firewall. This meets the requirement of using the public endpoint while limiting access to a single Azure subnet without needing a private IP address.

Answer

Create a private endpoint and disable public network access.

Answer

Generate a user delegation SAS token and distribute it only to the subnet.

Answer

Change the redundancy setting to ZRS and enable soft delete.

Question 9

A subnet has a user-defined route for 0.0.0.0/0 that sends traffic to a network virtual appliance at 10.1.0.4. The same virtual network is peered to a hub VNet that has a system route for 10.50.16.0/20. A VM in the subnet sends traffic to 10.50.18.25. Which next hop will Azure use?

Accepted Answer

Virtual network peering, because the /20 peering route is more specific than 0.0.0.0/0.. Azure uses the most specific route (longest prefix match) to determine next hop. The destination 10.50.18.25 falls within the 10.50.16.0/20 range of the peering route, which is more specific than the 0.0.0.0/0 UDR. Therefore, the traffic is routed via the virtual network peering, not the NVA.

Answer

Internet, because the default route overrides more specific routes.

Answer

Network virtual appliance at 10.1.0.4, because user-defined routes always win over system routes.

Answer

None, because Azure disables routing when a subnet has both peering and a UDR.

Question 10

A storage account must be reachable only from resources in one Azure subnet, and traffic must use a private IP rather than the public endpoint. Which configuration should the administrator implement?

Accepted Answer

A private endpoint in the subnet. A private endpoint assigns a private IP address from the subnet to the storage account, making it accessible only via that private IP within the virtual network. This ensures traffic never traverses the public endpoint, meeting both the reachability and private IP requirements.

Answer

A service endpoint on the subnet

Answer

A shared access signature scoped to the subnet

Answer

Allow trusted Microsoft services on the storage firewall

Question 11

An administrator is deploying a site-to-site VPN gateway in Azure. The GatewaySubnet already exists, but the deployment fails because no public-facing address is available for the gateway. What is required for the gateway to deploy and accept the on-premises connection?

Accepted Answer

Create and associate a public IP address with the VPN gateway.. A site-to-site VPN gateway in Azure requires a public IP address to establish the encrypted tunnel with the on-premises VPN device. The public IP address is assigned to the gateway's frontend configuration, enabling it to send and receive IPsec/IKE traffic over the internet. Without this public-facing address, the gateway cannot be provisioned or accept the on-premises connection.

Answer

Assign a standard Load Balancer to the GatewaySubnet.

Answer

Create a private endpoint for the virtual network gateway.

Answer

Delegate the GatewaySubnet to Microsoft.Network/privateEndpoints.

Question 12

An application writes transaction logs to a storage account in a region that supports availability zones. The business wants the account to stay available if one datacenter or zone fails, but it does not need a secondary region replica. Which redundancy option should you choose?

Accepted Answer

ZRS, because it replicates synchronously across zones in the same region and survives a zone outage.. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the same region. This design ensures that if one datacenter or zone fails, the storage account remains available and durable without requiring a secondary region replica, exactly matching the business requirement.

Answer

LRS, because it keeps three copies within a single datacenter and is enough for any zone failure.

Answer

GRS, because it adds a geographically replicated secondary region for disaster recovery.

Answer

RA-GRS, because read access to the secondary region is the best protection against a zone failure.

Question 13

Based on the exhibit, which subnet prefix should be used for Subnet A so it can support about 30 VM NICs?

Accepted Answer

/26. The correct option is C, /26, because a /26 prefix provides 2^(32-26) = 64 total addresses. Azure reserves 5 IP addresses per subnet, leaving 64 - 5 = 59 usable addresses, which comfortably supports about 30 VM NICs. A /28 (option A) provides only 16 total addresses (11 usable after Azure reservations), and a /27 (option B) provides 32 total addresses (27 usable after Azure reservations), which is too small for about 30 VM NICs. A /25 (option D) provides 128 total addresses (123 usable), which would also work but is larger than necessary for this requirement, making /26 the appropriate fit.

Answer

/28

Answer

/27

Answer

/25

Question 14

You need to prevent accidental deletion of a resource group while still allowing administrators to create and modify resources inside it. Which lock should you apply?

Accepted Answer

CanNotDelete. The CanNotDelete lock prevents the resource group from being deleted while still allowing all operations (including create and modify) on resources within it. This is the correct choice because the requirement is specifically to block deletion, not to restrict modifications or read access.

Answer

ReadOnly

Answer

Delete lock

Answer

No lock and a budget alert

Question 15

You need to send an email whenever CPU utilization on VM-Prod01 exceeds 90 percent for 15 minutes. Which Azure Monitor components should you configure?

Accepted Answer

A metric alert and an action group. A metric alert monitors a specific resource metric (like CPU utilization) and triggers when a condition (e.g., >90%) is met for a given duration (15 minutes). An action group defines the notification or remediation action (e.g., sending an email). Together, they fulfill the requirement to send an email when CPU utilization exceeds 90% for 15 minutes.

Answer

An activity log alert only

Answer

A resource lock and Azure Advisor

Answer

A budget alert and a private endpoint

Question 16

Your team wants every protected Azure VM in a vault to be backed up once each day and kept for 30 days. Which Recovery Services vault setting should you configure?

Accepted Answer

A backup policy. A backup policy defines the frequency and retention duration for backups. By configuring a backup policy with a daily backup schedule and a retention period of 30 days, you ensure that each protected Azure VM in the Recovery Services vault is backed up once per day and the backups are kept for 30 days. This is the correct setting to meet the team's requirements.

Answer

A diagnostic setting

Answer

A resource lock

Answer

An action group

Question 17

Two virtual machines named VM-Web01 and VM-Web02 host the same public web application. Users on the internet must connect through a single public IP address, and incoming requests should be distributed across both VMs. What should you deploy?

Accepted Answer

A public load balancer. A public load balancer (Azure Load Balancer with a public frontend IP) is required because it provides a single public IP address for internet clients and distributes incoming traffic across the backend VMs (VM-Web01 and VM-Web02) using a configured load-balancing rule. This ensures high availability and scalability for the web application.

Answer

An internal load balancer

Answer

A private DNS zone

Answer

A Recovery Services vault

Question 18

A user accidentally deleted a file from an Azure VM. The administrator wants to recover only the deleted file from the most recent backup instead of restoring the entire VM. What should the administrator use?

Accepted Answer

File recovery from the Azure Backup restore process. Azure Backup's file-level recovery (also known as item-level restore) allows you to recover individual files or folders from a VM backup point without restoring the entire VM. This is achieved by mounting the recovery point as a drive on the same or another VM, enabling direct file copy. Option A is correct because this feature is specifically designed for granular recovery of deleted files from the most recent backup.

Answer

A new VM image

Answer

A metric alert

Answer

An NSG flow log

Question 19

Based on the exhibit, an administrator is trying to peer two VNets so workloads can communicate privately. The peering creation fails. What should the administrator do first?

Accepted Answer

Readdress one of the VNets so the address spaces no longer overlap.. VNet peering requires that the address spaces of the two virtual networks do not overlap. Overlapping address spaces cause routing conflicts and prevent the peering from being established. The administrator must readdress one of the VNets so their IP ranges are unique before retrying the peering.

Answer

Create a user-defined route in VNet-Prod to force traffic through a firewall.

Answer

Enable gateway transit on both VNets and retry the peering.

Answer

Add an NSG rule that allows traffic from the other VNet.

Question 20

A subnet has a user-defined route for 0.0.0.0/0 that sends all outbound traffic to a network virtual appliance for inspection. The business now attaches a NAT gateway to the subnet and wants internet-bound traffic to use the NAT gateway's public IP, while traffic to private corporate prefixes should still go to the appliance. What should the administrator change?

Accepted Answer

Remove the 0.0.0.0/0 UDR and add only the specific private-prefix routes that must go to the appliance.. The 0.0.0.0/0 user-defined route (UDR) sends all outbound traffic to the network virtual appliance (NVA). A NAT gateway provides outbound connectivity with a public IP, but it only takes effect when there is no explicit 0.0.0.0/0 route overriding it. By removing the 0.0.0.0/0 UDR and adding only specific private-prefix routes (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) pointing to the NVA, internet-bound traffic will use the NAT gateway (via its default route), while corporate traffic is still forced through the appliance.

Answer

Leave the route table unchanged because the NAT gateway always overrides a default UDR.

Answer

Disable source NAT on the network virtual appliance.

Answer

Create a private endpoint for internet traffic so outbound packets stay in Azure.