AZ-104 Practice Exam 64 — 20 Questions

Question 1

Administrators need to manage Linux virtual machines that do not have public IP addresses. They want to connect from a browser without installing a VPN client. Which Azure service should they use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP/SSH connectivity to virtual machines directly from the Azure portal over TLS, without requiring public IP addresses or a VPN client. It uses a browser-based HTML5 client, making it ideal for administrators who need to manage Linux VMs without exposing them to the internet or installing additional software.

Answer

VPN Gateway

Answer

Load Balancer

Answer

Private endpoint

Question 2

A developer wants to give one Azure VM access to Azure Storage now, and that identity should be removed automatically if the VM is deleted. Which identity type should the administrator assign?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is tied directly to the lifecycle of the Azure VM. When the VM is deleted, Azure automatically removes the identity from Azure AD and revokes any associated role assignments, fulfilling the developer's requirement for automatic cleanup. This identity is created and managed by Azure without any additional administrative overhead.

Answer

A user-assigned managed identity

Answer

A storage account SAS token

Answer

An NSG service tag

Question 3

A network team centralizes DHCP in a data center. Users in a remote branch stop receiving addresses after the branch router is replaced. Which missing configuration on the branch gateway is the strongest suspect?

Accepted Answer

DHCP relay or helper configuration on the client-facing gateway interface. When a DHCP server is centralized in a data center, remote clients rely on the branch gateway to forward their broadcast DHCP requests as unicast to the server. This is achieved by configuring a DHCP relay agent (ip helper-address) on the client-facing interface of the branch router. Without this configuration, DHCP broadcasts are dropped at the router, and clients never receive IP addresses.

Answer

A spanning-tree priority change on the branch switch

Answer

A CAPWAP tunnel from the branch PCs to the data center

Answer

A voice VLAN configuration on the WAN interface

Question 4

Which three of the following are valid ways to achieve high availability for a virtual machine workload running in Azure? (Choose three.)

Accepted Answer

Deploy the VM inside an Availability Set with two or more VMs.. Deploying a VM inside an Availability Set with two or more VMs ensures high availability by placing the VMs across multiple fault domains and update domains within a single Azure datacenter. This protects against hardware failures and planned maintenance events, as at least one VM remains available during an outage or update cycle.

Answer

Assign a public IP address to each VM to enable load balancing.

Answer

Set the VM’s operating system disk to a Premium SSD tier to reduce disk latency.

Answer

Enable Azure Backup on the VM to protect against regional disasters.

Question 5

You need to ensure that all users in the HelpdeskAdmins group can reset passwords for cloud-only users in Microsoft Entra ID but cannot modify group memberships or delete users. Which role should you assign?

Accepted Answer

Helpdesk Administrator. The Helpdesk Administrator role is specifically designed to allow password resets for non-administrator users (including cloud-only users) while explicitly preventing modifications to group memberships or deletion of users. This aligns perfectly with the requirement to restrict the HelpdeskAdmins group to only password reset capabilities.

Answer

Global Administrator

Answer

User Administrator

Answer

Security Administrator

Question 6

A business stores audit logs in Azure Blob Storage. The account must remain available if an entire availability zone in the primary region fails, and analysts must still be able to read the data from the paired region if the primary region becomes unavailable. Which replication option should the administrator select?

Accepted Answer

Read-access geo-zone-redundant storage (RA-GZRS). C is correct because Read-access geo-zone-redundant storage (RA-GZRS) combines zone-redundancy within the primary region (surviving an entire zone failure) with geo-replication to a paired region, and crucially provides read access to the secondary region data even if the primary region is unavailable. This meets both requirements: availability during a zone failure and readable data from the paired region during a primary region outage.

Answer

Zone-redundant storage (ZRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 7

A storage account already has a private endpoint for Blob service in a VNet. Virtual machines in AppSubnet still resolve the account name to the public endpoint, so traffic never reaches the private IP. Which two actions should the administrator take? Select two.

Accepted Answer

Create a private DNS zone for privatelink.blob.core.windows.net.. A private DNS zone for `privatelink.blob.core.windows.net` is required to override the default public DNS resolution for the storage account. When a private endpoint is created, the storage account's FQDN (e.g., `mystorageaccount.blob.core.windows.net`) must resolve to the private IP address of the endpoint within the VNet. Without this DNS zone, the VM in AppSubnet will continue to resolve the name to the public IP via Azure's public DNS servers, bypassing the private endpoint.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet.

Answer

Set the storage account firewall to Selected networks without a private endpoint.

Answer

Assign a static public IP to the private endpoint.

Question 8

A spoke VM can connect to a hub VM by IP address after peering is configured, but it cannot resolve internal host names such as app01.corp.local. The hub has a DNS server at 10.50.1.4 that hosts those records. What should the administrator configure so the spoke VMs use that DNS server?

Accepted Answer

Set the spoke VNet's custom DNS server to 10.50.1.4.. The spoke VNet must be configured to use a custom DNS server to override Azure's default internal name resolution. By setting the spoke VNet's DNS server to 10.50.1.4, all VMs in the spoke will query that server for hostname resolution, including app01.corp.local. This is a VNet-level setting that applies to all VMs in the spoke, and it does not require any changes to NSGs or peering configurations.

Answer

Add an NSG rule allowing UDP and TCP port 53 between the VNets.

Answer

Create a private endpoint for the hub DNS server.

Answer

Enable remote gateways on the spoke peering.

Question 9

A company wants an Azure Storage account to be reachable privately from a virtual network. Which two statements about a private endpoint are correct? Select two.

Accepted Answer

The storage service gets a private IP address in the selected virtual network.. A private endpoint assigns the Azure Storage service a private IP address from the subnet of the selected virtual network, effectively bringing the service into the VPC-like environment. This ensures that traffic to the storage account stays within the Microsoft backbone network and never traverses the public internet, meeting private connectivity requirements.

Answer

The virtual machine that reaches the service must have its own public IP address.

Answer

A private endpoint replaces the need for any DNS configuration.

Answer

A private endpoint and a service endpoint are the same feature.

Question 10

You need to keep Azure activity log data for longer than the default retention period and make it available for analysis. What should you configure?

Accepted Answer

Diagnostic settings for the activity log. The default retention period for Azure activity logs is 90 days. To retain activity log data beyond this period and make it available for analysis (e.g., in a Log Analytics workspace, storage account, or Event Hubs), you must configure diagnostic settings for the activity log. This allows you to stream the log data to a destination of your choice, where you can set custom retention policies.

Answer

A resource lock on the subscription

Answer

An availability zone

Answer

A scale set autoscale policy

Question 11

A company wants an alert to be sent by email and SMS whenever a production virtual machine's CPU percentage goes above 80 percent. The administrator also wants the notification targets to be reusable by other alerts later. What should the administrator configure first?

Accepted Answer

An action group. An action group (B) is the correct first configuration because it defines the notification targets (email, SMS) that can be reused across multiple alert rules. In Azure Monitor, alert rules are decoupled from notification actions; you create an action group once and then reference it in any metric alert rule, including the CPU percentage threshold rule needed here. This ensures the administrator can meet the requirement for reusable notification targets.

Answer

A metric alert rule only

Answer

A service health alert

Answer

A diagnostic setting

Question 12

A user deleted several files from an Azure VM, and the administrator wants to use Azure Backup file recovery. Which two items are needed to start the recovery process? Select two.

Accepted Answer

A recovery point. Azure Backup file recovery requires a recovery point (A) because it represents the snapshot of the VM's data at a specific time from which files can be restored. The file recovery script (C) is downloaded from the Recovery Services vault and mounts the recovery point as a drive on the VM, enabling file-level access. Without both, the recovery process cannot proceed.

Answer

An application security group

Answer

A metric alert rule

Answer

A user-assigned managed identity

Question 13

A VM in a subnet cannot connect to another VM on TCP 1433. The administrator wants to confirm whether an NSG rule is blocking the flow and which rule is responsible. Which Network Watcher feature should be used?

Accepted Answer

IP flow verify. B is correct because IP flow verify is the Network Watcher feature specifically designed to test whether traffic is allowed or denied to or from a virtual machine. It checks the security rules (NSG and ASG) and returns which rule is blocking the flow, including the direction and priority. For a TCP 1433 connection failure, this tool directly identifies the blocking NSG rule.

Answer

Connection troubleshoot

Answer

Packet capture

Answer

Effective routes

Question 14

Based on the exhibit, a workload must remain available even if one datacenter in an Azure region becomes unavailable. The region supports zone deployment. What should the administrator configure?

Accepted Answer

Availability zones.. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying the workload across two or more zones ensures that if one datacenter fails, the other zones continue to operate, maintaining availability. This directly meets the requirement of surviving a single datacenter outage within a region that supports zone deployment.

Answer

An availability set.

Answer

A resource lock.

Answer

A user-defined route.

Question 15

A cloud operations team in the Corp business unit needs to read all Azure resources in every current and future subscription under the Corp management group to prepare monthly governance reports. They must not gain access to subscriptions that belong to other business units. What scope should the administrator use when assigning the Reader role?

Accepted Answer

Management group scope. The Reader role assigned at the management group scope grants read-only access to all subscriptions within that management group, including future subscriptions, because Azure RBAC permissions are inherited by child resources. This meets the requirement to cover all current and future subscriptions under the Corp management group while excluding subscriptions in other business units.

Answer

Subscription scope

Answer

Resource group scope

Answer

Resource scope

Question 16

A branch office with a fixed public IP needs encrypted access to private Azure virtual machines and internal services in a VNet. Traffic must travel across the public internet in an encrypted tunnel, and the connection should use a route-based design. What should the administrator deploy in Azure?

Accepted Answer

A VPN gateway with a site-to-site connection.. A VPN gateway with a site-to-site connection is the correct choice because it establishes an encrypted IPSec tunnel over the public internet between the branch office's fixed public IP and Azure, using a route-based (IKEv2) configuration. This allows the branch office to securely access private Azure VMs and internal services in the VNet, meeting the requirement for encrypted traffic across the internet.

Answer

An Azure Virtual Network peering connection to the branch office network.

Answer

A service endpoint on the target subnet.

Answer

An Azure private endpoint for the virtual machines.

Question 17

An administrator is comparing Azure monitoring data sources and destinations during an investigation. Match each item to the best operational use.

Accepted Answer

Activity Log: Tracks management events such as resource creation and deletion. Activity Log tracks management events; Metrics provide numeric performance data; Logs workspace enables cross-resource log analysis; Application Insights monitors app performance; Alerts trigger notifications; Workbooks combine data into dashboards.

Answer

Activity Log: Numeric performance data for resources

Answer

Metrics: Tracks management events such as resource creation and deletion

Question 18

Which statement best explains why centralized logging is valuable in security operations?

Accepted Answer

It improves visibility by collecting events from multiple devices in one place for review and investigation.. Centralized logging aggregates security events (e.g., Windows Event Log, syslog, Azure Activity Log) from multiple sources into a single repository like Azure Log Analytics or a SIEM. This consolidation enables security analysts to correlate events across devices, detect patterns indicative of attacks, and perform efficient forensic investigations without needing to access each device individually.

Answer

It guarantees that no unauthorized action can occur.

Answer

It replaces the need for NTP and authentication.

Answer

It automatically assigns IP addresses to monitoring systems.

Question 19

Users on the internet cannot access an HTTPS website hosted on VM-Web01. The VM has a public IP address, the web service is running, and the guest OS firewall allows TCP 443. What is the most likely Azure-side issue?

Accepted Answer

The NSG does not allow inbound TCP 443. The most likely Azure-side issue is that the Network Security Group (NSG) associated with the VM's subnet or NIC does not have an inbound rule allowing TCP 443. Even if the guest OS firewall permits HTTPS and the web service is running, the NSG acts as a distributed firewall that filters traffic at the Azure network boundary. Without an explicit inbound security rule for TCP 443, all HTTPS traffic from the internet is dropped before reaching the VM.

Answer

The VM uses managed disks

Answer

Azure Backup is not enabled

Answer

The storage account uses the Cool tier

Question 20

A company has 18 subscriptions under a management group named Corp. The audit team needs Reader access to all current and future subscriptions in Corp without creating one assignment per subscription. Which two statements are correct? Select two.

Accepted Answer

Assign Reader at the Corp management group scope.. Assigning the Reader role at the Corp management group scope is correct because Azure RBAC allows role assignments to be inherited by all child resources, including all current and future subscriptions under that management group. This eliminates the need to create a separate assignment per subscription, as the single assignment at the management group level applies to all subscriptions within it.

Answer

Assign Reader separately at each subscription scope.

Answer

Assign Reader at one resource group in each subscription.

Answer

Create a lock on each subscription to provide Reader access.