AZ-104 Practice Exam 65 — 20 Questions

Question 1

A Windows VM and a Linux VM are both joined to the same Active Directory Domain Services domain. Which two authentication methods can be used to mount the same Azure Files share over SMB? Select two.

Accepted Answer

Storage account key. Option A (Storage account key) is correct because Azure Files SMB shares can always be mounted using the storage account name and its access key as the credential, regardless of whether the client is Windows or Linux and independent of any domain membership. Option B (Active Directory Domain Services credentials) is correct because both VMs are joined to the same AD DS domain, and Azure Files supports identity-based SMB authentication via AD DS (on-premises AD DS or Entra Domain Services) so domain users can mount the share with their Kerberos credentials. Option C (Blob SAS token) does not apply because SAS tokens are used for Azure Blob Storage REST access, not for SMB mounts of Azure Files. Option D (Network security group rule) is a network access control, not an authentication method. Option E (Azure resource lock) is a management-plane governance feature and has nothing to do with authenticating an SMB mount.

Answer

Blob SAS token

Answer

Network security group rule

Answer

Azure resource lock

Question 2

Based on the exhibit, which Azure feature should the administrator use to install software and run the bootstrap script during VM provisioning?

Accepted Answer

Azure VM Custom Script Extension. The Azure VM Custom Script Extension (CSE) is the correct feature because it allows the administrator to execute scripts (such as installing software or running a bootstrap script) during VM provisioning or after the VM is running. The extension downloads the script from Azure Storage or a public URL and executes it using the local system account, making it ideal for post-deployment configuration tasks.

Answer

A network security group rule allowing RDP from the Internet

Answer

An availability set with two fault domains

Answer

A managed disk snapshot restored as the operating system disk

Question 3

You manage an Azure virtual network with multiple subnets, including a subnet named 'AppSubnet' that hosts critical application servers. You need to monitor and log network traffic to and from AppSubnet for security analysis. The solution must capture all flow logs without impacting application performance. Which three of the following should you implement? (Choose three.)

Accepted Answer

Store the flow logs in an Azure Storage account.. Network Watcher flow logs capture IP traffic flowing through a subnet, providing security analysis without impacting performance because they are processed by the Azure network fabric, not by the VMs. Storing logs in an Azure Storage account ensures durable, cost-effective retention. Configuring a retention policy is essential to manage storage costs and comply with data lifecycle requirements.

Answer

Deploy a network virtual appliance (NVA) in a transit subnet and route all traffic through it.

Answer

Enable diagnostic settings on each virtual machine in AppSubnet to log network traffic.

Answer

Install a third-party packet capture agent on each application server.

Question 4

An application in a VNet must access an Azure Storage account over a private IP address. Public network access is disabled on the storage account, and the app must resolve the normal blob FQDN to that private address only from within the VNet. What should the administrator configure?

Accepted Answer

A private endpoint for the blob service and a linked private DNS zone for the VNet.. A private endpoint assigns the storage account a private IP from the VNet, and linking a private DNS zone (e.g., `privatelink.blob.core.windows.net`) to the VNet ensures that the blob FQDN resolves to that private IP only from within the VNet. This meets the requirement of disabling public network access while providing private connectivity and DNS resolution.

Answer

A service endpoint on the subnet and a storage account firewall rule for the subnet.

Answer

Allow trusted Microsoft services on the storage account and keep the public endpoint enabled.

Answer

Create a public DNS record that maps the blob FQDN to the storage account's public IP address.

Question 5

An NSG is associated with a subnet. It contains these inbound rules:
- Priority 100: Deny TCP 443 from Internet to Any
- Priority 200: Allow TCP 443 from 203.0.113.0/24 to Any
A tester at 203.0.113.10 browses to the VM's HTTPS endpoint in that subnet. What happens?

Accepted Answer

The request is denied because the priority 100 deny rule matches before the allow rule.. Network Security Group (NSG) rules are evaluated in priority order, from lowest to highest numeric value. The priority 100 rule explicitly denies TCP 443 from the Internet (which includes the 203.0.113.0/24 range), and it is evaluated before the priority 200 allow rule. Since the deny rule matches first, the traffic is blocked regardless of the more specific source IP in the allow rule.

Answer

The request is allowed because the more specific source range matches first.

Answer

The request is denied only if the VM has no public IP address.

Answer

The request is allowed because default NSG rules always override custom rules.

Question 6

Based on the exhibit, the company will deploy two identical web server VMs in East US 2 behind a load balancer. The service must keep running if one datacenter in the region becomes unavailable. Which deployment choice best meets the requirement?

Accepted Answer

Place one VM in each of two availability zones and front them with the load balancer.. Deploying one VM in each of two availability zones within East US 2 ensures that the VMs are physically separated across distinct datacenters, each with independent power, cooling, and networking. If one datacenter (zone) fails, the other zone remains operational, and the load balancer automatically directs traffic to the healthy VM. This meets the requirement of keeping the service running if one datacenter in the region becomes unavailable.

Answer

Place both VMs in an availability set so Azure can spread them across fault domains.

Answer

Place both VMs in one availability zone because all zones in a region share failure domains.

Answer

Deploy a single VM because Azure automatically replicates it across the region.

Question 7

A team already has a metric alert on a production VM. The alert should continue evaluating 24/7, but email notifications must be sent only Monday through Friday from 08:00 to 18:00 local time. What should the administrator add or change?

Accepted Answer

Create an alert processing rule that suppresses notifications outside business hours.. An alert processing rule (formerly action rule) can suppress notifications for a metric alert based on a schedule. By creating a rule with a suppression action that applies outside business hours (e.g., 18:00 to 08:00 and weekends), the alert continues to evaluate and fire, but email notifications are blocked during those times. This meets the requirement without altering the alert rule itself.

Answer

Replace the metric alert with a diagnostic setting and store the data in Log Analytics.

Answer

Lower the alert threshold so fewer alerts occur during the week.

Answer

Use an autoscale profile instead of an alert rule.

Question 8

Based on the exhibit, what is the best way to simplify access management for the project team?

Accepted Answer

Assign the RBAC role to an Entra ID group and manage membership there.. Assigning the RBAC role to an Entra ID group and managing membership centrally is the recommended approach because it decouples role assignments from individual user accounts. When team membership changes, you only update group membership rather than reassigning roles per user. This reduces administrative overhead and the risk of orphaned or excessive permissions, and it aligns with Azure's least-privilege and identity-governance best practices.

Answer

Keep assigning RBAC roles directly to each user account.

Answer

Create a resource lock on RG-App.

Answer

Create an Azure Policy assignment for RG-App.

Question 9

A company wants to stop users from creating resources in any Azure region except East US and West US across all subscriptions. Which Azure feature should be used to enforce this requirement?

Accepted Answer

An Azure Policy assignment with a Deny effect at the management group scope. Azure Policy with a Deny effect at the management group scope is the correct choice because it can enforce a location constraint across all subscriptions under that management group. The Deny effect prevents the creation of resources in non-compliant regions at the time of deployment, ensuring that only East US and West US are allowed. This is a governance control that applies to all subscriptions within the scope, making it the ideal solution for this requirement.

Answer

An Azure RBAC role assignment

Answer

A CanNotDelete resource lock on the subscriptions

Answer

A tag inheritance rule on the management group

Question 10

A file server VM is corrupted after a bad change. The team needs to recover the whole machine to the latest recovery point, not just one file. Which restore workflow should they use?

Accepted Answer

Restore virtual machine. Azure Backup's 'Restore virtual machine' workflow creates a new VM from the latest recovery point, restoring the entire machine state including OS, applications, and data. This is the appropriate method when the goal is to recover the full VM after corruption, as it uses the VM-level restore point stored in the Recovery Services vault.

Answer

File and folder recovery

Answer

Modify the backup policy

Answer

Create an action group

Question 11

You create a private endpoint for an Azure SQL Database server. Virtual machines in VNet-Prod must resolve the server name to the private IP address of the endpoint. What should you configure?

Accepted Answer

A private DNS zone linked to VNet-Prod. A private endpoint uses a private IP address from your VNet, but DNS resolution must be configured to map the Azure SQL Database server name (e.g., `server.database.windows.net`) to that private IP. By creating a private DNS zone (privatelink.database.windows.net) and linking it to VNet-Prod, Azure automatically creates an A record for the private endpoint, ensuring VMs resolve the server name to the private IP instead of the public IP. This is the standard and required configuration for private endpoint name resolution.

Answer

A user-defined route on the subnet

Answer

An additional public IP address

Answer

A Recovery Services vault

Question 12

A subnet has an NSG with an inbound allow rule for TCP 3389 at priority 200 and an inbound deny rule for Internet traffic at priority 100. An administrator still cannot RDP to a virtual machine in the subnet from home. What is the most likely reason?

Accepted Answer

The deny rule wins because lower priority numbers are processed first.. In Azure Network Security Groups (NSGs), rules are processed in priority order, with lower numbers evaluated first. The deny rule for Internet traffic at priority 100 is processed before the allow rule for TCP 3389 at priority 200, so the deny rule blocks the inbound RDP connection from the internet. This is why the administrator cannot RDP from home.

Answer

The allow rule is ignored because inbound rules cannot permit RDP.

Answer

NSG rules apply only to outbound traffic, so inbound traffic is unaffected.

Answer

The subnet NSG is ignored whenever the VM has a public IP address.

Question 13

Your company wants to enforce a standard list of allowed Azure regions for all new resource deployments across several subscriptions. You need a centralized governance solution that can be assigned once and inherited by the child subscriptions. What should you use?

Accepted Answer

An Azure Policy assigned at the management group scope. Azure Policy assigned at the management group scope is the correct centralized governance solution because it enforces a standard list of allowed Azure regions across all subscriptions under that management group. Policies at the management group level are inherited by all child subscriptions, ensuring consistent compliance without requiring individual assignment per subscription.

Answer

A custom RBAC role assigned at each subscription

Answer

A CanNotDelete lock on each subscription

Answer

A budget alert on each subscription

Question 14

A compliance team wants newly uploaded monthly reports to remain in the Hot tier for 90 days and then move automatically to a cheaper online tier without becoming offline. Which two configurations should the administrator use? Select two.

Accepted Answer

Create a blob lifecycle management rule.. Azure Blob Lifecycle Management rules allow administrators to automate tier transitions for blobs based on age or other conditions. Option B is correct because transitioning from Hot to Cool after 90 days meets the requirement of moving to a cheaper online tier (Cool is online and less expensive than Hot) while keeping the data accessible without becoming offline.

Answer

Transition the blobs to Archive after 90 days so they cost less than Cool.

Answer

Use file share snapshots because lifecycle rules do not apply to blobs.

Answer

Enable soft delete on the container to change access tiers automatically.

Question 15

An employee accidentally deletes a critical document from an Azure file share. You need to restore only that file to its earlier state without restoring the entire share or using a vault-based backup job. Which feature should you use?

Accepted Answer

A file share snapshot, because it captures a point-in-time copy of the share for granular recovery.. File share snapshots are point-in-time, read-only copies of Azure file shares that allow you to recover individual files or folders without restoring the entire share. When a file is accidentally deleted, you can mount a previous snapshot, copy the deleted file from it, and restore it to the live share—no vault-based backup job or full share restore required.

Answer

A storage account access key, because it can retrieve deleted files from any share version.

Answer

An Azure VM snapshot, because it captures the file share state automatically.

Answer

A private endpoint to the file share, because it enables restore operations.

Question 16

You are designing a storage solution for a large-scale data analytics application that will run in Azure. The solution needs to support high-throughput writes, hierarchical namespace for organizing data, and the ability to assign POSIX-like permissions to directories and files. Additionally, the solution must support lifecycle management policies to tier data to cooler storage tiers after 30 days and enable blob-level versioning. Which four of the following features or services should you include in your design? (Choose all that apply. There are four correct answers.)

Accepted Answer

Blob versioning. Azure Data Lake Storage Gen2 (ADLS Gen2) is the correct foundational service because it combines Azure Blob Storage with a hierarchical namespace, enabling POSIX-like access control lists (ACLs) for directories and files. This service is specifically designed for high-throughput analytics workloads, supporting both hierarchical namespace and blob-level operations. Lifecycle management policies and blob versioning are built-in Azure Blob Storage features that work seamlessly with ADLS Gen2 to automate data tiering and maintain data integrity.

Answer

Azure Files with SMB protocol

Answer

Azure NetApp Files

Question 17

An administrator needs to deploy a VM quickly using the same hardened operating system image that was approved by the security team. What should the administrator use as the source for the new VM?

Accepted Answer

A managed image. A managed image captures a fully configured, hardened OS disk (including installed software and settings) as a reusable snapshot. When deploying a new VM, specifying this managed image as the source ensures the VM boots with the exact, security-approved OS configuration, meeting the requirement for a quick, consistent deployment.

Answer

A network interface

Answer

A resource lock

Answer

A public IP address

Question 18

Central IT wants to apply three related policy definitions—allowed Azure regions, required owner tag, and approved VM sizes—to all subscriptions in the Corp management group and report compliance as one package. What should the administrator create?

Accepted Answer

An initiative. An initiative (also known as a policy set) in Azure Policy allows you to group multiple related policy definitions into a single package. By assigning the initiative to the Corp management group, all subscriptions under that management group inherit the three policies (allowed regions, required owner tag, approved VM sizes) as a bundle, and compliance is reported collectively for the entire initiative.

Answer

A resource lock

Answer

A role assignment

Answer

A managed identity

Question 19

A web app running on an Azure VM must read files from Azure Blob Storage without storing any passwords, secrets, or access keys on the VM. The identity should be tied to that VM and removed automatically if the VM is deleted. What should you enable?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is the correct choice because it creates an identity in Microsoft Entra ID that is tied directly to the lifecycle of the VM. When the VM is deleted, the identity is automatically removed. The VM can use this identity to authenticate to Azure Blob Storage via Microsoft Entra ID without storing any credentials on the VM, using the Azure Instance Metadata Service (IMDS) to obtain tokens.

Answer

A shared storage account key in the application settings

Answer

A user account with a local password on the VM

Answer

A service endpoint on the VM subnet

Question 20

You removed public IP addresses from a backend subnet containing 20 VMs. The VMs still need outbound internet access for updates, and the organization wants all outbound traffic to appear from one predictable public IP. No inbound publishing is required. Which Azure service should you use?

Accepted Answer

Azure NAT Gateway associated with the subnet.. Azure NAT Gateway is the correct choice because it provides outbound-only internet connectivity for a subnet, translating all VM traffic to a single public IP address without requiring inbound NAT rules or a load balancer. It supports SNAT (Source Network Address Translation) for up to 64,000 concurrent flows per IP, meeting the requirement for predictable outbound IP and no inbound publishing.

Answer

A public load balancer with inbound NAT rules for each VM.

Answer

A private load balancer with a backend pool of the VMs.

Answer

A VPN gateway connection to a remote network.