AZ-104 Practice Exam 65 — 20 Questions

Question 1

An application in a VNet must access an Azure Storage account over a private IP address. Public network access is disabled on the storage account, and the app must resolve the normal blob FQDN to that private address only from within the VNet. What should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A private endpoint for the blob service and a linked private DNS zone for the VNet.. A private endpoint assigns the storage account a private IP from the VNet, and linking a private DNS zone (e.g., `privatelink.blob.core.windows.net`) to the VNet ensures that the blob FQDN resolves to that private IP only from within the VNet. This meets the requirement of disabling public network access while providing private connectivity and DNS resolution.

Answer

A service endpoint on the subnet and a storage account firewall rule for the subnet.

Answer

Allow trusted Microsoft services on the storage account and keep the public endpoint enabled.

Answer

Create a public DNS record that maps the blob FQDN to the storage account's public IP address.

Question 2

A stateless web application must automatically add VM instances during business hours and remove them at night based on CPU usage. Which Azure service should be deployed?

Accepted Answer

Virtual machine scale set. Virtual Machine Scale Sets (VMSS) are designed to automatically scale the number of VM instances in or out based on metrics like CPU usage, and they support scheduled scaling to align with business hours. This makes them the correct choice for a stateless web application that needs to add instances during business hours and remove them at night, as VMSS can integrate with Azure Autoscale to adjust capacity based on both performance metrics and time schedules.

Answer

Availability set

Answer

Azure Bastion

Answer

Proximity placement group

Question 3

A team wants a storage option that stays available if one availability zone in the primary region fails. Which two redundancy options meet that requirement? Select two.

Accepted Answer

Zone-redundant storage (ZRS).. Zone-redundant storage (ZRS) synchronously replicates data across three Azure availability zones within the primary region. If one zone fails, the data remains accessible from the other zones, ensuring high availability without requiring failover to a secondary region.

Answer

Locally redundant storage (LRS).

Answer

Geo-redundant storage (GRS).

Answer

Read-access geo-redundant storage (RA-GRS).

Question 4

Your company hosts an internal web app in Azure App Service. Access must be limited to users connecting from the corporate virtual network over private IP addresses only. What should you configure?

Accepted Answer

A private endpoint for the web app.. A private endpoint assigns a private IP address from your virtual network to the web app, making it accessible only over the corporate network via private IPs. This ensures traffic never traverses the public internet, meeting the requirement for private IP-only access.

Answer

An App Service Environment only.

Answer

Access restrictions based on public IP ranges only.

Answer

A public load balancer in front of the web app.

Question 5

You plan to run a web application on Azure virtual machines and need protection against a single datacenter failure within an Azure region. Which deployment option should you use?

Accepted Answer

Availability zones. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying your VMs across two or more zones protects against a single datacenter failure because if one zone goes down, the application continues running in the other zone. This meets the requirement for datacenter-level fault tolerance within a single region.

Answer

An availability set only

Answer

A proximity placement group

Answer

A single VM with premium SSD

Question 6

Your company has multiple applications deployed across separate production and nonproduction subscriptions. Finance wants cost reporting by application, and each app team should manage only its own resources. Which two design choices best satisfy both requirements? Select two.

Accepted Answer

Place each application's Azure resources in a dedicated resource group.. Resource groups are the logical container for grouping Azure resources by application, enabling each app team to manage its own resources via Azure RBAC at the resource group scope. Option B is correct because tagging resources with an application or cost-center identifier allows Azure Cost Management to filter and report costs by application, satisfying the finance requirement for cost reporting by application.

Answer

Create one subscription per virtual machine to simplify chargeback reporting.

Answer

Use resource names only for cost reporting because names are always unique and queryable.

Answer

Place all applications in one management group and use it as the access boundary for each app team.

Question 7

Based on the exhibit, why does a query against AzureDiagnostics return no rows after the storage account diagnostic setting was changed?

Accepted Answer

The logs are written to resource-specific tables instead of AzureDiagnostics.. When you change a diagnostic setting for a storage account from 'AzureDiagnostics' mode to 'Resource-specific' mode, logs are no longer sent to the AzureDiagnostics table. Instead, they are written to dedicated resource-specific tables (e.g., StorageReadLogs, StorageWriteLogs). Since the query targets AzureDiagnostics, it returns no rows because the logs are now stored in the new table format.

Answer

The storage account cannot send logs to Log Analytics when public network access is disabled.

Answer

The diagnostic setting only sends metrics, not logs, to the workspace.

Answer

The workspace retention period automatically deletes all records after one hour.

Question 8

An enterprise uses one management group to contain five subscriptions for a business unit. A compliance auditor in an Entra ID group needs read-only access to every current and future resource in all five subscriptions, but must not see resources in other business units. What is the best scope for the Reader role assignment?

Accepted Answer

Assign Reader at the management group that contains the five subscriptions.. Assigning the Reader role at the management group scope grants inherited read-only access to all current and future resources within every subscription under that management group, while preventing access to resources in other business units that are in separate management groups. This satisfies the auditor's requirement for a single, scalable assignment that automatically covers new subscriptions added to the management group.

Answer

Assign Reader separately at each subscription in the business unit.

Answer

Assign Reader at a single resource group within one subscription.

Answer

Assign Reader directly to each resource that the auditor should see.

Question 9

You need to grant an external partner temporary read access to a single blob in an Azure storage account without giving access to the account key. What should you create?

Accepted Answer

A shared access signature (SAS). A shared access signature (SAS) is the correct solution because it provides delegated, time-limited access to a specific Azure storage resource (such as a single blob) without exposing the storage account key. You can configure the SAS with read-only permissions, an expiration time, and apply it to a specific blob URL, meeting the requirement for temporary external read access.

Answer

A storage account access key

Answer

A resource lock

Answer

A private endpoint

Question 10

Third-party support engineers connect from the public internet and need browser-based RDP and SSH access to Azure VMs that have only private IPs. The security team will not allow public IPs on the VMs, inbound 3389 or 22 from the internet, or a client VPN on each laptop. What should you deploy?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless browser-based RDP and SSH connectivity to Azure VMs directly from the Azure portal over TLS, without requiring public IPs on the VMs or exposing inbound RDP/SSH ports (3389/22) to the internet. It uses a hardened bastion host deployed in a dedicated subnet, which brokers the connection via the Azure portal, satisfying the security team's constraints of no public IPs on VMs, no inbound internet access to those ports, and no client VPN software.

Answer

VPN Gateway with point-to-site configuration

Answer

A public load balancer with inbound NAT rules

Answer

A NAT gateway attached to the VM subnet

Question 11

A company has frontend and backend VMs in the same subnet. Security rules must allow the frontend tier to reach only the backend tier on TCP 443, without assigning rules to individual VM IP addresses. What should the administrator use in the NSG rule?

Accepted Answer

Application security groups for the frontend and backend VMs.. Application Security Groups (ASGs) allow you to group VMs logically by their application tier (e.g., frontend, backend) without relying on individual IP addresses. You can then create an NSG rule that uses the frontend ASG as the source and the backend ASG as the destination, restricting traffic to TCP 443. This meets the requirement of not assigning rules to individual VM IPs while ensuring only frontend VMs can reach backend VMs within the same subnet.

Answer

A user-defined route that sends frontend traffic to the backend subnet.

Answer

A network security group rule that references both subnets by address prefix only.

Answer

A VNet peering connection between the two tiers.

Question 12

An application subnet has an NSG outbound rule Deny-HTTPS at priority 200 for TCP 443 to Any. A second outbound rule Allow-HTTPS-API at priority 300 permits TCP 443 from ASG-Web to ASG-Api. Web servers can reach other ports but not the API. What change should the administrator make?

Accepted Answer

Change the allow rule to a higher priority than 200, such as 100.. NSG rules are evaluated in priority order, with lower numbers having higher precedence. The Deny-HTTPS rule at priority 200 blocks all outbound TCP 443 traffic, including traffic from ASG-Web to ASG-Api. To allow the specific traffic, the Allow-HTTPS-API rule must have a lower priority number (e.g., 100) so it is evaluated before the deny rule, permitting the desired traffic while the deny rule still blocks other outbound HTTPS traffic.

Answer

Delete the deny rule so the allow rule can be evaluated.

Answer

Change the destination from ASG-Api to the entire subnet address range.

Answer

Change the protocol from TCP to Any so the rule matches more traffic.

Question 13

A company wants a single storage account for blob containers, Azure Files shares, and blob lifecycle management rules. Which two statements about the required account are true? Select two.

Accepted Answer

It should be a general-purpose v2 storage account.. A general-purpose v2 (GPv2) storage account is required because it is the only account type that supports all Azure Storage data services—including blob containers and Azure Files—and also provides full support for blob lifecycle management policies. GPv2 accounts offer the lowest per-gigabyte storage prices for blobs and enable you to define rules to automatically tier or delete blobs based on age or other conditions.

Answer

It must be a premium block blob account.

Answer

It cannot use lifecycle management on blobs.

Answer

It can store only one type of Azure Storage data service at a time.

Question 14

A team manages a production VM and its supporting storage account. Match each operational requirement to the Azure Monitor component that should be configured.

Accepted Answer

Azure Monitor Metrics: Stores numerical performance data. Azure Monitor Metrics stores numerical performance data, Log Analytics enables KQL queries, Alerts notify on conditions, Workbooks provide dashboards, the Azure Monitor Agent collects guest OS logs, and Storage analytics logs capture storage access data.

Answer

Azure Monitor Metrics: Enables KQL queries against collected log data

Answer

Log Analytics: Stores numerical performance data

Question 15

Based on the exhibit, which Azure feature best meets the file-sharing requirement?

Accepted Answer

Azure File Sync, because it synchronizes local servers with a central Azure file share and keeps hot data cached.. Azure File Sync is the correct choice because it enables hybrid file sharing by synchronizing on-premises Windows file servers with a central Azure file share, while also keeping frequently accessed (hot) data cached locally for low-latency access. This directly meets the requirement to replace branch server shares with a cloud-backed solution that maintains local performance.

Answer

Azure Files only, because a cloud file share can replace every branch server share directly.

Answer

Azure Backup, because it can restore files after a WAN outage occurs.

Answer

Azure NetApp Files, because it is the only service that supports SMB access from Windows servers.

Question 16

A Windows VM must automatically run a setup script after provisioning to install an agent, create a folder, and write configuration files. The administrator wants the script to be delivered through Azure management and run without a human signing in. What should be used?

Accepted Answer

Custom Script Extension. The Custom Script Extension (CSE) is the correct Azure feature to automatically run a setup script on a Windows VM after provisioning. It downloads and executes scripts from Azure Storage or GitHub, runs as the local system account, and requires no user sign-in, making it ideal for post-deployment configuration like installing agents and writing files.

Answer

Availability set

Answer

Azure Load Balancer

Answer

Route table

Question 17

A storage account must be reachable only from one subnet. The team does not want to deploy a private endpoint or manage private DNS zones, and they are acceptable with the storage account continuing to use its public endpoint. Which feature should be configured on the subnet?

Accepted Answer

A service endpoint for Microsoft.Storage. A service endpoint for Microsoft.Storage allows a subnet to restrict access to a storage account's public endpoint without deploying a private endpoint or managing private DNS zones. When enabled, Azure adds the subnet's identity to traffic from that subnet, and the storage account's firewall can be configured to allow only that specific subnet, keeping the public endpoint active.

Answer

A private endpoint for the storage account

Answer

A route table with a default route to the storage account

Answer

An application security group containing the subnet

Question 18

A production workload must continue running if one entire Azure datacenter in the region becomes unavailable. The region supports availability zones, and you want the strongest placement option for a single VM. What should you choose?

Accepted Answer

Availability zone. An availability zone protects against an entire datacenter failure by placing the VM in a physically separate zone within the region, each with independent power, cooling, and networking. This is the strongest placement option for a single VM because it guarantees isolation from other zones, ensuring the workload continues if one datacenter fails. Availability sets only protect against rack-level failures within the same datacenter, not a full datacenter outage.

Answer

Availability set

Answer

Proximity placement group

Answer

Managed disk snapshot

Question 19

A VM has both a default route from a VPN gateway and a user-defined route to an on-premises firewall. Traffic is still not reaching the expected next hop. The administrator wants to see the exact routes currently applied to the VM NIC. Which tool should be used?

Accepted Answer

Effective routes. Effective routes is the correct tool because it displays the actual, consolidated routing table applied to a specific network interface, including user-defined routes (UDRs), BGP routes from the VPN gateway, and system default routes. When traffic fails to reach the expected next hop despite having both a VPN default route and a UDR, the administrator must verify which route is actually active and has the highest priority (based on prefix length and route preference). Effective routes shows the exact next-hop IP and route source for each prefix, allowing the administrator to confirm whether the UDR to the on-premises firewall is being honored or overridden.

Answer

IP flow verify

Answer

Packet capture

Answer

Connection troubleshoot

Question 20

A subnet has an NSG with an inbound allow rule for TCP 3389 at priority 200 and an inbound deny rule for Internet traffic at priority 100. An administrator still cannot RDP to a virtual machine in the subnet from home. What is the most likely reason?

Accepted Answer

The deny rule wins because lower priority numbers are processed first.. In Azure Network Security Groups (NSGs), rules are processed in priority order, with lower numbers evaluated first. The deny rule for Internet traffic at priority 100 is processed before the allow rule for TCP 3389 at priority 200, so the deny rule blocks the inbound RDP connection from the internet. This is why the administrator cannot RDP from home.

Answer

The allow rule is ignored because inbound rules cannot permit RDP.

Answer

NSG rules apply only to outbound traffic, so inbound traffic is unaffected.

Answer

The subnet NSG is ignored whenever the VM has a public IP address.