AZ-104 Practice Exam 66 — 20 Questions

Question 1

Based on the exhibit, a contractor must be able to restart only one virtual machine named vm-pay-01 and read its properties. The contractor must not be able to manage any other VM in the resource group. Where should the role assignment be created?

Accepted Answer

At the resource scope for vm-pay-01 so the contractor receives permissions only on that VM.. Option B is correct because Azure RBAC allows role assignments at the resource scope, which in this case is the virtual machine vm-pay-01. By assigning a role (e.g., Virtual Machine Contributor or a custom role with restart and read permissions) directly to the VM resource, the contractor receives permissions only on that specific VM, fulfilling the requirement to restrict access to other VMs in the resource group.

Answer

At the subscription scope so the contractor inherits access everywhere in the subscription.

Answer

At the resource group scope because resource assignments cannot be applied to virtual machines.

Answer

At the management group scope so the same role can be reused for all payroll subscriptions.

Question 2

Based on the exhibit, an Azure Policy with the Modify effect was assigned to add Environment=Prod to resources in RG-Prod. New resources get the tag, but existing virtual machines still do not have it. What should the administrator do next?

Accepted Answer

Create a remediation task for the policy assignment.. The Modify effect in Azure Policy automatically applies to new resources during creation or update, but it does not retroactively fix existing non-compliant resources. To apply the tag to existing virtual machines, the administrator must create a remediation task for the policy assignment, which triggers a deployment to modify those resources.

Answer

Move the policy assignment to the subscription scope.

Answer

Change the policy effect from Modify to Deny.

Answer

Add a CanNotDelete lock to RG-Prod.

Question 3

An operations team must be able to restart virtual machines in one resource group. They must not create, delete, resize, or change disks or networking. Which two actions should the administrator take? Select two.

Accepted Answer

Create a custom RBAC role that includes only read and restart actions for virtual machines.. Option A is correct because a custom RBAC role can be defined to include only the 'Microsoft.Compute/virtualMachines/read' and 'Microsoft.Compute/virtualMachines/restart/action' permissions, which precisely limits the operations team to reading and restarting VMs without allowing create, delete, resize, or disk/network changes. This aligns with the principle of least privilege.

Answer

Assign the Virtual Machine Contributor role to the operations group.

Answer

Create an Azure Policy assignment that denies VM creation in the resource group.

Answer

Apply a ReadOnly lock to the resource group.

Question 4

Based on the exhibit, an administrator wants to prevent new Azure resources from being deployed in any region except East US and West US across the entire Corp hierarchy. What should the administrator configure?

Accepted Answer

Create and assign an Azure Policy at the Corp management group using the allowed locations rule.. Azure Policy is the correct tool to enforce governance rules across management groups. The 'allowed locations' built-in policy definition restricts resource deployment to specified regions. By assigning this policy at the Corp management group, the rule applies to all child subscriptions and resources, preventing deployment in any region except East US and West US.

Answer

Assign a built-in RBAC role that denies deployments in unsupported regions.

Answer

Apply a CanNotDelete lock to the subscriptions.

Answer

Use a resource tag named RegionApproved and require teams to set it manually.

Question 5

Based on the exhibit, a user deleted one file from a Windows Azure VM. The VM is still running, and the administrator wants to restore only that file instead of recovering the full machine. Which restore approach should be used?

Accepted Answer

Mount the recovery point and copy the file back to the VM.. Option B is correct because Azure VM backup allows you to mount a recovery point as a disk on another VM or the same VM, enabling file-level restore without overwriting the entire VM. This approach uses the 'File Recovery' feature of Azure Backup, which presents the recovery point as an iSCSI target that can be mounted and browsed to copy individual files back to the running VM.

Answer

Use the VM restore option and overwrite the entire VM.

Answer

Increase the VM size and redeploy the workload.

Answer

Enable a diagnostic setting on the VM and recover the file from logs.

Question 6

Based on the exhibit, where should the administrator assign the role so the contractor can start and stop virtual machines only in RG-App and nothing else?

Accepted Answer

Assign the role at the resource group scope for RG-App.. The contractor needs to manage virtual machines only within RG-App. Azure RBAC allows you to assign the Virtual Machine Contributor role at the resource group scope, which grants permissions to start and stop VMs within that specific resource group while preventing access to resources in other resource groups or at higher scopes. Assigning at the subscription or management group level would grant permissions across all resource groups, violating the principle of least privilege.

Answer

Assign the role at the subscription scope so it covers the contractor's work area.

Answer

Assign the role at the management group scope above the subscription.

Answer

Assign the role directly to one virtual machine only, because that is always the best scope.

Question 7

A backend VM belongs to AppASG and listens on TCP 8443. The subnet NSG has a deny rule at priority 200 that blocks TCP 8443 from VirtualNetwork to any destination. The backend VM's NIC NSG has an allow rule at priority 100 for TCP 8443 from WebASG to AppASG. Web VMs in WebASG still cannot connect. What should you change to allow only the web tier while keeping other virtual network traffic blocked?

Accepted Answer

Add an allow rule in the subnet NSG at priority 150 for TCP 8443 from WebASG to AppASG.. In Azure, network security group (NSG) rules are evaluated in priority order, and subnet NSG rules are evaluated before NIC NSG rules for inbound traffic. The subnet NSG has a deny rule at priority 200 that blocks TCP 8443 from VirtualNetwork to any destination, which overrides the NIC NSG allow rule because the subnet deny is evaluated first. To allow traffic from WebASG to AppASG while still blocking other virtual network traffic, you must add an allow rule in the subnet NSG at a higher priority (e.g., 150) than the deny rule, explicitly permitting TCP 8443 from WebASG to AppASG.

Answer

Move the NIC NSG allow rule to priority 50.

Answer

Replace the subnet deny rule with a rule for the AzureLoadBalancer service tag.

Answer

Remove the backend VM from AppASG and allow traffic by subnet only.

Question 8

Two VNets are peered. AppVNet contains VMs that access a private endpoint in DataVNet successfully by IP, but name resolution fails for the storage FQDN. The private DNS zone is linked only to DataVNet. What should you do?

Accepted Answer

Add a virtual network link from the private DNS zone to AppVNet.. The private DNS zone is linked only to DataVNet, so VMs in AppVNet cannot resolve the storage FQDN even though IP connectivity works via the VNet peering. By adding a virtual network link from the private DNS zone to AppVNet, you enable DNS resolution for the private endpoint's FQDN across the peered VNet. This is required because private DNS zones are scoped to the VNets they are linked to, and peering alone does not propagate DNS resolution.

Answer

Create another peering connection from AppVNet to DataVNet.

Answer

Create a public DNS zone with the same name as the private zone.

Answer

Assign a public IP address to the private endpoint.

Question 9

Based on the exhibit, administrators can reach a web server from the approved subnet, but connections still fail. What is the most likely reason?

Accepted Answer

The deny rule has a higher priority and matches the traffic before the allow rule.. Network Security Groups (NSGs) evaluate rules in order of priority, where a lower priority number (e.g., 100) is evaluated before a higher number (e.g., 200). If a deny rule with a higher priority (lower number) matches the traffic before the allow rule, the traffic is blocked. In this scenario, the deny rule (priority 100) matches the source subnet and destination port 443 before the allow rule (priority 200) can permit it, causing connections to fail.

Answer

The allow rule is blocked because inbound rules are evaluated from highest priority number to lowest.

Answer

The destination port must be changed to 80 because NSGs cannot allow TCP 443.

Answer

The subnet requires a route table before HTTPS can be permitted.

Question 10

Based on the exhibit, the operations team wants to store the VM deployment definition in source control and deploy the same group of Azure VMs every sprint. The code should be readable and easy to review. What should they use?

Accepted Answer

Bicep template files stored in source control.. Bicep is a domain-specific language (DSL) for deploying Azure resources that provides a cleaner, more readable syntax compared to ARM JSON templates. Storing Bicep files in source control enables versioning, code review, and repeatable deployments via CI/CD pipelines, which aligns with the requirement to deploy the same VM group every sprint. The declarative nature of Bicep ensures the deployment definition is both human-readable and machine-executable.

Answer

Manual creation in the Azure portal.

Answer

A one-time Azure CLI command typed into Cloud Shell.

Answer

A resource lock on the subscription.

Question 11

Based on the exhibit, what next hop will the VM use when it sends traffic to 10.30.5.10?

Accepted Answer

Virtual network gateway. The VM's effective route table shows a route for 10.30.5.0/24 with a next hop type of 'Virtual network gateway'. Since 10.30.5.10 falls within this prefix, the VM will use the virtual network gateway as the next hop. This overrides the default virtual network (local) route because it is a more specific prefix match.

Answer

Virtual appliance at the user-defined next hop

Answer

Internet

Answer

Virtual network

Question 12

Based on the exhibit, the company will deploy two identical web server VMs in East US 2 behind a load balancer. The service must keep running if one datacenter in the region becomes unavailable. Which deployment choice best meets the requirement?

Accepted Answer

Place one VM in each of two availability zones and front them with the load balancer.. Option B is correct because deploying one VM in each of two availability zones within East US 2 ensures that the VMs are physically separated across distinct datacenters, each with independent power, cooling, and networking. If one datacenter (zone) fails, the other zone remains operational, and the load balancer automatically directs traffic to the healthy VM. This meets the requirement of keeping the service running if one datacenter in the region becomes unavailable.

Answer

Place both VMs in an availability set so Azure can spread them across fault domains.

Answer

Place both VMs in one availability zone because all zones in a region share failure domains.

Answer

Deploy a single VM because Azure automatically replicates it across the region.

Question 13

Based on the exhibit, the business says the workload must keep running if an entire Azure region becomes unavailable. Is Azure Backup alone sufficient, and what should you add if it is not?

Accepted Answer

No. Add Azure Site Recovery or another replication and failover design for regional resilience.. Azure Backup is designed to protect data by creating recovery points that can be used to restore data to a different region, but it does not provide continuous service or automatic failover during a regional outage. To keep the workload running without interruption, you need Azure Site Recovery (ASR) or a custom replication and failover solution that replicates the entire workload to a secondary region and enables automatic or manual failover. Therefore, Azure Backup alone is insufficient for high availability during a regional disaster.

Answer

Yes. Azure Backup alone provides continuous service during a regional outage.

Answer

Yes. Increasing the backup retention period will keep the application online.

Answer

No. Configure an action group so operators receive faster notifications during outages.

Question 14

Based on the exhibit, which KQL query should you use to find failed storage account delete operations in the last hour and count them by caller?

Accepted Answer

AzureActivity | where TimeGenerated > ago(1h) | where OperationNameValue has 'Microsoft.Storage/storageAccounts/delete' | where ActivityStatusValue == 'Failed' | summarize Failures=count() by Caller. Option A is correct because it filters AzureActivity logs to the last hour using `TimeGenerated > ago(1h)`, targets only storage account delete operations with `OperationNameValue has 'Microsoft.Storage/storageAccounts/delete'`, restricts to failed operations via `ActivityStatusValue == 'Failed'`, and then counts failures by caller using `summarize Failures=count() by Caller`. This precisely meets the requirement to find failed storage account delete operations in the last hour and count them by caller.

Answer

AzureActivity | where TimeGenerated > ago(1h) | where OperationNameValue has 'Microsoft.Storage/storageAccounts/delete' | where ActivityStatusValue == 'Succeeded' | summarize Failures=count() by Caller

Answer

SecurityEvent | where EventID == 4670 | summarize count() by Account

Answer

AzureActivity | where TimeGenerated > ago(1h) | where OperationNameValue has 'Microsoft.Storage/storageAccounts/delete' | summarize Failures=count() by Caller

Question 15

Based on the exhibit, the security team needs 30 days of searchable log data for a storage account and wants to create queries that can be used in workbooks and alerts. The current configuration only sends data to an archive location. What should the administrator configure?

Accepted Answer

Add a Log Analytics workspace destination to the diagnostic setting.. Option A is correct because the current diagnostic setting only archives logs to a storage account, which does not support interactive querying, workbooks, or alert rules. By adding a Log Analytics workspace destination to the same diagnostic setting, logs are sent to a centralized workspace where they become searchable via KQL, enabling real-time queries, workbook visualizations, and alert triggers. This meets the security team's requirement for 30 days of searchable log data without changing the existing archive destination.

Answer

Change the storage account redundancy to RA-GRS.

Answer

Enable a CanNotDelete lock on the storage account.

Answer

Configure a private endpoint for the storage account.

Question 16

Based on the exhibit, what should the administrator change to allow only the web tier to reach the app tier on TCP 8443?

Accepted Answer

Move the allow rule for WebTier-ASG to a priority lower than 100.. The exhibit shows a default-deny NSG rule at priority 100 that blocks all traffic from VirtualNetwork to VirtualNetwork. To allow only the web tier (WebTier-ASG) to reach the app tier (AppTier-ASG) on TCP 8443, the administrator must move the allow rule for WebTier-ASG to a priority lower than 100 (e.g., 90). This ensures the allow rule is evaluated before the deny rule, as NSG rules are processed in priority order (lowest number first).

Answer

Change the deny rule source from VirtualNetwork to Internet.

Answer

Associate the NSG with the virtual machine NIC instead of the subnet.

Answer

Replace the ASG destination with the subnet address range.

Question 17

Based on the exhibit, what should the administrator check first to resolve the backup failure for the Azure VM?

Accepted Answer

Verify that the Azure VM Agent is installed and running on the VM.. The Azure VM backup failure is most commonly caused by the Azure VM Agent (also known as the Windows Guest Agent or Linux Agent) not being installed, outdated, or in a non-responsive state. The backup extension relies on the VM Agent to execute snapshots and coordinate with the Azure Backup service; without a healthy agent, the backup process cannot initiate. Therefore, verifying the agent's installation and status is the first troubleshooting step.

Answer

Increase the backup retention period in the vault policy.

Answer

Move the VM to a different availability zone.

Answer

Change the storage account redundancy to ZRS.

Question 18

Based on the exhibit, which identity should be granted the Contributor role so access can be managed centrally as team members change?

Accepted Answer

Assign Contributor to a Microsoft Entra security group that contains the team members.. Assigning the Contributor role to a Microsoft Entra security group that contains the team members allows access to be managed centrally. As team members join or leave, you simply add or remove them from the group, and their permissions update automatically without needing to modify role assignments for each individual user. This aligns with Azure RBAC best practices for centralized identity governance.

Answer

Assign Contributor to each user account individually.

Answer

Assign Contributor to a managed identity.

Answer

Assign Contributor to the management group that contains rg-app.

Question 19

Based on the exhibit, which Azure feature should the administrator add so ownership and chargeback information remains visible even if resources are moved between resource groups?

Accepted Answer

Tags. Tags are metadata key-value pairs that can be assigned to Azure resources and resource groups. They persist even when resources are moved between resource groups, making them ideal for tracking ownership and chargeback information across organizational boundaries. Unlike other options, tags are specifically designed for cost tracking, ownership attribution, and resource categorization.

Answer

Management groups

Answer

Resource locks

Answer

Role assignments

Question 20

Based on the exhibit, which identity type should be used so the on-premises build server can authenticate to Azure without using a human account password?

Accepted Answer

Service principal. A service principal is the correct identity type for an on-premises build server to authenticate to Azure without a human account password because it represents a non-human identity that can be assigned to applications, services, and automation tools. Service principals authenticate using client secrets or certificates, enabling secure, password-less authentication via OAuth 2.0 client credentials grant flow, which is ideal for automated build pipelines.

Answer

System-assigned managed identity

Answer

User-assigned managed identity

Answer

Azure Storage access key