AZ-104 Practice Exam 66 — 20 Questions

Question 1

Based on the exhibit, web servers can reach a backend VM only after it is added to a specific group. What should the administrator change to allow the traffic to match the existing NSG rule?

Accepted Answer

Add api01's NIC to ASG-Api.. The exhibit shows that the NSG rule allows traffic from ASG-Web to ASG-Api. Since web01 is in ASG-Web, traffic from web01 to api01 is only permitted if api01 is a member of ASG-Api. Adding api01's NIC to ASG-Api ensures the destination matches the NSG rule, allowing the traffic.

Answer

Move the deny rule to priority 100.

Answer

Change the source of the allow rule from ASG-Web to VirtualNetwork.

Answer

Place api01 in the same subnet as web01.

Question 2

An operations team must apply three related policies to all subscriptions in a department: require a cost-center tag, allow only approved locations, and block certain VM SKUs. They want to assign and track these rules as one unit. What should they create?

Accepted Answer

An Azure Policy initiative.. An Azure Policy initiative is a collection of policy definitions designed to group related policies together for assignment and tracking as a single unit. By creating an initiative, the operations team can assign all three rules (cost-center tag, allowed locations, blocked VM SKUs) to all subscriptions in a department and track compliance at the initiative level, simplifying management and reporting.

Answer

A single Azure Policy definition containing all three rules.

Answer

A management group with no policy assignments.

Answer

An RBAC custom role with deny permissions.

Question 3

A network engineer wants device logs from routers and switches sent to a central server for long-term retention and analysis. Which service should be configured?

Accepted Answer

Syslog. Syslog is the standard protocol for sending device logs (e.g., from routers and switches) to a central server for long-term retention and analysis. It operates over UDP port 514 (or TCP 6514 for reliable delivery) and allows network devices to forward event messages to a syslog collector, which can store, filter, and analyze them. This directly meets the requirement for centralized logging and analysis.

Answer

NTP

Answer

DNS

Answer

NetFlow

Question 4

A team manages 20 web VMs and 15 app VMs that scale independently. The administrator needs an NSG rule that allows only the web tier to reach the app tier on TCP 8443, and future VM additions must be included automatically without editing IP addresses. What should the administrator use in the NSG rule?

Accepted Answer

A source application security group for the web tier and a destination application security group for the app tier.. Application security groups (ASGs) allow you to define network security rules based on logical groupings of VMs, regardless of their IP addresses. By assigning the web tier VMs to a source ASG and the app tier VMs to a destination ASG, the NSG rule automatically includes any new VMs added to those groups, meeting the requirement for dynamic inclusion without manual IP edits.

Answer

A service endpoint on the subnet where the app VMs are deployed.

Answer

A user-defined route between the web subnet and app subnet.

Answer

A load balancer backend pool for both tiers.

Question 5

A VM in a subnet must send traffic to 10.50.0.0/16 through an on-premises VPN gateway, while all other destinations should use the Internet. Which route should be added to the subnet's route table?

Accepted Answer

Destination 10.50.0.0/16 with next hop type Virtual network gateway.. The VM needs to send traffic destined for 10.50.0.0/16 through the on-premises VPN gateway. Adding a user-defined route (UDR) with destination 10.50.0.0/16 and next hop type 'Virtual network gateway' forces that specific traffic to be routed over the VPN tunnel, while the default route (0.0.0.0/0) to the Internet remains unchanged, allowing all other traffic to egress via the Internet.

Answer

Destination 0.0.0.0/0 with next hop type Virtual network gateway.

Answer

Destination 10.50.0.0/16 with next hop type Service endpoint.

Answer

Destination 10.50.0.0/16 with next hop type Internet.

Question 6

A Windows VM must install an agent and copy a configuration file automatically after provisioning. The administrator wants Azure to run the setup step without logging into the VM manually. Which feature should be used?

Accepted Answer

VM extension. VM extensions are the correct Azure feature to automatically install agents and apply configurations during or after provisioning without manual login. The Custom Script Extension (CSE) specifically can execute a PowerShell or Bash script to install the agent and copy the configuration file, running as a post-deployment task via Azure Resource Manager (ARM) templates, Azure CLI, or PowerShell.

Answer

Boot diagnostics

Answer

Managed disk encryption

Answer

Availability set

Question 7

An operations team wants to deploy the same set of Azure VMs every month from source control. The deployment should be readable, repeatable, and stored as code. What should they use?

Accepted Answer

Bicep template. Bicep is a domain-specific language (DSL) that uses declarative syntax to deploy Azure resources as code. It provides readability, repeatability, and version control integration, making it ideal for deploying the same set of VMs monthly from source control. Unlike ARM templates, Bicep offers cleaner syntax and modularity, but both are valid infrastructure-as-code solutions.

Answer

Manual portal deployment

Answer

Azure Advisor recommendation

Answer

Azure Resource Explorer

Question 8

A contractor from a partner company needs read-only access to one application resource group for 14 days. When the contractor leaves the project, access should be removed immediately by removing a single identity from a group. Which two actions should the administrator take? Select two.

Accepted Answer

Create an Entra ID security group for the contractor team.. Creating an Entra ID security group for the contractor team (Option A) allows the administrator to manage access centrally. By assigning the Reader role to that group at the application resource group scope (Option B), all members inherit read-only permissions. When the contractor leaves, removing their user object from the group immediately revokes access without needing to modify role assignments, satisfying the requirement for a single identity removal.

Answer

Assign Reader directly to the contractor's user object at the subscription scope.

Answer

Assign Contributor at the resource group scope and rely on discipline.

Answer

Use a resource lock to limit the contractor to read-only access.

Question 9

A developer has the Reader role assigned at the subscription scope. Later, the developer is assigned Contributor at the RG-Web resource group scope. Which permission is inherited by a storage account inside RG-Web?

Accepted Answer

The Contributor role from RG-Web is inherited by the storage account.. In Azure RBAC, permissions are inherited from higher scopes to lower scopes. The Contributor role assigned at the RG-Web resource group scope is inherited by all resources within that resource group, including the storage account. The Reader role from the subscription scope is also inherited, but the more permissive Contributor role at the resource group scope takes precedence for actions allowed by Contributor. Therefore, the storage account effectively has Contributor permissions.

Answer

Only the Reader role from the subscription scope is inherited by the storage account.

Answer

Neither role is inherited because storage accounts require a direct assignment.

Answer

Both roles are merged into a new custom role automatically.

Question 10

A team wants to restrict a storage account so only one Azure subnet can reach it. They do not need a private IP address, and they are fine with the storage account still using its public endpoint. Which configuration should the administrator use?

Accepted Answer

Enable a service endpoint on the subnet and allow that subnet in the storage account firewall.. A service endpoint extends the virtual network identity to the storage account over the public endpoint, allowing the administrator to restrict access to only traffic originating from that specific subnet via the storage account firewall. This meets the requirement of using the public endpoint while limiting access to a single Azure subnet without needing a private IP address.

Answer

Create a private endpoint and disable public network access.

Answer

Generate a user delegation SAS token and distribute it only to the subnet.

Answer

Change the redundancy setting to ZRS and enable soft delete.

Question 11

Two virtual networks are in different subscriptions. VNet-A uses 10.20.0.0/16 and VNet-B uses 10.20.128.0/17. A design review also states that traffic between two spoke VNets should flow through a hub VNet instead of directly between spokes. Which two statements are correct? Select two.

Accepted Answer

The two VNets cannot be peered until one address space is changed because the ranges overlap.. VNet peering in Azure requires that the address spaces of the peered VNets do not overlap. VNet-A uses 10.20.0.0/16 and VNet-B uses 10.20.128.0/17, which are overlapping ranges (10.20.128.0/17 is a subset of 10.20.0.0/16). Azure will reject the peering request until one of the address spaces is changed to eliminate the overlap.

Answer

VNet peering is transitive, so spoke-to-spoke traffic will automatically use the hub peering.

Answer

Overlapping CIDR blocks are allowed if the VNets are placed in separate resource groups.

Answer

If the hub has a VPN gateway, spoke traffic to other spokes is routed automatically without additional configuration.

Question 12

A department wants three related policies grouped together and assigned as one unit to a set of subscriptions. Which two statements about an Azure Policy initiative are correct? Select two.

Accepted Answer

An initiative groups multiple policy definitions into one assignment.. An Azure Policy initiative is specifically designed to group multiple policy definitions into a single assignment. This allows you to apply a set of related compliance rules as one unit, simplifying management and ensuring consistent enforcement across subscriptions.

Answer

An initiative grants Azure permissions to users.

Answer

An initiative replaces resource group locks.

Answer

An initiative is used to create a new resource group.

Question 13

Two VNets are peered. AppVNet contains VMs that access a private endpoint in DataVNet successfully by IP, but name resolution fails for the storage FQDN. The private DNS zone is linked only to DataVNet. What should you do?

Accepted Answer

Add a virtual network link from the private DNS zone to AppVNet.. The private DNS zone is linked only to DataVNet, so VMs in AppVNet cannot resolve the storage FQDN even though IP connectivity works via the VNet peering. By adding a virtual network link from the private DNS zone to AppVNet, you enable DNS resolution for the private endpoint's FQDN across the peered VNet. This is required because private DNS zones are scoped to the VNets they are linked to, and peering alone does not propagate DNS resolution.

Answer

Create another peering connection from AppVNet to DataVNet.

Answer

Create a public DNS zone with the same name as the private zone.

Answer

Assign a public IP address to the private endpoint.

Question 14

An application writes transaction logs to a storage account in a region that supports availability zones. The business wants the account to stay available if one datacenter or zone fails, but it does not need a secondary region replica. Which redundancy option should you choose?

Accepted Answer

ZRS, because it replicates synchronously across zones in the same region and survives a zone outage.. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within the same region. This design ensures that if one datacenter or zone fails, the storage account remains available and durable without requiring a secondary region replica, exactly matching the business requirement.

Answer

LRS, because it keeps three copies within a single datacenter and is enough for any zone failure.

Answer

GRS, because it adds a geographically replicated secondary region for disaster recovery.

Answer

RA-GRS, because read access to the secondary region is the best protection against a zone failure.

Question 15

Two virtual machines named VM-Web01 and VM-Web02 host the same public web application. Users on the internet must connect through a single public IP address, and incoming requests should be distributed across both VMs. What should you deploy?

Accepted Answer

A public load balancer. A public load balancer (Azure Load Balancer with a public frontend IP) is required because it provides a single public IP address for internet clients and distributes incoming traffic across the backend VMs (VM-Web01 and VM-Web02) using a configured load-balancing rule. This ensures high availability and scalability for the web application.

Answer

An internal load balancer

Answer

A private DNS zone

Answer

A Recovery Services vault

Question 16

Two application VMs are in the same Azure region. They must stay available during planned host maintenance, but the business does not require protection from a full datacenter outage. Which placement option should you use?

Accepted Answer

Availability set. An availability set distributes VMs across multiple fault domains (up to 3) and update domains (up to 20) within a single Azure datacenter. This ensures that during planned host maintenance, only one update domain is taken offline at a time, keeping the application VMs available. Since the requirement does not include protection from a full datacenter outage, an availability set is the correct and cost-effective placement option.

Answer

Availability zone

Answer

Shared disk

Answer

Snapshot set

Question 17

A line-of-business app will run on a single Azure virtual machine in a region that supports availability zones. The business wants the VM to keep running if one datacenter in the region fails. Which deployment choice should you use?

Accepted Answer

Deploy the VM in an availability zone. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying the VM in an an availability zone ensures that if one datacenter fails, the VM remains operational because it is hosted in a different zone. This directly meets the requirement for resilience against a single datacenter failure.

Answer

Place the VM in an availability set

Answer

Use a larger VM size

Answer

Use a custom image

Question 18

Based on the exhibit, an administrator is trying to peer two VNets so workloads can communicate privately. The peering creation fails. What should the administrator do first?

Accepted Answer

Readdress one of the VNets so the address spaces no longer overlap.. VNet peering requires that the address spaces of the two virtual networks do not overlap. Overlapping address spaces cause routing conflicts and prevent the peering from being established. The administrator must readdress one of the VNets so their IP ranges are unique before retrying the peering.

Answer

Create a user-defined route in VNet-Prod to force traffic through a firewall.

Answer

Enable gateway transit on both VNets and retry the peering.

Answer

Add an NSG rule that allows traffic from the other VNet.

Question 19

A production Azure VM farm runs customer-facing APIs. Operations wants an automatic notification when the average Percentage CPU on any VM stays above 85 percent for 10 minutes, and the notification must reach both email and SMS recipients. Which two Azure Monitor items must be configured? Select two.

Accepted Answer

Metric alert rule. A Metric alert rule is correct because it monitors the 'Percentage CPU' metric on Azure VMs and can trigger when the average value exceeds 85% for a duration of 10 minutes. This rule evaluates the metric over a specified time window and fires an alert based on the threshold condition, meeting the requirement for automatic notification based on performance metrics.

Answer

Diagnostic setting

Answer

Workbook

Answer

Service health alert

Question 20

You plan to store backup files that are written once per week and are rarely accessed except during an audit. The company wants the lowest storage cost but still needs online access within hours, not days. Which blob access tier should you choose?

Accepted Answer

Cool. The Cool tier is the correct choice because it is designed for data that is infrequently accessed and stored for at least 30 days, offering lower storage costs than Hot while still providing millisecond latency for online access. Since backups are written once per week and rarely accessed except during an audit, Cool tier meets the requirement of online access within hours at the lowest storage cost among the online tiers.

Answer

Hot

Answer