AZ-104 Practice Exam 67 — 20 Questions

Question 1

A subnet has a user-defined route for 0.0.0.0/0 that sends all outbound traffic to a network virtual appliance for inspection. The business now attaches a NAT gateway to the subnet and wants internet-bound traffic to use the NAT gateway's public IP, while traffic to private corporate prefixes should still go to the appliance. What should the administrator change?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Remove the 0.0.0.0/0 UDR and add only the specific private-prefix routes that must go to the appliance.. The 0.0.0.0/0 user-defined route (UDR) sends all outbound traffic to the network virtual appliance (NVA). A NAT gateway provides outbound connectivity with a public IP, but it only takes effect when there is no explicit 0.0.0.0/0 route overriding it. By removing the 0.0.0.0/0 UDR and adding only specific private-prefix routes (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) pointing to the NVA, internet-bound traffic will use the NAT gateway (via its default route), while corporate traffic is still forced through the appliance.

Answer

Leave the route table unchanged because the NAT gateway always overrides a default UDR.

Answer

Disable source NAT on the network virtual appliance.

Answer

Create a private endpoint for internet traffic so outbound packets stay in Azure.

Question 2

An administrator wants to run a one-time Azure CLI command from inside a VM to create a resource in Azure, but the administrator does not want to store credentials on the VM. What should be used for authentication?

Accepted Answer

The VM's managed identity. Azure Managed Identity provides an automatically managed identity in Azure AD that allows a VM to authenticate to any service that supports Azure AD authentication, including Azure Resource Manager, without storing any credentials on the VM. When the administrator runs the Azure CLI command from within the VM, the CLI can use the managed identity's token endpoint (169.254.169.254/metadata/identity/oauth2/token) to obtain an access token, enabling secure, credential-free resource creation.

Answer

A local administrator password

Answer

A network security group rule

Answer

An Azure region paired with the VM

Question 3

Your company stores departmental documents in an Azure file share. Users need to be able to recover previous versions of files that were deleted or modified accidentally. You need a solution that supports recovery at the file share level without deploying additional virtual machines. What should you configure?

Accepted Answer

Create share snapshots for the Azure file share.. Azure file share snapshots provide point-in-time, read-only copies of the entire file share, allowing users to recover previous versions of files that were deleted or modified accidentally. This feature operates at the file share level without requiring any additional virtual machines, making it a straightforward and cost-effective solution for version recovery.

Answer

Enable blob versioning.

Answer

Configure Azure File Sync cloud tiering.

Answer

Enable immutable blob storage.

Question 4

An enterprise has a management group named Corp. Corp contains two child management groups: Prod and Sandbox. A compliance auditor is a member of an Entra ID group and must have read-only access to every current and future resource in all subscriptions that are under Prod. The auditor must not see resources in Sandbox, and the admin does not want to maintain separate assignments for each new subscription. What should the administrator do?

Accepted Answer

Assign the Reader role to the group at the Prod management group scope.. Assigning the Reader role at the Prod management group scope applies that permission to all current and future subscriptions and resources within Prod, satisfying the requirement for read-only access without needing separate assignments. Management groups in Azure provide a hierarchical scope that inherits role assignments to all child subscriptions and resource groups, making this the most efficient and future-proof approach.

Answer

Assign the Reader role to the group at each subscription scope under Prod.

Answer

Assign the Reader role to the group at the Corp management group scope.

Answer

Assign the Reader role to the group at one resource group in each Prod subscription.

Question 5

Based on the exhibit, the team must prevent accidental deletion of a resource group, but administrators still need to update settings on resources inside it. Which lock should you apply?

Accepted Answer

Apply a CanNotDelete lock to RG-Prod.. Applying a CanNotDelete lock to RG-Prod prevents the resource group from being deleted while still allowing administrators to update settings on resources inside it. This lock type blocks delete operations but permits read and update operations, which aligns with the requirement to prevent accidental deletion without restricting management changes.

Answer

Apply no lock and rely on RBAC alone.

Answer

Apply a ReadOnly lock to RG-Prod.

Answer

Apply a Contributor role assignment to RG-Prod.

Question 6

Based on the exhibit, which Azure feature should the administrator use to install software and run the bootstrap script during VM provisioning?

Accepted Answer

Azure VM Custom Script Extension. The Azure VM Custom Script Extension (CSE) is the correct feature because it allows the administrator to execute scripts (such as installing software or running a bootstrap script) during VM provisioning or after the VM is running. The extension downloads the script from Azure Storage or a public URL and executes it using the local system account, making it ideal for post-deployment configuration tasks.

Answer

A network security group rule allowing RDP from the Internet

Answer

An availability set with two fault domains

Answer

A managed disk snapshot restored as the operating system disk

Question 7

You manage an Azure virtual network with multiple subnets, including a subnet named 'AppSubnet' that hosts critical application servers. You need to monitor and log network traffic to and from AppSubnet for security analysis. The solution must capture all flow logs without impacting application performance. Which three of the following should you implement? (Choose three.)

Accepted Answer

Configure a retention policy for the flow logs to manage storage costs.. Network Watcher flow logs capture IP traffic flowing through a subnet, providing security analysis without impacting performance because they are processed by the Azure network fabric, not by the VMs. Storing logs in an Azure Storage account ensures durable, cost-effective retention. Configuring a retention policy is essential to manage storage costs and comply with data lifecycle requirements.

Answer

Deploy a network virtual appliance (NVA) in a transit subnet and route all traffic through it.

Answer

Enable diagnostic settings on each virtual machine in AppSubnet to log network traffic.

Answer

Install a third-party packet capture agent on each application server.

Question 8

An NSG is associated with a subnet. It contains these inbound rules:
- Priority 100: Deny TCP 443 from Internet to Any
- Priority 200: Allow TCP 443 from 203.0.113.0/24 to Any
A tester at 203.0.113.10 browses to the VM's HTTPS endpoint in that subnet. What happens?

Accepted Answer

The request is denied because the priority 100 deny rule matches before the allow rule.. Network Security Group (NSG) rules are evaluated in priority order, from lowest to highest numeric value. The priority 100 rule explicitly denies TCP 443 from the Internet (which includes the 203.0.113.0/24 range), and it is evaluated before the priority 200 allow rule. Since the deny rule matches first, the traffic is blocked regardless of the more specific source IP in the allow rule.

Answer

The request is allowed because the more specific source range matches first.

Answer

The request is denied only if the VM has no public IP address.

Answer

The request is allowed because default NSG rules always override custom rules.

Question 9

The platform team wants to block deployment of Azure resources in any region except East US and West US. What should they configure?

Accepted Answer

An Azure Policy assignment that uses an allowed locations policy. Azure Policy's 'allowed locations' built-in policy definition enables you to restrict the regions where resources can be deployed. By assigning this policy at a management group or subscription scope with a parameter list containing only 'East US' and 'West US', any attempt to deploy resources in other regions will be denied at the Azure Resource Manager level, effectively blocking non-compliant deployments.

Answer

A Reader role assignment at the management group

Answer

A CanNotDelete lock on the subscription

Answer

A tag requirement enforced only by resource group naming

Question 10

Based on the exhibit, the company will deploy two identical web server VMs in East US 2 behind a load balancer. The service must keep running if one datacenter in the region becomes unavailable. Which deployment choice best meets the requirement?

Accepted Answer

Place one VM in each of two availability zones and front them with the load balancer.. Deploying one VM in each of two availability zones within East US 2 ensures that the VMs are physically separated across distinct datacenters, each with independent power, cooling, and networking. If one datacenter (zone) fails, the other zone remains operational, and the load balancer automatically directs traffic to the healthy VM. This meets the requirement of keeping the service running if one datacenter in the region becomes unavailable.

Answer

Place both VMs in an availability set so Azure can spread them across fault domains.

Answer

Place both VMs in one availability zone because all zones in a region share failure domains.

Answer

Deploy a single VM because Azure automatically replicates it across the region.

Question 11

Based on the exhibit, a compliance team must read all current and future resources in every subscription under the Corp management group. Where should you assign the Reader role?

Accepted Answer

Assign Reader at the Corp management group scope.. Assigning the Reader role at the Corp management group scope applies the role to all current and future subscriptions and resource groups within that management group hierarchy. This is because Azure RBAC roles assigned at a management group scope are inherited by all child management groups, subscriptions, and resources, ensuring the compliance team can read all resources across the entire Corp hierarchy without needing separate assignments.

Answer

Assign Reader at the RG-Finance resource group scope.

Answer

Assign Reader separately at each subscription scope.

Answer

Assign Reader only at the individual resource scope.

Question 12

A company creates new Azure subscriptions every month. Central IT wants all production subscriptions to inherit the same governance baseline automatically, while sandbox subscriptions remain separate. What should the administrator implement?

Accepted Answer

Organize subscriptions under management groups and assign the baseline at the appropriate management group.. Management groups allow hierarchical organization of Azure subscriptions, enabling the assignment of Azure Policy and RBAC at the management group level. By placing all production subscriptions under a dedicated management group and assigning the governance baseline (e.g., Azure Policy initiatives) to that group, new subscriptions automatically inherit the baseline without manual intervention. Sandbox subscriptions remain separate by being placed in a different management group or at the root level without the baseline.

Answer

Apply all governance controls individually to each new subscription after it is created.

Answer

Use a resource lock on the subscription root.

Answer

Place all resources into one shared resource group per business unit.

Question 13

A company wants to stop users from creating resources in any Azure region except East US and West US across all subscriptions. Which Azure feature should be used to enforce this requirement?

Accepted Answer

An Azure Policy assignment with a Deny effect at the management group scope. Azure Policy with a Deny effect at the management group scope is the correct choice because it can enforce a location constraint across all subscriptions under that management group. The Deny effect prevents the creation of resources in non-compliant regions at the time of deployment, ensuring that only East US and West US are allowed. This is a governance control that applies to all subscriptions within the scope, making it the ideal solution for this requirement.

Answer

An Azure RBAC role assignment

Answer

A CanNotDelete resource lock on the subscriptions

Answer

A tag inheritance rule on the management group

Question 14

A file server VM is corrupted after a bad change. The team needs to recover the whole machine to the latest recovery point, not just one file. Which restore workflow should they use?

Accepted Answer

Restore virtual machine. Azure Backup's 'Restore virtual machine' workflow creates a new VM from the latest recovery point, restoring the entire machine state including OS, applications, and data. This is the appropriate method when the goal is to recover the full VM after corruption, as it uses the VM-level restore point stored in the Recovery Services vault.

Answer

File and folder recovery

Answer

Modify the backup policy

Answer

Create an action group

Question 15

You create a private endpoint for an Azure SQL Database server. Virtual machines in VNet-Prod must resolve the server name to the private IP address of the endpoint. What should you configure?

Accepted Answer

A private DNS zone linked to VNet-Prod. A private endpoint uses a private IP address from your VNet, but DNS resolution must be configured to map the Azure SQL Database server name (e.g., `server.database.windows.net`) to that private IP. By creating a private DNS zone (privatelink.database.windows.net) and linking it to VNet-Prod, Azure automatically creates an A record for the private endpoint, ensuring VMs resolve the server name to the private IP instead of the public IP. This is the standard and required configuration for private endpoint name resolution.

Answer

A user-defined route on the subnet

Answer

An additional public IP address

Answer

A Recovery Services vault

Question 16

A compliance team wants newly uploaded monthly reports to remain in the Hot tier for 90 days and then move automatically to a cheaper online tier without becoming offline. Which two configurations should the administrator use? Select two.

Accepted Answer

Create a blob lifecycle management rule.. Azure Blob Lifecycle Management rules allow administrators to automate tier transitions for blobs based on age or other conditions. Option B is correct because transitioning from Hot to Cool after 90 days meets the requirement of moving to a cheaper online tier (Cool is online and less expensive than Hot) while keeping the data accessible without becoming offline.

Answer

Transition the blobs to Archive after 90 days so they cost less than Cool.

Answer

Use file share snapshots because lifecycle rules do not apply to blobs.

Answer

Enable soft delete on the container to change access tiers automatically.

Question 17

Finance, HR, and Engineering each use separate subscriptions. The compliance team wants a simple hierarchy that lets them apply governance to groups of subscriptions and produce resource ownership reports by department and environment. Which two features should the administrator use? Select two.

Accepted Answer

Management groups to organize the subscriptions into a hierarchy.. Management groups (A) are correct because they allow you to organize multiple subscriptions into a hierarchical structure for applying governance policies and role-based access control at scale. This directly supports the compliance team's need to apply governance to groups of subscriptions and produce resource ownership reports by department and environment.

Answer

Resource locks to group subscriptions by business unit.

Answer

Availability sets to group applications by department.

Answer

Private endpoints to separate Finance from HR.

Question 18

A storage account must accept traffic only from a single subnet. The team wants to keep using the storage account's public endpoint and does not want to deploy a private endpoint. What should you configure?

Accepted Answer

A service endpoint on the subnet and a storage firewall rule that allows that subnet. A service endpoint on the subnet extends the virtual network identity to the storage account, and a storage firewall rule that allows that subnet restricts access to only traffic originating from that subnet. This meets the requirement of using the public endpoint without deploying a private endpoint, as the storage account's public endpoint remains accessible but is locked down to the specified subnet via the firewall rule.

Answer

A private endpoint and private DNS zone

Answer

Read-access geo-redundant storage (RA-GRS)

Answer

Archive access tier for the container

Question 19

A contractor needs to upload files to one blob container for the next two hours. The contractor must not learn the storage account key, and access should expire automatically without manual cleanup. What is the best way to grant access?

Accepted Answer

Generate a user delegation SAS from Entra ID with only the required container permissions and a two-hour expiry.. A user delegation SAS is the correct choice because it is secured with Entra ID credentials rather than the storage account key, ensuring the contractor never learns the key. The SAS can be scoped to exactly the required container permissions and a two-hour expiry, providing automatic, time-limited access without manual cleanup. This approach aligns with the principle of least privilege and eliminates the need to share or rotate storage account keys.

Answer

Share the storage account key and ask the contractor to stop using it after two hours.

Answer

Create an account SAS with broad permissions and send it to the contractor by email.

Answer

Assign the contractor the Storage Blob Data Contributor role at the storage account scope.

Question 20

A team wants to allow a subnet to access a storage account only from that subnet, but they do not want to create a private endpoint or change DNS. The storage account should still be reachable through its public endpoint, just not from other networks. What should the administrator configure?

Accepted Answer

A service endpoint on the subnet and a storage firewall rule allowing that subnet.. A service endpoint on the subnet extends the virtual network identity to the storage account, allowing the storage firewall to restrict access to traffic originating from that specific subnet. This ensures the storage account remains reachable via its public endpoint, but only from the configured subnet, without requiring a private endpoint or DNS changes.

Answer

A private endpoint for the storage account and a private DNS zone.

Answer

A public IP address for the subnet and a storage account firewall exception.

Answer

An NSG rule that permits outbound TCP 443 to the storage account.