AZ-104 Practice Exam 67 — 20 Questions

Question 1

You plan to store backup files that are written once per week and are rarely accessed except during an audit. The company wants the lowest storage cost but still needs online access within hours, not days. Which blob access tier should you choose?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Cool. The Cool tier is the correct choice because it is designed for data that is infrequently accessed and stored for at least 30 days, offering lower storage costs than Hot while still providing millisecond latency for online access. Since backups are written once per week and rarely accessed except during an audit, Cool tier meets the requirement of online access within hours at the lowest storage cost among the online tiers.

Answer

Hot

Answer

Archive

Answer

Premium

Question 2

A contractor needs Contributor on only VM1 and VM2 in rg-prod. Other resources in rg-prod must remain untouched, and the contractor must not gain access to any other resource groups or subscriptions. Which two role-assignment scopes meet the requirement? Select two.

Accepted Answer

Assign the role at the VM1 resource scope.. Options A and B are correct because Azure RBAC role assignments can be scoped directly to an individual resource, so assigning Contributor at the VM1 resource scope (A) grants the contractor Contributor permissions on VM1 only, and assigning Contributor at the VM2 resource scope (B) grants Contributor permissions on VM2 only; neither assignment propagates to any other resource in rg-prod or to any other resource group or subscription. This precisely satisfies the requirement that the contractor have Contributor on only VM1 and VM2 while all other resources in rg-prod remain untouched and no access is gained elsewhere. Option C is incorrect because assigning Contributor at the rg-prod resource group scope would grant Contributor over every resource in rg-prod, not just VM1 and VM2. Option D is incorrect because a subscription-scope assignment would grant Contributor across all resource groups and resources in the subscription. Option E is incorrect because a management group scope would grant Contributor across all subscriptions and resource groups under that management group, which is far broader than required.

Answer

Assign the role at the rg-prod resource group scope.

Answer

Assign the role at the subscription scope.

Answer

Assign the role at the management group scope.

Question 3

A company wants an alert to be sent by email and SMS whenever a production virtual machine's CPU percentage goes above 80 percent. The administrator also wants the notification targets to be reusable by other alerts later. What should the administrator configure first?

Accepted Answer

An action group. An action group (B) is the correct first configuration because it defines the notification targets (email, SMS) that can be reused across multiple alert rules. In Azure Monitor, alert rules are decoupled from notification actions; you create an action group once and then reference it in any metric alert rule, including the CPU percentage threshold rule needed here. This ensures the administrator can meet the requirement for reusable notification targets.

Answer

A metric alert rule only

Answer

A service health alert

Answer

A diagnostic setting

Question 4

A company has 18 subscriptions under a management group named Corp. The audit team needs Reader access to all current and future subscriptions in Corp without creating one assignment per subscription. Which two statements are correct? Select two.

Accepted Answer

Assign Reader at the Corp management group scope.. Option A is correct because Azure RBAC assignments made at a management group scope are inherited by all subscriptions, resource groups, and resources beneath that management group, so a single Reader assignment at the Corp management group grants Reader to all 18 current subscriptions. Option B is correct because inheritance only applies to resources within the management group hierarchy; any new subscription must be placed under the Corp management group to automatically inherit the Reader assignment, which satisfies the 'future subscriptions' requirement without per-subscription assignments. Option C is incorrect because assigning Reader at each subscription scope requires one assignment per subscription, which the scenario explicitly wants to avoid. Option D is incorrect because a resource group scope only covers resources in that group, not the whole subscription, and would still require many assignments. Option E is incorrect because a lock (CanNotDelete or ReadOnly) is a governance control that restricts operations and does not grant Reader RBAC permissions to the audit team.

Answer

Assign Reader separately at each subscription scope.

Answer

Assign Reader at one resource group in each subscription.

Answer

Create a lock on each subscription to provide Reader access.

Question 5

A team manages 20 web VMs and 15 app VMs that scale independently. The administrator needs an NSG rule that allows only the web tier to reach the app tier on TCP 8443, and future VM additions must be included automatically without editing IP addresses. What should the administrator use in the NSG rule?

Accepted Answer

A source application security group for the web tier and a destination application security group for the app tier.. Application security groups (ASGs) allow you to define network security rules based on logical groupings of VMs, regardless of their IP addresses. By assigning the web tier VMs to a source ASG and the app tier VMs to a destination ASG, the NSG rule automatically includes any new VMs added to those groups, meeting the requirement for dynamic inclusion without manual IP edits.

Answer

A service endpoint on the subnet where the app VMs are deployed.

Answer

A user-defined route between the web subnet and app subnet.

Answer

A load balancer backend pool for both tiers.

Question 6

A PowerShell script runs on an Azure VM every night and uses Azure CLI commands to create tags and VM resources in another subscription. The script cannot store a password or client secret. What should it use to authenticate to Azure?

Accepted Answer

az login --identity.. The script runs on an Azure VM and can use a managed identity to authenticate without storing any secrets. The `az login --identity` command uses the VM's system-assigned or user-assigned managed identity to obtain an Microsoft Entra ID access token via the Azure Instance Metadata Service (IMDS) endpoint. This satisfies the requirement of no password or client secret storage.

Answer

az login with a username and password.

Answer

Connect-AzAccount with device code authentication.

Answer

An app registration secret stored in a PowerShell variable.

Question 7

Two application VMs are in the same Azure region. They must stay available during planned host maintenance, but the business does not require protection from a full datacenter outage. Which placement option should you use?

Accepted Answer

Availability set. An availability set distributes VMs across multiple fault domains (up to 3) and update domains (up to 20) within a single Azure datacenter. This ensures that during planned host maintenance, only one update domain is taken offline at a time, keeping the application VMs available. Since the requirement does not include protection from a full datacenter outage, an availability set is the correct and cost-effective placement option.

Answer

Availability zone

Answer

Shared disk

Answer

Snapshot set

Question 8

Your company stores departmental documents in an Azure file share. Users need to be able to recover previous versions of files that were deleted or modified accidentally. You need a solution that supports recovery at the file share level without deploying additional virtual machines. What should you configure?

Accepted Answer

Create share snapshots for the Azure file share.. Azure file share snapshots provide point-in-time, read-only copies of the entire file share, allowing users to recover previous versions of files that were deleted or modified accidentally. This feature operates at the file share level without requiring any additional virtual machines, making it a straightforward and cost-effective solution for version recovery.

Answer

Enable blob versioning.

Answer

Configure Azure File Sync cloud tiering.

Answer

Enable immutable blob storage.

Question 9

A container group runs a one-time import job that writes data to an external system. If the job succeeds, the container must stop and stay stopped. If the job fails, it should automatically retry by restarting. Which restart policy should the administrator choose?

Accepted Answer

OnFailure. The OnFailure restart policy is correct because it instructs Azure Container Instances (ACI) to restart the container only when the process exits with a non-zero exit code, indicating failure. For a one-time import job that must stop permanently on success (exit code 0) and retry on failure, OnFailure matches this exact behavior without unnecessary restarts.

Answer

Always

Answer

Never

Answer

Manual

Question 10

A company hosts documents in Azure Blob Storage. The files must remain available if one availability zone in the region fails. Which redundancy option should the administrator choose?

Accepted Answer

ZRS, because it stores copies across multiple availability zones in the region.. B is correct because Zone-Redundant Storage (ZRS) synchronously replicates data across three Azure availability zones within a primary region, ensuring data remains accessible if one zone fails. This meets the requirement for high availability within a single region without relying on a secondary region.

Answer

LRS, because it keeps three copies within one datacenter.

Answer

GRS, because it automatically makes the account available in another region for reads.

Answer

RA-GRS, because it is the only option that keeps a secondary copy.

Question 11

Based on the exhibit, the alert rule is firing, but the operations team is not receiving any notification. What should you change to make the alert send an email when the condition is met?

Accepted Answer

Attach an action group that includes the required email recipient.. An alert rule in Azure Monitor requires an action group to define the notification actions (e.g., email, SMS) when the alert fires. Without an action group attached to the alert rule, no notifications are sent, even if the condition is met. Option B correctly identifies that attaching an action group containing the required email recipient will enable email notifications.

Answer

Increase the evaluation frequency to 15 minutes so Azure sends a summary notification.

Answer

Create a diagnostic setting on the virtual machine and send logs to a storage account.

Answer

Move the virtual machine into a different resource group so the alert can notify the team.

Question 12

You need to deploy 20 identical Azure virtual machines for a web application and automatically scale the number of instances based on CPU demand. Which Azure feature should you use?

Accepted Answer

A Virtual Machine Scale Set. A Virtual Machine Scale Set (VMSS) is the correct Azure feature because it allows you to deploy and manage a group of identical, load-balanced VMs that can automatically scale in or out based on CPU demand using autoscale rules. This directly meets the requirement for deploying 20 identical VMs with automatic scaling based on a performance metric like CPU utilization.

Answer

An availability set

Answer

A Recovery Services vault

Answer

Boot diagnostics

Question 13

Why is centralized logging especially useful during security investigations?

Accepted Answer

It makes related events from multiple devices easier to review and correlate.. Centralized logging aggregates logs from multiple sources (e.g., firewalls, servers, Azure Network Watcher) into a single repository, such as Azure Log Analytics. During security investigations, this enables security analysts to correlate events across devices (e.g., matching a suspicious IP address in firewall logs with authentication failures in domain controller logs) without manually connecting to each device. This correlation is critical for reconstructing attack timelines and identifying lateral movement, which is impossible with siloed logs.

Answer

It guarantees that attacks cannot succeed.

Answer

It replaces the need for authentication and authorization.

Answer

It forces all devices to use the same VLAN.

Question 14

You need to deploy a set of identical Azure virtual machines that can automatically scale out during demand spikes and scale in when usage falls. Which Azure feature should you use?

Accepted Answer

A Virtual Machine Scale Set. A Virtual Machine Scale Set (VMSS) is the correct Azure feature because it is designed specifically to deploy and manage a set of identical, load-balanced VMs that can automatically scale out (increase instance count) during demand spikes and scale in (decrease instance count) when usage falls, using autoscale rules based on metrics like CPU or memory.

Answer

An availability set

Answer

A Recovery Services vault

Answer

Boot diagnostics

Question 15

You need to connect VNet-Hub and VNet-Spoke so that resources in both virtual networks can communicate privately over the Microsoft backbone. Both virtual networks are in the same region. What should you configure?

Accepted Answer

Virtual network peering. Virtual network peering (A) is the correct solution because it enables direct, private connectivity between two virtual networks over the Microsoft backbone infrastructure. Since both VNets are in the same region, you can use standard VNet peering, which routes traffic between the peered networks using only private IP addresses, with no internet transit or gateway required. This meets the requirement for private communication without any additional VPN or gateway overhead.

Answer

A site-to-site VPN

Answer

A network security group

Answer

An Azure Policy assignment

Question 16

You manage an Azure virtual network named VNet-App that contains a subnet named Subnet-Web with 40 web server VMs. The VMs must be reachable on TCP 443 from the internet, and Microsoft publishes service tags such as Internet, VirtualNetwork, and AzureLoadBalancer. You attach a network security group (NSG) named NSG-Web to Subnet-Web. You need to allow inbound HTTPS to the VMs while blocking all other inbound internet traffic. What should you configure in NSG-Web?

Accepted Answer

An inbound security rule with source Internet, destination port 443, protocol TCP, action Allow at priority 1000, and a default Deny rule for all other inbound traffic.. NSGs evaluate inbound rules by priority, and Azure provides default rules that deny inbound traffic from the internet unless a higher-priority allow rule matches. Creating an allow rule for the Internet service tag on TCP 443 permits only HTTPS, while the built-in default deny blocks everything else. Using VirtualNetwork or AzureLoadBalancer as the source would not match public client traffic, and allowing all ports would be overly permissive.

Answer

An inbound security rule with source Internet, destination port Any, protocol Any, action Allow at priority 100, and a default Deny rule for all other inbound traffic.

Answer

An inbound security rule with source AzureLoadBalancer, destination port 443, protocol TCP, action Allow at priority 100, and a default Deny rule for all other inbound traffic.

Answer

An inbound security rule with source VirtualNetwork, destination port 443, protocol TCP, action Allow at priority 65000, and a default Deny rule for all other inbound traffic.

Question 17

A company stores application log files in a general-purpose v2 storage account named stlogprodeus. Compliance requires that logs be kept for 180 days, but logs older than 30 days are almost never accessed. The security team wants to minimize storage costs without changing application code or blocking reads. Which action should you take?

Accepted Answer

Create a lifecycle management rule that moves blobs to the Cool tier after 30 days and keeps them in Cool until they are deleted at 180 days.. Lifecycle management policies can transition blobs between access tiers based on age and delete them at the end of a retention window. Moving logs to Cool after 30 days lowers cost for infrequently accessed data, while keeping them until 180 days satisfies compliance. Because the policy runs server-side, no application changes are required and reads remain immediately available.

Answer

Enable soft delete for blobs with a 180-day retention period and enable change feed to track modifications.

Answer

Create a lifecycle management rule that moves blobs to the Cool tier after 30 days and to the Archive tier after 180 days, then deletes them after 365 days.

Answer

Configure a blob index tag on each log file and enable a lifecycle rule that deletes blobs with that tag after 30 days.

Question 18

A company has an Azure VM running a production workload. The VM's OS disk is currently a Standard HDD. The administrator needs to improve the disk performance for the OS disk without recreating the VM. What should the administrator do?

Accepted Answer

Change the OS disk to a Premium SSD by using the Azure portal or Azure CLI.. Managed disks support changing the performance tier without recreating the VM. Upgrading the OS disk from Standard HDD to Premium SSD increases IOPS and throughput, directly improving performance. The other options either do not affect the OS disk performance or are not supported.

Answer

Add a new data disk and move the OS to it.

Answer

Resize the VM to a larger size that includes a temporary disk.

Answer

Enable read-only caching on the OS disk.

Question 19

You manage a line-of-business application running on an Azure virtual machine. The VM currently uses a 512-GiB Premium SSD data disk that stores a large indexed database. The database engine requires consistent low-latency access and the disk must remain online while it is resized. You need to increase the disk to 2 TiB with the least administrative effort. What should you do?

Accepted Answer

Expand the managed disk to 2 TiB in the Azure portal and then extend the volume inside the guest operating system.. Azure managed disks support online expansion, so you can increase the data disk from 512 GiB to 2 TiB while the VM remains running. After the Azure-side resize, you must extend the partition and file system inside the guest OS so the database can use the new space. This avoids the downtime and data migration that detaching, recreating, or attaching another disk would require.

Answer

Convert the VM's OS disk to a managed disk and then increase the size of the data disk.

Answer

Detach the data disk, recreate it as a 2-TiB Premium SSD, and reattach it to the VM.

Answer

Create a new 2-TiB Ultra Disk, attach it, and migrate the database by using Storage Migration Service.

Question 20

An administrator needs to deploy a Windows Server 2022 Azure VM that will run a latency-sensitive trading application. The application requires extremely low network latency and high throughput between the VM and other VMs in the same backend tier. The VMs are not part of an availability set. Which networking feature should be enabled on the VM's network interface to meet these requirements?

Accepted Answer

Accelerated networking. Accelerated networking is designed to provide low-latency, high-throughput networking by using SR-IOV to bypass the software virtual switch. It is available for many VM sizes and can be enabled on a NIC regardless of availability set membership. The other options either add latency, do not address per-VM network performance, or require specific end-to-end configuration not mentioned.

Answer

Jumbo frames (MTU 9000)

Answer

Azure Firewall with premium tier

Answer

Azure Load Balancer with HA ports