AZ-104 Practice Exam 69 — 20 Questions

Question 1

A platform team wants every current and future subscription under the company's Azure hierarchy to inherit Reader access for a central audit group. The team does not want to create separate assignments for each subscription. Where should the role be assigned?

Accepted Answer

At the management group that contains the subscriptions.. Assigning the Reader role at the management group level ensures that all current and future subscriptions within that management group inherit the assignment via Azure RBAC inheritance. This meets the requirement without needing separate assignments per subscription, as role assignments flow down the hierarchy from management group to subscription to resource group to resource.

Answer

At one subscription and rely on inheritance to reach the others.

Answer

At a resource group in a single subscription.

Answer

At an individual resource that the audit team will inspect.

Question 2

A payroll application in a VNet must access an Azure Storage account containing confidential blobs. The security team requires the storage account to be reachable only over a private IP, and public network access must be disabled. Which feature should the administrator implement?

Accepted Answer

A private endpoint for the storage account in the VNet.. A private endpoint assigns the storage account a private IP address from the VNet, enabling secure access over a private connection while completely disabling public network access. This meets the security team's requirement because traffic never traverses the public internet, and the storage account's firewall can be configured to deny all public traffic.

Answer

A service endpoint for Microsoft.Storage on the application subnet.

Answer

A shared access signature embedded in the application configuration.

Answer

A VPN gateway connection between the subnet and the storage account.

Question 3

A production resource group must be protected from accidental deletion during a change freeze. Administrators still need to update VM sizes, rotate tags, and change NSG rules. Which two actions should the administrator take? Select two.

Accepted Answer

Apply a CanNotDelete lock to the resource group.. Option A is correct because applying a CanNotDelete lock to the resource group prevents the entire resource group from being deleted, while still allowing administrators to update VM sizes, rotate tags, and modify NSG rules. This lock type blocks delete operations but permits all read and write operations, aligning with the requirement to protect against accidental deletion during a change freeze while maintaining administrative flexibility.

Answer

Apply a ReadOnly lock to the resource group.

Answer

Use Azure Policy to deny all delete requests.

Answer

Add a Protected=true tag and use it to prevent deletion.

Question 4

A production resource group contains VMs, public IP addresses, and a storage account. During a migration window, administrators must still be able to change settings and resize VMs, but nobody should accidentally delete any resource. Which lock should you apply to the resource group?

Accepted Answer

CanNotDelete. The CanNotDelete lock prevents any user or process from deleting the resource group or its resources, while still allowing all other operations including read, write, and configuration changes such as resizing VMs. This matches the requirement that administrators must be able to change settings and resize VMs but must not accidentally delete any resource.

Answer

ReadOnly

Answer

Contributor

Answer

Azure Policy

Question 5

An engineering team stores build artifacts that are downloaded every day by developers for a week after release, then rarely after that. Which tier should the administrator choose for the period when the artifacts are still actively used?

Accepted Answer

Hot. The Hot tier is the correct choice for the period when build artifacts are actively used because it provides the lowest access latency and highest throughput, which is essential for daily downloads by developers. Azure Blob Storage's Hot tier is optimized for frequent access patterns (e.g., multiple times per day) and incurs no data retrieval costs, making it cost-effective for this high-access phase.

Answer

Archive

Answer

Cool

Answer

Cold

Question 6

A virtual machine is already protected by Azure Backup. The business wants the VM backed up every day at 11:00 PM and wants daily recovery points retained for 30 days, without re-onboarding the VM. What should the administrator modify?

Accepted Answer

Modify the backup policy associated with the protected VM. Option B is correct because Azure Backup uses backup policies to define the backup schedule and retention rules for protected resources. By modifying the existing policy associated with the VM, you can change the backup time to 11:00 PM and set daily recovery point retention to 30 days without needing to re-onboard the VM or create a new vault.

Answer

Create a new Recovery Services vault and re-register the VM

Answer

Install a new VM extension to change retention behavior

Answer

Take a manual snapshot of the VM disk every night

Question 7

A project team adds and removes contractors every month. The admin wants Azure access to update automatically when membership changes without editing role assignments for each person. Which two actions should the admin take? Select two.

Accepted Answer

Create a Microsoft Entra ID security group for the contractors.. Option A is correct because creating a Microsoft Entra ID security group for contractors allows the admin to manage membership dynamically. When contractors are added or removed from the group, their Azure access updates automatically without needing to edit individual role assignments. This leverages group-based RBAC, where the group is assigned the role, and membership changes propagate to Azure RBAC.

Answer

Assign the Azure RBAC role directly to each contractor user account.

Answer

Create a management group for the contractors.

Answer

Use a resource lock to control access.

Question 8

A project team adds and removes contractors every month. The team wants Azure role assignments to stay the same when individual contractors leave or join, and access should be granted to everyone on the team through one control point. What should the administrator assign the Azure role to?

Accepted Answer

A Microsoft Entra security group. Assigning an Azure role to a Microsoft Entra security group provides a single control point for managing permissions. When contractors join or leave, the administrator only needs to add or remove their user accounts from the group, and the role assignments remain intact. This decouples access from individual user accounts and ensures consistent permissions for the entire team.

Answer

A Microsoft 365 group

Answer

A guest user account

Answer

A managed identity

Question 9

A production virtual machine must trigger an immediate notification whenever average CPU stays above 85 percent for 15 minutes, and the same event must also start an Azure Function that opens an incident ticket. Which two Azure Monitor components should you configure? Select two.

Accepted Answer

Create a metric alert rule on the VM CPU percentage.. A metric alert rule on the VM CPU percentage is correct because it monitors the specific metric (Percentage CPU) and triggers when the average exceeds 85% for 15 minutes, meeting the notification requirement. This rule evaluates the metric at regular intervals and fires when the condition is met, which is the standard Azure Monitor approach for real-time metric-based alerts.

Answer

Enable a diagnostic setting on the VM without creating an alert rule.

Answer

Create a Log Analytics workspace and rely on manual queries only.

Answer

Apply a resource lock so CPU usage changes are blocked.

Question 10

A Recovery Services vault protects 40 VMs by using one daily backup policy that retains recovery points for 7 days. One finance VM must keep daily recovery points for 30 days, but the other VMs should remain on the 7-day policy. What should the administrator do?

Accepted Answer

Create a second backup policy with 30-day retention and assign only the finance VM to it.. Option B is correct because Azure Backup allows multiple backup policies within a single Recovery Services vault, and you can assign different policies to different VMs. By creating a second policy with 30-day retention and assigning only the finance VM to it, the administrator meets the requirement without affecting the other 39 VMs that continue using the existing 7-day policy.

Answer

Edit the existing policy so all protected VMs inherit 30-day retention.

Answer

Move the finance VM to another resource group so it gets different retention automatically.

Answer

Apply a resource lock to the finance VM to preserve its recovery points longer.

Question 11

A records archive stores thousands of blobs that are usually read-only. The administrator wants blobs older than 90 days to move automatically to a lower-cost online tier without manual intervention. Which solution should be configured?

Accepted Answer

Create a blob lifecycle management policy with a rule that moves blobs after 90 days.. Option B is correct because Azure Blob Storage lifecycle management policies allow you to define rules that automatically transition blobs to a lower-cost access tier (e.g., from Hot to Cool or from Cool to Archive) based on the age of the blob. In this scenario, a rule can be configured to move blobs older than 90 days to the Cool or Archive tier without any manual intervention, meeting the requirement for automated cost optimization.

Answer

Manually change each blob tier when the archive team remembers to review it.

Answer

Enable object replication so the blobs are copied to another storage account.

Answer

Move the account to the Archive access tier and leave it there permanently.

Question 12

A reporting server will run an in-memory analytics application that needs 8 vCPUs and 64 GiB of RAM. The administrator wants a VM family that is a good fit for memory-heavy workloads. Which VM family should be chosen?

Accepted Answer

Memory-optimized VM family. Memory-optimized VM families (e.g., Azure E-series) are designed for workloads that require a high memory-to-vCPU ratio, such as in-memory analytics applications. The requirement of 64 GiB of RAM for 8 vCPUs (8:1 ratio) aligns with the memory-optimized profile, which offers up to 8 GiB per vCPU or more, ensuring the application's data fits entirely in RAM for low-latency processing.

Answer

Burstable VM family

Answer

Compute-optimized VM family

Answer

Storage-optimized VM family

Question 13

A Python app running on an Azure VM must upload blobs to one container in a storage account. The app must not store a storage account key or SAS token on the VM. Which two actions should the administrator take? Select two.

Accepted Answer

Enable a system-assigned managed identity on the VM.. A system-assigned managed identity on the VM allows Azure AD authentication without storing any credentials on the VM. By assigning the Storage Blob Data Contributor role to that identity at the container scope, the app can use Azure AD tokens to authenticate and upload blobs, eliminating the need for a storage account key or SAS token.

Answer

Store the storage account access key in an environment variable on the VM.

Answer

Generate a service SAS and copy it into the application configuration.

Answer

Assign the Contributor role on the resource group to the managed identity.

Question 14

A team wants daily Azure VM backups with a 30-day retention period. Which two settings are configured in the backup policy? Select two.

Accepted Answer

Backup schedule. Option A is correct because a backup policy for Azure VM backups must include a backup schedule that defines when the backup job runs (e.g., daily at a specific time). This schedule triggers the Azure Backup service to create recovery points for the VM. Without a schedule, the backup policy cannot automate the creation of backups.

Answer

Log Analytics workspace

Answer

Private endpoint

Answer

Metric alert threshold

Question 15

A storage account has public network access disabled. A VM in a virtual network must access blob data privately, and the application must resolve the storage endpoint name to a private IP address. What should the administrator deploy?

Accepted Answer

A private endpoint for the storage account plus a private DNS zone linked to the virtual network. A private endpoint assigns the storage account a private IP from the VM's virtual network, enabling direct, secure access over the Microsoft backbone. A private DNS zone linked to the virtual network ensures the storage endpoint name (e.g., mystorageaccount.blob.core.windows.net) resolves to that private IP, meeting the requirement for private name resolution without relying on public DNS or hosts file entries.

Answer

A service endpoint for Microsoft.Storage and a custom hosts file entry on the VM

Answer

Allow trusted Microsoft services and keep using the public endpoint

Answer

A route table that sends traffic for the storage account's public IP to the VPN gateway

Question 16

A security team requires all outbound traffic from a subnet to pass through an Azure Firewall at 10.1.0.4, including internet-bound traffic from the VMs. What should the administrator configure?

Accepted Answer

Create a route table with a 0.0.0.0/0 route to 10.1.0.4 and associate it with the subnet.. Option B is correct because creating a route table with a default route (0.0.0.0/0) pointing to the Azure Firewall private IP (10.1.0.4) and associating it with the subnet forces all outbound traffic, including internet-bound traffic, to be routed through the firewall. This ensures the firewall can inspect and control all egress traffic as required by the security team.

Answer

Assign a NAT gateway to the subnet and leave the default routing in place.

Answer

Enable service endpoints for the subnet so outbound traffic stays private.

Answer

Deploy a public IP on each VM and use NSG rules to inspect the traffic.

Question 17

A storage account has a private endpoint in VNet A. A VM in peered VNet B can reach the storage account by private IP, but when the VM resolves the storage account name it still gets the public IP address. What should be configured so the name resolves to the private IP from VNet B?

Accepted Answer

Link the private DNS zone for the storage service to VNet B.. When a private endpoint is created in VNet A, a private DNS zone (e.g., `privatelink.blob.core.windows.net`) is automatically linked to VNet A, enabling name resolution to the private IP within that VNet. However, VNet B is peered but not linked to that private DNS zone, so VMs in VNet B continue to resolve the storage account name via public DNS, returning the public IP. By linking the private DNS zone to VNet B, the VM will resolve the storage account name to the private IP address of the private endpoint.

Answer

Create a new storage account in VNet B.

Answer

Add an inbound NSG rule allowing DNS traffic from VNet B.

Answer

Replace the private endpoint with a service endpoint.

Question 18

An analytics platform stores daily export files in Azure Blob Storage. The business wants the storage account to survive a failure of any one availability zone and also keep a replicated copy in a paired region for disaster recovery. No one needs to read from the secondary region unless a disaster recovery event occurs. Which redundancy option should be used?

Accepted Answer

GZRS. C is correct because GZRS (Geo-Zone-Redundant Storage) combines zone-redundant storage (ZRS) within the primary region, ensuring the storage account survives any single availability zone failure, with geo-redundant replication to a paired region for disaster recovery. The secondary region copy is read-only unless a failover is initiated, matching the requirement that no one reads from the secondary region unless a disaster recovery event occurs.

Answer

ZRS

Answer

GRS

Answer

RA-GRS

Question 19

A spoke VM can connect to a hub VM by IP address after peering is configured, but it cannot resolve internal host names such as app01.corp.local. The hub has a DNS server at 10.50.1.4 that hosts those records. What should the administrator configure so the spoke VMs use that DNS server?

Accepted Answer

Set the spoke VNet's custom DNS server to 10.50.1.4.. Option B is correct because the spoke VNet must be configured to use a custom DNS server to override Azure's default internal name resolution. By setting the spoke VNet's DNS server to 10.50.1.4, all VMs in the spoke will query that server for hostname resolution, including app01.corp.local. This is a VNet-level setting that applies to all VMs in the spoke, and it does not require any changes to NSGs or peering configurations.

Answer

Add an NSG rule allowing UDP and TCP port 53 between the VNets.

Answer

Create a private endpoint for the hub DNS server.

Answer

Enable remote gateways on the spoke peering.

Question 20

A team needs to understand Azure RBAC inheritance. Which two statements are correct? Select two.

Accepted Answer

A role assignment at a resource group scope applies to resources inside that group.. Option A is correct because Azure RBAC inheritance follows a hierarchical scope model: a role assignment at a resource group scope applies to all resources within that resource group, as the resource group is the parent scope for its child resources. This means any user or group assigned a role at the resource group level automatically inherits those permissions for every resource (e.g., VMs, storage accounts) inside that group, without needing separate assignments.

Answer

A role assignment at a resource scope automatically applies to all other resources in the subscription.

Answer

A role assignment at management group scope applies only to the subscription where it was created.

Answer

A role assignment at a resource group scope is broader than a subscription scope.