AZ-104 Practice Exam 70 — 20 Questions

Question 1

A storage account must be reachable only from workloads in one Azure subnet. The team wants to keep using the storage account's public FQDN, avoid creating a private IP address in the virtual network, and avoid managing private DNS zones. What should the administrator configure?

Accepted Answer

A service endpoint on the subnet and a storage firewall rule for that subnet. A service endpoint on the subnet and a storage firewall rule for that subnet is correct because it allows the storage account to be reachable only from workloads in one Azure subnet while still using the storage account's public FQDN. Service endpoints extend the virtual network identity to the storage account over the Microsoft backbone, and the firewall rule restricts access to that specific subnet. This avoids creating a private IP address in the virtual network and eliminates the need to manage private DNS zones, as the public endpoint is retained.

Answer

A private endpoint for the storage account

Answer

An NSG rule that allows TCP 443 to the storage account

Answer

An application security group tied to the storage account

Question 2

A subnet has a route table with these user-defined routes: 10.10.0.0/16 to Virtual appliance, 10.10.5.0/24 to Virtual network gateway, and 10.10.5.128/25 to Virtual network. The subnet is attached to a VM that sends traffic to several destinations. Which three next-hop decisions are correct? Select three.

Accepted Answer

Traffic to 10.10.5.9 uses Virtual network gateway.. Option A is correct because the route table uses longest prefix match. The destination 10.10.5.9 falls within the 10.10.5.0/24 range, which has a more specific prefix (24 bits) than 10.10.0.0/16 (16 bits). The user-defined route for 10.10.5.0/24 specifies a next hop of Virtual network gateway, so traffic to 10.10.5.9 is forwarded to the gateway.

Answer

Traffic to 10.10.5.9 uses Virtual appliance.

Answer

Traffic to 8.8.8.8 uses Virtual appliance.

Question 3

A storage account must be reachable only from a single subnet. The team wants to keep the storage public endpoint in place, avoid a private endpoint, and avoid managing any custom DNS records. Which change best meets the requirement?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and add the subnet to the storage account firewall allow list.. Option B is correct because enabling a service endpoint for Microsoft.Storage on the subnet injects the subnet's identity into the traffic to the storage account, allowing the storage account firewall to permit access only from that subnet while keeping the public endpoint active. This avoids the need for a private endpoint, custom DNS records, or additional routing appliances, directly meeting the requirement of restricting access to a single subnet.

Answer

Add a network security group rule to the subnet that allows outbound TCP 443 to the storage account.

Answer

Create a private endpoint and set the storage account to use a private DNS zone.

Answer

Create a route table that sends storage traffic through an Azure Firewall appliance.

Question 4

A storage account has public network access disabled. An application runs on a VM in a VNet and must access the storage account over a private IP address. The team also wants the storage name to resolve to a private address inside the VNet without changing application code. What should the administrator create?

Accepted Answer

A private endpoint for the storage account and a corresponding private DNS zone link.. A private endpoint assigns the storage account a private IP from the VNet, making it accessible over a private IP address. A corresponding private DNS zone link (e.g., privatelink.blob.core.windows.net) ensures the storage account name resolves to that private IP inside the VNet without modifying application code, meeting both requirements.

Answer

A service endpoint on the subnet and a storage account firewall rule allowing that subnet.

Answer

An account SAS token with read/write permissions for the application.

Answer

Allow trusted Microsoft services to bypass the storage firewall.

Question 5

A storage account must be reachable only from one subnet. The team does not want to deploy a private endpoint or manage private DNS zones, and they are acceptable with the storage account continuing to use its public endpoint. Which feature should be configured on the subnet?

Accepted Answer

A service endpoint for Microsoft.Storage. Option B is correct because a service endpoint for Microsoft.Storage allows a subnet to restrict access to a storage account's public endpoint without deploying a private endpoint or managing private DNS zones. When enabled, Azure adds the subnet's identity to traffic from that subnet, and the storage account's firewall can be configured to allow only that specific subnet, keeping the public endpoint active.

Answer

A private endpoint for the storage account

Answer

A route table with a default route to the storage account

Answer

An application security group containing the subnet

Question 6

A storage account should accept traffic only from one subnet, but the team does not want to create a private IP address for the service in the virtual network. What should they enable?

Accepted Answer

Service endpoint, because it allows the subnet to access the storage service securely over the Azure backbone.. Service endpoints allow a subnet to access Azure PaaS services (like Storage) over the Azure backbone without requiring a private IP address. By enabling a Microsoft.Storage service endpoint on the subnet and configuring the storage account firewall to allow traffic only from that subnet, the team meets the requirement securely and cost-effectively.

Answer

Private endpoint, because it is the only way to allow one subnet.

Answer

User-assigned managed identity, because it controls subnet access.

Answer

Blob soft delete, because it helps restrict where traffic comes from.

Question 7

A storage account must remain reachable through its public endpoint for an on-premises integration server, but only one Azure subnet should be allowed to access it from Azure. The team does not want private endpoints or DNS changes. What should the administrator configure?

Accepted Answer

Enable a service endpoint on the subnet and add that subnet to the storage account networking rules. Option B is correct because a service endpoint extends the virtual network identity to the storage account, allowing you to restrict access to a specific subnet while keeping the public endpoint enabled for on-premises access. This meets the requirement of allowing only one Azure subnet to access the storage account from Azure without using private endpoints or DNS changes.

Answer

Add a private endpoint and disable public network access

Answer

Create a SAS token restricted to that subnet

Answer

Assign Storage Blob Data Reader to the subnet

Question 8

A subnet has an NSG with these inbound rules: priority 100 denies TCP 443 from Any, and priority 200 allows TCP 443 from an Application Security Group named WebFrontEnd. A backend VM in the subnet still does not accept traffic from the frontend tier. What should the administrator change?

Accepted Answer

Move the allow rule to a lower priority number than the deny rule.. Network Security Group (NSG) rules are evaluated in priority order, with lower numbers evaluated first. Since the deny rule has priority 100 and the allow rule has priority 200, the deny rule is evaluated first and blocks TCP 443 traffic from any source, including the WebFrontEnd Application Security Group. To allow the frontend traffic, the allow rule must be moved to a lower priority number (e.g., 90) so it is evaluated before the deny rule.

Answer

Change the allow rule source from an Application Security Group to VirtualNetwork.

Answer

Attach a user-defined route to the subnet so traffic bypasses the NSG.

Answer

Place the backend VM in a different availability set so the rule is evaluated differently.

Question 9

A subnet NSG contains these inbound rules: Priority 100 denies TCP 8443 from VirtualNetwork to any destination, Priority 110 allows TCP 8443 from AzureLoadBalancer to any destination, and Priority 200 allows TCP 8443 from ASG-Web to ASG-App. The app VM NIC has no additional inbound rules. Web servers are members of ASG-Web and the app VM is a member of ASG-App. The web tier still cannot connect to TCP 8443. What should the administrator change?

Accepted Answer

Move the allow rule for ASG-Web to ASG-App to a priority lower than 100.. The correct answer is A because NSG rules are evaluated in priority order, from lowest to highest number. The deny rule at priority 100 explicitly blocks TCP 8443 from VirtualNetwork, which includes traffic from ASG-Web (since ASG-Web members are within the virtual network). The allow rule at priority 110 only permits traffic from AzureLoadBalancer, not from ASG-Web. The allow rule at priority 200 is never evaluated because the deny rule at priority 100 matches first. By moving the allow rule for ASG-Web to ASG-App to a priority lower than 100 (e.g., 90), it will be evaluated before the deny rule, allowing the web servers to connect.

Answer

Replace ASG-Web with the VirtualNetwork service tag in the allow rule.

Answer

Add a route table that sends TCP 8443 traffic to the app subnet.

Answer

Create a second NSG on the app NIC with an allow rule at priority 50.

Question 10

An operations team needs to start and deallocate every virtual machine in RG-App and read VM settings, but they must not be able to delete VMs or manage networking resources. What is the best Azure RBAC solution?

Accepted Answer

Create a custom role and assign it at the RG-App resource group scope. Option B is correct because the required permissions—starting, deallocating, and reading VM settings—are not fully covered by any built-in role, and the custom role must be scoped to RG-App to avoid granting broader access. A custom role allows combining Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/read, while explicitly excluding delete and networking management actions. Assigning at the resource group scope ensures the permissions apply only to resources within RG-App.

Answer

Assign the Virtual Machine Contributor role at the subscription scope

Answer

Assign the Reader role at the resource group scope

Answer

Assign the Owner role at the resource group scope

Question 11

Based on the exhibit, an auditor needs to view all resources in RG-Finance but must not be able to make any changes. The auditor also should not have access to other resource groups. Which RBAC assignment best meets the requirement?

Accepted Answer

Reader at RG-Finance scope, because it allows viewing without granting write permissions.. The Reader role at the RG-Finance scope grants read-only access to all resources within that specific resource group, preventing any modifications. This meets the auditor's requirement to view resources in RG-Finance without write permissions and without access to other resource groups, as the scope is limited to RG-Finance.

Answer

Reader at the subscription scope, because it is read-only and easy to manage.

Answer

Contributor at RG-Finance scope, because the auditor needs to read tags and configuration.

Answer

Reader at the management group scope, because all finance resources are grouped there.

Question 12

The operations team wants 3 to 8 identical Linux VM instances, with more instances added when average CPU stays above 70 percent for 10 minutes and removed when load falls. Which three settings should be configured? Select three.

Accepted Answer

Use a virtual machine scale set for the identical application instances.. A virtual machine scale set (VMSS) is the correct Azure service for deploying and managing a group of identical, load-balanced Linux VMs that can automatically scale in and out based on demand. It supports autoscaling rules that adjust the instance count within a defined range, meeting the requirement for 3 to 8 identical instances with automatic addition when average CPU exceeds 70% for 10 minutes and removal when load falls.

Answer

Place the VMs in an availability set instead of using a scale set.

Answer

Clone the VM manually whenever CPU rises and remove clones by hand later.

Question 13

A subnet must send traffic to on-premises networks through a VPN gateway, but internet-bound traffic should use the Azure platform's normal outbound path and not be forced through a virtual appliance. The administrator wants to avoid creating a 0.0.0.0/0 user-defined route. Which design meets the requirement?

Accepted Answer

Associate a route table that contains only the specific on-premises prefixes and leave gateway route propagation enabled.. Option A is correct because it uses a route table with only the specific on-premises prefixes, which forces traffic destined for those prefixes through the VPN gateway, while leaving gateway route propagation enabled. With gateway propagation enabled, the VPN gateway's learned routes (including the 0.0.0.0/0 route from the on-premises network) are not automatically added to the subnet's route table unless explicitly propagated; instead, the subnet's effective routes combine the user-defined routes (UDRs) for on-premises prefixes with the Azure default system routes, which include a 0.0.0.0/0 route to the internet. This ensures internet-bound traffic uses the Azure platform's normal outbound path without a forced tunnel through the virtual appliance or VPN gateway.

Answer

Add a 0.0.0.0/0 route to the VPN gateway and disable gateway route propagation.

Answer

Create a service endpoint for the subnet and use it as the default next hop.

Answer

Attach an NSG rule that allows on-premises traffic and blocks all internet traffic.

Question 14

A subnet has these inbound NSG rules: Rule 100 denies TCP 3389 from Internet, Rule 200 allows TCP 3389 from 10.0.0.0/8, and Rule 300 allows TCP 3389 from AzureLoadBalancer. An administrator in 10.20.5.4 cannot RDP to a VM in the subnet. Why is the connection denied?

Accepted Answer

The deny rule at priority 100 matches before the allow rule at priority 200.. Option A is correct because Network Security Group (NSG) rules are evaluated in priority order, from lowest number to highest. Rule 100 with priority 100 denies TCP port 3389 from the Internet source, which includes all IP addresses not explicitly part of Azure virtual networks, such as the 10.20.5.4 address (since it is not in the 10.0.0.0/8 range). The deny rule matches first, so the connection is blocked before the allow rule at priority 200 can be evaluated.

Answer

The AzureLoadBalancer service tag blocks all other inbound traffic on that port.

Answer

The VM needs a public IP address for RDP to work from a private source.

Answer

NSG rules are processed by longest prefix match, so the /8 source loses to the /32 VM address.

Question 15

An administrator enabled diagnostic settings on an Azure Storage account using the resource-specific schema. A coworker then ran a query against AzureDiagnostics and got no rows, even though failed blob writes occurred during the last hour. What is the best fix?

Accepted Answer

Query the storage account's dedicated resource-specific log table and filter for failed write operations.. When a diagnostic setting is configured with the resource-specific schema, Azure routes logs to dedicated tables (e.g., StorageBlobLogs) rather than the legacy AzureDiagnostics table. Querying AzureDiagnostics returns no rows because the logs are not stored there. The correct fix is to query the appropriate resource-specific log table (e.g., StorageBlobLogs) and filter for failed write operations, as this table contains the detailed, schema-specific data for the storage account's blob operations.

Answer

Switch the diagnostic setting back to the legacy AzureDiagnostics schema so all logs land there.

Answer

Use the Azure Activity log because blob write failures are always control-plane events.

Answer

Create a metric alert on storage capacity because that metric includes failed requests.

Question 16

A team manages 20 web VMs and 15 app VMs that scale independently. The administrator needs an NSG rule that allows only the web tier to reach the app tier on TCP 8443, and future VM additions must be included automatically without editing IP addresses. What should the administrator use in the NSG rule?

Accepted Answer

A source application security group for the web tier and a destination application security group for the app tier.. Application security groups (ASGs) allow you to define network security rules based on logical groupings of VMs, regardless of their IP addresses. By assigning the web tier VMs to a source ASG and the app tier VMs to a destination ASG, the NSG rule automatically includes any new VMs added to those groups, meeting the requirement for dynamic inclusion without manual IP edits.

Answer

A service endpoint on the subnet where the app VMs are deployed.

Answer

A user-defined route between the web subnet and app subnet.

Answer

A load balancer backend pool for both tiers.

Question 17

Based on the exhibit, what inbound NSG rule should the administrator add to allow only the web tier to reach the app tier on TCP 8080?

Accepted Answer

Source: WebASG, Destination: AppASG, Protocol: TCP, Port: 8080, Priority: 250. Option A is correct because the inbound NSG rule must allow traffic from the web tier (source: WebASG) to the app tier (destination: AppASG) on TCP port 8080. A priority of 250 is lower than the default rules (65000+) and ensures this rule is evaluated before any higher-numbered deny rules, while being high enough to leave room for more specific rules if needed.

Answer

Source: Internet, Destination: VirtualNetwork, Protocol: TCP, Port: 8080, Priority: 250

Answer

Source: AppASG, Destination: WebASG, Protocol: TCP, Port: 8080, Priority: 250

Answer

Source: WebASG, Destination: AppASG, Protocol: TCP, Port: 8080, Priority: 350

Question 18

Based on the exhibit, the VPN gateway deployment fails during validation. What resource is missing?

Accepted Answer

A public IP address resource associated with the VPN gateway.. A VPN gateway requires a dedicated public IP address resource to establish the IPsec tunnel with the on-premises VPN device. During validation, Azure checks that a public IP address is associated with the gateway; if missing, the deployment fails because the gateway cannot route traffic over the internet or terminate the VPN connection.

Answer

A network security group attached to GatewaySubnet.

Answer

A route table with a default route to the on-premises network.

Answer

A private endpoint for the on-premises VPN device.

Question 19

A team wants an Azure Storage account to be reachable only from a single Azure virtual network and to use a private IP address inside that network. Which option should the administrator configure?

Accepted Answer

A private endpoint for the storage account.. A private endpoint assigns a private IP address from the virtual network to the storage account, making it reachable only from that VNet over the Microsoft backbone network. This meets the requirement of exclusive access and private IP usage, unlike a service endpoint which still exposes the storage account to the public internet via its public endpoint.

Answer

A service endpoint on the subnet.

Answer

A public IP address with an NSG inbound allow rule.

Answer

A VPN gateway connection to the storage account.

Question 20

A team stores application logs in an Azure Storage account. The logs must remain available if an entire Azure availability zone in the primary region has an outage, but the team does not require a secondary region copy. Which redundancy option should you choose?

Accepted Answer

ZRS. Zone-redundant storage (ZRS) synchronously replicates data across three Azure availability zones within the primary region, ensuring durability even if an entire zone fails. Since the requirement explicitly states no secondary region copy is needed, ZRS is the correct choice because it provides intra-region zone-level resilience without cross-region replication.

Answer

LRS

Answer

GRS

Answer

RA-GRS