AZ-104 Mock Exam 71 — 25 Questions

Question 1

Based on the exhibit, the business wants two Azure VMs to stay available if a host is patched or fails. A full datacenter outage is not part of the requirement. What should you use?

Accepted Answer

Deploy the VMs in an availability set.. An availability set protects against failures within a single datacenter by distributing VMs across multiple fault domains (physical racks with separate power and network) and update domains (groups that are patched sequentially). This ensures that during host patching or a host failure, at least one VM remains available, meeting the requirement without needing to survive a full datacenter outage.

Answer

Deploy the VMs in the same availability zone.

Answer

Use a virtual machine scale set with autoscale only.

Answer

Place both VMs on a dedicated host.

Question 2

A user is assigned the Reader role on a resource group named RG1. Later, a new storage account is created in RG1. What access will the user have to that storage account without any new role assignment?

Accepted Answer

Reader access, because the resource group assignment is inherited by the storage account.. Option B is correct because Azure RBAC permissions assigned at a resource group scope are inherited by all resources within that resource group, including resources created after the assignment. Since the user has the Reader role on RG1, that role is inherited by the new storage account, granting read-only access to it without any additional role assignment.

Answer

No access, because RBAC assignments do not apply to resources created later.

Answer

Contributor access, because storage accounts inherit the highest available permissions.

Answer

Owner access, because resource group permissions always become full control on child resources.

Question 3

Finance wants every resource created in one production resource group to receive the tag CostCenter=FINSVC automatically, but deployments should not be blocked if a template omits the tag. Existing resources should be updated when possible. Which two actions should the administrator take? Select two.

Accepted Answer

Assign a Modify policy that adds or updates the CostCenter tag.. Option A is correct because a Modify effect policy definition can automatically add or update the CostCenter tag on resources during creation or update, without blocking deployments if the tag is missing. This satisfies the requirement that deployments should not be blocked, as the Modify effect only applies the tag rather than denying non-compliant requests.

Answer

Apply a ReadOnly lock to the resource group to keep tags consistent.

Answer

Assign Reader to the resource group to ensure tag visibility.

Answer

Use only an Audit policy so teams can see missing tags.

Question 4

Finance, HR, and Engineering each use separate subscriptions. The compliance team wants a simple hierarchy that lets them apply governance to groups of subscriptions and produce resource ownership reports by department and environment. Which two features should the administrator use? Select two.

Accepted Answer

Management groups to organize the subscriptions into a hierarchy.. Management groups (A) are correct because they allow you to organize multiple subscriptions into a hierarchical structure for applying governance policies and role-based access control at scale. This directly supports the compliance team's need to apply governance to groups of subscriptions and produce resource ownership reports by department and environment.

Answer

Resource locks to group subscriptions by business unit.

Answer

Availability sets to group applications by department.

Answer

Private endpoints to separate Finance from HR.

Question 5

A web app in Azure needs to upload files to a blob container. The development team wants the app to authenticate without storing a storage account key or password in code. Which approach should the administrator configure?

Accepted Answer

Assign a managed identity to the app and grant it storage permissions. Option B is correct because Azure Managed Identity provides an automatically managed service principal in Azure AD, allowing the web app to authenticate to Azure Blob Storage without storing any credentials in code or configuration. By assigning the managed identity to the app and granting it the appropriate RBAC role (e.g., Storage Blob Data Contributor), the app can obtain an Azure AD token to securely access the blob container.

Answer

Embed the storage account key in the application settings

Answer

Use the public endpoint and anonymous access

Answer

Use an archive tier for the container

Question 6

A VM-based app must upload invoices to a blob container every hour. Security prohibits storing account keys or SAS tokens on the VM. The app should authenticate with Microsoft Entra ID and be allowed only to write blobs in one container. What should you configure?

Accepted Answer

Enable a managed identity on the VM and assign Storage Blob Data Contributor at the container scope.. Option B is correct because enabling a managed identity on the VM allows the app to authenticate with Microsoft Entra ID without storing any secrets. Assigning the Storage Blob Data Contributor role at the container scope grants the VM’s managed identity the minimum required permission to write blobs only to that specific container, adhering to the principle of least privilege.

Answer

Create an account SAS token and store it in the VM's application settings.

Answer

Assign Reader on the storage account so the VM can reach the container securely.

Answer

Grant Storage Account Contributor at the subscription scope so the app can manage all storage resources.

Question 7

A web app in a subnet must access a storage account through the storage account's public FQDN. Access must be limited to that single subnet, and the team does not want to deploy a private endpoint or manage private DNS records. Which configuration should you use?

Accepted Answer

Enable a service endpoint on the subnet and allow that subnet in the storage account network rules.. Option B is correct because a service endpoint on the subnet allows the web app to access the storage account via its public FQDN while restricting access to that specific subnet. By enabling the Microsoft.Storage service endpoint on the subnet and adding the subnet's virtual network rule to the storage account's network rules, traffic from the subnet to the storage account's public endpoint is routed through the Azure backbone network, and only traffic from that subnet is permitted. This meets the requirement of limiting access without deploying a private endpoint or managing private DNS records.

Answer

Deploy a private endpoint and private DNS zone.

Answer

Add a route table that sends storage traffic to an NVA.

Answer

Place the storage account behind a public load balancer.

Question 8

A VM-based application needs to read from Azure Storage without storing a password, access key, or other secret in code or configuration. The identity should also be removed automatically if the VM is deleted. What should you enable?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity is the correct choice because it is tied directly to the lifecycle of the Azure VM: when the VM is deleted, the identity is automatically removed. It allows the VM to authenticate to Azure Storage without storing any secrets in code or configuration, using Azure AD tokens obtained via the Azure Instance Metadata Service (IMDS) endpoint at 169.254.169.254.

Answer

A user-assigned managed identity

Answer

A storage account access key

Answer

A shared access signature

Question 9

A team wants to allow a subnet to access a storage account only from that subnet, but they do not want to create a private endpoint or change DNS. The storage account should still be reachable through its public endpoint, just not from other networks. What should the administrator configure?

Accepted Answer

A service endpoint on the subnet and a storage firewall rule allowing that subnet.. Option C is correct because a service endpoint on the subnet extends the virtual network identity to the storage account, allowing the storage firewall to restrict access to traffic originating from that specific subnet. This ensures the storage account remains reachable via its public endpoint, but only from the configured subnet, without requiring a private endpoint or DNS changes.

Answer

A private endpoint for the storage account and a private DNS zone.

Answer

A public IP address for the subnet and a storage account firewall exception.

Answer

An NSG rule that permits outbound TCP 443 to the storage account.

Question 10

Based on the exhibit, what should the administrator change so the web tier can reach the database tier on TCP 443 without opening the subnet more broadly?

Accepted Answer

Move the allow rule for WebTierASG to a priority lower than 100.. Option A is correct because the administrator must ensure the allow rule for WebTierASG is evaluated before the deny-all rule. In Azure Network Security Groups (NSGs), rules are processed in priority order (lower numbers first). The current deny rule at priority 100 blocks all traffic from VirtualNetwork, including TCP 443 from the web tier. By moving the allow rule to a priority lower than 100 (e.g., 90), it will be evaluated first, permitting TCP 443 traffic from WebTierASG to the database tier, while the deny rule still blocks all other traffic from the virtual network.

Answer

Delete the deny rule because default rules already block unwanted traffic.

Answer

Change the deny rule source from VirtualNetwork to Internet.

Answer

Change the default inbound rule to AllowVnetInBound.

Question 11

Based on the exhibit, what should the administrator change so outbound internet traffic uses the NAT gateway?

Accepted Answer

Remove the 0.0.0.0/0 user-defined route to the virtual appliance.. The correct answer is B because the user-defined route (UDR) with destination 0.0.0.0/0 pointing to the virtual appliance is overriding the default route to the NAT gateway. For outbound internet traffic to use the NAT gateway, the 0.0.0.0/0 route must point to the NAT gateway's private IP address or be removed entirely so the system route to the NAT gateway takes precedence. Removing this UDR allows the NAT gateway to handle all outbound traffic from the subnet.

Answer

Detach the subnet from the NAT gateway.

Answer

Change the route table source address to 10.1.0.4.

Answer

Enable a service endpoint on the subnet.

Question 12

Based on the exhibit, which identity approach should be used so all three virtual machines can reuse the same Azure access without sharing secrets?

Accepted Answer

Use a user-assigned managed identity and attach it to all three VMs.. A user-assigned managed identity is a standalone Azure resource that can be assigned to multiple Azure VMs, allowing all three VMs to authenticate to Azure services (e.g., Azure Storage, Key Vault) using the same identity without sharing any secrets. This approach eliminates the need to manage or rotate credentials, as the identity is managed entirely by Azure AD and tokens are obtained via the Azure Instance Metadata Service (IMDS) endpoint.

Answer

Assign a system-assigned managed identity to each VM.

Answer

Create a storage account access key and place it in each VM's application settings.

Answer

Create a separate SAS token for each VM and rotate it manually.

Question 13

Based on the exhibit, which identity should be enabled on the VM so the application can access Azure Blob Storage and the identity disappears when the VM is deleted?

Accepted Answer

System-assigned managed identity. A system-assigned managed identity is tied directly to the lifecycle of the Azure VM — when the VM is deleted, the identity is automatically removed. It can be granted access to Azure Blob Storage via Azure RBAC, allowing the application to authenticate without storing credentials. This matches the requirement for an identity that disappears with the VM.

Answer

User-assigned managed identity

Answer

Storage account shared key

Answer

SAS token stored in a startup script

Question 14

Based on the exhibit, what should the administrator configure so the operations team receives an email when the VM's average CPU stays above 80% for 10 minutes?

Accepted Answer

Create an action group and attach it to the metric alert rule.. To send an email when a metric threshold is breached, you must first create an action group that defines the notification action (e.g., email, SMS). Then, when configuring the metric alert rule for 'Percentage CPU' with a condition of 'greater than 80%' for 10 minutes, you attach that action group to the alert rule. This ensures that when the alert fires, the defined email notification is sent to the operations team.

Answer

Create a diagnostic setting on the VM and send platform logs to Log Analytics.

Answer

Assign a Reader role to the operations team on the VM resource.

Answer

Enable a resource lock on the VM to prevent CPU spikes.

Question 15

Based on the exhibit, why is the administrator's HTTPS test still being denied, and what should be changed?

Accepted Answer

Move Allow-HTTPS-Admin to a priority lower than 200.. The administrator's HTTPS test is denied because Azure Network Security Groups (NSGs) process rules in priority order, from lowest to highest numeric value. The deny rule at priority 200 is evaluated before the allow rule at priority 300, so the HTTPS traffic is blocked. To allow HTTPS traffic, the allow rule must have a lower priority number (e.g., 100) than the deny rule, ensuring it is evaluated first. Option B correctly identifies that moving Allow-HTTPS-Admin to a priority lower than 200 (i.e., a smaller number) will allow the traffic before the deny rule is applied.

Answer

Increase the deny rule priority number from 200 to 300.

Answer

Change Allow-HTTPS-Admin to use protocol Any.

Answer

Assign a public IP address to the VM.

Question 16

Based on the exhibit, which Network Watcher tool should you use to determine whether an NSG allows or denies TCP 1433 traffic and which rule is responsible?

Accepted Answer

IP flow verify. IP flow verify tests a specific source/destination IP, port, and protocol (TCP 1433) against the effective NSG rules to report whether traffic is allowed or denied, and it identifies the exact NSG rule (name and priority) responsible for that decision. This makes it the correct tool for determining NSG rule impact on a specific traffic flow.

Answer

Connection troubleshoot

Answer

Packet capture

Answer

Next hop

Question 17

RG-Prod is locked during a change freeze with a CanNotDelete lock. Administrators still need to keep the environment healthy without removing the lock. Which three actions can still be completed? Select three.

Accepted Answer

Change the size of an existing virtual machine in the resource group.. A CanNotDelete lock prevents deletion of resources but allows all management operations that do not involve deletion. Changing the size of an existing virtual machine is a modification operation, not a deletion, so it is permitted under this lock type.

Answer

Delete an unused storage account from the resource group.

Answer

Delete the entire resource group to rebuild it from scratch.

Question 18

Based on the exhibit, which restore option should the administrator use to recover only the deleted file while keeping the VM online?

Accepted Answer

Use File Recovery from the Recovery Services vault.. Option B is correct because Azure Backup's File Recovery feature allows you to mount a recovery point as a drive on the VM, enabling you to browse and restore individual files without affecting the running VM. This avoids the need to restore the entire VM or take it offline, which is essential for recovering only the deleted file while maintaining availability.

Answer

Restore the entire virtual machine to the latest recovery point.

Answer

Redeploy the VM from the original image.

Answer

Disable backup protection and then re-enable it.

Question 19

Based on the exhibit, which redundancy setting should you choose before deploying the storage account?

Accepted Answer

RA-GZRS, because it provides zone redundancy and read access to the secondary region.. RA-GRS (Read-Access Geo-Redundant Storage) is the correct choice because the exhibit shows a requirement for read access to the secondary region in the event of a primary region outage. RA-GRS provides zone-level redundancy within the primary region (using LRS for three copies) and asynchronously replicates data to a secondary region, where it is also stored with LRS. The 'RA' prefix enables read access to the secondary endpoint, allowing applications to serve read requests from the secondary region even when the primary is unavailable.

Answer

LRS, because it keeps three copies within one datacenter and is the least expensive option.

Answer

ZRS, because it replicates data across availability zones in the primary region.

Answer

GZRS, because it combines zone redundancy with geo-replication to another region.

Question 20

Which two settings can you configure in an Azure Backup policy for a virtual machine? Select two.

Accepted Answer

Backup schedule. Option A is correct because an Azure Backup policy for a virtual machine includes a 'Backup schedule' setting that defines how often (e.g., daily or weekly) and at what time the backup job runs. This schedule controls the frequency of recovery point creation, which is essential for meeting recovery point objectives (RPOs).

Answer

Virtual network peering

Answer

Network security group rules

Answer

Public IP allocation

AZ-104 Mock Exam 71 — 25 Questions

Exhibit

AZ-104 Mock Exam 71 — 25 Questions

Exhibit