AZ-104 Practice Test 8 — 10 Questions

Question 1

A platform team must deploy the same group of Azure VMs every month from source control and wants the deployment to be repeatable and reviewable. Which approach should they use?

Accepted Answer

A Bicep template in source control. Bicep is a domain-specific language (DSL) for deploying Azure resources declaratively. Storing a Bicep template in source control ensures the VM deployment is repeatable (same parameters produce identical infrastructure) and reviewable (changes are tracked via pull requests and commit history), meeting the team's requirements for infrastructure as code (IaC).

Answer

Manual portal deployment each month

Answer

A temporary virtual machine snapshot

Answer

A network security group rule collection

Question 2

An administrator needs two non-overlapping VNets in the same region to communicate directly over private IP addresses without deploying a gateway. What should be configured?

Accepted Answer

VNet peering between the two virtual networks.. VNet peering enables direct connectivity between two Azure virtual networks using private IP addresses across the Microsoft backbone, without requiring a gateway or public internet. It supports non-overlapping address spaces in the same region and provides low-latency, high-bandwidth communication. This matches the requirement exactly.

Answer

A site-to-site VPN gateway connection.

Answer

A service endpoint on both subnets.

Answer

A route table with default routes to each VNet.

Question 3

The operations team wants 3 to 8 identical Linux VM instances, with more instances added when average CPU stays above 70 percent for 10 minutes and removed when load falls. Which three settings should be configured? Select three.

Accepted Answer

Use a virtual machine scale set for the identical application instances.. A virtual machine scale set (VMSS) is the correct Azure service for deploying and managing a group of identical, load-balanced Linux VMs that can automatically scale in and out based on demand. It supports autoscaling rules that adjust the instance count within a defined range, meeting the requirement for 3 to 8 identical instances with automatic addition when average CPU exceeds 70% for 10 minutes and removal when load falls.

Answer

Place the VMs in an availability set instead of using a scale set.

Answer

Clone the VM manually whenever CPU rises and remove clones by hand later.

Question 4

Based on the exhibit, where should you assign the Reader role so the Auditors group can read every current and future resource in the Sales subscription, including resource groups created later, while not granting access to the Research subscription?

Accepted Answer

Assign Reader to the Sales subscription, because subscription-level scope includes all current and future resource groups and resources in that subscription.. Assigning the Reader role at the Sales subscription scope grants the Auditors group read access to all current and future resource groups and resources within that subscription. This is because Azure RBAC roles assigned at a subscription level are inherited by all child resource groups and resources, including those created later. The requirement explicitly excludes the Research subscription, so a subscription-level assignment is the correct and most efficient approach.

Answer

Assign Reader to RG-Web, because the group can then inherit access to resources in that resource group only.

Answer

Assign Reader to the Corp management group, because that is the only scope that can cover multiple subscriptions.

Answer

Assign Reader to each resource individually, because that avoids inheritance and limits visibility to selected items.

Question 5

A contractor needs temporary access to upload and download files in only one blob container for 8 hours. You do not want to share the storage account key, and you want to revoke access later without affecting other containers. What should you create?

Accepted Answer

A container-level SAS token backed by a stored access policy, so you can limit and revoke access.. A container-level SAS token backed by a stored access policy is the correct solution because it allows you to grant temporary, scoped access to a single blob container without exposing the storage account key. The stored access policy enables you to revoke the SAS token at any time by modifying or deleting the policy, which immediately invalidates all tokens associated with it, without affecting other containers.

Answer

A storage account access key, because it can be limited to one container by policy.

Answer

Anonymous public access on the container, because it is the easiest way to time-limit access.

Answer

Azure RBAC on the storage account only, because RBAC automatically expires after a few hours.

Question 6

A web app running in Azure App Service must upload images to a blob container without storing any account keys, passwords, or connection strings in configuration. The app uses only one Azure resource. What should the administrator configure?

Accepted Answer

A system-assigned managed identity on the App Service and an Azure RBAC role on the storage account.. A system-assigned managed identity allows the App Service to authenticate to Azure Storage without storing any credentials in configuration. By assigning the RBAC role (e.g., Storage Blob Data Contributor) to that identity, the app can securely upload images using Azure AD authentication, meeting the requirement of no account keys, passwords, or connection strings.

Answer

The storage account key, because it is the simplest way to authenticate an application securely.

Answer

A shared access signature embedded in the app settings, because SAS is the same as managed identity.

Answer

An anonymous public container with write access disabled on the account.

Question 7

Why is centralized logging especially useful during security investigations?

Accepted Answer

It makes related events from multiple devices easier to review and correlate.. Centralized logging aggregates logs from multiple sources (e.g., firewalls, servers, Azure Network Watcher) into a single repository, such as Azure Log Analytics. During security investigations, this enables security analysts to correlate events across devices (e.g., matching a suspicious IP address in firewall logs with authentication failures in domain controller logs) without manually connecting to each device. This correlation is critical for reconstructing attack timelines and identifying lateral movement, which is impossible with siloed logs.

Answer

It guarantees that attacks cannot succeed.

Answer

It replaces the need for authentication and authorization.

Answer

It forces all devices to use the same VLAN.

Question 8

A company has a virtual machine in a subnet that must access an Azure Storage account. The storage account should remain reachable through its public endpoint, but access must be limited to that subnet, and the traffic should stay on the Azure backbone rather than the internet. Which feature should the administrator configure on the subnet?

Accepted Answer

A service endpoint for Microsoft.Storage.. A service endpoint for Microsoft.Storage extends the virtual network identity to the storage account, allowing traffic from the subnet to the storage account's public endpoint to be routed over the Azure backbone network rather than the internet. This satisfies the requirement to limit access to the subnet while keeping the public endpoint reachable and traffic within Azure's infrastructure.

Answer

A private endpoint for the storage account.

Answer

A site-to-site VPN connection to the storage account.

Answer

An application security group assigned to the storage account.

Question 9

An app running on an Azure VM must access Azure SQL Database over a private IP inside the VNet. The team also wants the SQL server name to resolve to that private address without using custom host-file entries. What should be configured?

Accepted Answer

A private endpoint for Azure SQL Database and a linked private DNS zone.. A private endpoint assigns Azure SQL Database a private IP address from the VM's VNet, enabling traffic to stay within Microsoft's backbone. Linking a private DNS zone automatically resolves the SQL server's FQDN (e.g., server.database.windows.net) to that private IP, eliminating the need for custom host-file entries. This meets both requirements: private IP connectivity and DNS resolution without manual configuration.

Answer

A service endpoint on the VM subnet and a firewall rule on Azure SQL Database.

Answer

A public IP address on the VM and a SQL server firewall exception.

Answer

An NSG rule that allows outbound TCP 1433 to the SQL server.

Question 10

A VM in a virtual network must access an Azure Storage account over a private IP address, and the storage account's public endpoint must be disabled. Name resolution from the VM should resolve the storage name to the private IP. Which configuration should you use?

Accepted Answer

Private endpoint with a private DNS zone linked to the virtual network.. A private endpoint assigns a private IP from the virtual network to the storage account, effectively bringing the service into the VNet. By linking a private DNS zone to the virtual network, the VM's DNS resolution for the storage account name returns the private IP instead of the public endpoint, satisfying both the private connectivity and public endpoint disablement requirements.

Answer

Service endpoint on the subnet plus public DNS, because the storage account will expose a private IP automatically.

Answer

Network security group rules only, because they can force traffic to use private addressing.

Answer

Storage account firewall rules with Allow trusted Microsoft services, because that gives a private address path.