AZ-104 Practice Test 9 — 10 Questions

Question 1

A Windows VM and a Linux VM in Azure need to use the same shared folder for application artifacts. The team wants a managed file service instead of running a separate file server VM, and both operating systems must be able to mount the share using a standard protocol. Which solution should the administrator implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an Azure Files share and mount it over SMB from both virtual machines.. Azure Files provides a fully managed file share that supports both SMB and NFS protocols. Since the question requires a managed file service accessible by both Windows and Linux VMs using a standard protocol, the correct solution is to create an Azure Files share and mount it over SMB from both VMs. Windows natively supports SMB, and Linux can mount SMB shares using the CIFS-utils package, meeting the requirement without running a separate file server VM.

Answer

Create a blob container and mount it as a file system from both virtual machines.

Answer

Use an Azure managed disk and attach it to both virtual machines.

Answer

Create an Azure Files share and force the Linux VM to use NFS while the Windows VM uses SMB.

Question 2

A team deploys a Linux VM that must read secrets from Azure Key Vault without storing any usernames, passwords, or client secrets on the VM. What should the administrator enable on the VM?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity enables the Linux VM to authenticate to Azure Key Vault without any stored credentials. Azure automatically creates a service principal in Entra ID for the VM, and the VM can obtain an access token from the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) to authenticate to Key Vault. This eliminates the need to store usernames, passwords, or client secrets on the VM.

Answer

A storage account access key

Answer

A service endpoint on the VM subnet

Answer

A user account in Entra ID with a stored password

Question 3

A production resource group contains several VMs and a storage account. The operations manager wants to prevent accidental deletion of the resource group and its resources, but still allow normal configuration changes during maintenance windows. Which lock should be applied to the resource group?

Accepted Answer

CanNotDelete lock at the resource group scope.. A CanNotDelete lock at the resource group scope prevents the deletion of the resource group and all its resources, while still allowing configuration changes (e.g., modifying VM settings or updating storage account properties). This meets the operations manager's requirement to block accidental deletion but permit normal maintenance operations. ReadOnly locks would block all write operations, which is too restrictive for maintenance windows.

Answer

ReadOnly lock at the resource group scope.

Answer

Azure Policy assignment that denies all delete requests.

Answer

Apply the lock only to individual virtual machines.

Question 4

A hub VNet has a VPN gateway connected to on-premises networks. A new spoke VNet must reach on-premises resources through the existing hub gateway without deploying another gateway. What peering configuration should the administrator use?

Accepted Answer

Enable gateway transit on the hub peering and use remote gateways on the spoke peering.. It enables the hub VNet's VPN gateway to be shared with the spoke VNet without deploying a separate gateway. 'Gateway transit' on the hub peering allows the hub to advertise routes from its VPN gateway to the spoke, while 'Use remote gateways' on the spoke peering allows the spoke to use the hub's gateway for outbound traffic to on-premises. This configuration ensures the spoke can reach on-premises resources through the hub's VPN tunnel.

Answer

Enable forwarded traffic on both peerings and create a route table in the spoke.

Answer

Deploy a private endpoint in the spoke for each on-premises subnet.

Answer

Create a service endpoint on the spoke subnet for Microsoft.Network.

Question 5

An administrator is deploying a new storage account for an application. The account must support blob containers, an Azure Files share, lifecycle rules for blobs, and standard access tiers. The application does not need premium performance for a single data service. Which storage account kind should be chosen?

Accepted Answer

General-purpose v2, because it supports blobs, files, access tiers, and lifecycle management.. General-purpose v2 (GPv2) storage accounts are the correct choice because they support all storage object types (blobs, files, queues, tables), standard access tiers (hot, cool, archive), and lifecycle management policies for blobs. This meets all the stated requirements without needing premium performance for a single data service.

Answer

BlobStorage, because it is optimized only for block blob workloads.

Answer

General-purpose v1, because it can host any storage object type.

Answer

BlockBlobStorage, because it is the best choice for any application that stores files.

Question 6

Three Azure VMs in separate resource groups run the same data-processing agent. The agent must read blobs from a storage account, and the access must continue to work if any VM is rebuilt or replaced. The operations team also wants one identity they can reassign to future VMs without creating another credential. Which identity approach should be used?

Accepted Answer

A user-assigned managed identity attached to the VMs.. A user-assigned managed identity (D) is the correct choice because it is a standalone Azure resource that can be created independently and then attached to multiple VMs. If a VM is rebuilt or replaced, the same user-assigned identity can be reassigned to the new VM without any credential rotation or secret management. This ensures continuous blob access via Microsoft Entra ID authentication, meeting the requirement for a single, reusable identity.

Answer

A system-assigned managed identity on each VM.

Answer

A storage account shared key embedded in the application settings.

Answer

A service principal credential stored in a Key Vault secret.

Question 7

A web workload in a subnet must use a NAT gateway for outbound internet traffic so the source IP is stable. The subnet currently has a route table with a 0.0.0.0/0 user-defined route to a virtual appliance. What should the administrator change?

Accepted Answer

Remove or replace the 0.0.0.0/0 UDR to the virtual appliance and associate the NAT gateway with the subnet.. The current route table has a 0.0.0.0/0 user-defined route (UDR) pointing to a virtual appliance, which forces all outbound traffic through that appliance. To use a NAT gateway for outbound internet traffic with a stable source IP, the administrator must remove or replace that UDR (so the default route no longer points to the appliance) and associate the NAT gateway with the subnet. The NAT gateway automatically creates a default route (0.0.0.0/0) with a next hop of 'Internet', overriding the appliance route, ensuring traffic egresses via the NAT gateway's public IP.

Answer

Add an NSG outbound allow rule for TCP 80 and TCP 443.

Answer

Create a private endpoint for the web workload.

Answer

Enable VNet peering to a hub network with a firewall.

Question 8

A contractor needs to upload files into one blob container for six hours. The administrator must avoid sharing the storage account key, and the access token should keep working even if the storage account keys are rotated later. Which access mechanism should be issued?

Accepted Answer

A user delegation SAS signed through Microsoft Entra authentication. A user delegation SAS is signed with Microsoft Entra credentials rather than the storage account key, so it remains valid even if the storage account keys are rotated. This meets the requirement to avoid sharing the account key while providing temporary, scoped access for exactly six hours. The contractor can upload files without the administrator exposing the account key or needing to manage key rotation.

Answer

An account SAS signed with the storage account key

Answer

A service SAS signed with the storage account key

Answer

The storage account access key itself in a temporary script variable

Question 9

A branch office has a single edge device with a static public IP and must connect securely to Azure so users can reach private VMs in a virtual network. The company wants traffic encrypted across the internet and does not need point-to-site access from individual laptops. Which solution should the administrator deploy?

Accepted Answer

A site-to-site VPN gateway connection.. A site-to-site VPN gateway connection (Option B) is correct because it creates an encrypted tunnel over the internet between the branch office's edge device with a static public IP and an Azure VPN gateway, allowing users to securely access private VMs in the virtual network. This solution meets the requirement for encrypted traffic across the internet without needing point-to-site access for individual laptops, as the entire branch network is connected via the VPN tunnel.

Answer

A point-to-site VPN configuration for each user laptop.

Answer

A private endpoint to each virtual machine in Azure.

Answer

VNet peering between the branch and Azure.

Question 10

A public web application runs on two Windows Server VMs in Azure. Users connect through a single public IP on TCP 443, and the solution must distribute traffic only to healthy VMs without requiring Layer 7 features such as URL-based routing. Which Azure service should the administrator deploy?

Accepted Answer

Azure Load Balancer Standard.. Azure Load Balancer Standard is the correct choice because it operates at Layer 4 (TCP/UDP) and distributes incoming traffic across healthy VM instances based on a single public IP address and port (TCP 443). It performs health probes to ensure traffic is only sent to healthy backend VMs, and it does not require any Layer 7 features like URL-based routing, making it ideal for this scenario.

Answer

Azure Application Gateway.

Answer

Azure Traffic Manager.

Answer

Azure Front Door.