AZ-104 Practice Test 9 — 10 Questions

Question 1

A build agent VM is recreated from image every night. The OS can be lost on reimage, but build caches and artifacts must persist across rebuilds. The team also wants the cheapest OS storage option that supports this pattern. Which two choices should you make? Select two.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an ephemeral OS disk.. An ephemeral OS disk uses the local VM storage or temp SSD, which is destroyed when the VM is deallocated or reimaged. This matches the requirement that the OS can be lost on reimage. Option B is correct because placing build caches and artifacts on a separate managed data disk ensures they persist independently of the OS disk lifecycle; data disks are not affected by OS reimaging and can be reattached to the new VM instance.

Answer

Use a Premium SSD OS disk so the reimage is preserved.

Answer

Store the caches only on the temporary resource disk.

Answer

Use an availability set to make the OS disk persistent.

Question 2

Based on the exhibit, which OS disk option best fits a development VM that is rebuilt often and does not need the disk contents to survive deallocation?

Accepted Answer

An ephemeral OS disk.. An ephemeral OS disk is created on the local VM host and not stored in Azure Storage, so it provides lower latency and is automatically deleted when the VM is deallocated. This makes it ideal for development VMs that are rebuilt often and do not require disk persistence across deallocations.

Answer

A Standard HDD managed OS disk.

Answer

A premium managed data disk used as the OS disk.

Answer

A shared disk attached to multiple VMs.

Question 3

Based on the exhibit, a shared resource group contains a production virtual machine and a storage account. Administrators must be able to update settings, but they must not be able to delete either resource by mistake. Which lock should be applied at the resource group scope?

Accepted Answer

CanNotDelete lock, because it allows updates but blocks deletion.. The CanNotDelete lock (option B) is correct because it allows administrators to update settings on the production VM and storage account while preventing accidental deletion of either resource. This lock operates at the resource group scope, applying to all resources within it, and is the appropriate choice for the stated requirement of allowing updates but blocking deletions.

Answer

ReadOnly lock, because it prevents all changes and keeps resources fully protected.

Answer

No lock is needed because Azure RBAC already prevents deletion by default.

Answer

Management group lock, because all changes in the tenant must be blocked centrally.

Question 4

Based on the exhibit, a compliance dashboard shows that several storage accounts are marked noncompliant because they do not have the required tag. The policy itself is correct, but one business unit needs a temporary exception for a single resource group during a merger. What should the administrator configure?

Accepted Answer

A policy exemption at the rg-merger01 resource group scope.. A policy exemption at the rg-merger01 resource group scope is the correct solution because it allows the administrator to temporarily exclude a specific resource group from the policy's enforcement or compliance evaluation without modifying or deleting the original policy assignment. This is designed for scenarios like mergers where a short-term exception is needed, and it maintains the policy's integrity for all other scopes.

Answer

Delete the policy assignment from corp-root and recreate it later.

Answer

Move rg-merger01 to a separate subscription so the policy no longer applies.

Answer

Change the policy effect to Audit so the resources can remain noncompliant.

Question 5

A company wants to group several subscriptions for Finance, HR, and Engineering so that the same governance settings can be applied above the subscription level. What should the administrator create?

Accepted Answer

A management group. A management group is the correct choice because it allows you to organize multiple Azure subscriptions into a hierarchy and apply governance policies, role-based access control (RBAC), and compliance settings at a scope above the subscription level. By creating a management group for Finance, HR, and Engineering, the administrator can enforce consistent Azure Policy initiatives and RBAC assignments across all three subscriptions, ensuring uniform governance without needing to configure each subscription individually.

Answer

A resource group

Answer

A tag

Answer

A resource lock

Question 6

A Windows VM and a Linux VM in Azure need to use the same shared folder for application artifacts. The team wants a managed file service instead of running a separate file server VM, and both operating systems must be able to mount the share using a standard protocol. Which solution should the administrator implement?

Accepted Answer

Create an Azure Files share and mount it over SMB from both virtual machines.. Azure Files provides a fully managed file share that supports both SMB and NFS protocols. Since the question requires a managed file service accessible by both Windows and Linux VMs using a standard protocol, the correct solution is to create an Azure Files share and mount it over SMB from both VMs. Windows natively supports SMB, and Linux can mount SMB shares using the CIFS-utils package, meeting the requirement without running a separate file server VM.

Answer

Create a blob container and mount it as a file system from both virtual machines.

Answer

Use an Azure managed disk and attach it to both virtual machines.

Answer

Create an Azure Files share and force the Linux VM to use NFS while the Windows VM uses SMB.

Question 7

A team deploys a Linux VM that must read secrets from Azure Key Vault without storing any usernames, passwords, or client secrets on the VM. What should the administrator enable on the VM?

Accepted Answer

A system-assigned managed identity. A system-assigned managed identity enables the Linux VM to authenticate to Azure Key Vault without any stored credentials. Azure automatically creates a service principal in Entra ID for the VM, and the VM can obtain an access token from the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) to authenticate to Key Vault. This eliminates the need to store usernames, passwords, or client secrets on the VM.

Answer

A storage account access key

Answer

A service endpoint on the VM subnet

Answer

A user account in Entra ID with a stored password

Question 8

A production resource group contains several VMs and a storage account. The operations manager wants to prevent accidental deletion of the resource group and its resources, but still allow normal configuration changes during maintenance windows. Which lock should be applied to the resource group?

Accepted Answer

CanNotDelete lock at the resource group scope.. A CanNotDelete lock at the resource group scope prevents the deletion of the resource group and all its resources, while still allowing configuration changes (e.g., modifying VM settings or updating storage account properties). This meets the operations manager's requirement to block accidental deletion but permit normal maintenance operations. ReadOnly locks would block all write operations, which is too restrictive for maintenance windows.

Answer

ReadOnly lock at the resource group scope.

Answer

Azure Policy assignment that denies all delete requests.

Answer

Apply the lock only to individual virtual machines.

Question 9

A hub VNet has a VPN gateway connected to on-premises networks. A new spoke VNet must reach on-premises resources through the existing hub gateway without deploying another gateway. What peering configuration should the administrator use?

Accepted Answer

Enable gateway transit on the hub peering and use remote gateways on the spoke peering.. It enables the hub VNet's VPN gateway to be shared with the spoke VNet without deploying a separate gateway. 'Gateway transit' on the hub peering allows the hub to advertise routes from its VPN gateway to the spoke, while 'Use remote gateways' on the spoke peering allows the spoke to use the hub's gateway for outbound traffic to on-premises. This configuration ensures the spoke can reach on-premises resources through the hub's VPN tunnel.

Answer

Enable forwarded traffic on both peerings and create a route table in the spoke.

Answer

Deploy a private endpoint in the spoke for each on-premises subnet.

Answer

Create a service endpoint on the spoke subnet for Microsoft.Network.

Question 10

An administrator is deploying a new storage account for an application. The account must support blob containers, an Azure Files share, lifecycle rules for blobs, and standard access tiers. The application does not need premium performance for a single data service. Which storage account kind should be chosen?

Accepted Answer

General-purpose v2, because it supports blobs, files, access tiers, and lifecycle management.. General-purpose v2 (GPv2) storage accounts are the correct choice because they support all storage object types (blobs, files, queues, tables), standard access tiers (hot, cool, archive), and lifecycle management policies for blobs. This meets all the stated requirements without needing premium performance for a single data service.

Answer

BlobStorage, because it is optimized only for block blob workloads.

Answer

General-purpose v1, because it can host any storage object type.

Answer

BlockBlobStorage, because it is the best choice for any application that stores files.