AZ-104 Deploy and Manage Azure Compute — 30 Questions

Question 1

You have an application that writes heavily to Azure-managed disks and requires the highest consistent IOPS and lowest latency. Which disk type should you choose?

Accepted Answer

Ultra Disk. Azure Ultra Disk offers the highest performance among Azure managed disks, with up to 160,000 IOPS per disk and sub-millisecond latency, exceeding Premium SSD v2's 80,000 IOPS. Therefore, Ultra Disk is the correct choice for applications requiring the highest consistent IOPS and lowest latency.

Answer

Standard HDD

Answer

Standard SSD

Answer

Premium SSD v2

Question 2

You need to run a scheduled script on an Azure virtual machine every time the VM starts. Which feature should you use?

Accepted Answer

A Custom Script Extension. To run a script every time an Azure VM starts, use the Custom Script Extension to deploy a script that creates a scheduled task configured to run at system startup. The Custom Script Extension itself executes only during provisioning or when manually invoked; it does not rerun automatically on each boot. Therefore, B is correct because it is the only option that allows executing custom code, and you can use it to set up the startup trigger.

Answer

Boot diagnostics

Answer

Azure Policy

Answer

An availability set

Question 3

You are deploying a Windows Server VM for an internal app. The VM must support Secure Boot and vTPM later, its OS disk must survive host moves, and the team wants the lowest-cost managed disk tier that still behaves like a normal writable OS disk. Which two choices should you make? Select two.

Accepted Answer

Use a Generation 2 Windows Server Marketplace image.. Secure Boot and vTPM are only supported on Generation 2 VMs in Azure, which use UEFI firmware and GPT-partitioned OS disks. A Generation 2 Windows Server Marketplace image provides the necessary firmware and partitioning. Additionally, Azure Trusted Launch (which enables Secure Boot and vTPM) requires a managed OS disk and supports only Premium SSD and Standard SSD tiers, not Standard HDD. Therefore, Standard SSD is the lowest-cost managed disk tier that supports vTPM while remaining a durable, writable OS disk. Ephemeral disks do not survive host moves and unmanaged VHDs are not managed disks, so they are incorrect.

Answer

Use an ephemeral OS disk to reduce storage cost.

Answer

Use an unmanaged VHD stored in a storage account.

Answer

Use a Generation 1 image and enable Secure Boot after deployment.

Question 4

A reporting application needs an Azure VM with at least 8 vCPUs and 64 GiB of RAM. The workload is memory-heavy, and the team wants a reasonable starting point. Which VM family should the administrator choose?

Accepted Answer

E-series. The E-series is Azure's memory-optimized VM family, designed for workloads that require a high memory-to-CPU ratio. For a memory-heavy reporting application, the E-series (e.g., E8s_v3 with 8 vCPUs and 64 GiB RAM) provides the needed memory efficiently and is a reasonable starting point. While a D-series VM like D16s_v3 can also meet the minimum specs, it does so with double the vCPUs, making E-series a more cost-effective and appropriate choice for memory-intensive workloads.

Answer

B-series

Answer

D-series

Answer

F-series

Question 5

A support desk needs to reset the local administrator password on specific virtual machines by using the VMAccess extension and restart those VMs. They must not be able to resize the machines, change networking, or manage disks. What should the administrator create?

Accepted Answer

Create a custom role with only the required VM actions and assign it at the virtual machine scope. The support desk needs only specific actions to reset the local admin password via the VMAccess extension (Microsoft.Compute/virtualMachines/extensions/write) and to restart VMs (Microsoft.Compute/virtualMachines/restart/action), without permissions to resize, change networking, or manage disks. A custom role at the VM scope allows granting precisely these required actions while excluding broader management actions. This follows the principle of least privilege and prevents unintended modifications to other resources.

Answer

Assign the Virtual Machine Contributor built-in role at the subscription scope

Answer

Assign the Contributor role at the resource group scope

Answer

Use an Azure Policy assignment to allow the VMAccess extension

Question 6

A business-critical application runs in a region that does not support availability zones. It uses two Azure VMs and must survive planned maintenance and a single host failure, but it does not need automatic scale-out. Which two actions should the administrator take? Select two.

Accepted Answer

Place both VMs in the same availability set. An availability set provides redundancy within a single region that does not support availability zones, protecting against both planned maintenance (via update domains) and host failures (via fault domains). By placing both VMs in the same availability set, Azure ensures they are distributed across multiple fault domains (up to 3) and update domains (up to 20), so a single hardware failure or planned maintenance event does not affect both VMs simultaneously.

Answer

Deploy the VMs so Azure distributes them across fault and update domains within that set

Answer

Deploy the VMs in separate availability zones

Answer

Convert the workload to a single larger VM

Answer

Put the VMs in a proximity placement group

Question 7

An application runs on two VMs in one Azure region. The business wants protection from a single hardware host failure and planned maintenance, but it does not require protection from an entire datacenter outage. Which two choices should the administrator make? Select two.

Accepted Answer

Place both VMs in an availability set.. An availability set distributes VMs across multiple fault domains (hardware hosts) and update domains within a single Azure datacenter. This protects against a single hardware host failure and planned maintenance (update domains ensure VMs are not rebooted simultaneously during updates). To benefit from this protection, you must have at least two VMs running in the same availability set; a single VM does not receive any fault or update domain isolation. Therefore, Option B (placing both VMs in an availability set) and Option D (keeping at least two running VMs in that availability set) are correct. Availability zones would protect against a full datacenter outage, which is not required here, and Azure Site Recovery is for disaster recovery to another region.

Answer

Place the workload in a single VM with a premium SSD.

Answer

Use availability zones across the region.

Answer

Replicate the VMs to another region with Azure Site Recovery.

Question 8

A batch container in Azure Container Instances should stop after a successful run and may retry only when the process fails. Which two restart policies are correct for that style of workload? Select two.

Accepted Answer

OnFailure. Azure Container Instances restart policies: Always restarts regardless of exit code; OnFailure restarts only when the process fails (non-zero exit code) and does not restart after success; Never never restarts after completion, regardless of exit code. For a batch workload that should stop after a successful run and may retry only on failure, OnFailure is the correct policy. Never would not retry on failure, so it is not suitable.

Answer

Never

Answer

Always

Answer

Manual

Answer

Scheduled

Question 9

A data disk was accidentally deleted from a production VM. The team has a snapshot of that disk from the previous night and wants the fastest Azure-side recovery path with the least risk of overwriting the existing OS disk. What should the administrator do first?

Accepted Answer

Create a new managed disk from the snapshot, then attach that disk to the VM.. Creating a new managed disk from the snapshot and attaching it to the VM is the fastest Azure-side recovery path. This directly restores the deleted data disk without affecting the existing OS disk. The new data disk can be created from the snapshot and attached within minutes using the Azure portal, CLI, or PowerShell, with minimal downtime.

Answer

Restore the entire virtual machine from the snapshot and overwrite the current instance.

Answer

Convert the snapshot into a temporary storage account and copy the files back manually.

Answer

Recreate the VM from the same marketplace image and restore only the deleted disk later.

Question 10

A scale set of application VMs uploads JSON files to one blob container. The identity must not use secrets, must keep working if an instance is reimaged or replaced, and the same identity should be reusable across all instances. What should the administrator configure?

Accepted Answer

A user-assigned managed identity, attached to the scale set, with Storage Blob Data Contributor scoped to the container.. A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource, can be assigned to multiple VMs in a scale set, and persists independently of any VM instance lifecycle. This ensures the identity remains available even if an instance is reimaged or replaced, and it avoids the need for secrets. The Storage Blob Data Contributor role scoped to the specific container grants the necessary permissions for uploading JSON files without exposing account-level access.

Answer

A system-assigned managed identity on each VM instance, with account-wide storage permissions.

Answer

A shared access signature stored in the VM image and renewed annually.

Answer

The storage account access key, because it allows the most reliable upload path.

Question 11

An administrator wants to deploy the same set of Azure VMs every sprint from source control and make code reviews capture every infrastructure change. Which three approaches meet this requirement? Select three.

Accepted Answer

Store a Bicep file in source control and use it as the deployment definition.. All three options are valid infrastructure-as-code approaches. Bicep (A) and ARM templates (B) provide declarative definitions stored in source control, enabling versioning and code review. Using Azure PowerShell or Azure CLI (C) to deploy the checked-in template ensures consistent, automated deployments from the source-controlled definition. Each approach allows every infrastructure change to be captured in code review before deployment.

Answer

Create the VMs manually in the Azure portal each sprint and document the clicks afterward.

Answer

Export the resources after deployment and treat the export as the only authoritative source.

Question 12

The operations team wants to store the VM deployment definition in source control and deploy the same group of Azure VMs every sprint. The code should be readable and easy to review. What should they use?

Accepted Answer

Bicep template files stored in source control.. Bicep is a domain-specific language (DSL) for deploying Azure resources that provides a cleaner, more readable syntax compared to ARM JSON templates. Storing Bicep files in source control enables versioning, code review, and repeatable deployments via CI/CD pipelines, which aligns with the requirement to deploy the same VM group every sprint. The declarative nature of Bicep ensures the deployment definition is both human-readable and machine-executable.

Answer

Manual creation in the Azure portal.

Answer

A one-time Azure CLI command typed into Cloud Shell.

Answer

A resource lock on the subscription.

Question 13

You are designing a highly available application on Azure that will run on multiple virtual machines. The solution must meet the following requirements: • Distribute VMs across multiple fault domains and update domains within a single Azure region. • Guarantee that at least one VM instance is available during planned maintenance. • Support automatic recovery of VMs if a physical server fails. • Keep the VMs in the same datacenter to minimize latency. Which three options should you configure? (Choose three.)

Accepted Answer

Configure the VMs to use managed disks.. An availability set distributes VMs across fault and update domains, ensuring at least one VM is available during planned maintenance and that VMs are in the same datacenter. Managed disks are required to support automatic recovery if a physical server fails, as they provide independent fault domains and higher durability. A proximity placement group guarantees that all VMs are placed in the same datacenter to minimize latency. The Azure Load Balancer with health probe is not required for these requirements; it primarily handles traffic distribution and application-level health monitoring.

Answer

Place the VMs in an availability zone.

Answer

Configure the VMs to use unmanaged disks stored in a single storage account.

Question 14

Arrange the steps to assign a custom RBAC role to a user in Azure.

Accepted Answer

Navigate to subscription → Access control (IAM) → Add → Add custom role → Define permissions and assignable scopes → Create → Add role assignment → Select custom role → Assign to user. Navigate to roles, create custom role with permissions and scopes, then assign at scope.

Answer

Navigate to subscription → Access control (IAM) → Add → Add role assignment → Select custom role (but none exist) → Assign to user → Realize custom role missing → Create custom role → Re-assign

Answer

Create custom role at management group scope with assignable scope set to management group → Navigate to subscription → Access control (IAM) → Add role assignment → Select custom role → Assign to user

Answer

Assign built-in role to user → Create custom role with similar permissions → Remove built-in assignment → Add custom role assignment to user

Question 15

You need to deploy 20 identical Azure virtual machines that host the same web application. The solution must support automatic scale-out based on CPU usage and should minimize administrative overhead. What should you deploy?

Accepted Answer

A Virtual Machine Scale Set.. A Virtual Machine Scale Set (VMSS) is the correct choice because it automates the deployment and management of identical VMs, supports autoscaling based on CPU usage metrics, and minimizes administrative overhead by handling VM creation, load balancing, and scaling policies as a single resource. This aligns with the requirement for 20 identical VMs with automatic scale-out based on CPU usage.

Answer

20 individual virtual machines in the same resource group.

Answer

An availability set.

Answer

Azure Container Instances.

Question 16

A virtual machine named VM-App01 hosts a critical internal application. You need to protect the VM so that it can be restored if the VM is deleted or corrupted. The solution must provide centralized backup management and retention policies. What should you use?

Accepted Answer

Azure Backup with a Recovery Services vault.. Azure Backup with a Recovery Services vault is the correct choice because it provides centralized backup management, configurable retention policies, and the ability to restore a VM even if it is deleted or corrupted. Unlike snapshots, Azure Backup stores backups in a separate vault, supports application-consistent backups via the Volume Shadow Copy Service (VSS), and offers long-term retention with backup policies.

Answer

Managed disk snapshots only.

Answer

Azure Site Recovery only.

Answer

Boot diagnostics.

Question 17

You need to restore a deleted file from a backed-up Azure virtual machine without restoring the entire VM. Which Azure Backup capability should you use?

Accepted Answer

File Recovery. Azure Backup's File Recovery capability allows you to mount the VM's recovery point as a drive on your local machine, enabling you to browse and restore individual files without restoring the entire VM. This is achieved by creating an iSCSI target from the recovery point snapshot, which you can connect to from a compatible OS. It is the correct choice for granular file-level recovery from a VM backup.

Answer

Cross-region restore

Answer

Azure Site Recovery failover

Answer

Boot diagnostics

Question 18

You deploy several Windows virtual machines and need to install Microsoft Antimalware on each VM without logging on manually. What should you use?

Accepted Answer

A VM extension.. VM extensions are small applications that provide post-deployment configuration and automation tasks on Azure VMs. The Microsoft Antimalware extension can be deployed to multiple VMs at scale via Azure PowerShell, CLI, ARM templates, or policies, enabling silent installation without manual login.

Answer

An NSG application security group.

Answer

A route table.

Answer

A blob lifecycle rule.

Question 19

Your company hosts an internal web app in Azure App Service. Access must be limited to users connecting from the corporate virtual network over private IP addresses only. What should you configure?

Accepted Answer

A private endpoint for the web app.. A private endpoint assigns a private IP address from your virtual network to the web app, making it accessible only over the corporate network via private IPs. This ensures traffic never traverses the public internet, meeting the requirement for private IP-only access.

Answer

An App Service Environment only.

Answer

Access restrictions based on public IP ranges only.

Answer

A public load balancer in front of the web app.

Question 20

You plan to deploy two virtual machines that run the same line-of-business application. The VMs must remain available during planned maintenance of the Azure platform, but autoscaling is not required. What should you use?

Accepted Answer

An availability set.. An availability set ensures that VMs are distributed across multiple fault domains and update domains within an Azure datacenter. This protects against both hardware failures (fault domains) and planned Azure platform maintenance (update domains), as only one update domain is rebooted at a time. Since autoscaling is not required, an availability set is the correct choice for high availability during planned maintenance.

Answer

A Virtual Machine Scale Set.

Answer

Azure Container Apps.

Answer

A private endpoint.