AZ-104 Deploy and Manage Azure Compute Practice Test 10 — 15 Questions

Question 1

A web application runs in Azure App Service and uploads files to Azure Blob Storage. The storage account has shared key access disabled, and the app must not store secrets in configuration. If the App Service is deleted and recreated later, the storage access should be removed automatically with the app. What should you configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A system-assigned managed identity with Blob Data Contributor permissions on the container.. A system-assigned managed identity is tied to the App Service lifecycle, so when the app is deleted, the identity is automatically removed, revoking access to Blob Storage. Granting Blob Data Contributor permissions on the container allows the app to upload files without storing any secrets, satisfying the requirement that shared key access is disabled and no secrets are stored in configuration.

Answer

A user-assigned managed identity with Blob Data Reader permissions on the storage account.

Answer

A shared access signature generated from the storage account key.

Answer

A storage account access key stored in an application setting.

Question 2

A workload needs more CPU and memory than the current Azure VM size provides. The administrator wants to increase compute capacity without redeploying the application. What should be done?

Accepted Answer

Resize the VM to a larger size. Resizing the Azure VM to a larger size (option A) directly increases the CPU and memory resources allocated to the VM without requiring redeployment of the application. Azure supports resizing VMs within the same hardware family or to a different family, provided the new size is available in the current region and the VM is not part of a VMSS with overprovisioning constraints. The resize operation updates the VM's SKU, and after a reboot, the new resources are available to the OS and applications.

Answer

Move the VM into an availability set

Answer

Replace the VM with a snapshot

Answer

Assign a user-assigned managed identity

Question 3

A container group in Azure Container Instances must pull a private image from Azure Container Registry without embedding registry credentials in the template. What should you configure?

Accepted Answer

A managed identity for the container group and the AcrPull role on the registry. Azure Container Instances (ACI) can authenticate to Azure Container Registry (ACR) using a managed identity assigned to the container group. By granting the managed identity the AcrPull role on the registry, ACI can pull private images without embedding any credentials in the deployment template, leveraging Azure AD authentication and RBAC for secure access.

Answer

An admin user account on the Azure Container Registry

Answer

A shared access signature in a container environment variable

Answer

A public network access rule that allows all Azure services

Question 4

Match each VM identity concept to its best use.

Accepted Answer

System-assigned managed identity: Tied to the VM lifecycle, automatically created and deleted with the VM, best for accessing Azure resources without managing credentials.. Managed identities (system or user-assigned) eliminate credential management; Azure AD app identity is for custom apps; IMDS provides tokens; role assignments grant access to resources.

Answer

System-assigned managed identity: Best when a pre-provisioned identity is needed before the VM is created, or the identity must be assigned to multiple resources.

Answer

User-assigned managed identity: Automatically created and deleted with the VM, best for a single VM requiring access to Azure resources.

Question 5

Administrators need to manage Linux virtual machines that do not have public IP addresses. They want to connect from a browser without installing a VPN client. Which Azure service should they use?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP/SSH connectivity to virtual machines directly from the Azure portal over TLS, without requiring public IP addresses or a VPN client. It uses a browser-based HTML5 client, making it ideal for administrators who need to manage Linux VMs without exposing them to the internet or installing additional software.

Answer

VPN Gateway

Answer

Load Balancer

Answer

Private endpoint

Question 6

An administrator wants future VMs to start from the same approved server build as an existing generalized VM. Which two image sources can be used to create the new VM? Select two.

Accepted Answer

A managed image created from the approved server build.. A managed image captures the exact configuration of a generalized VM, including the OS and data disks, and can be used to deploy multiple identical VMs. This ensures that future VMs start from the same approved server build without needing to recreate the image each time.

Answer

A Marketplace image from the operating system vendor.

Answer

A single managed disk snapshot.

Answer

A public IP address assigned to the VM.

Question 7

A new Windows VM must be deployed with an application installed, a configuration file copied from a storage account, and a bootstrap script run automatically after the operating system is provisioned. The operations team does not want to log in manually after deployment. What should they use?

Accepted Answer

A Custom Script Extension attached to the VM during provisioning.. The Custom Script Extension (CSE) is the correct choice because it allows you to run a PowerShell or Bash script automatically after the VM is provisioned. This script can install applications, download configuration files from Azure Storage using a managed identity or SAS token, and execute bootstrap commands—all without any manual login. CSE is the standard Azure mechanism for post-deployment configuration automation on both Windows and Linux VMs.

Answer

Azure Bastion to connect through the browser and complete setup interactively.

Answer

A managed identity assigned to the VM without any extensions.

Answer

An availability set so the VM comes online faster during provisioning.

Question 8

Match each Azure VM deployment concept to the description that best fits it.

Accepted Answer

VMSS: Provides auto-scaling of identical VMs. VMSS provides auto-scaling identical VMs; Availability Set groups VMs for redundancy; Availability Zone offers physical separation; Managed Disk is persistent block storage; Azure Bastion provides secure remote access; Dedicated Host gives single-tenant physical servers.

Answer

Availability Set: Offers physical separation within a region

Answer

Managed Disk: Provides secure remote access to VMs over SSL

Answer

Azure Bastion: Persistent block storage for Azure VMs

Question 9

A managed data disk on a VM was deleted by mistake. You have a snapshot from before the deletion and want to restore the data with minimal impact to the VM's operating system disk. What should you do?

Accepted Answer

Create a new managed disk from the snapshot and attach it to the VM. You can create a new managed disk from the snapshot and attach it as a data disk to the existing VM. This restores the data without affecting the OS disk or requiring a VM redeployment, minimizing downtime and impact.

Answer

Redeploy the VM from the marketplace image

Answer

Convert the snapshot directly into an OS disk and boot from it

Answer

Resize the VM to a larger size and the deleted disk will reappear

Question 10

A platform team has a hardened Windows Server VM that was generalized after patching, agent installation, and baseline configuration. They must deploy the same build to development, test, and production subscriptions, and they want a controlled way to publish newer versions later without rebuilding the image each time. What should they create first?

Accepted Answer

An Azure Compute Gallery image version based on the generalized VM image.. An Azure Compute Gallery (formerly Shared Image Gallery) allows you to store and manage multiple versions of a generalized VM image, enabling controlled, incremental publishing of image updates across subscriptions. By creating an image version in a gallery, the team can deploy the same build to dev, test, and prod subscriptions while maintaining versioning and replication control, avoiding the need to rebuild the image from scratch for each update.

Answer

An availability set for the source VM so new virtual machines inherit the same configuration.

Answer

A managed disk snapshot of the OS disk so new VMs can be created from the captured state.

Answer

A proximity placement group so all future VMs land close to the current server.

Question 11

An application on an Azure VM has outgrown its current CPU and memory. The administrator wants to increase compute capacity without rebuilding the application or changing the VM image. What should be done?

Accepted Answer

Resize the virtual machine to a larger size. Resizing the VM to a larger size (Option A) directly increases the CPU and memory resources allocated to the VM without requiring any changes to the application or the underlying OS disk image. Azure allows you to change the VM size as long as the new size is available in the current hardware cluster and the VM is deallocated (stopped) first. This is the simplest and most appropriate method to scale up compute capacity while preserving the existing configuration and data.

Answer

Create a new snapshot of the OS disk

Answer

Move the VM to an availability set

Answer

Attach a data disk

Question 12

A container group runs a nightly processing job in Azure Container Instances. The job should exit after completing successfully and should not restart automatically. Which restart policy should you configure?

Accepted Answer

Never. The 'Never' restart policy ensures that the container group runs once and does not restart after it exits, regardless of the exit code. This is ideal for a nightly batch job that should complete and then stop permanently without automatic restarts.

Answer

Always

Answer

OnFailure

Answer

Automatic

Question 13

A line-of-business app will run on a single Azure virtual machine in a region that supports availability zones. The business wants the VM to keep running if one datacenter in the region fails. Which deployment choice should you use?

Accepted Answer

Deploy the VM in an availability zone. Availability zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying the VM in an an availability zone ensures that if one datacenter fails, the VM remains operational because it is hosted in a different zone. This directly meets the requirement for resilience against a single datacenter failure.

Answer

Place the VM in an availability set

Answer

Use a larger VM size

Answer

Use a custom image

Question 14

A team has an approved Windows VM that already includes patches, a monitoring agent, and line-of-business software. They want future VMs to start from that same build. What should they use?

Accepted Answer

A custom image. A custom image captures the exact state of a VM, including installed patches, monitoring agents, and line-of-business software, allowing you to create multiple identical VMs from that golden image. Unlike a snapshot, which is tied to a specific disk and requires manual steps to create a VM, a custom image is stored as a managed image resource that can be used directly during VM provisioning via the Azure portal, CLI, or ARM templates.

Answer

A snapshot of the OS disk

Answer

An availability set

Answer

A larger VM size

Question 15

An operations team must administer Windows and Linux VMs that have no public IP addresses. They want to connect from a browser without installing a VPN client and without exposing RDP or SSH to the internet. Which Azure service should they deploy?

Accepted Answer

Azure Bastion. Azure Bastion provides secure, seamless RDP and SSH connectivity to virtual machines directly from the Azure portal over TLS, without requiring a public IP address on the VM, a VPN client, or exposing RDP/SSH ports to the internet. It uses a hardened bastion host inside the virtual network, proxying connections via the browser, which satisfies the requirement for browser-based access without additional client software.

Answer

Azure Load Balancer

Answer

VPN Gateway point-to-site only

Answer

Application Gateway