AZ-104 Deploy and Manage Azure Compute Practice Test 2 — 15 Questions

Question 1

A scale set of application VMs uploads JSON files to one blob container. The identity must not use secrets, must keep working if an instance is reimaged or replaced, and the same identity should be reusable across all instances. What should the administrator configure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A user-assigned managed identity, attached to the scale set, with Storage Blob Data Contributor scoped to the container.. A user-assigned managed identity is the correct choice because it is created as a standalone Azure resource, can be assigned to multiple VMs in a scale set, and persists independently of any VM instance lifecycle. This ensures the identity remains available even if an instance is reimaged or replaced, and it avoids the need for secrets. The Storage Blob Data Contributor role scoped to the specific container grants the necessary permissions for uploading JSON files without exposing account-level access.

Answer

A system-assigned managed identity on each VM instance, with account-wide storage permissions.

Answer

A shared access signature stored in the VM image and renewed annually.

Answer

The storage account access key, because it allows the most reliable upload path.

Question 2

An administrator wants to deploy the same set of Azure VMs every sprint from source control and make code reviews capture every infrastructure change. Which three approaches meet this requirement? Select three.

Accepted Answer

Store a Bicep file in source control and use it as the deployment definition.. All three options are valid infrastructure-as-code approaches. Bicep (A) and ARM templates (B) provide declarative definitions stored in source control, enabling versioning and code review. Using Azure PowerShell or Azure CLI (C) to deploy the checked-in template ensures consistent, automated deployments from the source-controlled definition. Each approach allows every infrastructure change to be captured in code review before deployment.

Answer

Create the VMs manually in the Azure portal each sprint and document the clicks afterward.

Answer

Export the resources after deployment and treat the export as the only authoritative source.

Question 3

The operations team wants to store the VM deployment definition in source control and deploy the same group of Azure VMs every sprint. The code should be readable and easy to review. What should they use?

Accepted Answer

Bicep template files stored in source control.. Bicep is a domain-specific language (DSL) for deploying Azure resources that provides a cleaner, more readable syntax compared to ARM JSON templates. Storing Bicep files in source control enables versioning, code review, and repeatable deployments via CI/CD pipelines, which aligns with the requirement to deploy the same VM group every sprint. The declarative nature of Bicep ensures the deployment definition is both human-readable and machine-executable.

Answer

Manual creation in the Azure portal.

Answer

A one-time Azure CLI command typed into Cloud Shell.

Answer

A resource lock on the subscription.

Question 4

You are designing a highly available application on Azure that will run on multiple virtual machines. The solution must meet the following requirements: • Distribute VMs across multiple fault domains and update domains within a single Azure region. • Guarantee that at least one VM instance is available during planned maintenance. • Support automatic recovery of VMs if a physical server fails. • Keep the VMs in the same datacenter to minimize latency. Which three options should you configure? (Choose three.)

Accepted Answer

Configure the VMs to use managed disks.. An availability set distributes VMs across fault and update domains, ensuring at least one VM is available during planned maintenance and that VMs are in the same datacenter. Managed disks are required to support automatic recovery if a physical server fails, as they provide independent fault domains and higher durability. A proximity placement group guarantees that all VMs are placed in the same datacenter to minimize latency. The Azure Load Balancer with health probe is not required for these requirements; it primarily handles traffic distribution and application-level health monitoring.

Answer

Place the VMs in an availability zone.

Answer

Configure the VMs to use unmanaged disks stored in a single storage account.

Question 5

Arrange the steps to assign a custom RBAC role to a user in Azure.

Accepted Answer

Navigate to subscription → Access control (IAM) → Add → Add custom role → Define permissions and assignable scopes → Create → Add role assignment → Select custom role → Assign to user. Navigate to roles, create custom role with permissions and scopes, then assign at scope.

Answer

Navigate to subscription → Access control (IAM) → Add → Add role assignment → Select custom role (but none exist) → Assign to user → Realize custom role missing → Create custom role → Re-assign

Answer

Create custom role at management group scope with assignable scope set to management group → Navigate to subscription → Access control (IAM) → Add role assignment → Select custom role → Assign to user

Answer

Assign built-in role to user → Create custom role with similar permissions → Remove built-in assignment → Add custom role assignment to user

Question 6

An administrator is deploying a new Azure VM using an Azure Resource Manager (ARM) template. The VM must have a public IP address that is static and can be assigned to the VM's network interface. The administrator also needs to ensure that the public IP address does not change if the VM is stopped and started. Which configuration should the administrator use in the ARM template?

Accepted Answer

Create a public IP address resource with the allocation method set to Static and the SKU set to Standard, then associate it with the NIC.. To ensure a static public IP address that persists across stop/start operations, the public IP must use Static allocation. The Standard SKU is required for static allocation and provides additional benefits like zone redundancy and secure defaults. Associating this public IP with the VM's NIC gives the VM the desired persistent public address.

Answer

Create a public IP address resource with the allocation method set to Dynamic and the SKU set to Standard, then associate it with the NIC.

Answer

Create a public IP address resource with the allocation method set to Dynamic and the SKU set to Basic, then associate it with the NIC.

Answer

Create a public IP address resource with the allocation method set to Static and the SKU set to Basic, then associate it with the NIC.

Question 7

You need to deploy 20 identical Azure virtual machines that host the same web application. The solution must support automatic scale-out based on CPU usage and should minimize administrative overhead. What should you deploy?

Accepted Answer

A Virtual Machine Scale Set.. A Virtual Machine Scale Set (VMSS) is the correct choice because it automates the deployment and management of identical VMs, supports autoscaling based on CPU usage metrics, and minimizes administrative overhead by handling VM creation, load balancing, and scaling policies as a single resource. This aligns with the requirement for 20 identical VMs with automatic scale-out based on CPU usage.

Answer

20 individual virtual machines in the same resource group.

Answer

An availability set.

Answer

Azure Container Instances.

Question 8

A virtual machine named VM-App01 hosts a critical internal application. You need to protect the VM so that it can be restored if the VM is deleted or corrupted. The solution must provide centralized backup management and retention policies. What should you use?

Accepted Answer

Azure Backup with a Recovery Services vault.. Azure Backup with a Recovery Services vault is the correct choice because it provides centralized backup management, configurable retention policies, and the ability to restore a VM even if it is deleted or corrupted. Unlike snapshots, Azure Backup stores backups in a separate vault, supports application-consistent backups via the Volume Shadow Copy Service (VSS), and offers long-term retention with backup policies.

Answer

Managed disk snapshots only.

Answer

Azure Site Recovery only.

Answer

Boot diagnostics.

Question 9

You need to restore a deleted file from a backed-up Azure virtual machine without restoring the entire VM. Which Azure Backup capability should you use?

Accepted Answer

File Recovery. Azure Backup's File Recovery capability allows you to mount the VM's recovery point as a drive on your local machine, enabling you to browse and restore individual files without restoring the entire VM. This is achieved by creating an iSCSI target from the recovery point snapshot, which you can connect to from a compatible OS. It is the correct choice for granular file-level recovery from a VM backup.

Answer

Cross-region restore

Answer

Azure Site Recovery failover

Answer

Boot diagnostics

Question 10

You deploy several Windows virtual machines and need to install Microsoft Antimalware on each VM without logging on manually. What should you use?

Accepted Answer

A VM extension.. VM extensions are small applications that provide post-deployment configuration and automation tasks on Azure VMs. The Microsoft Antimalware extension can be deployed to multiple VMs at scale via Azure PowerShell, CLI, ARM templates, or policies, enabling silent installation without manual login.

Answer

An NSG application security group.

Answer

A route table.

Answer

A blob lifecycle rule.

Question 11

Your company hosts an internal web app in Azure App Service. Access must be limited to users connecting from the corporate virtual network over private IP addresses only. What should you configure?

Accepted Answer

A private endpoint for the web app.. A private endpoint assigns a private IP address from your virtual network to the web app, making it accessible only over the corporate network via private IPs. This ensures traffic never traverses the public internet, meeting the requirement for private IP-only access.

Answer

An App Service Environment only.

Answer

Access restrictions based on public IP ranges only.

Answer

A public load balancer in front of the web app.

Question 12

You plan to deploy two virtual machines that run the same line-of-business application. The VMs must remain available during planned maintenance of the Azure platform, but autoscaling is not required. What should you use?

Accepted Answer

An availability set.. An availability set ensures that VMs are distributed across multiple fault domains and update domains within an Azure datacenter. This protects against both hardware failures (fault domains) and planned Azure platform maintenance (update domains), as only one update domain is rebooted at a time. Since autoscaling is not required, an availability set is the correct choice for high availability during planned maintenance.

Answer

A Virtual Machine Scale Set.

Answer

Azure Container Apps.

Answer

A private endpoint.

Question 13

You need to redeploy an Azure virtual machine to a new host while keeping the VM configuration and attached disks. Which action should you use in the Azure portal?

Accepted Answer

Redeploy. The Redeploy action moves the VM to a new Azure host node while preserving the VM configuration, attached managed disks, and network resources. This is used to recover from underlying host failures or performance issues without losing the VM's state or data.

Answer

Resize

Answer

Capture

Answer

Reapply

Question 14

You have a virtual machine scale set that must increase the number of instances automatically when average CPU utilization exceeds 75 percent and decrease when utilization drops below 30 percent. What should you configure?

Accepted Answer

An Azure Monitor autoscale rule on the scale set. Azure Monitor autoscale rules allow you to define conditions for automatically scaling out (increasing instances) when average CPU utilization exceeds a threshold (e.g., 75%) and scaling in (decreasing instances) when it drops below a lower threshold (e.g., 30%). These rules are applied directly to the virtual machine scale set, enabling dynamic scaling based on performance metrics.

Answer

A boot diagnostics configuration

Answer

An availability set

Answer

A custom script extension

Question 15

You plan to run a web application on Azure virtual machines and need protection against a single datacenter failure within an Azure region. Which deployment option should you use?

Accepted Answer

Availability zones. Availability Zones are physically separate datacenters within an Azure region, each with independent power, cooling, and networking. Deploying your VMs across two or more zones protects against a single datacenter failure because if one zone goes down, the application continues running in the other zone. This meets the requirement for datacenter-level fault tolerance within a single region.

Answer

An availability set only

Answer

A proximity placement group

Answer

A single VM with premium SSD