AZ-104 Implement and Manage Storage Practice Test 6 — 15 Questions

Question 1

A DevOps pipeline runs on an on-premises build server and must deploy ARM templates to a resource group in Azure without using a user password. The server is not in Azure, so managed identity is not available. What should the administrator create?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A service principal for the pipeline, with certificate-based or federated authentication.. The on-premises build server cannot use Azure managed identities (which require an Azure resource). Instead, a service principal with certificate-based or federated authentication provides a secure, passwordless identity for the pipeline to authenticate to Azure AD and deploy ARM templates. This aligns with the principle of using Azure AD application credentials for non-Azure workloads.

Answer

A system-assigned managed identity on the build server.

Answer

A user-assigned managed identity attached to the on-premises server.

Answer

A shared access signature for the target resource group.

Question 2

A finance operations team manages virtual machines in RG-App. They must start, stop, deallocate, and view VM properties for any VM in that resource group. They must not be able to delete VMs, read NIC settings, or manage disks. What should the administrator do?

Accepted Answer

Create a custom role with only the required VM actions and assign it at the RG-App scope.. The required permissions (start, stop, deallocate, view properties) are a subset of the built-in Virtual Machine Contributor role, but that role also includes delete and other management actions. A custom role allows you to grant only the specific Microsoft.Compute/virtualMachines/start/action, Microsoft.Compute/virtualMachines/deallocate/action, and Microsoft.Compute/virtualMachines/read permissions, while explicitly excluding delete, NIC read, and disk management actions. Assigning this custom role at the RG-App scope ensures the team can manage VMs without broader access.

Answer

Assign the built-in Virtual Machine Contributor role at the subscription scope.

Answer

Assign the built-in Reader role at the RG-App scope and let the team use portal buttons.

Answer

Assign the built-in Contributor role at the resource group scope.

Question 3

A finance department shares a resource group containing a critical VM and a storage account. Administrators must still be able to update settings and apply patches, but no one should accidentally delete the resources. Which lock should be applied at the resource group level?

Accepted Answer

CanNotDelete lock.. The CanNotDelete lock (option B) is correct because it prevents users from deleting the resource group or its resources, while still allowing read and update operations. This meets the requirement that administrators can update settings and apply patches, but accidental deletion is blocked. ReadOnly locks would block all write operations, including patching, which is too restrictive for this scenario.

Answer

ReadOnly lock, because it is the most restrictive option.

Answer

A policy assignment that denies delete operations.

Answer

No lock, because RBAC permissions already prevent deletion.

Question 4

A finance team stores application blobs in an Azure Storage account. The data must remain available if a single availability zone in the region is lost, and the team does not need automatic read access from another region. Which redundancy option best meets the requirement?

Accepted Answer

Zone-redundant storage (ZRS), which replicates data across availability zones in the same region.. Zone-redundant storage (ZRS) replicates your data synchronously across three Azure availability zones within the primary region. This ensures that if a single zone fails, the data remains available and durable without requiring any manual intervention or failover, meeting the requirement of no automatic read access from another region.

Answer

Locally redundant storage (LRS), which keeps three copies in one datacenter only.

Answer

Geo-redundant storage (GRS), which replicates data to a paired region and supports failover.

Answer

Read-access geo-redundant storage (RA-GRS), which allows reads from the secondary region.

Question 5

A hub VNet already has a VPN gateway connected to on-premises networks. A new spoke VNet must reach those on-premises networks through the existing gateway without deploying another gateway. Which peering settings are required?

Accepted Answer

Enable gateway transit on the hub peering and use remote gateways on the spoke peering.. To allow a spoke VNet to use the hub VNet's VPN gateway without deploying its own, you must enable 'Use remote gateways' on the spoke peering and 'Gateway transit' on the hub peering. This configuration allows the spoke to route traffic destined for on-premises networks through the hub's VPN gateway, leveraging the existing site-to-site VPN connection.

Answer

Enable forwarded traffic on both peerings and leave gateway settings disabled.

Answer

Enable use remote gateways on the hub peering and gateway transit on the spoke peering.

Answer

Create a private endpoint between the two VNets.

Question 6

A Windows file server VM in Azure must mount an Azure file share by using existing Active Directory Domain Services credentials instead of a storage account key. The organization already has domain-joined Windows servers in the environment. What should the administrator configure on the storage account?

Accepted Answer

Enable Azure Files identity-based authentication with Active Directory Domain Services.. Azure Files supports identity-based authentication over SMB using Active Directory Domain Services (AD DS). By enabling this on the storage account, the administrator can mount the file share using existing domain credentials instead of a storage account key, provided the client VM is domain-joined and the share is configured with appropriate NTFS permissions. This eliminates the need to manage or expose storage account keys.

Answer

Enable blob soft delete and mount the share with a blob container SAS token.

Answer

Enable a service endpoint for Microsoft.Storage on the subnet.

Answer

Create a shared access signature for the file share and map it as a local drive.

Question 7

An archive team stores legal exhibits in Azure Blob Storage. The files are downloaded only during quarterly audits, but when an auditor needs one, it must be readable immediately without waiting for a rehydration job. The team wants the lowest practical cost after the first 30 days and does not want to move blobs manually each quarter. What should the administrator configure?

Accepted Answer

Use a lifecycle management rule to move the blobs to Cool tier after 30 days.. Azure Blob Storage lifecycle management rules can automatically move blobs from Hot to Cool tier after 30 days, reducing storage costs while keeping data immediately accessible. Cool tier offers lower storage costs than Hot tier with the same low-latency read access, satisfying the requirement for instant auditor access without manual intervention.

Answer

Keep the blobs in Hot tier permanently and delete them manually after each audit cycle.

Answer

Move the blobs to Archive tier after 30 days and rehydrate them when audits begin.

Answer

Store the files in Premium block blob storage and use snapshots for audit recovery.

Question 8

A company stores customer documents in Azure Blob Storage. The business requires the data to stay available if one availability zone in the region has an outage. Which redundancy option should the administrator choose?

Accepted Answer

Zone-redundant storage (ZRS). Zone-redundant storage (ZRS) replicates data synchronously across three Azure availability zones within a primary region, ensuring data remains accessible if one zone fails. This meets the requirement for intra-region zone-level fault tolerance without the cost or complexity of geo-replication.

Answer

Locally redundant storage (LRS)

Answer

Geo-redundant storage (GRS)

Answer

Read-access geo-redundant storage (RA-GRS)

Question 9

A storage account must be reachable only from resources in one Azure subnet, and public network access should not be used. Which configuration best meets this requirement?

Accepted Answer

Create a private endpoint for the storage account in the subnet. A private endpoint assigns the storage account a private IP address from the specified Azure subnet, effectively bringing the storage account into the virtual network. This ensures that all traffic to the storage account stays within the Microsoft Azure backbone network and never traverses the public internet, meeting the requirement to restrict access exclusively to resources in that subnet while disabling public network access.

Answer

Enable blob versioning on the storage account

Answer

Assign a ReadOnly lock to the storage account

Answer

Enable a shared access signature

Question 10

A media company stores project video assets in Azure Blob Storage. The business requires the data to survive a single availability zone outage in the primary region. In addition, if the primary region becomes unavailable, operations staff must still be able to read the most recently replicated copy from the secondary region right away, even if writes are temporarily unavailable. Which redundancy option best meets this requirement?

Accepted Answer

RA-GZRS. RA-GZRS (Read-Access Geo-Zone-Redundant Storage) is correct because it combines zone-redundant storage (ZRS) within the primary region to survive a single availability zone outage, and geo-redundant storage (GRS) to replicate data to a secondary region. The 'RA' prefix enables read access to the secondary region immediately after a primary region failure, allowing operations staff to read the most recently replicated copy even if writes are temporarily unavailable.

Answer

ZRS

Answer

GZRS

Answer

RA-GRS

Question 11

A finance department stores spreadsheets in an Azure file share. Yesterday a user deleted a subfolder tree, but other folders were modified after that point and must not be rolled back. The administrator wants to restore only the deleted subfolder tree to its state from yesterday. What should the administrator use?

Accepted Answer

Use the Azure Files snapshot taken before the deletion and copy back only the required folders.. Azure Files supports snapshot-based restore at the share level. By taking a snapshot before the deletion, the administrator can mount that snapshot as a read-only copy of the share, then copy back only the deleted subfolder tree without affecting any modifications made to other folders after the snapshot was taken. This meets the requirement of restoring only the deleted content while preserving later changes.

Answer

Restore the entire share from Azure Backup to the yesterday recovery point.

Answer

Enable blob soft delete on the storage account and then recover the folders.

Answer

Create a new file share and use synchronization to merge the deleted content.

Question 12

An application uploads documents by using one of the storage account access keys. The team wants to rotate keys without interrupting uploads. Which process should the administrator follow?

Accepted Answer

Switch the app to the secondary key, regenerate the primary key, and then update the app back later.. It follows the safe key rotation pattern: switch the application to use the secondary key, regenerate the primary key (which invalidates the old primary key), and then later update the application back to the primary key if desired. This ensures the application never loses access during the rotation, as it always has a valid key in use.

Answer

Regenerate both keys at the same time so the account is fully refreshed.

Answer

Disable shared key authorization before rotating the keys.

Answer

Delete the storage account and create a new one with the same name.

Question 13

A monthly report file must automatically move to a cheaper online tier after 90 days in Azure Blob Storage. Which feature should the administrator configure?

Accepted Answer

Blob lifecycle management. Blob lifecycle management is the correct feature because it allows administrators to define rules that automatically transition blobs to a cheaper access tier (e.g., from Hot to Cool) after a specified number of days. This policy operates at the storage account or container level and can move data to the Cool or Archive tier based on age, meeting the requirement of moving the report file after 90 days without manual intervention.

Answer

Archive rehydration policy

Answer

Snapshot retention

Answer

Storage account failover

Question 14

A Windows file server VM must mount an Azure file share by using domain credentials instead of a storage account key. The organization already manages users in Active Directory Domain Services. Which authentication option should be configured for Azure Files?

Accepted Answer

Identity-based authentication with Active Directory Domain Services.. Azure Files supports identity-based authentication using Active Directory Domain Services (AD DS), which allows domain-joined Windows VMs to mount Azure file shares using their existing domain credentials instead of a storage account key. This enables Kerberos-based authentication and preserves NTFS permissions, meeting the requirement to avoid shared key access.

Answer

Shared key authentication, because it is the default for Azure file shares.

Answer

A service SAS created for the share and mapped as a network drive.

Answer

Anonymous access with public network restrictions disabled.

Question 15

A contractor must import data into one blob container for six hours. The contractor should not receive the storage account key, and access must be limited to that container only. Which credential should the administrator generate?

Accepted Answer

A user delegation SAS, because it is signed with Microsoft Entra credentials and is time limited.. A user delegation SAS is signed with Microsoft Entra credentials (formerly Azure AD) and can be scoped to a specific blob container with a time limit. This meets the requirement of granting the contractor access only to that container for six hours without exposing the storage account key.

Answer

A storage account access key, because it can be copied into the import tool.

Answer

A shared key connection string, because it works with any tool that needs blob access.

Answer

A managed identity token, because the contractor can use it outside Azure directly.