AZ-104 Matching — 30 Questions

Question 1

Match each Azure VM deployment concept to the description that best fits it.

Accepted Answer

VMSS: Provides auto-scaling of identical VMs. VMSS provides auto-scaling identical VMs; Availability Set groups VMs for redundancy; Availability Zone offers physical separation; Managed Disk is persistent block storage; Azure Bastion provides secure remote access; Dedicated Host gives single-tenant physical servers.

Answer

Availability Set: Offers physical separation within a region

Answer

Managed Disk: Provides secure remote access to VMs over SSL

Answer

Azure Bastion: Persistent block storage for Azure VMs

Question 2

Match each Azure VM administration requirement on the left with the most appropriate Azure CLI command on the right. Use each answer once.

Accepted Answer

Deploy a new virtual machine: az vm create. Azure CLI commands for VM administration: 'az vm create' deploys, 'az vm resize' changes size, 'az vm start/stop/restart' controls state, and 'az vm delete' removes the VM.

Answer

Stop a virtual machine: az vm delete

Answer

Delete a virtual machine: az vm restart

Answer

Restart a virtual machine: az vm stop

Question 3

Match each storage resiliency requirement to the Azure redundancy option that best satisfies it.

Accepted Answer

LRS: Locally redundant storage replicates data three times within a single datacenter in the primary region.. LRS replicates within a single datacenter; ZRS across zones; GRS across regions; RA-GRS adds read access to GRS; RA-ZRS adds read access to ZRS. LRS is cheapest, GRS is highest durability.

Answer

LRS: Provides synchronous replication across three availability zones.

Answer

GRS: Provides read access to the secondary region.

Question 4

Match each storage networking requirement to the Azure storage network control that should be used.

Accepted Answer

Enable secure access from a specific VNet: Use service endpoints. Azure storage network controls: service endpoints for VNet access, private endpoints for private connectivity, IP firewall for public IP restrictions, trusted services exception, route tables for custom routing, and disabling public access for complete lockdown.

Answer

Enable secure access from a specific VNet: Use private endpoints

Answer

Restrict access to a specific public IP address: Enable trusted services exception

Answer

Block all public network access: Use IP firewall rules

Question 5

A team is troubleshooting inbound access to Azure VMs. Match each NSG concept on the left with the most accurate behavior or troubleshooting implication on the right.

Accepted Answer

NSG: A distributed firewall that filters traffic based on rules.. NSG is a distributed firewall; default inbound rule denies all; UDR overrides routes; ASG groups VMs; flow logs record traffic; service tags represent Azure IPs.

Answer

Default inbound rule: Allows all inbound traffic by default.

Answer

Service tags: Override default system routes.

Question 6

Match each access scenario to the SAS or key type that best fits it.

Accepted Answer

Interactive logins: User delegation SAS. Interactive logins use user delegation SAS; automated backups use system-assigned managed identity; cross-tenant access requires a service principal with certificate; VM patching uses system-assigned managed identity; app access to SQL uses user-assigned managed identity; key rotation uses storage account access keys.

Answer

Interactive logins: Storage account access keys

Answer

Automated backups: User delegation SAS

Answer

Cross-tenant access: System-assigned managed identity

Question 7

Match each lifecycle management requirement to the blob tier transition or action that should be configured.

Accepted Answer

Move blobs not modified for 30 days: Transition to cool tier. Lifecycle management rules define actions (tier changes or deletion) based on age or access. The actions correspond to moving to cooler tiers (cool, cold, archive) or deleting, and can apply to snapshots.

Answer

Move blobs not modified for 30 days: Transition to archive tier

Answer

Move blobs not modified for 90 days: Transition to cool tier

Answer

Delete blobs after 365 days: Transition to cool tier

Question 8

Match each Azure CLI command to the action it performs for a virtual machine.

Accepted Answer

az vm create: Creates a new virtual machine.. Each Azure CLI command performs the corresponding VM lifecycle action: create, start, stop, deallocate (releases resources), delete, or list.

Answer

az vm start: Stops a running virtual machine.

Answer

az vm stop: Deallocates a virtual machine.

Question 9

Match each data-access pattern to the blob tier or required action.

Accepted Answer

Frequent read and write operations: Hot tier. Azure Blob Storage tiers are Hot (frequent access), Cool (infrequent, 30-day minimum), and Archive (rare, 180-day minimum). Rehydration is needed to access Archive blobs. Azure Files sync is used for replication.

Answer

Frequent read and write operations: Cool tier

Answer

Infrequent access with 30-day minimum storage duration: Archive tier

Question 10

Match each workload requirement to the Azure storage account kind that best fits it.

Accepted Answer

General-purpose v2: Provides support for blobs, files, queues, tables, and VM disks. Suitable for most general-purpose workloads.. Each storage kind is tailored for specific workloads: GPv2 is the default, BlockBlobStorage for high throughput, FileStorage for premium files, and others for legacy or specialized needs.

Answer

General-purpose v2: Premium performance for block blob and append blob data, with low latency.

Answer

BlockBlobStorage: Legacy blob-only account type.

Question 11

A VM suffered corruption and an auditor also needs one missing file. Match each Azure Backup restore workflow to the recovery outcome it provides.

Accepted Answer

Restore VM: Creates a new VM. Azure Backup restore workflows: 'Restore VM' creates a new VM, 'Restore files' recovers individual files, 'Restore as unmanaged/managed disks' recovers disks, 'Replace existing VM' overwrites the original, and 'Cross-region restore' restores to another region.

Answer

Restore VM: Recovers individual files

Answer

Restore files: Overwrites the original VM

Question 12

A platform team is tuning alerting for a production VM and the surrounding Azure resources. Match each Azure Monitor component to the function it performs in this design.

Accepted Answer

Azure Monitor Metrics: Collects and analyzes numerical data such as CPU and memory usage from Azure resources.. Azure Monitor Metrics handles numerical data, Logs handles log data; Application Insights is for app monitoring; Alerts notify on conditions; Workbooks and Dashboards are visualization tools.

Answer

Azure Monitor Metrics: Collects and analyzes log data such as event logs and error traces.

Answer

Application Insights: Collects and analyzes numerical data such as CPU and memory usage.

Question 13

A VM backup policy is being designed in a Recovery Services vault. Match each backup policy element to the behavior it controls.

Accepted Answer

Retention Range: Defines how long backup snapshots and recovery points are kept.. A backup policy in a Recovery Services vault includes retention settings (how long to keep backups), schedule (when to back up), snapshot retention (for instant restores), policy type (Standard vs Enhanced), time zone, and frequency (daily/weekly).

Answer

Retention Range: Controls the time zone for backup scheduling.

Answer

Backup Schedule: Defines how many backups are retained.

Question 14

An administrator is reviewing a KQL query used to investigate failed operations in a Log Analytics workspace. Match each KQL operator to the effect it has on the query output.

Accepted Answer

where: Filters results to rows matching a specified condition. These are standard KQL operators used in Log Analytics queries. 'where' filters, 'project' selects columns, 'extend' adds computed columns, 'summarize' aggregates, 'join' merges tables, and 'order by' sorts results.

Answer

extend: Filters results to rows matching a specified condition

Answer

join: Adds computed columns to the result set

Answer

order by: Groups data and applies aggregation

Question 15

Match each Azure Storage redundancy option to the best description.

Accepted Answer

LRS: Data is replicated three times within a single data center.. Each redundancy option provides increasing durability and availability: LRS is lowest cost, ZRS protects against zone failure, GRS adds geo-replication, RA-GRS allows read from secondary, GZRS combines zone and geo, RA-GZRS adds read access to secondary.

Answer

RA-GRS: Data is replicated across availability zones and also to a secondary region with read access from secondary.

Answer

RA-GZRS: Data is replicated to a secondary region and supports read access from that secondary.

Question 16

Match each access requirement to the most appropriate Azure Storage authentication or authorization approach.

Accepted Answer

SAS: Provides time-limited delegated access with specified permissions.. SAS provides delegated access; Azure AD authentication uses identity; public access allows anonymous reads; RBAC controls permissions; Azure AD DS extends on-prem AD; Service SAS can include IP restrictions.

Answer

SAS: Uses Azure AD identities to authenticate.

Answer

Azure AD authentication: Provides anonymous read access.

Question 17

Match each NSG or ASG scenario to the most accurate Azure security behavior.

Accepted Answer

NSG applied to subnet: Traffic filtering is applied to all network interfaces in that subnet.. NSGs filter traffic at subnet or NIC level, while ASGs group VMs for scalable rule application. Service tags simplify rules for Azure services.

Answer

Service tag in NSG: Allows traffic only to specific IP ranges defined by user.

Answer

ASG automatically updates NSG rules: ASGs integrate with NSGs but do not auto-update rules; rules must reference the ASG.

Question 18

Match each storage or PaaS access requirement to the correct Azure networking approach or DNS action.

Accepted Answer

Azure VPN Gateway: Connect on-premises network to Azure storage account over the internet using an encrypted tunnel. VPN and ExpressRoute provide private connectivity, Private Link ensures private IP access, and DNS CNAME records map custom domains to Azure endpoints.

Answer

Azure VPN Gateway: Connect on-premises network to Azure storage account with a dedicated private connection that does not traverse the internet

Answer

Azure Private Link: Map a custom domain name to an Azure App Service endpoint

Question 19

A team is choosing the right Azure Monitor alert type for different operational signals. Match each alert type to the situation it is best suited for.

Accepted Answer

Metric alerts: Monitor numeric values. Metric alerts monitor numeric values; Activity log alerts on resource changes; Log alerts query log data; Smart detection finds anomalies; Resource health alerts on resource status; Service health alerts on Azure service issues.

Answer

Metric alerts: Track resource changes

Answer

Activity log alerts: Monitor numeric values

Question 20

Match each Recovery Services vault setting or feature to the behavior an administrator should expect after changing it.

Accepted Answer

Changing replication to GRS: Replicates all existing recovery points. Changing replication to GRS replicates all existing recovery points. Soft delete retains deleted data for 14 days. Changing storage replication after backup requires reconfiguration. Custom managed identity grants specific resource access. Diagnostics settings send logs to Log Analytics. Cross Region Restore enables restore in paired region with GRS.

Answer

Cross Region Restore: Sends logs to Log Analytics

Answer

Diagnostics settings: Enables restore in paired region with GRS