AZ-104 Multiple Select — 30 Questions

Question 1

A Modify policy adds CostCenter=042 to resources in RG-Finance. New resources are tagged correctly, but existing virtual machines remain untagged. What three requirements must be met for the assignment to update the existing resources? Select three.

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a remediation task for the policy assignment.. A remediation task is required to apply a Modify effect policy to existing non-compliant resources. The Modify effect only tags new resources automatically; existing resources remain untagged until a remediation task is triggered, which uses the policy's managed identity to update the resource tags.

Answer

Recreate the virtual machines before the policy can evaluate them.

Answer

Change the effect from Modify to Audit to trigger the tag operation.

Question 2

A developer wants to keep application data separate from the operating system so the VM can be rebuilt without losing files. Before making a risky change, the administrator also wants a fast rollback point for that data disk. Which two actions should the administrator take? Select two.

Accepted Answer

Store the application data on a separate managed data disk. Storing application data on a separate managed data disk decouples the data from the OS disk. This allows the VM to be rebuilt or reimaged without affecting the application files, as the data disk persists independently. Option B is correct because a snapshot of the data disk provides a point-in-time, crash-consistent backup that can be used to quickly restore the data disk to its pre-change state, enabling fast rollback without needing to rebuild the entire VM.

Answer

Use an ephemeral OS disk for the application files

Answer

Keep the files only on the OS disk and rely on reimaging

Answer

Delete and recreate the VM from the same image

Question 3

A policy initiative is assigned at the Corp management group to enforce allowed locations and required tags. A new subscription is added under Corp later. Which two statements are true? Select two.

Accepted Answer

The new subscription is automatically in scope because the assignment is at the management group.. Azure Policy assignments at a management group scope are inherited by all child subscriptions, including new ones added later. When the Corp management group has the initiative assigned, any subscription under Corp automatically falls within the policy's evaluation scope without requiring manual re-assignment.

Answer

The initiative must be copied to every resource group in the new subscription before it takes effect.

Answer

The initiative changes RBAC so users lose read access to the subscription.

Answer

Compliance results are only visible in Activity Log, not in Azure Policy.

Question 4

A Windows VM must run a bootstrap script during provisioning to install a monitoring agent and write configuration files. The administrator does not want to log in interactively, and the script must be runnable again after the VM is rebuilt. Which two Azure compute components should be used? Select two.

Accepted Answer

Azure VM Agent. The Azure VM Agent (A) is required because it enables the VM to run extensions, including the Custom Script Extension. The Custom Script Extension (B) is the correct mechanism to execute the bootstrap script during provisioning without interactive login, and it can be reapplied to a rebuilt VM by redeploying the same ARM template or CLI command.

Answer

Boot diagnostics

Answer

Availability zone

Answer

Ephemeral OS disk

Question 5

One team needs to run a Linux container for about 15 minutes per request with no inbound traffic and no cluster to manage. Another team needs an internet-facing web app with built-in HTTPS, deployment slots, and autoscale. Which two Azure services should the administrator choose? Select two.

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice for the first team because it allows running a Linux container directly on Azure without managing any underlying infrastructure or cluster, and it supports a 15-minute execution time with no inbound traffic required. ACI is ideal for burstable, short-lived container workloads that do not need orchestration.

Answer

Azure Virtual Machines

Answer

Azure Kubernetes Service

Answer

Azure Batch

Question 6

Your company has a hybrid infrastructure with Azure VMs and on-premises servers. You need to configure Azure Monitor to collect and analyze performance and event data from all servers in a centralized workspace. Which three of the following steps are required to achieve this? (Choose three.)

Accepted Answer

Create a Log Analytics workspace in the same Azure region as your Azure VMs.. The Azure Monitor Agent (AMA) is the current recommended agent for collecting telemetry from both Azure VMs and on-premises servers, replacing the legacy Microsoft Monitoring Agent (MMA). A Log Analytics workspace is required as the centralized data repository, and Data Collection Rules (DCRs) define exactly which performance counters and events to collect, enabling granular, scalable data ingestion without manual configuration per machine.

Answer

Create a VM Insights solution in the Azure portal to automatically collect data from all Azure VMs.

Answer

Install the Microsoft Monitoring Agent (MMA) on all servers and connect to a Log Analytics workspace.

Answer

Enable Network Watcher to monitor network traffic between on-premises and Azure.

Question 7

You are designing an Azure virtual network for a three-tier application. The frontend, application, and database tiers each require their own subnet. You need to ensure that the frontend tier can communicate with the application tier, but the database tier must be isolated from direct inbound traffic from the internet. Which three of the following actions should you include in your design? (Choose three.)

Accepted Answer

Assign a network security group (NSG) to the database subnet that denies all inbound traffic from the internet.. Assigning a network security group (NSG) to the database subnet that denies all inbound traffic from the internet is correct because NSGs act as a distributed, stateful firewall at the subnet or NIC level. By default, NSGs allow all inbound traffic from within the virtual network, so you must explicitly add a deny rule for internet traffic (source 'Internet') to isolate the database tier. This ensures the database subnet is protected from direct inbound internet traffic while still allowing traffic from the application tier via the default allow rule for virtual network traffic.

Answer

Route traffic from the application tier to the database tier using a user-defined route (UDR) pointing to the Azure Firewall.

Answer

Use Azure Firewall to inspect traffic between the frontend and application tiers.

Answer

Configure a virtual network peering to connect the frontend and database subnets.

Question 8

Your organization has an Azure Active Directory (Azure AD) tenant with 500 users. You need to ensure that users can reset their own passwords without IT support, but only if they have registered for multi-factor authentication (MFA). Additionally, you want to prevent users from reusing their last 10 passwords. Which three of the following should you configure? (Choose three.)

Accepted Answer

Set the 'Number of passwords remembered' policy to 10 in the 'Password reset' blade.. To allow users to reset their own passwords without IT support, you must enable the 'Self-service password reset' (SSPR) feature in Azure AD. To prevent password reuse, you set the 'Number of passwords remembered' policy to 10 in the Password reset blade, which enforces a password history of 10 unique passwords. Finally, to ensure that only users registered for MFA can reset their passwords, you configure the 'Number of methods required to reset' to 2 and require MFA registration, which forces users to provide two authentication methods (including MFA) before resetting.

Answer

Assign the 'Global Administrator' role to all users to allow password reset.

Answer

Configure 'Password protection' with a custom banned password list.

Answer

Enable 'Combined registration' for security info to simplify MFA and SSPR registration.

Question 9

You are an Azure administrator for a company that runs critical virtual machines (VMs) in Azure. You need to configure a monitoring solution that will alert you when the average CPU usage of a specific VM exceeds 90% for more than 15 minutes. Which three of the following actions should you take to set up this alert? (Choose three.)

Accepted Answer

Configure the alert condition to fire when the average CPU usage is greater than 90 for a period of 15 minutes.. A metric alert rule in Azure Monitor is the correct approach because it directly monitors a specific metric like 'Percentage CPU' from the VM without requiring additional data collection. Configuring the condition to fire when the average CPU usage exceeds 90% for a period of 15 minutes ensures the alert triggers only after sustained high usage, reducing noise. Defining an action group with email notification is necessary to alert the operations team when the alert fires, completing the monitoring solution.

Answer

Configure an Application Insights availability test to monitor the VM's CPU.

Answer

Create a log alert rule based on the VM's performance counters collected in Log Analytics.

Answer

Enable Azure Diagnostic Settings on the VM to send performance data to a storage account.

Question 10

Which three of the following statements about Azure App Service plans are correct? (Choose three.)

Accepted Answer

Apps in the same App Service plan share the same compute resources, even if they are in different resource groups.. Apps in the same App Service plan share the same compute resources (VMs, memory, CPU) because the plan defines the underlying infrastructure. This is true even if the apps are in different resource groups, as the plan is the boundary for resource allocation, not the resource group.

Answer

Changing the pricing tier of an App Service plan always causes downtime for all apps in the plan.

Answer

An App Service plan can only contain apps from the same region and the same resource group.

Answer

The Free and Shared tiers support custom domain names and SSL binding without additional cost.

Question 11

A Windows VM and a Linux VM are both joined to the same Active Directory Domain Services domain. Which two authentication methods can be used to mount the same Azure Files share over SMB? Select two.

Accepted Answer

Storage account key. The storage account key provides administrative access to the Azure Files share, allowing any SMB client (Windows or Linux) to mount the share by using the key as the credential. Option B is correct because when both VMs are joined to the same Active Directory Domain Services domain, the Azure Files share can be enabled for AD DS authentication, allowing domain-joined clients to mount the share using their domain credentials.

Answer

Blob SAS token

Answer

Network security group rule

Answer

Azure resource lock

Question 12

A department has 10 subscriptions and wants the same two governance rules applied to all current and future subscriptions. One rule audits missing tags, and the other denies unapproved locations. Which two actions should the administrator take? Select two.

Accepted Answer

Create an Azure Policy initiative that contains both policy definitions.. Azure Policy Initiative allows grouping multiple policy definitions (like audit for missing tags and deny for unapproved locations) into a single set for coordinated enforcement. Assigning the initiative at the management group scope ensures it applies to all current and future subscriptions under that management group, meeting the requirement for consistent governance across all 10 subscriptions and any new ones added later.

Answer

Assign each policy only to one resource group.

Answer

Use Azure RBAC instead of Policy for both requirements.

Answer

Create a read-only lock on each subscription.

Question 13

A reporting application will run on a single Azure VM and needs 8 vCPUs, 64 GiB of RAM, and a temporary local disk for cache. The team wants a size that satisfies the requirement without oversizing memory or paying for an unnecessarily large specialty series. Which two VM sizes meet the requirement best? Select two.

Accepted Answer

E8as_v5. The E8as_v5 is correct because it provides 8 vCPUs and 64 GiB of RAM, matching the requirement exactly, and includes a temporary local disk (SSD) for cache. It belongs to the memory-optimized Esv5 series, which is designed for memory-intensive workloads without oversizing, and the 'as' variant includes local temporary storage.

Answer

D8as_v5

Answer

F8s_v2

Answer

M8ms

Question 14

A customer-facing service needs to survive a single datacenter outage in a zone-supported region. You do not need cross-region failover, but you do need Azure to spread instances without manual placement errors. Which two deployment choices satisfy that goal? Select two.

Accepted Answer

Place the VMs in different availability zones within the same region.. Availability zones are physically separate datacenters within a region, each with independent power, cooling, and networking. Placing VMs in different zones ensures that a single datacenter outage does not affect all instances, meeting the survivability requirement without manual placement errors. Azure automatically distributes VMs across selected zones, eliminating human error in instance placement.

Answer

Use an availability set and expect it to cover a zone outage.

Answer

Keep all instances in one zone and rely on the load balancer.

Answer

Use a paired region for automatic in-region zone balancing.

Question 15

A customer wants official information about whether an Azure service issue is affecting their subscription or the wider Azure platform. Which two sources should they check? Select two.

Accepted Answer

Azure Service Health. Azure Service Health (B) provides personalized alerts and guidance when Azure service issues affect your subscription, including planned maintenance and health advisories. Azure Status (D) offers a global view of the health of all Azure services across regions, which is the official source for widespread platform issues. Together, they cover both subscription-specific and platform-wide service incidents.

Answer

Azure Advisor

Answer

Backup center

Answer

Resource Graph

Question 16

Three application VMs in separate resource groups must use the same identity to read a configuration endpoint. The identity must keep working if any one VM is deleted and later recreated. Which three actions should the administrator take? Select three.

Accepted Answer

Create a user-assigned managed identity that can exist independently of any single VM.. A user-assigned managed identity is an Azure resource that exists independently of any VM, unlike a system-assigned identity which is tied to the VM lifecycle. This independence ensures the identity persists even when a VM is deleted and recreated, maintaining continuous access to the configuration endpoint. By creating a user-assigned managed identity, the administrator decouples the identity from any single VM, satisfying the requirement that the identity must keep working after VM deletion and recreation.

Answer

Use a system-assigned managed identity on only one VM and copy its access token to the other two VMs.

Answer

Store one application password locally on each VM and use it instead of Azure-managed identities.

Question 17

VM-App01 is responding slowly and appears to be on a degraded Azure host. You must keep the VM resource, keep its disks and NIC, and move it to fresh infrastructure before further troubleshooting. Which two actions can achieve that goal? Select two.

Accepted Answer

Redeploy the VM.. Redeploying the VM (Option A) moves the VM to a new Azure host node while preserving the VM resource, its disks, and NIC. This is the correct action because it resolves host-level degradation without deleting or recreating the VM. Stopping/deallocating the VM (Option D) releases the underlying hardware lease, which forces the VM to be placed on a new host when started again, also preserving the VM resource, disks, and NIC.

Answer

Delete the VM and recreate it from the OS disk.

Answer

Capture the VM into a generalized image.

Answer

Convert the VM to an availability set.

Question 18

An operations team wants to label resources by Department and Environment so they can search and report on ownership across many resource groups. Which two statements are correct? Select two.

Accepted Answer

Tags are key-value pairs that can be applied to resources and resource groups.. Azure tags are indeed key-value pairs that can be applied to resources and resource groups. This allows the operations team to label resources with metadata like Department and Environment, enabling efficient searching, filtering, and reporting across multiple resource groups without affecting resource functionality.

Answer

A ReadOnly lock is the best way to record department ownership.

Answer

Tags automatically encrypt the data in a resource.

Answer

Tags replace Azure Policy when compliance must be enforced.

Question 19

The operations team wants 3 to 8 identical Linux VM instances, with more instances added when average CPU stays above 70 percent for 10 minutes and removed when load falls. Which three settings should be configured? Select three.

Accepted Answer

Use a virtual machine scale set for the identical application instances.. A virtual machine scale set (VMSS) is the correct Azure service for deploying and managing a group of identical, load-balanced Linux VMs that can automatically scale in and out based on demand. It supports autoscaling rules that adjust the instance count within a defined range, meeting the requirement for 3 to 8 identical instances with automatic addition when average CPU exceeds 70% for 10 minutes and removal when load falls.

Answer

Place the VMs in an availability set instead of using a scale set.

Answer

Clone the VM manually whenever CPU rises and remove clones by hand later.

Question 20

A build agent VM is recreated from image every night. The OS can be lost on reimage, but build caches and artifacts must persist across rebuilds. The team also wants the cheapest OS storage option that supports this pattern. Which two choices should you make? Select two.

Accepted Answer

Use an ephemeral OS disk.. An ephemeral OS disk uses the local VM storage or temp SSD, which is destroyed when the VM is deallocated or reimaged. This matches the requirement that the OS can be lost on reimage. Option B is correct because placing build caches and artifacts on a separate managed data disk ensures they persist independently of the OS disk lifecycle; data disks are not affected by OS reimaging and can be reattached to the new VM instance.

Answer

Use a Premium SSD OS disk so the reimage is preserved.

Answer

Store the caches only on the temporary resource disk.

Answer

Use an availability set to make the OS disk persistent.