AZ-104 Multiple Select — 60 Questions

Question 1

A subscription admin wants to investigate who changed a resource and also review the platform-generated events for that subscription. Which two types of logs can be sent to Log Analytics and queried later? Select two.

Accepted Answer

Activity log entries. The Activity log (option A) records subscription-level events such as who created, modified, or deleted a resource, making it essential for investigating administrative changes. Resource diagnostic logs (option B) capture platform-generated events emitted by a resource itself (e.g., Azure SQL Database audit logs, network security group flow logs), which can be sent to Log Analytics for querying. Both log types can be configured to stream to a Log Analytics workspace, enabling Kusto Query Language (KQL) analysis.

Answer

Azure Backup vault names

Answer

Virtual network address spaces

Answer

Managed disk size settings

Question 2

A support engineer must start and restart one specific virtual machine from the Azure portal, but must not be able to delete the VM, change networking, or grant access to others. Which two actions should be included in a custom role? Select two.

Accepted Answer

Microsoft.Compute/virtualMachines/start/action grants the ability to start the VM without broader management permissions.. Option A is correct because Microsoft.Compute/virtualMachines/start/action is a specific permission that allows starting a VM without granting broader management capabilities like deletion or network changes. This action is part of the Azure RBAC role definition and can be included in a custom role to limit the support engineer's scope to only starting the VM.

Answer

Microsoft.Compute/virtualMachines/delete gives the ability to remove the VM from the subscription.

Answer

Microsoft.Network/networkInterfaces/write is needed because a VM start or restart always requires NIC modification rights.

Answer

Microsoft.Authorization/roleAssignments/write would let the engineer grant access to other users and manage permissions.

Question 3

A subscription already grants Contributor to an application team. The organization wants to prevent deployments in unsupported Azure regions and ensure every new resource has an Environment tag. Which two controls should be implemented with Azure Policy rather than RBAC? Select two.

Accepted Answer

Assign an allowed-locations policy at the management group or subscription scope.. Option A is correct because Azure Policy can enforce an 'allowed-locations' policy at the management group or subscription scope to restrict resource deployment to only approved Azure regions. This is a governance control that operates declaratively, evaluating resource properties against policy rules before or after creation, unlike RBAC which controls identity-based permissions. Option C is correct because Azure Policy can enforce the 'Environment' tag on new resources using a 'require a tag and its value' policy, ensuring compliance without modifying role assignments.

Answer

Create a custom RBAC role that blocks resources deployed outside approved regions.

Answer

Add a CanNotDelete lock to every resource group.

Answer

Grant User Access Administrator to the deployment team.

Question 4

A team moved blob data to the Archive tier to minimize cost. They now need to restore a few files for an audit. Which two statements are true about accessing archived blobs? Select two.

Accepted Answer

Rehydration is required before the blob can be read or copied.. Archived blobs are in an offline state and cannot be read or copied directly. They must first be rehydrated to an online tier (Hot or Cool) through a process that changes the blob's tier or copies it to a new online blob. This rehydration process is asynchronous and takes time, depending on the priority set.

Answer

Archived blobs can be read immediately through normal blob reads.

Answer

Archive tier provides the fastest retrieval time.

Answer

Changing a blob from Archive to Hot completes instantly and synchronously.

Question 5

A user deleted several files from an Azure VM, and the administrator wants to use Azure Backup file recovery. Which two items are needed to start the recovery process? Select two.

Accepted Answer

A recovery point. Azure Backup file recovery requires a recovery point (A) because it represents the snapshot of the VM's data at a specific time from which files can be restored. The file recovery script (C) is downloaded from the Recovery Services vault and mounts the recovery point as a drive on the VM, enabling file-level access. Without both, the recovery process cannot proceed.

Answer

An application security group

Answer

A metric alert rule

Answer

A user-assigned managed identity

Question 6

An administrator wants to deploy the same set of Azure VMs every sprint from source control and make code reviews capture every infrastructure change. Which three approaches meet this requirement? Select three.

Accepted Answer

Store a Bicep file in source control and use it as the deployment definition.. Option A is correct because Bicep is a domain-specific language (DSL) for deploying Azure resources declaratively. Storing a Bicep file in source control allows you to version infrastructure as code, and code reviews can capture every change before deployment, ensuring consistency across sprints.

Answer

Create the VMs manually in the Azure portal each sprint and document the clicks afterward.

Answer

Export the resources after deployment and treat the export as the only authoritative source.

Question 7

An administrator is preparing an Azure site-to-site VPN gateway deployment for an existing VNet. Which two prerequisites must be in place for the gateway to deploy successfully? Select two.

Accepted Answer

A dedicated GatewaySubnet must exist in the VNet.. Option A is correct because a dedicated GatewaySubnet is a mandatory requirement for deploying any Azure VPN gateway. This subnet must be named 'GatewaySubnet' and must have a minimum address prefix of /29 (though /27 is recommended) to accommodate the gateway VMs and future scaling. Without this subnet, the gateway creation will fail as Azure uses it to host the gateway VMs and route traffic.

Answer

The VNet must already contain a private endpoint for on-premises connectivity.

Answer

A network security group must be attached to the GatewaySubnet.

Answer

The VNet must use a service endpoint for Microsoft.Network.

Question 8

An operations team wants an email notification when the average CPU percentage on a VM stays above 85 percent for 10 minutes. Which two Azure Monitor components should they configure? Select two.

Accepted Answer

A metric alert rule. A metric alert rule is correct because it monitors a specific VM performance metric (e.g., Percentage CPU) and triggers when the average value exceeds 85% for a duration of 10 minutes, as defined by the aggregation granularity and evaluation frequency. This rule evaluates the metric data at regular intervals and fires an alert when the condition is met, enabling automated notification.

Answer

Azure Bastion

Answer

A Recovery Services vault

Answer

A resource lock

Question 9

An external consultant must access a resource group in your tenant using the consultant's existing work account. You want to avoid creating a separate username and password pair. Which two actions should the administrator take? Select two.

Accepted Answer

Invite the consultant as a guest user in Microsoft Entra ID.. Option A is correct because inviting the consultant as a guest user in Microsoft Entra ID (formerly Azure AD) allows the consultant to use their existing work account (external identity) without creating a new username/password. This leverages B2B collaboration, which uses the consultant's home directory for authentication, and the guest user object is created in your tenant to represent them.

Answer

Create a new member user account with an internal password.

Answer

Add the consultant to the Global Administrator role.

Answer

Share the subscription ID and tenant ID only.

Question 10

An enterprise has a management group named Corp that contains all production and sandbox subscriptions. An Entra ID group named Auditors must be able to read resources in every current subscription under Corp and in any subscription added later. Which two actions should the administrator take? Select two.

Accepted Answer

Assign the Reader role to the Auditors group at the Corp management group scope.. Assigning the Reader role at the Corp management group scope ensures that the Auditors group inherits read permissions to all current and future subscriptions under Corp, because Azure RBAC permissions assigned at a management group are inherited by all child subscriptions and resource groups. This meets the requirement for both existing and future subscriptions without manual updates.

Answer

Assign the Reader role directly to every subscription under Corp.

Answer

Assign the Reader role to the Auditors group at one resource group scope.

Answer

Create an Azure Policy assignment to grant read access to all subscriptions.

Question 11

An Azure application and an Azure Automation account need Azure access without any stored secrets. The same identity should be reusable and should not require manual secret rotation. Which two identity choices meet the requirement? Select two.

Accepted Answer

System-assigned managed identity attached to the resource that needs access.. System-assigned managed identity (Option A) is correct because it is automatically created and tied to a specific Azure resource, such as a virtual machine or App Service, and provides an Azure AD identity that can be used to authenticate to any service supporting Azure AD authentication without storing any secrets. The identity is managed by Azure, eliminating the need for manual secret rotation, and it is automatically deleted when the resource is deleted, ensuring no orphaned secrets.

Answer

Service principal with a client secret stored in an app setting.

Answer

Shared administrator username and password stored in a Key Vault secret.

Answer

SAS token generated once and reused indefinitely by both resources.

Question 12

An employee deleted one spreadsheet from a Windows VM that is protected by Azure Backup. The VM must stay online while the administrator recovers only that file. Which two restore methods are supported? Select two.

Accepted Answer

Use file recovery from the recovery point in the Azure portal.. Option A is correct because Azure Backup's file-level recovery feature in the Azure portal allows you to mount a recovery point as a drive on the running Windows VM, enabling you to browse and copy individual files without restoring the entire VM. This method supports selective file recovery while the VM remains online, meeting the requirement. Option B is also correct because the file recovery script (or PowerShell mount workflow) performs the same mount operation programmatically, providing an alternative way to access and recover the specific spreadsheet from the recovery point.

Answer

Restore the entire VM to a new VM and copy the file back manually.

Answer

Restore the disks from backup and attach them to the running VM.

Answer

Use Azure Site Recovery failover to expose the file.

Question 13

A business wants a line-of-business VM workload to keep running if one Azure datacenter in the region goes offline. Which two deployment choices should the administrator use? Select two.

Accepted Answer

Deploy the VMs in different availability zones.. Option A is correct because deploying VMs across different availability zones protects against a single datacenter failure. Each availability zone is a physically separate datacenter within an Azure region, with independent power, cooling, and networking. If one zone goes offline, the VM in the other zone remains operational, ensuring business continuity for the line-of-business workload.

Answer

Place the VMs in the same availability set.

Answer

Use a proximity placement group for the VMs.

Answer

Use a snapshot of the operating system disk.

Question 14

One team needs to run a Linux container for about 15 minutes per request with no inbound traffic and no cluster to manage. Another team needs an internet-facing web app with built-in HTTPS, deployment slots, and autoscale. Which two Azure services should the administrator choose? Select two.

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice for the first team because it allows running a Linux container directly on Azure without managing any underlying infrastructure or cluster, and it supports a 15-minute execution time with no inbound traffic required. ACI is ideal for burstable, short-lived container workloads that do not need orchestration.

Answer

Azure Virtual Machines

Answer

Azure Kubernetes Service

Answer

Azure Batch

Question 15

A contractor needs Contributor on only VM1 and VM2 in rg-prod. Other resources in rg-prod must remain untouched, and the contractor must not gain access to any other resource groups or subscriptions. Which two role-assignment scopes meet the requirement? Select two.

Accepted Answer

Assign the role at the VM1 resource scope.. Option A is correct because assigning the Contributor role at the VM1 resource scope grants the contractor permissions exclusively to that virtual machine, leaving all other resources in rg-prod and other scopes untouched. This meets the requirement of limiting access to only VM1 and VM2 within rg-prod.

Answer

Assign the role at the rg-prod resource group scope.

Answer

Assign the role at the subscription scope.

Answer

Assign the role at the management group scope.

Question 16

A finance team stores documents in Azure Storage. The account must survive a failure of one availability zone in the primary region and also remain available if the primary region becomes unavailable. Which two replication options meet this requirement? Select two.

Accepted Answer

GZRS, because it combines zone redundancy in the primary region with geo-replication to a secondary region.. Option C (GZRS) is correct because it provides both zone-redundant storage (ZRS) within the primary region, ensuring survival of an availability zone failure, and geo-replication (GRS) to a secondary region, ensuring availability if the entire primary region becomes unavailable. This meets both requirements of the question.

Answer

LRS, because it keeps copies only within one datacenter and does not provide zone or geo protection.

Answer

ZRS, because it replicates across zones in one region but does not add secondary-region replication.

Answer

RA-GRS, because it allows reading from the secondary region but does not use zone-redundant storage in the primary region.

Question 17

A production resource group contains web and data resources. Administrators must be able to update, scale, and restart resources, but they must not delete the resource group or any resource inside it during maintenance windows. Which two actions should the administrator take? Select two.

Accepted Answer

Apply a CanNotDelete lock to the resource group.. Option A is correct because applying a CanNotDelete lock to the resource group prevents the deletion of the resource group and all resources within it, while still allowing administrators to update, scale, and restart resources. This lock type blocks delete operations but permits read and update operations, which aligns with the requirement to perform maintenance actions without risking deletion. The lock is inherited by all child resources in the resource group, ensuring comprehensive protection.

Answer

Apply a ReadOnly lock to the resource group.

Answer

Apply a CanNotDelete lock only to the individual virtual machines.

Answer

Use tags to mark the resources as production and prevent deletion.

Question 18

A legal team archived a 200-GB blob last quarter. They now need to open it repeatedly later today for review, and waiting more than a day would delay the case. Which two actions should the administrator take? Select two.

Accepted Answer

Start a rehydration request and target the Hot tier.. Option A is correct because rehydrating a blob from the Archive tier to the Hot tier makes it accessible for frequent reads. The Hot tier is optimized for high-frequency access, which matches the legal team's need to open the blob repeatedly later today. Rehydration is the only way to change the blob's tier from Archive to an online tier like Hot.

Answer

Copy the blob directly while it remains in the Archive tier.

Answer

Change the blob back to the Archive tier after the request starts.

Answer

Take a snapshot first and expect it to make the archived blob readable immediately.

Question 19

A stateless web tier must survive a datacenter outage in a region that supports availability zones, and the number of instances should increase during business hours. Which three actions should the administrator take? Select three.

Accepted Answer

Deploy the workload as a virtual machine scale set instead of a standalone VM.. A virtual machine scale set (VMSS) provides automatic scaling and high availability across multiple instances, which is essential for a stateless web tier that must survive a datacenter outage. By deploying as a scale set instead of a standalone VM, the administrator gains the ability to distribute instances across availability zones and configure autoscale rules to adjust capacity based on demand, meeting both the resilience and elasticity requirements.

Answer

Place all instances in a single availability set and scale them manually.

Answer

Deploy only one zonal VM and use snapshots to recover if the datacenter fails.

Question 20

A team wants an Azure VM in a subnet to reach a storage account securely without opening the account to the entire internet. Which two configuration choices can be used to achieve this? Select two.

Accepted Answer

Private endpoint. Private endpoint (A) assigns a private IP address from the VM's subnet to the storage account, enabling secure connectivity over the Microsoft backbone network without exposing the account to the public internet. Service endpoint (B) extends the virtual network identity to the storage account via its public endpoint but restricts access to traffic originating from the specified subnet, also avoiding full internet exposure. Both options satisfy the requirement for secure, subnet-restricted access.

Answer

Enable anonymous blob access

Answer

Move the account to the Archive tier

Answer

Apply a delete lock to the storage account