AZ-104 Timed Practice Test 1 — 10 Questions

Question 1

A Modify policy adds CostCenter=042 to resources in RG-Finance. New resources are tagged correctly, but existing virtual machines remain untagged. What three requirements must be met for the assignment to update the existing resources? Select three.

10 minute time limit — choose an answer to begin.

Accepted Answer

Create a remediation task for the policy assignment.. A remediation task is required to apply a Modify effect policy to existing non-compliant resources. The Modify effect only tags new resources automatically; existing resources remain untagged until a remediation task is triggered, which uses the policy's managed identity to update the resource tags.

Answer

Recreate the virtual machines before the policy can evaluate them.

Answer

Change the effect from Modify to Audit to trigger the tag operation.

Question 2

A developer wants to keep application data separate from the operating system so the VM can be rebuilt without losing files. Before making a risky change, the administrator also wants a fast rollback point for that data disk. Which two actions should the administrator take? Select two.

Accepted Answer

Store the application data on a separate managed data disk. Storing application data on a separate managed data disk decouples the data from the OS disk. This allows the VM to be rebuilt or reimaged without affecting the application files, as the data disk persists independently. Option B is correct because a snapshot of the data disk provides a point-in-time, crash-consistent backup that can be used to quickly restore the data disk to its pre-change state, enabling fast rollback without needing to rebuild the entire VM.

Answer

Use an ephemeral OS disk for the application files

Answer

Keep the files only on the OS disk and rely on reimaging

Answer

Delete and recreate the VM from the same image

Question 3

Based on the exhibit, which Network Watcher tool should you use to determine whether an NSG allows or denies TCP 1433 traffic and which rule is responsible?

Accepted Answer

IP flow verify. IP flow verify tests a specific source/destination IP, port, and protocol (TCP 1433) against the effective NSG rules to report whether traffic is allowed or denied, and it identifies the exact NSG rule (name and priority) responsible for that decision. This makes it the correct tool for determining NSG rule impact on a specific traffic flow.

Answer

Connection troubleshoot

Answer

Packet capture

Answer

Next hop

Question 4

A policy initiative is assigned at the Corp management group to enforce allowed locations and required tags. A new subscription is added under Corp later. Which two statements are true? Select two.

Accepted Answer

The new subscription is automatically in scope because the assignment is at the management group.. Azure Policy assignments at a management group scope are inherited by all child subscriptions, including new ones added later. When the Corp management group has the initiative assigned, any subscription under Corp automatically falls within the policy's evaluation scope without requiring manual re-assignment.

Answer

The initiative must be copied to every resource group in the new subscription before it takes effect.

Answer

The initiative changes RBAC so users lose read access to the subscription.

Answer

Compliance results are only visible in Activity Log, not in Azure Policy.

Question 5

Arrange the steps to create a virtual network in Azure with a subnet and deploy a VM.

Accepted Answer

Step 1: Create the virtual network with address space. Step 2: Add a subnet. Step 3: Associate a Network Security Group (NSG) to the subnet. Step 4: Deploy a virtual machine into the subnet. Step 5: Verify network connectivity.. First create the VNet with address space, then add a subnet, associate NSG, deploy VM, then verify.

Answer

Step 1: Create the virtual network with address space. Step 2: Deploy the virtual machine. Step 3: Add a subnet. Step 4: Associate an NSG to the subnet. Step 5: Verify network connectivity.

Answer

Step 1: Create the virtual network with address space. Step 2: Add a subnet. Step 3: Deploy the virtual machine. Step 4: Associate an NSG to the subnet. Step 5: Verify network connectivity.

Answer

Step 1: Deploy the virtual machine. Step 2: Create the virtual network with address space. Step 3: Add a subnet. Step 4: Associate an NSG to the subnet. Step 5: Verify network connectivity.

Question 6

You need to ensure that junior administrators can view all resources in the Prod-Sub subscription but cannot create, modify, or delete any resources. Which Azure RBAC role should you assign?

Accepted Answer

Reader. The Reader role is the correct choice because it grants read-only access to all resources in a subscription, including their properties and status, but does not allow any create, modify, or delete operations. This aligns perfectly with the requirement for junior administrators to view resources without making changes.

Answer

Owner

Answer

Contributor

Answer

Monitoring Reader

Question 7

A Windows VM must run a bootstrap script during provisioning to install a monitoring agent and write configuration files. The administrator does not want to log in interactively, and the script must be runnable again after the VM is rebuilt. Which two Azure compute components should be used? Select two.

Accepted Answer

Azure VM Agent. The Azure VM Agent (A) is required because it enables the VM to run extensions, including the Custom Script Extension. The Custom Script Extension (B) is the correct mechanism to execute the bootstrap script during provisioning without interactive login, and it can be reapplied to a rebuilt VM by redeploying the same ARM template or CLI command.

Answer

Boot diagnostics

Answer

Availability zone

Answer

Ephemeral OS disk

Question 8

Match each Azure VM deployment concept to the description that best fits it.

Accepted Answer

VMSS: Provides auto-scaling of identical VMs. VMSS provides auto-scaling identical VMs; Availability Set groups VMs for redundancy; Availability Zone offers physical separation; Managed Disk is persistent block storage; Azure Bastion provides secure remote access; Dedicated Host gives single-tenant physical servers.

Answer

Availability Set: Offers physical separation within a region

Answer

Managed Disk: Provides secure remote access to VMs over SSL

Answer

Azure Bastion: Persistent block storage for Azure VMs

Question 9

Match each Azure VM administration requirement on the left with the most appropriate Azure CLI command on the right. Use each answer once.

Accepted Answer

Deploy a new virtual machine: az vm create. Azure CLI commands for VM administration: 'az vm create' deploys, 'az vm resize' changes size, 'az vm start/stop/restart' controls state, and 'az vm delete' removes the VM.

Answer

Stop a virtual machine: az vm delete

Answer

Delete a virtual machine: az vm restart

Answer

Restart a virtual machine: az vm stop

Question 10

Your operations team needs to run Kusto queries across collected sign-in logs, VM performance counters, and Azure Activity Log data in a central location. What should you deploy?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the central repository in Azure that ingests and stores diagnostic data from multiple sources, including sign-in logs (Azure AD), VM performance counters (Azure Monitor for VMs), and Azure Activity Logs. It supports Kusto Query Language (KQL) for running complex queries across all collected data, making it the correct choice for this requirement.

Answer

An availability zone

Answer

A NAT gateway

Answer

A standard public IP address