AZ-104 Timed Practice Test 2 — 10 Questions

Question 1

One team needs to run a Linux container for about 15 minutes per request with no inbound traffic and no cluster to manage. Another team needs an internet-facing web app with built-in HTTPS, deployment slots, and autoscale. Which two Azure services should the administrator choose? Select two.

10 minute time limit — choose an answer to begin.

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice for the first team because it allows running a Linux container directly on Azure without managing any underlying infrastructure or cluster, and it supports a 15-minute execution time with no inbound traffic required. ACI is ideal for burstable, short-lived container workloads that do not need orchestration.

Answer

Azure Virtual Machines

Answer

Azure Kubernetes Service

Answer

Azure Batch

Question 2

Match each storage resiliency requirement to the Azure redundancy option that best satisfies it.

Accepted Answer

LRS: Locally redundant storage replicates data three times within a single datacenter in the primary region.. LRS replicates within a single datacenter; ZRS across zones; GRS across regions; RA-GRS adds read access to GRS; RA-ZRS adds read access to ZRS. LRS is cheapest, GRS is highest durability.

Answer

LRS: Provides synchronous replication across three availability zones.

Answer

GRS: Provides read access to the secondary region.

Question 3

Match each storage networking requirement to the Azure storage network control that should be used.

Accepted Answer

Enable secure access from a specific VNet: Use service endpoints. Azure storage network controls: service endpoints for VNet access, private endpoints for private connectivity, IP firewall for public IP restrictions, trusted services exception, route tables for custom routing, and disabling public access for complete lockdown.

Answer

Enable secure access from a specific VNet: Use private endpoints

Answer

Restrict access to a specific public IP address: Enable trusted services exception

Answer

Block all public network access: Use IP firewall rules

Question 4

A team is troubleshooting inbound access to Azure VMs. Match each NSG concept on the left with the most accurate behavior or troubleshooting implication on the right.

Accepted Answer

NSG: A distributed firewall that filters traffic based on rules.. NSG is a distributed firewall; default inbound rule denies all; UDR overrides routes; ASG groups VMs; flow logs record traffic; service tags represent Azure IPs.

Answer

Default inbound rule: Allows all inbound traffic by default.

Answer

Service tags: Override default system routes.

Question 5

Match each access scenario to the SAS or key type that best fits it.

Accepted Answer

Interactive logins: User delegation SAS. Interactive logins use user delegation SAS; automated backups use system-assigned managed identity; cross-tenant access requires a service principal with certificate; VM patching uses system-assigned managed identity; app access to SQL uses user-assigned managed identity; key rotation uses storage account access keys.

Answer

Interactive logins: Storage account access keys

Answer

Automated backups: User delegation SAS

Answer

Cross-tenant access: System-assigned managed identity

Question 6

You need to view recommendations about underutilized virtual machines, security improvements, and cost-saving opportunities in Azure. Which service should you use?

Accepted Answer

Azure Advisor. Azure Advisor provides personalized best-practice recommendations related to reliability, security, performance, operational excellence, and cost.

Answer

Azure Policy

Answer

Network Watcher

Answer

Azure Backup

Question 7

Your company has a hybrid infrastructure with Azure VMs and on-premises servers. You need to configure Azure Monitor to collect and analyze performance and event data from all servers in a centralized workspace. Which three of the following steps are required to achieve this? (Choose three.)

Accepted Answer

Create a Log Analytics workspace in the same Azure region as your Azure VMs.. The Azure Monitor Agent (AMA) is the current recommended agent for collecting telemetry from both Azure VMs and on-premises servers, replacing the legacy Microsoft Monitoring Agent (MMA). A Log Analytics workspace is required as the centralized data repository, and Data Collection Rules (DCRs) define exactly which performance counters and events to collect, enabling granular, scalable data ingestion without manual configuration per machine.

Answer

Enable Network Watcher to monitor network traffic between on-premises and Azure.

Answer

Create a VM Insights solution in the Azure portal to automatically collect data from all Azure VMs.

Answer

Install the Microsoft Monitoring Agent (MMA) on all servers and connect to a Log Analytics workspace.

Question 8

You are designing an Azure virtual network for a three-tier application. The frontend, application, and database tiers each require their own subnet. You need to ensure that the frontend tier can communicate with the application tier, but the database tier must be isolated from direct inbound traffic from the internet. Which three of the following actions should you include in your design? (Choose three.)

Accepted Answer

Create a single virtual network with three subnets: frontend, application, and database.. Assigning a network security group (NSG) to the database subnet that denies all inbound traffic from the internet is correct because NSGs act as a distributed, stateful firewall at the subnet or NIC level. By default, NSGs allow all inbound traffic from within the virtual network, so you must explicitly add a deny rule for internet traffic (source 'Internet') to isolate the database tier. This ensures the database subnet is protected from direct inbound internet traffic while still allowing traffic from the application tier via the default allow rule for virtual network traffic.

Answer

Use Azure Firewall to inspect traffic between the frontend and application tiers.

Answer

Route traffic from the application tier to the database tier using a user-defined route (UDR) pointing to the Azure Firewall.

Answer

Configure a virtual network peering to connect the frontend and database subnets.

Question 9

Your organization has an Azure Active Directory (Azure AD) tenant with 500 users. You need to ensure that users can reset their own passwords without IT support, but only if they have registered for multi-factor authentication (MFA). Additionally, you want to prevent users from reusing their last 10 passwords. Which three of the following should you configure? (Choose three.)

Accepted Answer

Set the 'Number of passwords remembered' policy to 10 in the 'Password reset' blade.. To allow users to reset their own passwords without IT support, you must enable the 'Self-service password reset' (SSPR) feature in Azure AD. To prevent password reuse, you set the 'Number of passwords remembered' policy to 10 in the Password reset blade, which enforces a password history of 10 unique passwords. Finally, to ensure that only users registered for MFA can reset their passwords, you configure the 'Number of methods required to reset' to 2 and require MFA registration, which forces users to provide two authentication methods (including MFA) before resetting.

Answer

Enable 'Combined registration' for security info to simplify MFA and SSPR registration.

Answer

Assign the 'Global Administrator' role to all users to allow password reset.

Answer

Configure 'Password protection' with a custom banned password list.

Question 10

You are an Azure administrator for a company that runs critical virtual machines (VMs) in Azure. You need to configure a monitoring solution that will alert you when the average CPU usage of a specific VM exceeds 90% for more than 15 minutes. Which three of the following actions should you take to set up this alert? (Choose three.)

Accepted Answer

Define an action group that includes an email notification to the operations team.. A metric alert rule in Azure Monitor is the correct approach because it directly monitors a specific metric like 'Percentage CPU' from the VM without requiring additional data collection. Configuring the condition to fire when the average CPU usage exceeds 90% for a period of 15 minutes ensures the alert triggers only after sustained high usage, reducing noise. Defining an action group with email notification is necessary to alert the operations team when the alert fires, completing the monitoring solution.

Answer

Enable Azure Diagnostic Settings on the VM to send performance data to a storage account.

Answer

Create a log alert rule based on the VM's performance counters collected in Log Analytics.

Answer

Configure an Application Insights availability test to monitor the VM's CPU.