AZ-104 Timed Practice Test 4 — 10 Questions

Question 1

A virtual machine scale set must increase instance count when average CPU exceeds 75 percent and decrease when it stays below 30 percent. What Azure feature should you configure?

Accepted Answer

Autoscale settings. Autoscale settings are the correct feature because they allow you to define scale-out and scale-in rules based on performance metrics like average CPU percentage. In this scenario, you would configure a scale-out rule to increase the instance count when average CPU exceeds 75% and a scale-in rule to decrease it when CPU stays below 30%.

Answer

Availability zones

Answer

Azure Policy

Answer

Update management

Question 2

After a private endpoint for an Azure Blob Storage account is created, VMs in the same VNet still resolve the storage name to the public IP address. The administrator wants the name to resolve to the private endpoint address instead. What should be configured?

Accepted Answer

Link the private DNS zone for blob storage to the virtual network.. When a private endpoint is created for Azure Blob Storage, the private DNS zone (privatelink.blob.core.windows.net) must be linked to the virtual network to enable automatic resolution of the storage account's FQDN to the private endpoint's private IP address. Without this link, VMs in the VNet continue to use public DNS resolution, which returns the public IP. Linking the private DNS zone to the VNet ensures that DNS queries from VMs resolve to the private endpoint address via Azure's DNS infrastructure.

Answer

Create a route table that sends storage traffic to the private endpoint subnet.

Answer

Enable a service endpoint on the subnet that hosts the VMs.

Answer

Assign a public IP address to the private endpoint subnet.

Question 3

An administrator added a user to an Entra security group that already has Contributor on a resource group. The role assignment is correct, but the user still gets 'You do not have access' in the Azure portal 5 minutes later. What is the most likely next step?

Accepted Answer

Have the user sign out and sign back in to refresh the access token.. When a user is added to a security group that already has a role assignment, the new permissions take effect immediately in Azure RBAC, but the user's existing access token (which is cached by the Azure portal) does not include the new group membership claims. The token must be refreshed by signing out and signing back in, or by closing and reopening the browser, to force a new token acquisition that includes the updated role assignments.

Answer

Change the role assignment from the group to the subscription.

Answer

Delete and recreate the resource group.

Answer

Assign Owner directly to the user.

Question 4

An administrator moved a blob to the Archive tier last month. A user needs to open it tomorrow. What must happen before the file can be read?

Accepted Answer

Change the blob to Hot or Cool and wait for rehydration to complete. To read a blob in the Archive tier, it must first be rehydrated to the Hot or Cool tier. This process, called rehydration, changes the blob's tier and makes it accessible for reading. Until rehydration completes, the blob remains offline and cannot be read.

Answer

Create a snapshot of the archived blob

Answer

Enable versioning on the storage account

Answer

Move the storage account to LRS redundancy

Question 5

An Azure subscription contains several resource groups. You need to ensure that users can create virtual machines only in regions approved by the security team. Existing noncompliant VMs can remain unchanged. What should you do?

Accepted Answer

Assign a policy that denies resources in disallowed locations.. Azure Policy can enforce organizational standards by evaluating resources for compliance. The built-in 'Not allowed locations' policy denies the creation of resources in specified regions, ensuring users can only deploy VMs in approved regions. Since the requirement is to allow existing noncompliant VMs to remain unchanged, a deny effect policy (without a 'DeployIfNotExists' or 'Modify' effect) will only affect new deployments, leaving existing resources untouched.

Answer

Apply a ReadOnly lock to each resource group.

Answer

Create an action group in Azure Monitor.

Answer

Move all existing VMs to approved regions.

Question 6

An administrator wants to deploy the same set of Azure VMs every sprint from source control and make code reviews capture every infrastructure change. Which three approaches meet this requirement? Select three.

Accepted Answer

Store a Bicep file in source control and use it as the deployment definition.. Option A is correct because Bicep is a domain-specific language (DSL) for deploying Azure resources declaratively. Storing a Bicep file in source control allows you to version infrastructure as code, and code reviews can capture every change before deployment, ensuring consistency across sprints.

Answer

Create the VMs manually in the Azure portal each sprint and document the clicks afterward.

Answer

Export the resources after deployment and treat the export as the only authoritative source.

Question 7

A storage account should accept requests only from a specific virtual network subnet in Azure. The team does not want traffic to reach the public endpoint from the internet. What should the administrator configure?

Accepted Answer

Add a storage network rule for the subnet or use a private endpoint. Option B is correct because Azure storage accounts can restrict access to specific virtual network subnets using service endpoints or private endpoints. A storage network rule for the subnet allows traffic only from that subnet, while a private endpoint maps the storage account to a private IP in the VNet, completely bypassing the public endpoint. This ensures no internet traffic reaches the public endpoint, meeting the requirement.

Answer

Enable anonymous blob access

Answer

Move the container to the Archive tier

Answer

Assign the Contributor role to the subnet

Question 8

An administrator is preparing an Azure site-to-site VPN gateway deployment for an existing VNet. Which two prerequisites must be in place for the gateway to deploy successfully? Select two.

Accepted Answer

A dedicated GatewaySubnet must exist in the VNet.. Option A is correct because a dedicated GatewaySubnet is a mandatory requirement for deploying any Azure VPN gateway. This subnet must be named 'GatewaySubnet' and must have a minimum address prefix of /29 (though /27 is recommended) to accommodate the gateway VMs and future scaling. Without this subnet, the gateway creation will fail as Azure uses it to host the gateway VMs and route traffic.

Answer

The VNet must already contain a private endpoint for on-premises connectivity.

Answer

A network security group must be attached to the GatewaySubnet.

Answer

The VNet must use a service endpoint for Microsoft.Network.

Question 9

An application running on a VM in a subnet must access an Azure Storage account. The security team wants the storage account to accept traffic only from that subnet, but they do not want a private IP address in the VNet and they do not want to change DNS records. What should the administrator configure?

Accepted Answer

Enable a service endpoint for Microsoft.Storage on the subnet and restrict the storage firewall to that subnet.. Option B is correct because a service endpoint for Microsoft.Storage allows the subnet to send traffic to the storage account over the Azure backbone network using the storage account's public endpoint, without requiring a private IP address or DNS changes. The storage firewall then restricts access to only that subnet's traffic, meeting the security team's requirements.

Answer

Create a private endpoint and a private DNS zone for the storage account.

Answer

Allow access only from the VM public IP address.

Answer

Place the storage account in the same resource group as the VM.

Question 10

An operations team wants an email notification when the average CPU percentage on a VM stays above 85 percent for 10 minutes. Which two Azure Monitor components should they configure? Select two.

Accepted Answer

A metric alert rule. A metric alert rule is correct because it monitors a specific VM performance metric (e.g., Percentage CPU) and triggers when the average value exceeds 85% for a duration of 10 minutes, as defined by the aggregation granularity and evaluation frequency. This rule evaluates the metric data at regular intervals and fires an alert when the condition is met, enabling automated notification.

Answer

Azure Bastion

Answer

A Recovery Services vault

Answer

A resource lock