AZ-104 Practice Questions

Question 1

A Modify policy adds CostCenter=042 to resources in RG-Finance. New resources are tagged correctly, but existing virtual machines remain untagged. What three requirements must be met for the assignment to update the existing resources? Select three.

Accepted Answer

Create a remediation task for the policy assignment.. A remediation task is required to apply a Modify effect policy to existing non-compliant resources. The Modify effect only tags new resources automatically; existing resources remain untagged until a remediation task is triggered, which uses the policy's managed identity to update the resource tags.

Answer

Recreate the virtual machines before the policy can evaluate them.

Answer

Change the effect from Modify to Audit to trigger the tag operation.

Question 2

A developer wants to keep application data separate from the operating system so the VM can be rebuilt without losing files. Before making a risky change, the administrator also wants a fast rollback point for that data disk. Which two actions should the administrator take? Select two.

Accepted Answer

Store the application data on a separate managed data disk. Storing application data on a separate managed data disk decouples the data from the OS disk. This allows the VM to be rebuilt or reimaged without affecting the application files, as the data disk persists independently. Option B is correct because a snapshot of the data disk provides a point-in-time, crash-consistent backup that can be used to quickly restore the data disk to its pre-change state, enabling fast rollback without needing to rebuild the entire VM.

Answer

Use an ephemeral OS disk for the application files

Answer

Keep the files only on the OS disk and rely on reimaging

Answer

Delete and recreate the VM from the same image

Question 3

Based on the exhibit, which Network Watcher tool should you use to determine whether an NSG allows or denies TCP 1433 traffic and which rule is responsible?

Accepted Answer

IP flow verify. IP flow verify tests a specific source/destination IP, port, and protocol (TCP 1433) against the effective NSG rules to report whether traffic is allowed or denied, and it identifies the exact NSG rule (name and priority) responsible for that decision. This makes it the correct tool for determining NSG rule impact on a specific traffic flow.

Answer

Connection troubleshoot

Answer

Packet capture

Answer

Next hop

Question 4

A policy initiative is assigned at the Corp management group to enforce allowed locations and required tags. A new subscription is added under Corp later. Which two statements are true? Select two.

Accepted Answer

The new subscription is automatically in scope because the assignment is at the management group.. Azure Policy assignments at a management group scope are inherited by all child subscriptions, including new ones added later. When the Corp management group has the initiative assigned, any subscription under Corp automatically falls within the policy's evaluation scope without requiring manual re-assignment.

Answer

The initiative must be copied to every resource group in the new subscription before it takes effect.

Answer

The initiative changes RBAC so users lose read access to the subscription.

Answer

Compliance results are only visible in Activity Log, not in Azure Policy.

Question 5

Arrange the steps to create a virtual network in Azure with a subnet and deploy a VM.

Accepted Answer

Step 1: Create the virtual network with address space. Step 2: Add a subnet. Step 3: Associate a Network Security Group (NSG) to the subnet. Step 4: Deploy a virtual machine into the subnet. Step 5: Verify network connectivity.. First create the VNet with address space, then add a subnet, associate NSG, deploy VM, then verify.

Answer

Step 1: Create the virtual network with address space. Step 2: Deploy the virtual machine. Step 3: Add a subnet. Step 4: Associate an NSG to the subnet. Step 5: Verify network connectivity.

Answer

Step 1: Create the virtual network with address space. Step 2: Add a subnet. Step 3: Deploy the virtual machine. Step 4: Associate an NSG to the subnet. Step 5: Verify network connectivity.

Answer

Step 1: Deploy the virtual machine. Step 2: Create the virtual network with address space. Step 3: Add a subnet. Step 4: Associate an NSG to the subnet. Step 5: Verify network connectivity.

Question 6

You need to ensure that junior administrators can view all resources in the Prod-Sub subscription but cannot create, modify, or delete any resources. Which Azure RBAC role should you assign?

Accepted Answer

Reader. The Reader role is the correct choice because it grants read-only access to all resources in a subscription, including their properties and status, but does not allow any create, modify, or delete operations. This aligns perfectly with the requirement for junior administrators to view resources without making changes.

Answer

Owner

Answer

Contributor

Answer

Monitoring Reader

Question 7

A Windows VM must run a bootstrap script during provisioning to install a monitoring agent and write configuration files. The administrator does not want to log in interactively, and the script must be runnable again after the VM is rebuilt. Which two Azure compute components should be used? Select two.

Accepted Answer

Azure VM Agent. The Azure VM Agent (A) is required because it enables the VM to run extensions, including the Custom Script Extension. The Custom Script Extension (B) is the correct mechanism to execute the bootstrap script during provisioning without interactive login, and it can be reapplied to a rebuilt VM by redeploying the same ARM template or CLI command.

Answer

Boot diagnostics

Answer

Availability zone

Answer

Ephemeral OS disk

Question 8

Match each Azure VM deployment concept to the description that best fits it.

Accepted Answer

VMSS: Provides auto-scaling of identical VMs. VMSS provides auto-scaling identical VMs; Availability Set groups VMs for redundancy; Availability Zone offers physical separation; Managed Disk is persistent block storage; Azure Bastion provides secure remote access; Dedicated Host gives single-tenant physical servers.

Answer

Availability Set: Offers physical separation within a region

Answer

Managed Disk: Provides secure remote access to VMs over SSL

Answer

Azure Bastion: Persistent block storage for Azure VMs

Question 9

Match each Azure VM administration requirement on the left with the most appropriate Azure CLI command on the right. Use each answer once.

Accepted Answer

Deploy a new virtual machine: az vm create. Azure CLI commands for VM administration: 'az vm create' deploys, 'az vm resize' changes size, 'az vm start/stop/restart' controls state, and 'az vm delete' removes the VM.

Answer

Stop a virtual machine: az vm delete

Answer

Delete a virtual machine: az vm restart

Answer

Restart a virtual machine: az vm stop

Question 10

Your operations team needs to run Kusto queries across collected sign-in logs, VM performance counters, and Azure Activity Log data in a central location. What should you deploy?

Accepted Answer

A Log Analytics workspace. A Log Analytics workspace is the central repository in Azure that ingests and stores diagnostic data from multiple sources, including sign-in logs (Azure AD), VM performance counters (Azure Monitor for VMs), and Azure Activity Logs. It supports Kusto Query Language (KQL) for running complex queries across all collected data, making it the correct choice for this requirement.

Answer

An availability zone

Answer

A NAT gateway

Answer

A standard public IP address

Question 11

One team needs to run a Linux container for about 15 minutes per request with no inbound traffic and no cluster to manage. Another team needs an internet-facing web app with built-in HTTPS, deployment slots, and autoscale. Which two Azure services should the administrator choose? Select two.

Accepted Answer

Azure Container Instances. Azure Container Instances (ACI) is the correct choice for the first team because it allows running a Linux container directly on Azure without managing any underlying infrastructure or cluster, and it supports a 15-minute execution time with no inbound traffic required. ACI is ideal for burstable, short-lived container workloads that do not need orchestration.

Answer

Azure Virtual Machines

Answer

Azure Kubernetes Service

Answer

Azure Batch

Question 12

Match each storage resiliency requirement to the Azure redundancy option that best satisfies it.

Accepted Answer

LRS: Locally redundant storage replicates data three times within a single datacenter in the primary region.. LRS replicates within a single datacenter; ZRS across zones; GRS across regions; RA-GRS adds read access to GRS; RA-ZRS adds read access to ZRS. LRS is cheapest, GRS is highest durability.

Answer

LRS: Provides synchronous replication across three availability zones.

Answer

GRS: Provides read access to the secondary region.

Question 13

Match each storage networking requirement to the Azure storage network control that should be used.

Accepted Answer

Enable secure access from a specific VNet: Use service endpoints. Azure storage network controls: service endpoints for VNet access, private endpoints for private connectivity, IP firewall for public IP restrictions, trusted services exception, route tables for custom routing, and disabling public access for complete lockdown.

Answer

Enable secure access from a specific VNet: Use private endpoints

Answer

Restrict access to a specific public IP address: Enable trusted services exception

Answer

Block all public network access: Use IP firewall rules

Question 14

A team is troubleshooting inbound access to Azure VMs. Match each NSG concept on the left with the most accurate behavior or troubleshooting implication on the right.

Accepted Answer

NSG: A distributed firewall that filters traffic based on rules.. NSG is a distributed firewall; default inbound rule denies all; UDR overrides routes; ASG groups VMs; flow logs record traffic; service tags represent Azure IPs.

Answer

Default inbound rule: Allows all inbound traffic by default.

Answer

Service tags: Override default system routes.

Question 15

Match each access scenario to the SAS or key type that best fits it.

Accepted Answer

Interactive logins: User delegation SAS. Interactive logins use user delegation SAS; automated backups use system-assigned managed identity; cross-tenant access requires a service principal with certificate; VM patching uses system-assigned managed identity; app access to SQL uses user-assigned managed identity; key rotation uses storage account access keys.

Answer

Interactive logins: Storage account access keys

Answer

Automated backups: User delegation SAS

Answer

Cross-tenant access: System-assigned managed identity

AZ-104 practice test

Three ways to study

Study AZ-104 by domain

Study AZ-104 by topic

Manage Azure Identities and Governance practice questions

Implement and Manage Storage practice questions

Deploy and Manage Azure Compute practice questions

Implement and Manage Virtual Networking practice questions

Monitor and Maintain Azure Resources practice questions

AZ-104 Azure RBAC practice questions

AZ-104 storage account practice questions

AZ-104 virtual network practice questions

AZ-104 NSG practice questions

AZ-104 Azure Monitor practice questions

AZ-104 backup practice questions

AZ-104 managed identity practice questions

Top AZ-104 questions

AZ-104 practice questions

How to use these AZ-104 questions

Quick answer