AZ-104 AZ-104 practice test

A storage automation service principal must upload, read, and delete blob data in one container by using Microsoft Entra authentication. It must not manage storage account settings, keys, or other containers. Which approach is best?

Trap 1: Assign Storage Account Contributor at the resource group scope.

This grants management-plane control over the storage account and is much broader than needed.

Trap 2: Assign Reader and give the service principal a storage account…

This introduces stored credentials and does not follow the Entra-based least-privilege requirement.

Trap 3: Assign Contributor at the subscription scope and restrict access…

Naming conventions do not enforce security, and subscription scope is unnecessarily broad.

A
Assign Storage Account Contributor at the resource group scope.
Why wrong: This grants management-plane control over the storage account and is much broader than needed.
B
Create a custom role with blob dataActions only and assign it at the container scope.
This allows data access while avoiding storage account management permissions and limiting scope.
C
Assign Reader and give the service principal a storage account access key.
Why wrong: This introduces stored credentials and does not follow the Entra-based least-privilege requirement.
D
Assign Contributor at the subscription scope and restrict access with naming conventions.
Why wrong: Naming conventions do not enforce security, and subscription scope is unnecessarily broad.

Review the full subnetting walkthrough →

Question 2mediummultiple choice

A subnet contains several application servers. You need to allow inbound TCP 3389 only from a management subnet named Subnet-Mgmt and deny RDP from all other sources. What should you do?

Trap 1: Create a route table that sends RDP traffic to the management…

Route tables do not implement port-based access control.

Trap 2: Deploy a private endpoint for each application server.

Private endpoints are for Azure PaaS services, not exposing VM RDP selectively.

Trap 3: Enable service endpoints on the application subnet.

Service endpoints are unrelated to RDP access control.

A
Create an NSG rule allowing TCP 3389 from the Subnet-Mgmt address range and rely on the default deny afterward.
This is the correct way to permit RDP from a specific source while denying other sources.
B
Create a route table that sends RDP traffic to the management subnet.
Why wrong: Route tables do not implement port-based access control.
C
Deploy a private endpoint for each application server.
Why wrong: Private endpoints are for Azure PaaS services, not exposing VM RDP selectively.
D
Enable service endpoints on the application subnet.
Why wrong: Service endpoints are unrelated to RDP access control.

Question 3easymulti select

A subscription admin wants to investigate who changed a resource and also review the platform-generated events for that subscription. Which two types of logs can be sent to Log Analytics and queried later? Select two.

Trap 1: Azure Backup vault names

Vault names are configuration details, not a log type that can be queried.

Trap 2: Virtual network address spaces

Address spaces describe networking, but they are not log records for analysis.

Trap 3: Managed disk size settings

Disk size is a resource property, not a log stream for Log Analytics.

A
Activity log entries
Activity logs record subscription-level events such as create, update, and delete operations.
B
Resource diagnostic logs
Diagnostic logs capture service-specific events and can be sent to a workspace.
C
Azure Backup vault names
Why wrong: Vault names are configuration details, not a log type that can be queried.
D
Virtual network address spaces
Why wrong: Address spaces describe networking, but they are not log records for analysis.
E
Managed disk size settings
Why wrong: Disk size is a resource property, not a log stream for Log Analytics.

Question 4easymultiple choice

Based on the exhibit, which Azure feature should the administrator use to track this kind of platform-wide service issue?

Exhibit

Azure portal > Service Health
Incident: Azure Virtual Machines
Region: East US
Status: Active incident
Impact: Some customers may experience failed VM start operations
Recommended action: Monitor the incident for updates and mitigation status.

Trap 1: Resource Health, because it shows whether a specific virtual…

Resource Health is focused on the status of an individual resource. It is useful for one VM, but not for tracking a broader regional Azure service incident.

Trap 2: Activity Log, because it lists every administrative action taken in…

Activity Log records control-plane events such as create, update, and delete operations. It does not provide official incident status for Azure platform outages.

Trap 3: Azure Advisor, because it gives recommendations to improve the…

Azure Advisor provides optimization recommendations and best practices. It does not monitor live Microsoft service incidents or outage notifications.

A
Service Health, because it reports Azure platform incidents that affect customers in a region.
Service Health is the right source for official Azure platform incidents and advisories. It tells administrators when a Microsoft-managed service is having a regional or global issue that may affect their resources.
B
Resource Health, because it shows whether a specific virtual machine is healthy or unavailable.
Why wrong: Resource Health is focused on the status of an individual resource. It is useful for one VM, but not for tracking a broader regional Azure service incident.
C
Activity Log, because it lists every administrative action taken in the subscription.
Why wrong: Activity Log records control-plane events such as create, update, and delete operations. It does not provide official incident status for Azure platform outages.
D
Azure Advisor, because it gives recommendations to improve the virtual machine configuration.
Why wrong: Azure Advisor provides optimization recommendations and best practices. It does not monitor live Microsoft service incidents or outage notifications.

Question 5easymultiple choice

An administrator wants a script running on an Azure VM to create a resource in Azure without storing any passwords or client secrets on the VM. What should the administrator configure first?

Trap 1: A shared local account on the VM

A local account helps with operating system access, but it does not securely authenticate to Azure APIs.

Trap 2: An Azure Policy exemption

Policy exemptions affect governance rules, not authentication for scripts or Azure resource creation.

Trap 3: A public IP address on the VM

A public IP affects network reachability, but it does not replace Azure authentication credentials.

A
A shared local account on the VM
Why wrong: A local account helps with operating system access, but it does not securely authenticate to Azure APIs.
B
A system-assigned managed identity on the VM
A managed identity lets the VM authenticate to Azure directly, so the script can use Azure CLI or PowerShell without secrets.
C
An Azure Policy exemption
Why wrong: Policy exemptions affect governance rules, not authentication for scripts or Azure resource creation.
D
A public IP address on the VM
Why wrong: A public IP affects network reachability, but it does not replace Azure authentication credentials.

Question 6mediummultiple choice

A PowerShell script runs on an Azure VM every night and uses Azure CLI commands to create tags and VM resources in another subscription. The script cannot store a password or client secret. What should it use to authenticate to Azure?

Trap 1: az login with a username and password.

A username and password requires credential storage and is not appropriate for secretless automation.

Trap 2: Connect-AzAccount with device code authentication.

Device code authentication is interactive and not suitable for unattended nightly automation on a VM.

Trap 3: An app registration secret stored in a PowerShell variable.

A secret in a variable is still a secret on the machine and violates the stated security requirement.

A
az login with a username and password.
Why wrong: A username and password requires credential storage and is not appropriate for secretless automation.
B
az login --identity.
The Azure CLI can sign in with the VM's managed identity by using az login --identity. That allows the script to authenticate without storing a password or client secret. After sign-in, the identity can be granted access to the target subscription or resource group, which makes the solution both secure and automation-friendly for nightly jobs.
C
Connect-AzAccount with device code authentication.
Why wrong: Device code authentication is interactive and not suitable for unattended nightly automation on a VM.
D
An app registration secret stored in a PowerShell variable.
Why wrong: A secret in a variable is still a secret on the machine and violates the stated security requirement.