CertBlaze

Microsoft

AZ-104 Free Practice Questions — Page 11

Question 105

You have an Azure subscription named Subscription1. You have 5 TB of data that you need to transfer to Subscription1. You plan to use an Azure Import/Export job. What can you use as the destination of the imported data?

A. Azure Data Factory
B. the Azure File Sync Storage Sync Service
C. Azure File Storage
D. Azure SQL Database
Show Answer
Correct Answer: C
Explanation:
Azure Import/Export supports importing data from shipped drives into Azure Blob Storage or Azure Files. Among the options provided, Azure File Storage (Azure Files) is the supported destination. Azure Data Factory, Azure File Sync Storage Sync Service, and Azure SQL Database are not import destinations for the Import/Export service.

Question 106

You have an Azure subscription named Subscription1 that contains virtual network named VNet1. VNet1 is in a resource group named RG1. A user named User1 has the following roles for Subscription1: • Reader • Security Admin • Security Reader You need to ensure that User1 can assign the Reader role for VNet1 to other users. What should you do?

A. Remove User1 from the Security Reader and Reader roles for Subscription1. Assign User1 the Contributor role for Subscription1.
B. Assign User1 the Contributor role for VNet1.
C. Assign User1 the Owner role for VNet1.
D. Assign User1 the Network Contributor role for RG1.
Show Answer
Correct Answer: C
Explanation:
Assigning Azure RBAC roles requires the Owner or User Access Administrator role (or an equivalent role with Microsoft.Authorization/roleAssignments/write). Contributor and Network Contributor cannot assign roles. Granting Owner scoped to VNet1 allows the user to assign the Reader role for that virtual network.

Question 107

You have an Azure subscription that contains the virtual networks shown in the following table. All the virtual networks are peered. Each virtual network contains nine virtual machines. You need to configure secure RDP connections to the virtual machines by using Azure Bastion. What is the minimum number of Bastion hosts required?

A. 1
B. 3
C. 9
D. 10
Show Answer
Correct Answer: A
Explanation:
A single Azure Bastion host can be used to connect to virtual machines in peered virtual networks, including globally peered VNets. Since all virtual networks are peered, the minimum number of Bastion hosts required is one.

Question 108

You have an Azure subscription that contains a virtual machine named VM1 and an Azure key vault named KV1. You need to configure encryption for VM1. The solution must meet the following requirements: • Store and use the encryption key in KV1. • Maintain encryption if VM1 is downloaded from Azure. • Encrypt both the operating system disk and the data disks. Which encryption method should you use?

A. customer-managed keys
B. Confidential disk encryption
C. Azure Disk Encryption
D. encryption at host
Show Answer
Correct Answer: C
Explanation:
Azure Disk Encryption encrypts both the operating system and data disks using BitLocker (Windows) or DM-Crypt (Linux), integrates with Azure Key Vault to store and use encryption keys, and performs guest-level encryption that remains in effect if the managed disk or VM is exported or downloaded from Azure. Customer-managed keys encrypt managed disks at the storage layer but do not provide guest OS volume encryption that persists independently in the same way. Encryption at host and confidential disk encryption do not satisfy all stated requirements.

Question 109

HOTSPOT - You have an Azure subscription that contains the virtual machines shown in the following table. You create an Azure Compute Gallery named ComputeGallery1 as shown in the Azure Compute Gallery exhibit. (Click the Azure Compute Gallery tab.) In ComputeGallery1, you create a virtual machine image definition named Image1 as shown in the image definition exhibit. (Click the Image Definition tab.) For each of the following statements, select Yes if the statement is true. Otherwise, select No, NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 109 Illustration for AZ-104 question 109 Illustration for AZ-104 question 109 Illustration for AZ-104 question 109
Show Answer
Correct Answer: No Yes Yes
Explanation:
The image definition is Generation 1 and specialized Windows. The recommended vCPU range is informational only and does not restrict image creation. Gallery/image region does not prevent using an OS disk as the source for an image version. A Gen2 source is not suitable for a Gen1 image definition, while Gen1 sources are valid.

Question 110

You have an Azure AD tenant named contoso.com. You have an Azure subscription that contains an Azure App Service web app named App1 and an Azure key vault named KV1. KV1 contains a wildcard certificate for contoso.com. You have a user named that is assigned the Owner role for App1 and KV1. You need to configure App1 to use the wildcard certificate of KV1. What should you do first?

A. Create an access policy for KV1 and assign the Microsoft Azure App Service principal to the policy.
B. Assign a managed user identity to App1.
C. Configure KV1 to use the role-based access control (RBAC) authorization system.
D. Create an access policy for KV1 and assign the policy to User1.
Show Answer
Correct Answer: B
Explanation:
To allow an App Service to securely access a certificate stored in Azure Key Vault, the app must first have an identity in Microsoft Entra ID. Enabling a managed identity (system-assigned or user-assigned) creates that identity. After that, you grant the identity the necessary permissions to the Key Vault (via access policy or RBAC, depending on the vault's authorization model). Simply granting access to the App Service principal is not possible until the app has an identity, and granting the user or switching the vault to RBAC alone does not enable the app to authenticate to the vault.

Question 111

HOTSPOT - You have an Azure subscription that contains the container images shown in the following table. You plan to use the following services: • Azure Container Instances • Azure Container Apps • Azure App Service In which services can you run the images? To answer, select the options in the answer area. NOTE: Each correct answer is worth one point.

Illustration for AZ-104 question 111 Illustration for AZ-104 question 111
Show Answer
Correct Answer: Image1: Azure Container Instances and App Services only Image2: Azure Container Instances, Azure Container Apps, and App Services
Explanation:
Azure Container Instances supports both Windows and Linux containers. Azure Container Apps supports Linux containers only. Azure App Service supports custom Windows and Linux containers.

Question 112

You have an Azure App Service app named App1 that contains two running instances. You have an autoscale rule configured as shown in the following exhibit. For the Instance limits scale condition setting, you set Maximum to 5. During a 30-minute period, App1 uses 80 percent of the available memory. What is the maximum number of instances for App1 during the 30-minute period?

A. 2
B. 3
C. 4
D. 5
Show Answer
Correct Answer: D
Explanation:
Starting from 2 instances, the scale rule triggers after the metric exceeds the threshold for the configured duration (15 minutes), increasing to 3 instances. After the 5-minute cooldown, autoscale evaluates again using the rolling metric window; because memory has remained above the threshold throughout the 30-minute period, additional scale-outs can occur every cooldown interval until the configured maximum of 5 instances is reached within the 30-minute window.

Question 113

HOTSPOT - You have the Azure virtual machines shown in the following table. VNET1, VNET2, and VNET3 are peered. VM4 has a DNS server that is authoritative for a zone named contoso.com and contains the records shown in the following table. The virtual networks are configured to use the DNS servers shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 113 Illustration for AZ-104 question 113 Illustration for AZ-104 question 113 Illustration for AZ-104 question 113
Show Answer
Correct Answer: No Yes No
Explanation:
VM1 uses Azure-provided DNS, so it does not query the custom DNS server on VM4 for the contoso.com zone. VM2 and VM3 use the custom DNS server (VM4), which returns its authoritative records. Server1 resolves to 131.107.3.3, while the third statement is false because it claims 131.107.2.4 instead of the configured 131.107.3.4.

Question 114

HOTSPOT - You have an Azure subscription named Sub1 that contains the blob containers shown in the following table. Sub1 contains two users named User1 and User2. Both users are assigned the Reader role at the Sub1 scope. You have a condition named Condition1 as shown in the following exhibit. You have a condition named Condition2 as shown in the following exhibit. You assign roles to User1 and User2 as shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 114 Illustration for AZ-104 question 114 Illustration for AZ-104 question 114 Illustration for AZ-104 question 114 Illustration for AZ-104 question 114
Show Answer
Correct Answer: No No Yes
Explanation:
Condition1 restricts blob read actions to container cont1 only, so User1 cannot read blobs in cont2 or cont3. Condition2 restricts only write actions (to blob paths matching *2*), not read actions, so User2 can read blob1 within storage1.

$19

Get all 555 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full AZ-104 study guide →