Microsoft

AZ-104 Free Practice Questions — Page 4

Question 31

You have an Azure subscription that contains a storage account named storage1. You need to ensure that the access keys for storage1 rotate automatically. What should you configure?

A. a backup vault
B. redundancy for storage1
C. lifecycle management for storage1
D. an Azure key vault
E. a Recovery Services vault
Show Answer
Correct Answer: D
Explanation:
Azure Key Vault can manage Azure Storage account access keys and supports automatic storage account key rotation. The other options (backup vault, redundancy, lifecycle management, and Recovery Services vault) do not provide automatic rotation of storage account access keys.

Question 32

HOTSPOT - You have a Microsoft Entra tenant that is linked to the subscriptions shown in the following table. You have the resource groups shown in the following table. You assign roles to users as shown in the following table. For each of the following statements, select Yes if the statement is true. Otherwise, select No. NOTE: Each correct selection is worth one point.

Illustration for AZ-104 question 32 Illustration for AZ-104 question 32 Illustration for AZ-104 question 32 Illustration for AZ-104 question 32
Show Answer
Correct Answer: Yes No Yes
Explanation:
Contributor at MG2 inherits to Sub3/RG3/VM1, allowing VM resize. Storage Account Contributor scoped only to the storage1 resource cannot create a new storage account in RG1. User Access Administrator at the Tenant Root Group can manage RBAC role assignments across descendant scopes, including assigning Owner on RG3.

Question 33

You have an Azure subscription that contains two peered virtual networks named VNet1 and VNet2. You have a Network Virtual Appliance (NVA) named NetVA1. You need to ensure that the traffic from VNet1 to VNet2 is inspected by using NetVA1. What should you use?

A. a local network gateway
B. a route table that has custom routes
C. a service endpoint
D. IP address reservations
Show Answer
Correct Answer: B
Explanation:
To ensure traffic between peered virtual networks is inspected by a Network Virtual Appliance (NVA), you use a user-defined route (UDR) in a route table with a custom route that points the destination prefix to the NVA as the next hop (Virtual appliance). Associate the route table with the appropriate subnet(s) in VNet1 so traffic destined for VNet2 is forced through NetVA1. Local network gateways are for VPN connections, service endpoints provide optimized access to Azure PaaS services, and IP address reservations are unrelated to traffic steering.

Question 34

You plan to deploy several Azure virtual machines that will run Windows Server 2022 in a virtual machine scale set by using an Azure Resource Manager template. You need to ensure that NGINX is available on all the virtual machines after they are deployed. What should you use?

A. Azure Custom Script Extension
B. Deployment Center in Azure App Service
C. Microsoft Entra Application Proxy
D. the Publish-AzVMDscConfiguration cmdlet
Show Answer
Correct Answer: A
Explanation:
Azure Custom Script Extension is the appropriate choice for installing software such as NGINX on all virtual machines in a VM scale set after deployment from an ARM template. Deployment Center is for App Service, Microsoft Entra Application Proxy publishes on-premises apps, and Publish-AzVMDscConfiguration only publishes a DSC configuration to Azure Automation rather than applying it to the VMs.

Question 35

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure Storage account named storage1. You need to enable a user named User1 to list and regenerate storage account keys for storage1. Solution: You assign the Storage Account Key Operator Service Role to User1. Does this meet the goal?

A. Yes
B. No
Show Answer
Correct Answer: A
Explanation:
The built-in Azure RBAC role 'Storage Account Key Operator Service Role' permits listing and regenerating storage account access keys. Assigning this role to User1 satisfies the requirement to list and regenerate the storage account keys for storage1.

Question 36

HOTSPOT - You have an Azure container registry named contoso2023 as shown in the following exhibit. You need to enable contoso2023 to use a dedicated data endpoint. Which two settings should you configure for contoso2023? To answer, select the appropriate settings in the answer area. NOTE: Each correct answer is worth one point.

Illustration for AZ-104 question 36 Illustration for AZ-104 question 36
Show Answer
Correct Answer: Properties Networking
Explanation:
Dedicated data endpoints require the Premium SKU. Upgrade the registry from Standard to Premium (via Properties in the portal), then enable the dedicated data endpoint under Networking.

Question 37

Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have an Azure container registry named Registry1 that contains an image named image1. You receive an error message when you attempt to deploy a container instance by using image1. You need to be able to deploy a container instance by using image1. Solution: You set Admin user to Enable for Registry1. Does this meet the goal?

A. Yes
B. No
Show Answer
Correct Answer: A
Explanation:
Yes. Enabling the Azure Container Registry admin user provides username/password credentials that Azure Container Instances can use to authenticate and pull the image. In common Azure exam scenarios, this is the required configuration, particularly for portal-based deployments from a private Azure Container Registry.

Question 38

You have an Azure subscription that contains three virtual machines named VM1, VM2, and VM3. All the virtual machines are in an availability set named AVSet1. You need to scale up VM1 to a new virtual machine size, but the intended size is unavailable. What should you do first?

A. Create a proximity placement group.
B. Deallocate VM1.
C. Convert AvSet1 into a managed availability set.
D. Shut down VM3 and VM3.
Show Answer
Correct Answer: B
Explanation:
The first step is to deallocate (stop) VM1. Azure exposes additional VM sizes after a VM is deallocated because it can be placed on different hardware when restarted. If the desired size is still unavailable due to availability set cluster constraints, you may ultimately need to deallocate the other VMs in the availability set as well, but the initial action is to deallocate VM1. The other options do not address VM size availability.

Question 39

You have an Azure subscription. You create a routing table named RT1. You need to add a route to RT1 that specifies the next hop IP address. Which next hop type should you select?

A. Internet
B. Virtual network gateway
C. Virtual network
D. Virtual appliance
Show Answer
Correct Answer: D
Explanation:
To specify a next hop IP address in an Azure user-defined route, the next hop type must be 'Virtual appliance'. This option is used to route traffic to a specific IP address, typically the private IP of a network virtual appliance (NVA) such as a firewall or router. The other next hop types do not require or allow specifying a next hop IP address.

Question 40

You have an Azure subscription that contains a storage account named storage1. You need to allow access to storage1 from selected networks and your home office. The solution must minimize administrative effort. What should you do first for storage1?

A. Add a private endpoint.
B. Modify the Public network access settings.
C. Select Internet routing.
D. Modify the Access Control (IAM) settings.
Show Answer
Correct Answer: B
Explanation:
To allow access from selected networks and a home office, the first step is to change the storage account's Public network access/firewall configuration from allowing all networks to allowing selected networks. You can then add the required virtual networks and your home office public IP address. A private endpoint is not the best first step because home office access would require private connectivity (such as VPN/ExpressRoute), increasing administrative effort. Internet routing is unrelated to access control, and IAM controls authorization, not network access.

$19

Get all 555 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.