Hard — AZ-104 Practice Quiz

Question 1

Your company has a resource group named RG-Finance that contains several virtual machines. A new team member, Dana, needs to be able to start, stop, and restart all virtual machines in RG-Finance, but must NOT be able to create or delete VMs, modify VM configurations, or manage any other resource types in the resource group. You want to follow the principle of least privilege using built-in roles only. What should you do?

Accepted Answer

Assign Dana the DevTest Labs User role at the RG-Finance scope

Answer

Assign Dana the Virtual Machine Contributor role at the RG-Finance scope

Answer

Assign Dana the Contributor role at the RG-Finance scope

Answer

Assign Dana the Virtual Machine User Login role at the RG-Finance scope

Question 2

Your company has an on-premises DNS server and an Azure VNet named VNet1. You deploy several Azure VMs into VNet1 that must resolve records hosted in an Azure Private DNS zone named corp.contoso.internal. On-premises servers must also be able to resolve names in this private zone. The Private DNS zone is already linked to VNet1. Which solution enables on-premises servers to resolve records in the Azure Private DNS zone?

Accepted Answer

Deploy an Azure DNS Private Resolver with an inbound endpoint in VNet1 and configure a conditional forwarder on the on-premises DNS server pointing to the inbound endpoint IP.

Answer

Create an NS record delegation in the on-premises DNS zone pointing to the Azure name servers assigned to the Private DNS zone.

Answer

Enable autoregistration on the Private DNS zone virtual network link so on-premises hosts appear in the zone.

Answer

Add the on-premises DNS server's IP address to the custom DNS servers setting of VNet1.

Question 3

Your company stores critical documents in a blob container within a general-purpose v2 storage account. An application accidentally overwrote a blob named contract.docx with an incorrect version an hour ago. Blob soft delete is enabled with a 14-day retention period, but blob versioning is NOT enabled on the account. You need to recover the original contents of contract.docx. What should you do?

Accepted Answer

Undelete the soft-deleted snapshot that was automatically retained when the blob was overwritten, then promote it to the base blob.

Answer

Restore the previous version of the blob from the Versions tab in the Azure portal.

Answer

You cannot recover the original data because soft delete does not protect against overwrites when versioning is disabled.

Answer

Enable point-in-time restore and restore the container to a timestamp before the overwrite occurred.

Question 4

Your organization uses group-based licensing in Microsoft Entra ID. A user named Jordan is a member of two groups: the 'Sales' group, which is assigned an Office 365 E3 license with the 'Exchange Online' service plan enabled, and the 'Contractors' group, which is assigned an Office 365 E3 license with 'Exchange Online' disabled. Jordan is also directly assigned an Office 365 E3 license with all service plans enabled. Which statement correctly describes the resulting license state for Jordan?

Accepted Answer

Jordan consumes one Office 365 E3 license, and because a direct assignment plus group assignments overlap, the enabled service plans are combined so Exchange Online remains enabled.

Answer

Jordan consumes three separate Office 365 E3 licenses, one from each source.

Answer

Jordan's license assignment fails entirely because the conflicting Exchange Online settings between the two groups cannot be resolved.

Answer

Jordan consumes one Office 365 E3 license and Exchange Online is disabled because the most restrictive group setting always takes precedence.

Question 5

Your company needs a custom Azure role for a team of support engineers. They must be able to view and restart virtual machines in a resource group, but they must NOT be able to delete virtual machines or change any role assignments. You are defining the JSON for the custom role. Which combination of properties correctly enforces these requirements?

Accepted Answer

Set "Actions" to "Microsoft.Compute/virtualMachines/read" and "Microsoft.Compute/virtualMachines/restart/action", and leave "NotActions" empty.

Answer

Set "Actions" to "Microsoft.Compute/*" and set "NotActions" to "Microsoft.Compute/virtualMachines/delete" and "Microsoft.Authorization/*/write".

Answer

Set "Actions" to "*" and set "NotActions" to "Microsoft.Compute/virtualMachines/delete".

Answer

Set "DataActions" to "Microsoft.Compute/virtualMachines/read" and "Microsoft.Compute/virtualMachines/restart/action", and set "NotDataActions" to "Microsoft.Compute/virtualMachines/delete".

Question 6

Your organization has a management group hierarchy: a root management group named 'Contoso' contains a child management group named 'Production', which contains two subscriptions: 'Sub-A' and 'Sub-B'. You assign an Azure Policy that denies the creation of public IP addresses at the 'Production' management group scope. Separately, a different administrator assigns a policy at 'Sub-A' that explicitly allows public IP address creation. What is the effective outcome when a user attempts to create a public IP address in 'Sub-A'?

Accepted Answer

The public IP creation is denied because a Deny effect inherited from a higher scope cannot be overridden by a policy at a lower scope.

Answer

The public IP creation is allowed because the policy assigned closest to the resource (Sub-A) takes precedence.

Answer

The public IP creation is allowed only if the Sub-A policy uses a higher priority number than the Production policy.

Answer

The two policies conflict, so the resource creation request fails with an evaluation error until an administrator resolves the conflict.

Question 7

A web server VM named VM1 resides in subnet Web-Subnet. An NSG named NSG-Subnet is associated with the subnet, and a separate NSG named NSG-NIC is associated with VM1's network interface. Users report that inbound HTTPS (TCP 443) connections to VM1 are failing. NSG-NIC contains a custom inbound rule (priority 100) that allows TCP 443 from any source. NSG-Subnet contains a custom inbound rule (priority 200) that denies TCP 443 from any source, plus a rule (priority 300) allowing TCP 443. Which action will restore inbound HTTPS connectivity to VM1 with the least administrative effort?

Accepted Answer

Remove the deny rule (priority 200) from NSG-Subnet.

Answer

Add an allow rule for TCP 443 with priority 400 to NSG-Subnet.

Answer

Disassociate NSG-NIC from VM1's network interface.

Answer

Increase the priority number of the allow rule in NSG-NIC to 50.

Question 8

You manage an Azure public Standard Load Balancer that distributes traffic to two VMs hosting a SQL Server Always On availability group listener. The application must connect to the availability group listener IP, and the backend VMs need to receive traffic addressed to the frontend IP without the load balancer rewriting the destination address. Which load balancing rule setting must you enable to support this configuration?

Accepted Answer

Floating IP (Direct Server Return)

Answer

Session persistence set to Client IP and protocol

Answer

TCP Reset on idle timeout

Answer

Outbound SNAT with port allocation

Question 9

Your company runs a fleet of 8 VMs behind a Standard public Azure Load Balancer. The VMs open many simultaneous outbound connections to an external partner API on a single destination IP and port. Users report intermittent connection failures, and diagnostics show SNAT port exhaustion. Which configuration change most directly resolves the outbound SNAT port limitation?

Accepted Answer

Add an outbound rule that allocates more SNAT ports per instance, optionally increasing the number of frontend public IP addresses

Answer

Change the load balancer health probe interval to a lower value

Answer

Move the backend VMs into an availability set

Answer

Enable session persistence (source IP affinity) on the load balancing rule

Question 10

Your company uses Azure RBAC to control access. A user is assigned the Reader role at the subscription scope and the Contributor role at a resource group named RG-Prod within that subscription. The Contributor role is later removed, and a Deny assignment for delete operations is added at the RG-Prod scope. What are the user's effective permissions on a virtual machine inside RG-Prod?

Accepted Answer

The user can read the VM but cannot modify or delete it.

Answer

The user can read and modify the VM but cannot delete it.

Answer

The user has no access to the VM because the Deny assignment overrides all roles.

Answer

The user can read, modify, and delete the VM because Reader is inherited from the subscription.