AZ-104 practice questions

Answer: D, Microsoft Entra ID P2. Microsoft Entra ID Protection supplies user risk and sign-in risk policies, and Privileged Identity Management supplies permanent and temporary administrators with an activation workflow. Both are P2 capabilities. P1 covers Conditional Access, self-service password reset with writeback and full multifactor authentication, but neither risk-based policies nor Privileged Identity Management. Security defaults on the Free tier enforce multifactor authentication for everyone but cannot make a decision based on risk. Microsoft 365 Business Standard is a productivity plan and adds neither capability.

Answer: D, Resources the virtual machine depends on, such as its managed disks, network interface, public IP address and virtual network, are neither already in the destination nor included in the move request. A move request has to carry every resource the moved resource depends on unless those dependencies already exist in the destination. Moving a virtual machine can involve seven resource types across three providers: virtualMachines and disks, networkInterfaces, publicIPAddresses, networkSecurityGroups and virtualNetworks, and storageAccounts. The virtual machine does not have to be stopped, and a move never changes region, so neither of those is the cause. An unregistered resource provider is a genuine failure mode but it returns a different error stating the subscription is not registered for the resource type.

Answer: B, Virtual Machine Contributor for the project team on the resource group holding the virtual machines, with the virtual network kept in a resource group they have no assignment on. Virtual Machine Contributor grants precisely the virtual machine and disk management the team needs and explicitly does not grant management access to the virtual network the machines are connected to, so keeping the network in a separate resource group completes the separation. Contributor or Owner on that resource group would work only while the network lives elsewhere, and Owner adds delegation nobody asked for. Contributor at subscription scope reaches the network wherever it is, and the Read-only lock proposed to compensate would also block the networking team, who are supposed to be able to change it.

Answer: A, The Read-only lock blocks listing the account keys, because List Keys is handled by a POST request and locks prevent POST requests to the Resource Manager API. Microsoft documents this case specifically: a read-only lock on a storage account prevents users from listing the account keys, because the List Keys operation is a POST request and locks prevent POST from reaching the Resource Manager API. It is the classic example of a lock blocking something that does not look like a modification. Locks never change the resource itself, so no key is rotated, no role assignment is removed and no account setting is altered. If the pipeline must keep working through the freeze, either have it authenticate with Microsoft Entra credentials and a data plane role instead of account keys, or use CanNotDelete rather than Read-only.

Answer: D, The change feed on the source account and blob versioning on both accounts. Object replication has exactly two prerequisites and they are asymmetric, which is what makes the other options tempting. The change feed is required on the source account only, because that is the log the service reads to discover which write and delete operations have to be copied. Blob versioning is required on both accounts, because the replicated state includes previous versions as well as the current one. Soft delete has nothing to do with it. Once a policy exists you cannot disable versioning on either account until it is removed.

Answer: B, Call Set Blob Tier or Copy Blob with the rehydration priority set to high. High-priority rehydration is prioritised over standard requests and often completes in under an hour for an object under 10 GB, which is the only option that fits the deadline. A lifecycle management policy can never rehydrate an archived blob, so that option cannot work at all. The account default access tier only decides the tier of blobs that have no explicitly set tier, and does nothing for an explicitly archived blob. Standard priority takes up to 15 hours regardless of whether you use Copy Blob or Set Blob Tier; the choice between those two affects early deletion fees, not speed.

Answer: D, A user delegation SAS. An account SAS and a service SAS are both signed with an account access key, so issuing either requires the application to hold that key, and both stop working once Shared Key authorisation is disallowed. That rules out the first three options regardless of how the token is scoped or how short its expiry is. A user delegation SAS is signed with a user delegation key obtained using Microsoft Entra credentials, so no account key is involved; the principal requesting the key needs the generateUserDelegationKey action, which the Storage Blob Delegator role carries.

Answer: B, Browse to last night's share snapshot and restore that single file from it. Soft delete for Azure Files operates at the file share level only. It recovers a share that was deleted, and it has nothing to say about a single file that was overwritten inside a share that still exists, so neither undeleting nor changing the retention period helps here. A share snapshot is a read-only point-in-time copy of the share from which you can restore an individual file or folder, which is exactly the requirement. Container soft delete is a Blob Storage feature and does not apply to file shares at all.

Answer: D, An entry in the outputs section whose value uses the reference function against the storage account. The outputs section exists precisely for values that are only known once the deployment has run, and the reference function reads the runtime state of a deployed resource, so referencing the storage account and returning its primaryEndpoints gives the real value, shown in the portal's deployment history and returned by the command line. A variable built by string concatenation guesses the endpoint rather than reading it, which breaks the moment the endpoint format or the cloud changes. A parameter is an input, so a default value is just a hardcoded guess supplied before the resource exists. A linked template is for breaking a large deployment into parts and adds a whole file to solve something one output line covers.

Answer: C, Three virtual machines pinned one to each of three availability zones, behind a Standard load balancer with a zone-redundant frontend. Availability zones are the only one of these that survives the loss of a datacentre, because each zone is one or more physically separate datacentres with independent power, cooling and networking, and every enabled region has at least three. Spreading three machines across three zones also gives three fault domains and three update domains for free. An availability set, however many fault domains it has, spreads machines across racks inside one datacentre, so a datacentre-level event takes all of them. A Basic load balancer is not zone-aware and would be a single point of failure regardless. Putting all three in one zone and relying on the paired region is a disaster recovery answer, not an availability answer, and involves a failover rather than staying up.

Answer: C, A managed identity on the virtual machine, granted the AcrPull role on the registry. A managed identity is the only option here with no credential to store: the platform issues and rotates it, the virtual machine authenticates as itself, and the identity is granted a registry role through Azure role-based access control. A service principal is a legitimate headless option and supports role-based access control, but it has a password that has to live somewhere and expires after a year by default, which is what the question rules out. The admin account is disabled by default, has no role-based access control, gives full push and pull to a single shared identity, and Microsoft recommends it only for testing. Running az acr login on a schedule does not help because that token is an individual identity's, valid for three hours, and still requires a signed-in user.

Answer: B, Regional virtual network integration for the app, with the integration subnet allowed on the database. This is an outbound problem, and virtual network integration is the outbound feature: it places the back end of the app in a subnet in a virtual network in the same region so outbound calls originate from that subnet, which is what a service endpoint or a firewall rule on the database can then allow. It also leaves the app's inbound public hostname untouched, which the question requires. A private endpoint is inbound only, controlling who can reach the app, not what the app can reach. Access restrictions filter requests coming in to the app and have nothing to do with its outbound calls. Hybrid Connections is for reaching a host and port in a network not connected to Azure, which is not the case for a resource sitting inside an Azure virtual network.

Answer: C, One of the two virtual networks has to be re-addressed so the ranges no longer overlap. 10.0.128.0/17 sits entirely inside 10.0.0.0/16, so the address spaces overlap, and peering creation fails outright when that is true. No setting makes an overlapping peering work: one side has to be re-addressed, which means deleting any existing peering, changing the address space and creating the peering again. Peered virtual networks do not need to share a resource group, a subscription or even a tenant. Gateway transit and user-defined routes are configured on a peering that already exists and cannot bring one into being.

Answer: B, That no inbound rule is needed, because network security groups are stateful and a flow record permits the return traffic. Network security groups are stateful. A flow record is created for an allowed connection and the return traffic is permitted on the strength of it, so you never write a mirror rule for replies. Rules are indeed evaluated per direction, but that governs which rules apply rather than whether replies need one. An inbound rule would be needed only if the partner initiated a connection to you, which is a different requirement from the one described. AllowInternetOutBound is an outbound rule and does not apply to inbound traffic in any sense.

Answer: B, Enable Virtual network gateway or Route Server on the hub side of each peering, and Remote virtual network gateway or Route Server on the spoke side. Gateway transit has a giving side and a taking side and the two are not interchangeable. The network that owns the gateway sets Virtual network gateway or Route Server, offering it; the network that wants to use it sets Remote virtual network gateway or Route Server. Reversing them configures each spoke to offer a gateway it does not have. Traffic forwarding controls whether non-originating traffic is accepted from the peer and is not what shares a gateway. Peering the spokes to each other achieves nothing, because peering is not transitive and neither spoke has a gateway to share in any case.

Answer: A, Azure Application Gateway. Routing on the URL path is a layer 7 decision and requires the service to read the HTTP request, which is what Application Gateway does and what Azure Load Balancer, operating at layer 4, cannot do at all. TLS termination at the entry point is likewise an Application Gateway capability. Load Balancer with two rules would require clients to connect to two different ports, which is a different design rather than an answer to this one. Traffic Manager directs clients at the domain level using DNS and cannot see a path either. Session persistence controls which instance a client returns to, not which pool a path is sent to.

Answer: D, Open Monitor, select Insights then Storage accounts, and set the subscription and storage account filters on the Overview workbook. Storage insights needs nothing enabled and nothing configured, because Azure collects storage metrics by default. Opening it and setting the filters gives availability, end-to-end and server latency, transaction counts and error types across accounts immediately, for up to 200 accounts at once. Diagnostic settings sending AllMetrics to a workspace is a real technique and would eventually produce the same figures, but it means creating 60 settings, it only collects from the moment it is switched on so there is no history this afternoon, and it costs ingestion. VM insights monitors machines, not storage accounts. Connection monitor measures reachability and round-trip time to an endpoint, which is a network question rather than a storage latency and throttling question, and it would need agents deployed first.

Answer: D, Create an alert processing rule scoped to the vault with the apply action group action, pointing at an action group that has an email notification. Built-in Azure Monitor alerts for Azure Backup are generated by the service itself, not by an alert rule you created, so there is nothing to attach an action group to. Alert processing rules exist precisely for alert sources that do not let you specify action groups, and adding one with the apply action group action routes those already-fired alerts to email, SMS, a webhook or anything else an action group supports. The log search alert would work but only if the vault is already sending diagnostics to a workspace, and it creates a second alert alongside the one the service already raises. A metric alert on backup health is a genuine and useful technique, particularly for alerting on success rather than failure, but again it creates a new alert rather than routing the existing one. Classic alerts are the older solution, do not appear alongside Azure Monitor alerts, and are on a deprecation path, so building on them now is the wrong direction.

Answer: B, Create a new geo-redundant Recovery Services vault, configure backup there, enable Cross Region Restore and allow up to 48 hours before the items appear in the secondary region. Cross Region Restore is what the audit is describing, because it lets you restore from the secondary region at any time rather than only during a declared outage, which is precisely how a compliance drill is run. It is supported only on a vault using geo-redundant storage, and a zone-redundant vault that already has backups configured cannot be changed to geo-redundant, so the honest answer is a new vault. Expect up to 48 hours after enabling before the backup items become available in the secondary region, which matters when the drill is scheduled. Cross Subscription Restore moves a restore between subscriptions in the same tenant and says nothing about region. Changing the replication type on a vault with configured backups is not possible, which is the trap in the last option.

Answer: D, Confirm the status reads Failover committed, run Re-Protect to reverse the replication direction, let the initial and delta replication complete, then fail over to the primary region and commit. Re-Protect is the supported route and it does exactly what is needed: it reverses the direction so the secondary region replicates back to the primary, creating any resources it needs in the primary region as part of the operation, and it sends an initial copy followed by deltas. Only once that delta replication is current is the failback a short operation, which is what makes the outage small. It requires the status to be Failover committed, hence the first clause of the answer. Disabling and re-enabling replication would work eventually but throws away the existing relationship and forces a full initial replication with no delta catch-up, which is a longer outage for no benefit. A test failover proves nothing here and cannot be committed, since commit applies to a real failover. Changing the recovery point is only possible before a failover is committed, and committing deletes the remaining recovery points precisely so that this cannot be done afterwards.