AZ-104 practice questions and answers

Correct answer: B — Assign the Virtual Machine Contributor role at the resource group scope.

Least privilege means the smallest built-in role at the smallest scope. Virtual Machine Contributor allows managing VMs — including restart — inside that resource group only. Owner and Contributor at subscription scope grant far too much, and Global Administrator is a directory role, not an Azure resource role.

Correct answer: A — Conditional Access policies

Conditional Access evaluates signals such as location, device and risk, and then requires controls like MFA. Azure Policy governs resource configuration, PIM handles just-in-time elevation of privileged roles, and locks protect resources from change or deletion.

Correct answer: D — RA-GRS

Read-access geo-redundant storage replicates to a secondary region and lets applications read from it directly. Plain GRS replicates but the secondary is only readable after a failover. LRS keeps three copies in one data centre and ZRS spreads copies across zones in one region — neither survives a regional loss.

Correct answer: A — A shared access signature (SAS) with read permission and an expiry time

A SAS token grants scoped, time-limited access to a specific resource. Account keys give full control, a public container exposes data to everyone, and a data owner role assignment is permanent and far too broad for a partner.

Correct answer: B — Virtual Machine Scale Set with autoscale rules

A scale set manages a group of identical VMs and can scale on metrics such as CPU. Availability Sets improve fault tolerance inside a data centre but do not scale. A load balancer distributes traffic, and proximity placement groups reduce latency between VMs.

Correct answer: B — Use an ARM template or Bicep file with parameters for each environment.

ARM templates and Bicep declare the resources once and take parameters, so the same definition deploys to every environment consistently. Manual portal work drifts between environments, and Storage Explorer only moves storage data.

Correct answer: A — VNet peering

VNet peering connects two virtual networks over the Azure backbone with private addressing and no gateway needed. A VPN adds gateways and overhead, Front Door is for global web traffic, and service endpoints extend a VNet identity to PaaS services.

Correct answer: C — The subnet NSG is evaluated first, then the NIC NSG; traffic must be allowed by both.

For inbound traffic, Azure evaluates the subnet NSG and then the NIC NSG, so both must allow the traffic. For outbound the order is reversed. Lower priority numbers are processed first, not higher ones.

Correct answer: A — Azure Bastion

Azure Bastion is a managed service that brokers RDP and SSH sessions over TLS from the portal, so VMs need no public IP and there is no jump box to maintain.

Correct answer: A — A metric alert rule in Azure Monitor with an action group that calls a webhook

Metric alert rules evaluate a metric against a threshold over a time window, and action groups run the response — email, SMS, webhook, Logic App or ITSM connector. Saved queries do not alert by themselves, Service Health reports platform issues, and Advisor gives recommendations.

Correct answer: B — Azure Backup with a Recovery Services vault

Azure Backup stores VM recovery points in a Recovery Services vault on a policy schedule. Site Recovery is for replication and failover of workloads to another region. Storage snapshots and File Sync solve different problems.

Correct answer: A, C — Tags can be used to group costs in Microsoft Cost Management reports. · Azure Policy can require a tag and even append a default value on deployment.

Tags are name/value pairs used for organizing and reporting, and Cost Management can group spend by tag. Azure Policy can require, deny or append tags. Tags are not inherited automatically — a policy is what copies them from the resource group — and they never provide access control.