AZ-104 practice questions with answers

Answer: A) DenyAction

• AThe denyAction effect can block specified actions, such as delete, on matching resources.
• BAudit reports but doesn't block.
• CAppend adds properties; that doesn't meet this requirement.
• DDisabled turns the policy off.

Answer: A) Grant another user access to the resource group

• AContributor can create and manage all resource types but cannot manage role assignments (grant/revoke access); that requires Owner or User Access Administrator.
• BCreating resources is exactly what Contributor allows.
• CContributor can delete resources it manages.
• DOperational actions like restarting a VM are within Contributor's rights.

Answer: A) A deny assignment

• ADeny assignments block actions regardless of role assignments and can't be removed directly by users.
• BA custom role grants permissions; Owners can remove its assignments.
• CTags are metadata and don't restrict actions.
• DLocks can be removed by users with the right permissions.

Answer: A) In any region

• AThe group's location only stores its metadata; resources can be in other regions.
• BResources don't have to match the group's region.
• CThere's no such restriction.
• DResources can be regional.

Answer: A) Open a share snapshot taken before the overwrite and restore that version of the file

Share snapshots, taken manually or by Azure Backup, are read-only point-in-time copies of an Azure file share. You recover an overwritten file by copying or restoring it from a snapshot taken before the change.

• ACorrect. A share snapshot is a read-only, point-in-time copy of the share, and you can retrieve individual files from it. In the portal, open the share's Snapshots view and choose Restore. On Windows, use the Previous Versions tab of the mounted share.
• BIncorrect. Soft delete for Azure Files protects against deletion of a whole file share. It does not keep earlier versions of individual files that were overwritten.
• CIncorrect. Geo-replication copies the current state of the data, including the overwrite, to the secondary region. Failover is for regional outages, not for recovering earlier versions.
• DIncorrect. Blob versioning applies to Blob Storage, not Azure Files. It also cannot recover versions from before it was turned on.

Answer: A) Data is copied synchronously across three or more availability zones in the primary region, so it remains readable and writable if one zone fails

ZRS replicates data synchronously across three or more availability zones in the primary region, so data stays available if a zone or datacenter fails. LRS keeps all replicas in a single datacenter. Neither option replicates data to another region.

• ACorrect. ZRS writes synchronously to replicas in three or more availability zones, so data stays available for reads and writes if one zone becomes unavailable. LRS keeps all of its replicas in a single datacenter.
• BIncorrect. This describes geo-redundant options (GRS/GZRS). ZRS stays within the primary region and on its own doesn't protect against a region-wide disaster.
• CIncorrect. This describes LRS, which keeps its replicas in a single physical datacenter. A datacenter-level event could make all LRS replicas unavailable.
• DIncorrect. Read access to a secondary region requires RA-GRS or RA-GZRS. ZRS has no secondary region or secondary endpoint.

Answer: A) A user delegation SAS signed with a key requested by an authorized security principal

Service SAS and account SAS are both signed with the storage account key and authorized through Shared Key. Only a user delegation SAS, signed with a user delegation key obtained with Microsoft Entra credentials, keeps working when Shared Key authorization is disallowed.

• ACorrect. A user delegation SAS is signed with a user delegation key created using Microsoft Entra credentials, and it is authorized through Microsoft Entra ID rather than Shared Key. It doesn't depend on the account keys, so it keeps working when Shared Key authorization is disallowed. Microsoft recommends this SAS type when possible.
• BIncorrect. A stored access policy lets you revoke a service SAS without regenerating keys. However, a service SAS is still signed with the storage account key and authorized through Shared Key, so it would stop working once Shared Key is disallowed.
• CIncorrect. Limiting services and permissions reduces exposure, but an account SAS is always signed with the storage account key. It depends on Shared Key authorization.
• DIncorrect. A short expiry and HTTPS-only are good practice, but they don't change how the token is signed. A service SAS is still secured with the account key and relies on Shared Key.

Answer: A) VNet integration

• AVNet integration routes the app's outbound traffic into the virtual network.
• BSlots stage releases; they don't provide network connectivity to a VNet.
• CAccess restrictions filter inbound traffic to the app, not outbound calls.
• DAlways On keeps the app loaded; it doesn't connect it to a VNet.

Answer: A) Add the Custom Script Extension to the VM, pointing it at the script's blob URI

The Custom Script Extension downloads a script from Azure Storage and runs it unattended after deployment, so it covers both the software installs and the domain join. Custom data isn't processed on standard Windows images, JsonADDomainExtension only joins the domain, and Serial Console is interactive.

• ACorrect. The Custom Script Extension downloads scripts from Azure Storage or GitHub and runs them on the VM. It's intended for post-deployment configuration and software installation, and you can deploy it with ARM templates, PowerShell, the Azure CLI or the portal.
• BIncorrect. On Windows, custom data is written to %SystemDrive%\AzureData\CustomData.bin, but it isn't processed. To run it, you'd have to build a custom image with your own code that reads the file. A standard Marketplace image won't run it.
• CIncorrect. JsonADDomainExtension joins the VM to a domain, but it can't run your custom script, so the application installs wouldn't happen.
• DIncorrect. Serial Console is an interactive, text-based console for troubleshooting. Someone has to connect and sign in with credentials, so it doesn't meet the requirement for automatic, unattended execution.

Answer: A) Template specs stored in a shared resource group

Template specs store ARM templates as versioned Azure resources. Teams with read access can deploy them through Azure RBAC without SAS tokens and without permission to change the templates.

• ACorrect. A template spec is an Azure resource (Microsoft.Resources/templateSpecs) that stores an ARM template and supports versions. Access is managed with Azure RBAC, and users need only read access, such as the Template Spec Reader role, to deploy it without being able to modify it.
• BIncorrect. Templates in a storage account must be made public or shared with SAS tokens, which is exactly the token-based access the requirement rules out. Microsoft lists this as a problem that template specs solve.
• CIncorrect. deployIfNotExists policies deploy remediation resources automatically when a policy condition is met. They aren't a catalog of versioned templates that teams choose to deploy themselves.
• DIncorrect. Export template creates a one-time snapshot of a resource group's configuration. The result isn't stored as a versioned, RBAC-controlled Azure resource that other teams can deploy.

Answer: A) VNet peering

• AVNet peering connects two virtual networks directly over the Microsoft backbone network, allowing private-IP communication without traversing the public internet.
• BA public load balancer distributes internet-facing traffic to backend resources; it doesn't connect two VNets to each other.
• CA CDN caches and serves content to end users from edge locations; it doesn't connect two virtual networks.
• DAssigning public IPs routes traffic over the internet, the opposite of the private, non-internet connectivity VNet peering provides.

Answer: A) Azure ExpressRoute

• AExpressRoute provides a private circuit through a connectivity provider, bypassing the public internet with consistent bandwidth, lower latency, and an availability SLA.
• BA site-to-site VPN runs encrypted over the public internet, so bandwidth and latency are less predictable.
• CPoint-to-site connects individual client devices over the internet, not a whole datacenter privately.
• DPeering connects Azure VNets to each other, not on-premises networks.

Answer: A) On the hub-to-spoke peering, enable 'Allow gateway transit'; on the spoke-to-hub peering, enable 'Use remote gateways'

• AGateway transit lets the hub share its VPN/ExpressRoute gateway with peered spokes; each spoke must opt in with 'Use remote gateways' and must not have its own gateway.
• BOnly the spoke consumes the remote gateway; the hub side provides transit. Setting it on the hub is invalid.
• CThat sends traffic to the internet, not through the hub's on-prem VPN gateway.
• DA full mesh doesn't provide on-premises connectivity and defeats the hub-and-spoke design.

Answer: A) Change Analysis in Azure Resource Graph, queried for the affected resources

Change Analysis in Azure Resource Graph shows recent control-plane changes to resources, including what changed, when, and who made the change. That makes it the quickest way to link a failure to a configuration change.

• AChange Analysis is built on Azure Resource Graph. It records create, update and delete operations sent through the Azure Resource Manager control plane, and shows the properties that changed, when, and the change actor. Changes can be queried for 14 days with no onboarding.
• BA metric alert tells you when a performance threshold is crossed in the future. It doesn't show which configuration properties changed in the past or who changed them.
• CDiagnostic settings only route platform logs and metrics to a destination from the time they are created. They don't give you a summary of past property changes, so they can't answer the question quickly.
• DA lock stops future management changes. It records nothing about changes that have already happened.

Answer: A) Azure Monitor Workbooks

Azure Monitor Workbooks are made for interactive reports that combine text, metrics, log query results and parameters from several sources and can be shared. The other tools each work with only one kind of data.

• ACorrect. Workbooks combine text, log queries, metrics and parameters into rich interactive reports. They can pull data from several sources into one report and can be saved as shared workbooks for the team.
• BIncorrect. Metrics explorer plots and correlates metric values. It doesn't combine explanatory text, KQL log query results and parameters into one report, although you can send a chart from it to a workbook or dashboard.
• CIncorrect. The Logs query editor runs KQL queries and shows the results. It doesn't build a multi-section report that combines text, metric charts and shared parameters.
• DIncorrect. Resource Graph Explorer queries resource inventory and properties across subscriptions. It doesn't chart performance metrics or Log Analytics data, and it doesn't build interactive reports.