az 104 practice test Practice Exam 2025: Latest Questions

You create a resource group named RG1. A user must be able to start and stop virtual machines in RG1 but must not be able to delete the VMs or modify networking resources. What should you assign?

You have a storage account that contains a container named data. You need to ensure that blobs in data can be read anonymously from the internet, but listing the container should not be allowed. What should you configure?

You need to ensure that an Azure VM can resolve and connect to a private endpoint for an Azure Storage account using the storage account's public FQDN (for example, mystorageaccount.blob.core.windows.net). What should you configure?

You need to deploy five identical Azure VMs for a web tier and want Azure to automatically distribute them across fault and update domains. The VMs must be created and managed as a single resource. What should you deploy?

A team uses a tag named CostCenter on all resources. They need to prevent deletion of the tag from any resource in a subscription, but resource owners must still be able to create and delete resources. What should you use?

You need to provide temporary read-only access to a single blob for an external vendor without making the container public. The access must automatically expire. What should you use?

You deploy a VM in Azure and enable a system-assigned managed identity. The VM must read secrets from an Azure Key Vault. What is the best practice to grant the VM access?

A VM in subnet Subnet1 cannot reach resources in subnet Subnet2 within the same virtual network. There is an NSG associated to Subnet2 that contains a rule denying inbound traffic from 10.10.1.0/24 to 10.10.2.0/24. What should you do to allow the traffic while keeping all other inbound restrictions?

You have 20 Azure VMs that must send guest-level performance counters and Windows Event Logs to a Log Analytics workspace. You need to configure data collection at scale with centralized management and support for multiple data sources. What should you use?

Your company requires that all Azure resources are deployed only in specific Azure regions. The requirement must apply to all subscriptions in a management group and prevent noncompliant deployments. What should you implement?

You have an Azure subscription that contains multiple resource groups. You need to ensure that only resources with the tag Environment=Prod can be created in the Prod-RG resource group. What should you use?

You need to grant a contractor access to manage DNS zones in a single resource group. The contractor must not be able to create or delete resource groups or manage access control. Which built-in role should you assign at the resource group scope?

You have a storage account that contains a container named data. You need to allow a partner to upload files to data for the next 24 hours without granting access to list or read existing blobs. What should you provide?

Your company uses multiple Azure subscriptions. You need to centrally apply a set of policies and RBAC assignments to all subscriptions, and ensure new subscriptions automatically inherit them. What should you use?

You have a virtual network with subnets: FrontEnd and BackEnd. You deploy an Azure Bastion host. Users report they cannot connect to VMs in BackEnd through Bastion. The Bastion resource deployed successfully. Which configuration is required for Bastion to work?

You deployed an Azure VM using the Standard SSD managed disk type. You need to increase the disk size from 128 GiB to 256 GiB with minimal downtime. What should you do?

You need to ensure that a group of VMs can resolve on-premises DNS names. The on-premises DNS servers are reachable over a site-to-site VPN. What should you configure?

You need to collect Windows event logs and performance counters from several Azure VMs into a central workspace and create alert rules based on the collected data. Which solution should you implement?

You have two VNets (VNetA and VNetB) peered in the same region. A VM in VNetA must connect to a VM in VNetB using the public IP of the VM in VNetB due to application constraints. The connection fails. What is the most likely reason?

You must ensure that all new storage accounts created in a subscription block public access to blob containers. Existing storage accounts should remain unchanged. What should you implement?

You have a storage account named stapp1. A developer must be able to list containers and read blobs, but must NOT be able to delete blobs or containers. The access must be granted without using the storage account keys. What should you assign?

You have a virtual network named VNet1 with subnets SubnetA and SubnetB. You deploy a network virtual appliance (NVA) in SubnetA and want all outbound traffic from SubnetB to the internet to be routed through the NVA. What should you configure?

You must ensure that all new Azure resources created in a subscription are deployed only to the West Europe region. Existing resources should not be affected. What should you use?

You have multiple Azure VMs in an availability set. You need to enable monitoring so that you can query guest OS performance counters (CPU, memory) across all VMs using Log Analytics queries. What should you do?

Your company uses Azure Files. You need to provide a Linux VM access to an Azure file share using identity-based authentication (no storage account keys or SAS). The VM is joined to Azure AD DS. Which configuration supports this requirement?