az 104 practice test Advanced Practice Exam: Hard Questions 2025

Your organization has implemented Azure AD Privileged Identity Management (PIM) for just-in-time access to Azure resources. Users report that when they activate their eligible role assignment for a resource group, they can immediately see the resources but receive 'Authorization failed' errors when attempting management operations for approximately 5-10 minutes. The role assignment shows as 'Active' in PIM. What is the MOST likely cause and solution?

You are designing a storage solution for a healthcare application that must retain patient records for 7 years with immutability guarantees to meet regulatory compliance. The application writes approximately 500 GB of data monthly, and data older than 90 days is rarely accessed. After 7 years, data must be automatically deleted. Which combination of features provides the MOST cost-effective solution while meeting all requirements?

Your company runs a multi-tier application with VMs in an availability set behind an Azure Standard Load Balancer. During a recent deployment, you updated the application on all VMs simultaneously, causing a complete outage. You need to implement a solution that prevents simultaneous updates to all VMs during maintenance while minimizing costs and management overhead. The VMs must remain in their current availability set. What should you implement?

You manage a hub-and-spoke network topology with 15 spoke VNets peered to a central hub VNet. The hub contains an Azure Firewall and a VPN Gateway for on-premises connectivity. Spoke VNets cannot communicate with each other directly. You need to enable direct spoke-to-spoke communication for latency-sensitive applications while maintaining centralized firewall inspection for all internet-bound and on-premises traffic. What is the MOST efficient solution?

Your organization uses Azure Policy to enforce compliance across 50 subscriptions. You've assigned a policy initiative at the management group level that denies creation of resources without specific tags. A critical application deployment is failing because the ARM template attempts to create a Key Vault without the required tags, but the application team cannot modify the template immediately. You need to allow this specific Key Vault creation while maintaining policy enforcement for all other resources. What is the MOST appropriate solution?

You have an Azure Storage Account with 5 TB of blob data using default settings. A developer accidentally deleted a critical container 25 days ago, and soft delete was not enabled. The storage account uses locally-redundant storage (LRS) in the East US region. Management has approved significant costs to attempt data recovery. What recovery options are available?

You have deployed an Azure VM Scale Set with 10 instances running a stateless web application behind Azure Application Gateway. The scale set uses Uniform orchestration mode and automatic OS upgrades. During the last platform update, 3 instances failed to boot after the OS upgrade, causing application performance degradation. You need to ensure that future upgrade failures don't impact application availability while maintaining automatic patching. What should you configure?

Your company has an Azure VNet with an Azure Bastion deployment in a dedicated subnet. Security team requires that all administrator connections to VMs must be logged and recorded for compliance auditing. The solution must capture actual session activities (commands executed, files accessed) rather than just connection metadata. RDP and SSH traffic should never traverse the public internet. What additional configuration is required?

You manage an Azure subscription with 200+ VMs across multiple resource groups. You've configured diagnostic settings on 50 VMs to send performance metrics and logs to a Log Analytics workspace. Your manager asks for a report showing CPU and memory trends for ALL VMs over the past 30 days. You discover that VMs without diagnostic settings configured show no data. What is the MOST efficient approach to collect this data going forward without reconfiguring each VM individually?

Your organization has implemented Azure AD Conditional Access policies requiring MFA for all users. A service principal used by an automated CI/CD pipeline suddenly fails authentication with 'interaction required' errors when attempting to access Azure Key Vault to retrieve secrets during deployment. The pipeline worked correctly last week. What is the MOST likely cause and appropriate solution?