Free AZ-104 practice test: 30 questions with answers

Administrative units scope directory roles to a subset of users, which limits the helpdesk to one department. Global Administrator and subscription Owner grant far more rights, and shared accounts are insecure.

Virtual Machine Contributor at the resource group scope permits VM management in that group only. Owner at a management group is broader, Reader cannot create VMs, and User Access Administrator manages access rather than resources.

Azure Policy with a deny effect blocks resources that are created without the required tag. Manual tagging after deployment, locks and budgets do not enforce tagging at creation.

Management groups organize subscriptions into hierarchies where policies and RBAC assignments are inherited. Tags, NSGs and storage accounts do not provide hierarchical inheritance.

A CanNotDelete lock prevents deletion even for Owners until the lock is removed. Tags do not block deletion, audit policies only report, and Reader roles do not prevent deletion by Owners.

Entra bulk operations and PowerShell support importing users from CSV files. Spreadsheet formulas, channel posts and lists do not create directory users.

Scale sets with autoscale add and remove instances based on metrics or schedules. A single large VM, a static IP and a larger disk do not scale capacity automatically.

A generalized image or a gallery image version provides a repeatable base for many VMs. Peering, storage firewalls and locks are not image resources.

Resizing keeps the VM and its disks while changing the size, provided the target size is available on the cluster. Deleting, renaming and tagging do not add memory.

Run command and runbooks execute scripts across VMs and collect results centrally. Manual logins, emailed scripts and printed copies do not provide central execution.

Availability sets spread VMs across fault and update domains so maintenance affects only some of them. Single VMs have no redundancy, and stopped VMs are unavailable.

Azure Site Recovery replicates VMs to another region and supports failover. Bastion provides access, DNS resolves names and Lighthouse manages delegated access.

VNet peering connects virtual networks privately without a gateway. Public IPs route over the internet, VPN gateways add an unnecessary hop, and internet load balancers are for public traffic.

An inbound allow for TCP 443 to the web subnet permits HTTPS. Allowing all ports is too broad, outbound rules control traffic leaving the subnet, and deny rules for port 80 do not allow HTTPS.

NSG rules are processed by priority number, and lower numbers are evaluated first, so the deny at 100 applies. The other statements misunderstand processing order.

NAT Gateway provides outbound internet access for private subnets without exposing inbound ports. Public IPs with open ports and inbound load balancers expose the VM, and VPN gateways are for private connections.

A site-to-site VPN gateway creates encrypted tunnels between on-premises and Azure. Bastion provides VM access, Firewall Manager manages firewalls, and CDN caches content.

Azure Bastion provides browser-based RDP and SSH through a managed service without public management ports. The other options expose the VMs or fail to provide secure access.

Azure Migrate discovers and assesses workloads, and Site Recovery replicates them for migration. Spreadsheets, Paint and Bastion do not assess or migrate workloads.

Metric alert rules evaluate metrics over time and trigger action groups. Diagnostic settings send logs, locks protect resources, and tags label them.

A diagnostic setting routes resource logs to a Log Analytics workspace. Tags, alerts without destinations and locks do not export logs.

Log Analytics uses KQL to query logs across resources. Paint, cost tools and Explorer search do not query Azure logs.

Azure Backup with a vault and policy provides scheduled backups, retention and recovery points. Manual copies, one-time snapshots that never expire and public containers do not meet the requirement.

Multi-user authorization and soft delete protect backup data from malicious deletion. Shared passwords, weekend pauses and deleted logs weaken protection.

Azure Files NFS shares support shared POSIX-style access from multiple Linux VMs. Blob storage is object storage, a managed disk attaches to one VM, and temporary disks are not durable shared storage.

Storage firewall rules limit access to specified networks, and disabling public access blocks internet connections. Public containers, posted keys and disabled HTTPS all expose data.

A scoped SAS with read permission and an expiry gives limited, time-bound access. Sharing account keys grants full control, public accounts expose everything, and emailing contents is inefficient and uncontrolled.

Lifecycle management policies transition and delete blobs based on rules such as age and access. Backup vaults, Explorer bookmarks and locks do not move or delete blobs by rule.

ZRS replicates data synchronously across zones in one region. LRS keeps copies in one datacenter, and GRS replicates to a secondary region rather than across zones in the primary region.

Soft delete retains deleted blobs for a configured period so they can be recovered. Blocking all deletions is not practical, temporary disks are not durable, and read-only settings are a different control.