Free AZ-104 practice test

Answer: D. Virtual Machine Contributor lets the user manage VMs but not the virtual networks or storage accounts they connect to, and scoping it to RG-Web limits it to that group, which follows least privilege. Owner and Contributor at subscription scope grant far too much, and Reader cannot start or resize anything.

Answer: C. Inviting an external user (B2B collaboration) creates a guest account that signs in with her home organization's identity, so no password is managed in your tenant. A new member account means managing her credentials, syncing on-premises groups is unrelated, and sharing service principal credentials breaks accountability.

Answer: D. A CanNotDelete lock lets authorized users read and modify resources but blocks deletion, and locks apply to all users, including Owners. A ReadOnly lock would also block configuration changes. An Audit policy only reports, and removing Owner rights is drastic and does not stop other roles from deleting.

Answer: A. The built-in inherit-a-tag policy uses the Modify effect to add the resource group's tag to resources, and a remediation task applies it to resources that existed before the assignment. Deny only blocks new non-compliant deployments and fixes nothing. Locks do not set tags, and subscription tags are not inherited automatically.

Answer: C. Policies assigned at a management group are inherited by every subscription and resource beneath it, including subscriptions added later. Assigning per subscription or per resource group works but is repetitive and easy to miss. Entra directory roles control identity administration, not Azure Policy scope.

Answer: D. A service SAS tied to a stored access policy can be revoked by changing or deleting the policy, without touching the account keys. An ad hoc SAS can only be revoked early by rotating the key that signed it, and an access key gives full control of the account. Public access exposes the data to anyone.

Answer: A. RA-GRS replicates data to a secondary region and gives read access to it at any time, so reads continue during a regional outage. GRS also replicates to the secondary region, but the copy is readable only after a failover. LRS and ZRS keep data within one region.

Answer: D. Lifecycle management rules move blobs between access tiers and delete them based on age, which lowers cost without manual work. Versioning keeps old copies and increases storage, object replication duplicates data elsewhere, and a stored access policy controls SAS permissions, not data retention.

Answer: B. With blob soft delete, deleted blobs are kept for the configured retention period and can be restored. The activity log records management operations, not blob data, and a geo-failover replicates deletions as well, so it would not bring the blob back.

Answer: C. Availability zones are physically separate locations within a region, so spreading VMs across zones protects against the loss of a datacenter. An availability set spreads VMs across fault and update domains within one datacenter. A bigger single VM or a proximity placement group puts everything closer together, not further apart.

Answer: A. If the current hardware cluster does not support the new size, deallocating the VM lets Azure place it on hardware that does, after which the size becomes available. Deleting and redeploying is unnecessary, and moving resource groups or adding disks does not change which sizes the host supports.

Answer: A. Virtual Machine Scale Sets manage a group of identical VMs and can scale out and in automatically with autoscale rules on metrics such as CPU. Availability sets improve resilience but do not scale, Site Recovery is for disaster recovery, and a larger VM size is vertical scaling that does not respond to demand.

Answer: B. Deployment slots are a feature of the Standard tier and above, so the plan must be scaled up. Scaling out adds instances but does not change features, and Always On and custom domains are unrelated to slots.

Answer: A. The Bicep CLI's decompile command converts ARM template JSON into a Bicep file, which you can then clean up. The build command goes the other way, compiling Bicep into ARM JSON, and renaming the file does not change the syntax. What-if previews the effect of a deployment and does not convert anything.

Answer: D. Virtual network peering is not transitive, so traffic does not pass through VNet-Hub on its own. A direct peering between VNet-A and VNet-B is the simplest fix; routing through the hub would need an appliance or gateway with user-defined routes. NSG rules and address changes do not create a path.

Answer: D. NSG rules are processed in priority order, lowest number first, and processing stops at the first match. The priority 100 deny rule matches first, so the connection is blocked. Allow rules have no special precedence, and port specificity and creation order do not matter.

Answer: B. A private endpoint gives the storage account a private IP address in the virtual network, which on-premises clients can reach over the VPN, and public access can then be disabled. A service endpoint keeps the public endpoint and routes VNet traffic over the Azure backbone, but it does not provide a private IP for on-premises clients. Bastion is for VM sign-in only.

Answer: D. Azure Bastion provides RDP and SSH from the portal over TLS without public IPs on the VMs, and it requires a dedicated subnet named AzureBastionSubnet. A public load balancer would expose RDP to the internet, a NAT gateway handles outbound traffic only, and service endpoints are for PaaS services.

Answer: C. A metric alert rule evaluates the CPU condition, and the action group defines who is notified and how, such as email and SMS. Diagnostic settings only route data, Advisor offers recommendations rather than real-time alerts, and locks protect resources from change.

Answer: B. For Azure VM backup the vault must be in the same region as the VMs, so a vault in North Europe is needed. Soft delete and storage redundancy settings do not change which VMs can be protected, and moving resource groups does not change the region.