Free Azure AZ-104 Practice Test: 50+ Essential Questions to Pass Fast

The signal logic specifies the condition to be evaluated, including the metric (failed requests), the aggregation type (count), the operator (greater than), and the threshold (100).

The ‘NotActions’ property explicitly removes permissions from ‘Actions’. If ‘Actions’ contains ‘Microsoft.Compute/virtualMachines/*’ and ‘NotActions’ contains ‘Microsoft.Compute/virtualMachines/deallocate/action’, the deallocate action will be denied.

Management groups are containers for subscriptions, sitting above them in the hierarchy to provide a single point for applying governance controls across an enterprise.

Write caching uses a lazy write mechanism. If the host fails before the cached data is persisted to the disk, that data can be lost.

This tool is designed to show the aggregate list of all security rules from all NSGs being applied to a network interface, providing a comprehensive view of what traffic is allowed or denied.

Autoscaling is a core feature of VMSS, allowing you to define rules based on metrics (like CPU percentage) or a schedule to automatically increase or decrease the number of instances.

This is an Infrastructure as a Service (IaaS) option. It gives you full control over the SQL Server instance and the underlying Windows or Linux operating system.

This is the best practice. The App Service gets an identity in Azure AD, which can be granted permissions on the Key Vault’s access policies, eliminating the need for credentials in code.

The Activity Log is a platform log that provides insight into subscription-level events, including all write operations (PUT, POST, DELETE) performed on your resources.

Microsoft 365 groups are specifically designed for collaboration, providing members with access to a collection of shared resources, including a group mailbox, calendar, and document library.

Configuring a data collection rule and deploying the Azure Monitor Agent to the VM enables the collection of detailed telemetry, including performance counters and logs, from the guest OS.

This is the primary function of a health probe. The load balancer uses the probe’s response to determine which backend instances are operational and can receive new connections.

These are the three foundational principles of the Zero Trust model: always authenticate and authorize, limit user access to only what is needed, and design the system to minimize the impact of a potential breach.

Data egress, or outbound data transfer, is a metered service and a common component of Azure billing.

The Custom Script Extension is the primary tool for downloading and executing scripts on Azure VMs post-deployment or during initial provisioning.

This service is specifically designed to provide visibility into Azure spending, allow for the creation of budgets with alerts, and offer tools to analyze and optimize costs.

This is the key distinction. PaaS abstracts the underlying OS and middleware, allowing customers to focus on their application and data, while IaaS requires the customer to manage the OS and everything above it.

Azure Private Link, through the use of a private endpoint, creates a network interface with a private IP from your VNet that maps directly to the PaaS service, ensuring traffic never traverses the public internet.

ACR is a private Docker registry service in Azure where you can build, store, and manage container images and related artifacts.

Linking the VNet to the private zone and enabling the auto-registration setting on the link allows VMs in that VNet to automatically register their DNS records.

This is a critical aspect of the move operation. The resources being moved will be locked and cannot be written to until the move is complete.

Azure Load Balancer operates at Layer 4 (Transport) of the OSI model and can distribute any traffic that uses TCP or UDP protocols based on IP and port numbers.

Retention rules specify the duration for which daily, weekly, monthly, and yearly recovery points are stored, allowing for both short-term and long-term data protection.

An action group is a reusable collection of notification preferences (like email, SMS, or push) and actions (like calling a webhook or Logic App) that can be associated with multiple alerts.

Scaling out, also known as horizontal scaling, involves adding more instances to handle increased load, which can be automated with rules based on metrics like CPU percentage.

This is the main design goal of Bicep. It reduces the verbosity of JSON, provides better validation, and uses a more intuitive syntax for defining resources and their relationships.

Azure requires domain verification to prevent unauthorized mapping. Creating a specific TXT record with a value provided by Azure proves you control the domain’s DNS settings.

Application Gateway is a Layer 7 load balancer that can make routing decisions based on attributes of an HTTP request, such as URL path, host headers, or cookies.

Dynamic membership automates the process of keeping group membership up-to-date based on rules (e.g., all users in the ‘Sales’ department), eliminating the need for manual updates.

Azure Bastion is a fully managed PaaS service that provides secure and seamless RDP/SSH connectivity to your virtual machines directly from the Azure portal over SSL.

This correctly describes the primary use case for Azure File Sync, which transforms an on-premises file server into a cache for an Azure Files share, enabling features like cloud tiering.

Azure Policy is designed to enforce organizational standards. A ‘Deny’ policy could be used to prevent the creation of storage accounts that do not meet this security requirement.

Azure Data Box is a physical appliance that Microsoft ships to your location. You load it with data and ship it back, providing a secure, offline method for large-scale data transfer.

An NSG can be associated with the subnet to protect all resources within it, and/or with a specific virtual machine’s network interface for more granular control.

The Storage Sync Service is the management resource in Azure that you deploy into a resource group. It contains sync groups which define the topology for syncing a set of files.

ZRS provides high availability within a region by writing data to three separate zones, protecting against a datacenter-level failure.

The App Service Plan is analogous to the server farm in traditional hosting. It specifies the underlying VM size, operating system, and scale that all apps within that plan will share.

Deployment slots are designed for this exact purpose. They are live apps with their own hostnames, allowing you to deploy and test a new version and then perform a seamless ‘swap’ into production with no downtime.

ARM templates allow you to codify your infrastructure, ensuring consistent and repeatable deployments, which is a core principle of Infrastructure as Code (IaC).

A SAS token is designed for delegated access, allowing you to define specific permissions (e.g., write), a validity period, and a limited scope (e.g., a single container).

Resource Locks are specifically designed to prevent users from accidentally deleting or modifying critical resources. A ‘CanNotDelete’ lock would meet this requirement.

This correctly describes the order of processing. Inbound traffic must first pass the subnet rules and then the NIC rules. Outbound traffic must pass the NIC rules first, then the subnet rules.

Microsoft Sentinel is explicitly defined as a scalable, cloud-native SIEM and SOAR solution that provides intelligent security analytics across an enterprise.

The bulk operations feature in Microsoft Entra ID is specifically designed for this purpose, allowing administrators to create, delete, or invite many users at once using a CSV template.

This accurately describes the difference. LRS provides local durability against rack or hardware failure, while GRS provides regional disaster recovery by replicating to a paired region.

Forced tunneling is the process of redirecting all internet-bound traffic from a subnet back to an on-premises location or to an NVA in Azure for inspection, typically by creating a user-defined route for 0.0.0.0/0.

This is the core benefit. It allows network traffic between your VNet and the service to travel entirely on the Microsoft backbone network, reducing exposure to internet-based threats.

A VPN Gateway is used to send encrypted traffic between an Azure virtual network and an on-premises location over the public internet, creating a site-to-site VPN.

The AKS control plane is provided at no cost. Customers only pay for the agent nodes (worker nodes) that run their applications.

AzCopy is a command-line utility created specifically to simplify and optimize the process of copying data to and from Azure Blob, File, and Table storage.

The AZ-900 is the entry-level ‘Foundational’ exam, designed to establish core cloud literacy and an understanding of Azure services.

Rules are processed in priority order, with a lower number indicating a higher priority. The first rule that matches the traffic pattern is applied.

This state is specifically for devices that are members of an on-premises Active Directory and also joined to Microsoft Entra ID, enabling management by both.

RFC 1918 specifically sets aside IP address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) for use in private networks.

This defines the event-driven, managed nature of serverless computing, where developers focus on code snippets that run on-demand without managing servers.

This is the correct definition. The isolation between zones protects applications from datacenter-level failures.

Global VNet Peering is the specific feature designed to connect Azure virtual networks located in different Azure regions.

Azure Front Door is a global service that operates at the edge of Microsoft’s network. It provides global HTTP load balancing, performance acceleration, and failover capabilities.

This is the definition of polyglot persistence, leveraging the strengths of various data stores (e.g., SQL for relational data, Cosmos DB for documents, Blob Storage for objects) within a single solution.

The `outputs` section is used to specify data that will be returned after a successful deployment, which is useful for chaining deployments or for retrieving important connection information.

ASR provides near-synchronous replication of VMs to another region, offering RPOs as low as 30 seconds, making it ideal for disaster recovery of critical applications.

Reserved Instances (RIs) offer the highest discounts by committing to a specific VM type and region for a long term, which is ideal for stable, predictable workloads.

This is the core function of an Availability Set: to provide resiliency against localized hardware failures and planned maintenance events within a single datacenter.

While DNS is a critical service, a specific IP address within the user-defined subnet is not explicitly reserved for the Azure DNS resolver in this manner.

The Cool tier has lower storage costs than the Hot tier and is designed for infrequently accessed data that must remain online and accessible.