Microsoft Azure Administrator (AZ-104) — Practice

Questions in this quiz

1. 1. You need to ensure VMs in a subnet can reach a storage account without traversing the public internet. What should you configure?
   1. A Service Endpoint or Private Endpoint for the storage account
   2. A NAT Gateway
   3. Azure Bastion
   4. Azure ExpressRoute
2. 2. Which RBAC role is the least-privilege option to allow a user to read VM properties but not change them?
   1. Owner
   2. Contributor
   3. Virtual Machine Contributor
   4. Reader
3. 3. You want to grant a user temporary administrative permissions that require approval and auto-expire. Which Entra ID feature should you use?
   1. Conditional Access
   2. Privileged Identity Management (PIM)
   3. Identity Protection
   4. Access Reviews
4. 4. Which storage replication option keeps three copies of data across three Availability Zones in a single region?
   1. LRS
   2. ZRS
   3. GRS
   4. GZRS
5. 5. A VM in VNet A must reach a VM in VNet B with low latency and without internet exposure. What is the typical solution?
   1. A site-to-site VPN
   2. VNet peering
   3. An Application Gateway
   4. Azure Front Door
6. 6. Which Azure tool gathers metrics and logs from VMs and PaaS resources for analysis with Kusto Query Language (KQL)?
   1. Azure Monitor with Log Analytics
   2. Azure Advisor
   3. Azure Service Health
   4. Azure Network Watcher
7. 7. You need to prevent accidental deletion of a critical resource group, even by Owners. What should you apply?
   1. Azure Policy with a 'deny' effect on Delete
   2. A CanNotDelete resource lock
   3. A read-only access role
   4. Tag-based RBAC
8. 8. Which Azure service provides a managed VPN-less, RDP/SSH access to VMs through the Azure portal?
   1. Azure Bastion
   2. Azure VPN Gateway
   3. Just-In-Time VM access
   4. Azure Firewall
9. 9. You want to enforce MFA for users only when they sign in from outside the corporate network. Which feature applies?
   1. Per-user MFA
   2. Security Defaults
   3. Conditional Access policies
   4. Privileged Identity Management
10. 10. A VM scale set must add instances when CPU exceeds 70% for 5 minutes. What should you configure?
    1. Manual scaling
    2. Custom autoscale rule with metric trigger
    3. Azure Front Door
    4. A new App Service Plan
11. 11. Which feature in Azure storage automatically tiers blobs based on access patterns?
    1. Lifecycle management policies
    2. Soft delete
    3. Immutable storage
    4. Storage account failover
12. 12. You need to ensure a VM keeps its private IP address across stop/start cycles. What allocation method must the NIC use?
    1. Dynamic
    2. Static
    3. DHCP only
    4. BGP-assigned