Free AZ-104 Azure Administrator Practice Exam (2026)

Your score by topic

Get a free AZ-104 study plan on WhatsApp See AZ-104 Azure Administrator Training with pass guarantee

Review answers Only my mistakes Retake

Question 1Storage⚑ Flag

You need to deploy SMB file shares that run on SSD storage with consistently low latency for a database workload. Which storage account type should you create?

APremium file shares (FileStorage) BPremium page blobs (general-purpose v2) CStandard general-purpose v2 DPremium block blobs (BlockBlobStorage)

Correct answer: A. Premium file shares (FileStorage)
SSD-based Azure file shares need a premium FileStorage account, shown in the portal as Premium file shares. A Standard general-purpose v2 account can also host file shares, but they run on HDD storage and do not offer the same low latency.

Question 2Identities & Governance⚑ Flag

You need to enable self-service password reset (SSPR) only for the 50 members of a security group named SSPR-Pilot. Other users must not be able to use SSPR. What should you configure?

AEnable SSPR for All users in the tenant BA Conditional Access policy for SSPR-Pilot CSet SSPR to Selected and choose SSPR-Pilot DAssign the group the Password Administrator role

Correct answer: C. Set SSPR to Selected and choose SSPR-Pilot
SSPR can be set to None, Selected, or All, and Selected limits the feature to the members of the chosen group. Password Administrator lets members reset other users' passwords, which is not self-service and is far more privilege than needed. Choosing All would open SSPR to every user.

Question 3Compute⚑ Flag

An ARM template has a vmSize parameter with allowedValues of Standard_B2s and Standard_D2s_v5 and a defaultValue of Standard_B2s. A deployment that passes Standard_D4s_v5 fails validation. You need to allow Standard_D4s_v5 and keep the other sizes valid. What should you do?

ARedeploy in Complete mode so the parameter value is accepted BChange the type of vmSize from string to securestring CChange the defaultValue of vmSize to Standard_D4s_v5 DAdd Standard_D4s_v5 to the allowedValues array of vmSize

Correct answer: D. Add Standard_D4s_v5 to the allowedValues array of vmSize
When a parameter has allowedValues, Resource Manager rejects any value that is not in the list, so the new size must be added to the array. Changing only the defaultValue does not help because the value you pass must still match an allowed value.

Question 4Virtual Networking⚑ Flag

Subnet1 uses the address range 10.2.1.16/28. You need to assign a static private IP address to a new VM in Subnet1. Which IP address can you assign?

A10.2.1.31 B10.2.1.17 C10.2.1.19 D10.2.1.20

Correct answer: D. 10.2.1.20
In 10.2.1.16/28, Azure reserves .16 for the network, .17 for the default gateway, .18 and .19 for Azure DNS and .31 for broadcast, so .20 is the first usable address. 10.2.1.17 looks like the first host address, but Azure keeps it for the default gateway.

Question 5Storage⚑ Flag

Several applications connect to a storage account by using access key 1. You need to rotate the keys without causing downtime. What should you do?

ARegenerate key 1, then update the applications to use key 1 BUpdate the applications to use key 2, then regenerate key 1 CRegenerate both keys, then update the applications to use key 2 DDisable shared key access, then regenerate key 1 and key 2

Correct answer: B. Update the applications to use key 2, then regenerate key 1
Moving the applications to key 2 first means nothing depends on key 1 when you regenerate it. Regenerating key 1 first breaks every application that still uses it until each one is updated.

Question 6Identities & Governance⚑ Flag

You try to directly assign a Microsoft 365 license to a new user named User5 in the Microsoft Entra admin center, but the assignment fails. Other users receive licenses normally. Which user property should you set first?

AEmployee type BUsage location COffice location DPreferred language

Correct answer: B. Usage location
A usage location is required before a license can be assigned directly, because some services are not available in every country. Office location only records where the person works and has no effect on licensing. The other properties are optional.

Question 7Compute⚑ Flag

Resource group RG-Test contains resources that were created manually over time. You need to deploy an ARM template so that, after the deployment, RG-Test contains only the resources that are defined in the template. What should you use?

AIncremental mode, which is the default deployment mode BWhat-if, run with the az deployment group what-if command CValidate, run with the az deployment group validate command DComplete mode, set with the --mode parameter of the command

Correct answer: D. Complete mode, set with the --mode parameter of the command
Complete mode deletes resources in the resource group that are not defined in the template, so only the template's resources remain. Incremental mode, the default, adds or updates resources but leaves unlisted resources in place.

Question 8Virtual Networking⚑ Flag

You deploy two network virtual appliances (NVAs) in Subnet2 for high availability. Traffic to the NVAs stays inside the virtual network. You need to load balance all TCP and UDP flows on all ports to the NVAs by using a single rule. What should you deploy?

AA Basic internal load balancer with an HA ports rule BAn Application Gateway v2 with a listener for each port CA Standard internal load balancer with an HA ports rule DA Standard public load balancer with an HA ports rule

Correct answer: C. A Standard internal load balancer with an HA ports rule
HA ports rules load balance all TCP and UDP flows on every port, and they are available only on a Standard SKU internal load balancer. A public load balancer cannot use HA ports, and the Basic SKU never supported them and is now retired.

Question 9Storage⚑ Flag

A general-purpose v2 storage account named st1 uses locally redundant storage (LRS). You need st1 to survive the loss of an availability zone in its region, with no change to the account name and no data copy jobs. What should you do?

ATurn on blob versioning and soft delete on st1 BStart a customer-initiated conversion of st1 to ZRS CCreate a new ZRS account and copy the data with AzCopy DEnable geo-redundant storage (GRS) on st1

Correct answer: B. Start a customer-initiated conversion of st1 to ZRS
Azure supports converting an existing LRS account to ZRS in place, which keeps the same account and endpoint while copying data across zones in the background. GRS adds a second region but keeps only LRS within the primary region, so it does not protect against a zone outage there.

Question 10Identities & Governance⚑ Flag

Your company has offices in Paris and Berlin. You need to let a Paris helpdesk team reset passwords only for Paris users, not for Berlin users. What should you do?

APlace Paris users in a resource group and assign a role there BMake the team owners of a dynamic group of Paris users CScope Helpdesk Administrator to a Paris administrative unit DAssign Helpdesk Administrator to the team at tenant scope

Correct answer: C. Scope Helpdesk Administrator to a Paris administrative unit
An administrative unit groups users so that an Entra role such as Helpdesk Administrator can be assigned with that unit as its scope. Assigning the role at tenant scope would let the team reset Berlin passwords too. Resource groups hold Azure resources, not Entra user accounts.

Question 11Compute⚑ Flag

VM5 was created without an availability set. You need VM5 to become part of an existing availability set named AS-Web while keeping its data. What should you do?

ARecreate VM5 in AS-Web by attaching its existing OS and data disks BSelect AS-Web in the availability settings of VM5 and then save CMove VM5 to the resource group that holds AS-Web and restart it DResize VM5 to a size that is offered in AS-Web and then redeploy it

Correct answer: A. Recreate VM5 in AS-Web by attaching its existing OS and data disks
A VM can be added to an availability set only when the VM is created, so you delete VM5, keep its disks, and create a new VM in AS-Web from those disks. Moving the VM to another resource group does not change its availability set membership.

Question 12Storage⚑ Flag

You need to make sure that blob containers that are deleted by mistake can be recovered for 14 days. Which feature should you enable?

ABlob versioning for all containers BSoft delete for containers CSoft delete for blobs DPoint-in-time restore for block blobs

Correct answer: B. Soft delete for containers
Container soft delete keeps a deleted container and its contents for the retention period so you can restore it. Blob soft delete protects individual blobs and snapshots, but it cannot bring back a container that was deleted.

Question 13Virtual Networking⚑ Flag

VM1 and VM2 are in the backend pool of a Standard load balancer. Both VMs show as unhealthy, but the app responds locally on each VM. The subnet NSG has a custom inbound rule at priority 110 that denies all traffic from Any. What should you add to the NSG?

AAn inbound rule allowing the AzureLoadBalancer service tag at priority 100 BAn outbound rule allowing the Internet service tag at priority 100 CAn inbound rule allowing the VirtualNetwork service tag at priority 4000 DAn inbound rule allowing the AzureLoadBalancer service tag at priority 4000

Correct answer: A. An inbound rule allowing the AzureLoadBalancer service tag at priority 100
Health probes come from 168.63.129.16, which the AzureLoadBalancer service tag represents, so an allow rule for that tag must be processed before the deny rule. The same rule at priority 4000 is never reached because the deny rule at 110 matches first.

Question 14Storage⚑ Flag

Regulations require that financial records in a container cannot be changed or deleted for seven years. Administrators must not be able to shorten or remove the retention rule after it is applied. What should you configure?

AAn unlocked time-based retention policy BA legal hold on the container CA locked time-based retention policy DA CanNotDelete lock on the storage account

Correct answer: C. A locked time-based retention policy
A locked time-based retention policy enforces WORM storage for the set period, and once locked it can be extended but never shortened or deleted. An unlocked policy protects data the same way, but an administrator can still shorten or delete it.

Question 15Identities & Governance⚑ Flag

A Global Administrator named Admin1 cannot see any Azure subscriptions after the previous administrator left. Admin1 needs to regain the ability to manage access to all subscriptions and management groups in the tenant. What should Admin1 do first?

AActivate the Global Reader role in Privileged Identity Management BCreate a new subscription and move the resources into it CAssign the Privileged Role Administrator role to Admin1 DEnable Access management for Azure resources for Admin1

Correct answer: D. Enable Access management for Azure resources for Admin1
Global Administrator is a Microsoft Entra role and does not include Azure resource permissions by default. Turning on Access management for Azure resources gives Admin1 User Access Administrator at root scope (/), so Admin1 can assign Azure roles anywhere. Privileged Role Administrator and Global Reader are Entra roles too and grant no subscription access.

Question 16Compute⚑ Flag

You are deploying two VMs for a web tier in a region that supports availability zones. The tier must stay available if an entire datacenter in the region fails, and you want the highest VM SLA for this deployment. What should you do?

APlace both VMs on a dedicated host group that spans two fault domains BPlace both VMs in one availability set with three fault domains CPlace both VMs in a proximity placement group in the region DDeploy the VMs to two different availability zones in the region

Correct answer: D. Deploy the VMs to two different availability zones in the region
Availability zones are physically separate datacenters within a region, and VMs spread across two or more zones have a 99.99 percent SLA. An availability set spreads VMs across racks in one datacenter, so it does not survive a datacenter outage and has a lower 99.95 percent SLA.

Question 17Storage⚑ Flag

Before you run a migration script against an Azure file share, you need a read-only, point-in-time copy of the entire share that users can later browse from Windows by using Previous Versions. What should you create?

AA share snapshot of the file share BSoft delete enabled on the file share CA copy of the share made with AzCopy DA blob snapshot of each file in the share

Correct answer: A. A share snapshot of the file share
A share snapshot is a read-only, point-in-time copy of the whole share, and Windows SMB clients can open it through Previous Versions. Soft delete only protects the share from being deleted; it does not give you a copy to roll back to.

Question 18Virtual Networking⚑ Flag

LB1 is a Standard public load balancer with VM1 and VM2 in its backend pool. Neither VM has a public IP address. You need administrators to connect to VM1 by using RDP through the LB1 frontend IP on TCP port 50001. What should you configure on LB1?

AA load balancing rule BAn inbound NAT rule CAn outbound rule DA health probe

Correct answer: B. An inbound NAT rule
An inbound NAT rule forwards traffic on a specific frontend port, such as 50001, to a specific backend VM and port, such as 3389 on VM1. A load balancing rule would spread connections across all backend VMs instead of targeting VM1.

Question 19Identities & Governance⚑ Flag

You create a custom Azure role for operators. The role must be available for assignment only in subscriptions Sub1 and Sub2. Which property of the role definition should you configure?

ANotActions BDataActions CActions DAssignableScopes

Correct answer: D. AssignableScopes
AssignableScopes lists the management groups, subscriptions, or resource groups where a custom role can be assigned. Actions and NotActions define which control plane operations are allowed or excluded, not where the role can be used. DataActions cover data plane operations, such as reading blob contents.

Question 20Compute⚑ Flag

Your security team requires that the temporary disk and the OS and data disk caches of new VMs be encrypted at rest. The solution must not depend on an in-guest agent or use VM CPU for encryption. What should you use?

AServer-side encryption with a disk encryption set BDouble encryption at rest with platform keys CEncryption at host on the virtual machines DAzure Disk Encryption with BitLocker or DM-Crypt

Correct answer: C. Encryption at host on the virtual machines
Encryption at host encrypts data on the VM host, so temp disks and disk caches are encrypted at rest without any in-guest agent. Server-side encryption, even with a disk encryption set, protects managed disk data in storage but does not cover temp disks or caches on its own.

Question 21Storage⚑ Flag

An app needs one SAS token that grants access to both the Blob and Queue services in a storage account, including service-level operations such as reading service properties. Which type of SAS should you create?

AAn account SAS BA service SAS CA user delegation SAS DA policy-based service SAS

Correct answer: A. An account SAS
An account SAS can cover more than one storage service and allows service-level operations such as Get Service Properties. A service SAS is limited to a single service, and a user delegation SAS works only with Blob storage.

Question 22Virtual Networking⚑ Flag

Web server VMs and database VMs share a subnet. You need an NSG rule that allows TCP 1433 only from the web servers to the database servers. New VMs are added often, and you want to avoid updating IP addresses in the rule. What should you use as the rule source and destination?

AIP groups from Azure Firewall BService tags such as VirtualNetwork CApplication security groups DCIDR ranges of the subnet

Correct answer: C. Application security groups
Application security groups group VM network interfaces by role and can be used as the source and destination of NSG rules, so new VMs only need to join the right group. Service tags cover Azure services or broad ranges such as the whole VNet, so they cannot separate web servers from database servers.

Question 23Identities & Governance⚑ Flag

You need to assign 12 related Azure Policy definitions for a security baseline as a single unit and see one compliance result for the whole set. What should you create?

AA policy initiative BA custom RBAC role CA management group DA policy exemption

Correct answer: A. A policy initiative
An initiative (policy set definition) groups several policy definitions so they are assigned together and reported as one compliance result. A management group is a scope you can assign policies to, but it does not bundle definitions. An exemption takes resources out of evaluation, which is the opposite of the goal.

Question 24Compute⚑ Flag

You need to add a data disk to a database VM. You must be able to change the disk's IOPS and throughput independently of its size while the disk stays attached, at a lower cost than Ultra Disk. Which disk type should you use?

APremium SSD managed disk with bursting enabled BPremium SSD v2 managed disk of the required size CStandard SSD managed disk with bursting enabled DStandard HDD managed disk with a larger size

Correct answer: B. Premium SSD v2 managed disk of the required size
Premium SSD v2 lets you set capacity, IOPS, and throughput separately and adjust performance while the disk stays attached, at a lower price than Ultra Disk. Premium SSD bursting only adds temporary performance above a size-based baseline and does not let you choose IOPS and throughput yourself.

Question 25Storage⚑ Flag

A storage account uses GRS. You need to make sure that, during a future outage in the primary region, an application can read data from the secondary region without waiting for a failover. What should you do?

AChange the redundancy to RA-GRS and read from the secondary endpoint BChange the redundancy to GZRS and keep the primary endpoint CConfigure object replication to a storage account in the paired region DInitiate a customer-managed failover to the secondary region

Correct answer: A. Change the redundancy to RA-GRS and read from the secondary endpoint
RA-GRS uses the same geo-replication as GRS but adds a read-only secondary endpoint that applications can use at any time. A customer-managed failover also restores access, but it takes time and makes the secondary the new primary, which is not needed just to read data.

Question 26Storage⚑ Flag

You store compliance images that are read only a few times a year. When requested, they must be readable within milliseconds. Each blob will be kept for at least 90 days. You need the lowest storage cost. Which access tier should you use?

AHot BCool CCold DArchive

Correct answer: C. Cold
The Cold tier is online, so reads are immediate, and it costs less to store data than Cool, with a 90-day minimum that this data already meets. Archive is cheaper still, but it is offline, and blobs must be rehydrated for hours before anyone can read them.

Question 27Identities & Governance⚑ Flag

You assign a policy with the deployIfNotExists effect that installs a monitoring agent on virtual machines. New VMs are compliant, but existing VMs still show as non-compliant. You need the existing VMs brought into compliance. What should you do?

AStart an on-demand compliance evaluation scan BCreate a remediation task for the assignment CChange the effect of the assignment to Audit DDelete the assignment and assign it again

Correct answer: B. Create a remediation task for the assignment
deployIfNotExists acts automatically only when resources are created or updated after the assignment. Existing resources are fixed by a remediation task, which uses the assignment's managed identity to deploy the missing configuration. An on-demand evaluation scan only refreshes compliance results and does not change resources.

Question 28Compute⚑ Flag

VM6 runs in the East US region in resource group RG1. You move VM6 and its dependent resources to resource group RG2, which was created in the West Europe region. Where does VM6 run after the move?

AIn West Europe, because resources take the region of their group BIn the paired region of East US until the move is committed CIn West Europe, after its disks finish replicating in the background DIn East US, because a move does not change a resource's region

Correct answer: D. In East US, because a move does not change a resource's region
Moving resources between resource groups or subscriptions changes only their container, not their region, and a resource group's location only stores its metadata. To change the region of a VM, you need a tool such as Azure Resource Mover.

Question 29Virtual Networking⚑ Flag

You need an Azure SQL logical server to accept connections only from VMs in Subnet3. The VMs must keep using the server's public endpoint, and you want no added hourly or data processing charges. What should you configure?

AA Microsoft.Sql service endpoint on Subnet3 and a VNet rule BA private endpoint for the SQL server in Subnet3 CA NAT gateway on Subnet3 plus a firewall rule for its public IP DAn NSG outbound rule on Subnet3 using the Sql service tag

Correct answer: A. A Microsoft.Sql service endpoint on Subnet3 and a VNet rule
A service endpoint sends Subnet3 traffic to Azure SQL with the subnet identity at no extra charge, and a virtual network rule on the server then allows only that subnet. A private endpoint would also restrict access, but it replaces the public endpoint with a private IP and adds hourly and data processing charges.

Question 30Monitor & Maintain⚑ Flag

You need prebuilt views that compare guest OS performance across 50 Azure VMs, including the percentage of used space on each logical disk, and that highlight the busiest machines. What should you use?

ABoot diagnostics BVM insights CMetrics explorer DConnection monitor

Correct answer: B. VM insights
VM insights collects guest performance data through the Azure Monitor Agent and includes ready-made charts that rank VMs by usage. Host metrics in Metrics explorer come from the hypervisor, so they do not show used space for each logical disk inside the guest OS.

Question 31Identities & Governance⚑ Flag

You assign a policy that requires specific encryption settings at the Sub1 scope. A resource group named RG-Lab in Sub1 must not be evaluated by this assignment, while every other resource group stays covered. What should you do?

AAdd RG-Lab as an exclusion on the assignment BReassign the policy at the management group scope CGrant RG-Lab users the Owner role on RG-Lab DApply a CanNotDelete lock to RG-Lab

Correct answer: A. Add RG-Lab as an exclusion on the assignment
An exclusion (notScopes) on the assignment removes a child scope such as RG-Lab from evaluation while the rest of Sub1 stays covered. Azure Policy applies regardless of a user's RBAC role, so making users Owners does not bypass it. Assigning at a management group widens the scope instead of narrowing it.

Question 32Compute⚑ Flag

You need to install a monitoring tool on 15 existing Windows VMs by running a PowerShell script that is stored in an Azure Storage blob container. The script must run once on each VM without anyone signing in to the VMs. What should you use?

ABoot diagnostics with a serial console BAzure VM Image Builder with a customizer CCustom data supplied through cloud-init DThe Custom Script Extension on each VM

Correct answer: D. The Custom Script Extension on each VM
The Custom Script Extension downloads scripts from locations such as Azure Storage and runs them on existing VMs, which suits post-deployment installs. Custom data and cloud-init are processed only when a VM is first provisioned, so they cannot configure VMs that already exist.

Question 33Virtual Networking⚑ Flag

You create a public DNS zone named contoso.com in Azure DNS and add the required records. Internet users still cannot resolve names in the zone. The domain is registered with a third-party registrar. What should you do?

APoint the domain's NS records at the registrar to Azure DNS BLink the zone to a virtual network with auto-registration enabled CAdd an SOA record in the zone that points to the registrar DCreate a CNAME record at the registrar that points to the zone

Correct answer: A. Point the domain's NS records at the registrar to Azure DNS
Azure DNS answers for the zone on the internet only after the registrar delegates the domain to the Azure DNS name servers listed on the zone. Virtual network links and auto-registration apply to private DNS zones, not public ones.

Question 34Monitor & Maintain⚑ Flag

An application on an Azure VM cannot reach an external API at api.partner.example on TCP port 443. You need to test connectivity from the VM to that FQDN and see the hops and any NSG rule or route that blocks the path. Which Network Watcher tool should you use?

APacket capture BNetwork security group diagnostics CConnection troubleshoot DIP flow verify

Correct answer: C. Connection troubleshoot
Connection troubleshoot runs a test from the source VM to an IP address, URI or FQDN on a chosen port and reports latency, hops and any NSG rule or route that blocks the path. IP flow verify only checks one packet against the NSG rules on the VM's own network interface, so it does not test the full path to an outside endpoint.

Question 35Identities & Governance⚑ Flag

An administrator applies a ReadOnly lock to a resource group that contains a storage account. Developers who have the Contributor role on the storage account can no longer view its access keys in the Azure portal. What causes this?

AThe listKeys operation is a POST request blocked by the lock BThe lock removes all Contributor role assignments in the group CApplying a lock rotates the storage account keys DKey access requires the Storage Account Contributor role

Correct answer: A. The listKeys operation is a POST request blocked by the lock
Listing storage account keys uses a POST request (listKeys), and a ReadOnly lock blocks it even for users whose role allows it. The lock does not remove or change any role assignments. Contributor already includes the listKeys permission, so a different role would not help while the lock is in place.

Question 36Compute⚑ Flag

You run a nightly data export job as a container group in Azure Container Instances. The container must run its task one time and must not be restarted after it exits, whether it succeeds or fails. Which restart policy should you set?

AOnFailure BAlways CUnlessStopped DNever

Correct answer: D. Never
With the Never restart policy, Container Instances runs the containers once and does not restart them after they exit, whatever the exit code. OnFailure restarts a container that ends with a non-zero exit code, which the requirement does not allow.

Question 37Monitor & Maintain⚑ Flag

You need to record the IP traffic that flows through a new virtual network, including traffic to subnets that have no network security group. What should you enable?

APacket capture on each virtual machine BVirtual network flow logs CNSG flow logs on each network security group DDiagnostic settings on the virtual network

Correct answer: B. Virtual network flow logs
Virtual network flow logs record traffic at the virtual network level, so subnets and NICs without an NSG are covered. NSG flow logs only capture traffic that an NSG evaluates, and new NSG flow logs can no longer be created since June 30, 2025.

Question 38Virtual Networking⚑ Flag

An app runs in East US and West US and uses a custom TCP protocol on port 5000. Clients must connect to East US and must connect to West US only when East US is unavailable. What should you use?

AAzure Front Door with priority routing BAzure Application Gateway with two backend pools CAzure Traffic Manager with priority routing DAn internal load balancer with two backend pools

Correct answer: C. Azure Traffic Manager with priority routing
Traffic Manager works at the DNS level, so it can direct clients for any protocol, and priority routing sends them to East US until that endpoint fails health checks. Front Door also supports priority routing, but it only handles HTTP and HTTPS traffic.

Question 39Monitor & Maintain⚑ Flag

You back up Azure VMs to a Recovery Services vault. A new requirement states that VM backups must run every 4 hours. What should you do?

AEnable Cross Region Restore on the Recovery Services vault BCreate an Enhanced policy with a 4-hour backup interval CIncrease instant restore retention in the current policy DCreate a Standard policy with four backup times per day

Correct answer: B. Create an Enhanced policy with a 4-hour backup interval
The Enhanced policy for Azure VMs supports several backups per day, with intervals of 4, 6, 8 or 12 hours. The Standard policy allows only one scheduled backup per day, so it cannot meet a 4-hour requirement.

Question 40Identities & Governance⚑ Flag

You need to move a storage account from a subscription named Sub1 to a subscription named Sub2. Which condition must be true for the move to succeed?

ABoth subscriptions must be in the same management group BBoth subscriptions must share the same billing account CThe target resource group must be in the storage account's region DBoth subscriptions must be in the same Microsoft Entra tenant

Correct answer: D. Both subscriptions must be in the same Microsoft Entra tenant
The source and destination subscriptions must be in the same Microsoft Entra tenant; otherwise the subscription has to be transferred to the other tenant first. Subscriptions can sit under different management groups or billing accounts, and the target resource group can be in any region. The destination must also be registered for the resource provider being moved.

Question 41Compute⚑ Flag

A web app runs in an App Service plan on the Basic tier. You need the app to scale out automatically when average CPU usage exceeds 70 percent. Which is the lowest App Service plan tier that supports rules-based autoscale?

ABasic BStandard CPremium v3 DIsolated v2

Correct answer: B. Standard
Rules-based autoscale is available starting with the Standard tier, which supports up to 10 instances. The Basic tier only supports manual scale out to a maximum of 3 instances, so it cannot add instances based on CPU rules.

Question 42Monitor & Maintain⚑ Flag

A user deleted a single folder on a Windows VM that is protected by Azure Backup. You need to restore only that folder from last night's recovery point without replacing the VM's disks. Which restore option should you use?

AReplace existing disks BRestore disks CFile Recovery DCreate new virtual machine

Correct answer: C. File Recovery
File Recovery mounts the recovery point's disks on a machine through a downloaded script, so you can copy back just the folder you need. Restore disks also gets the data back, but it creates full managed disks that you must attach and clean up, which is much more work for one folder.

Question 43Virtual Networking⚑ Flag

You are configuring a site-to-site VPN between VNet1 and your head office, and the VPN gateway is already deployed. You need an Azure resource that stores the public IP address of the office VPN device and the office address prefixes. What should you create?

AA local network gateway BA NAT gateway CA public IP address prefix DA virtual network gateway

Correct answer: A. A local network gateway
A local network gateway represents the on-premises site and holds the VPN device's public IP address and the on-premises address ranges used for routing. The virtual network gateway is the Azure end of the tunnel, which is already deployed.

Question 44Identities & Governance⚑ Flag

Your team wants development VMs in a subscription named Sub-Dev to shut down automatically when actual monthly costs reach 100 percent of the budget. What should you do?

AAssign a Deny policy that triggers when the budget is exceeded BEnable Azure Advisor automatic remediation for Sub-Dev CTurn on the budget's option to stop resources at 100% DUse the budget alert to trigger an action group runbook

Correct answer: D. Use the budget alert to trigger an action group runbook
Budgets do not stop resources on their own; they only send notifications. A budget alert can call an action group, which can start an Azure Automation runbook or Logic App that shuts down the VMs. Azure Policy evaluates resource properties, not spending, so it cannot react to a budget.

Question 45Compute⚑ Flag

A web app running on one instance of an App Service plan fails with out-of-memory errors when a single request processes a large report. CPU usage stays low. You need to resolve the issue. What should you do?

AScale up the App Service plan to a size with more memory BScale out the App Service plan to the maximum instance count CEnable ARR affinity so requests stay on the same instance DAdd a staging slot and route half of the traffic to it

Correct answer: A. Scale up the App Service plan to a size with more memory
Scaling up moves the plan to a larger size or tier, which gives each instance more memory. Scaling out adds more instances of the same size, so one memory-heavy request still runs out of memory on the instance that handles it.

Question 46Monitor & Maintain⚑ Flag

Five days ago, an administrator stopped protection for an Azure VM and chose to delete its backup data. The Recovery Services vault uses the default soft delete settings. You need to get the backup data back. What should you do?

AAccept the loss, because deleted backup data is gone BRestore the VM from an Azure Site Recovery recovery point CUndelete the backup item, then resume protection DCreate a new backup policy and apply it to the VM

Correct answer: C. Undelete the backup item, then resume protection
With default soft delete, deleted backup data is kept for 14 more days, so you can undelete the item and then resume backups. A new backup policy would only start fresh backups and would not bring back the recovery points that were deleted.

Question 47Virtual Networking⚑ Flag

VM1 has an NSG on its network interface, and its subnet has a different NSG. You need to view the combined set of rules, including default rules, that applies to the VM1 network interface. What should you use?

AIP flow verify in Network Watcher BVirtual network flow logs in Network Watcher CNext hop in Network Watcher DEffective security rules for the NIC

Correct answer: D. Effective security rules for the NIC
Effective security rules show the merged inbound and outbound rules from both the subnet NSG and the NIC NSG, including default rules. IP flow verify only tests one specific packet and reports the single rule that allowed or denied it.

Question 48Identities & Governance⚑ Flag

You need a list of virtual machines across your subscriptions that have low CPU usage, along with suggestions to resize or shut them down to reduce spend. Which service should you use?

AAzure Policy compliance BMicrosoft Defender for Cloud CAzure Service Health DAzure Advisor

Correct answer: D. Azure Advisor
Azure Advisor analyzes usage and gives cost recommendations, such as resizing or shutting down underused virtual machines. Defender for Cloud focuses on security posture and threat protection, not cost. Service Health reports Azure platform incidents and planned maintenance.

Question 49Compute⚑ Flag

You need to map the root domain contoso.com to an App Service web app named app-contoso. The domain is hosted by a third-party DNS provider that does not support ALIAS records. Which DNS records should you create?

AAn NS record for @ that delegates to app-contoso.azurewebsites.net BAn A record for @ with the app IP and a TXT record for asuid CA TXT record for @ that contains only the app's default host name DA CNAME record for @ that points to app-contoso.azurewebsites.net

Correct answer: B. An A record for @ with the app IP and a TXT record for asuid
DNS does not allow a CNAME at the root of a zone, so an apex domain uses an A record to the app's inbound IP address plus a TXT record named asuid that holds the domain verification ID. A CNAME works for subdomains such as www but not for the root domain.

Question 50Monitor & Maintain⚑ Flag

You replicate Azure VMs to a secondary region by using Azure Site Recovery. You need to validate the disaster recovery plan without affecting production workloads or ongoing replication. What should you do?

ADisable replication and start the VMs in the target BRun a failover and cancel it before it completes CRun a test failover to an isolated virtual network DRun a failover to the target region and commit it

Correct answer: C. Run a test failover to an isolated virtual network
A test failover creates VMs from a recovery point in a network you choose, while replication keeps running and production is untouched. A real failover moves the workload to the secondary region and needs a reprotect afterward, which is the impact the drill must avoid.