View Full Microsoft AZ-104 Exam Dumps and Practice Test Dumps.

 

Question 201

Which Azure service provides a centralized way to manage resources across multiple subscriptions?

1. Resource Groups
2. Management Groups
3. Availability Sets
4. Storage Accounts

Correct Answer: 2

Explanation

Management Groups allow administrators to organize multiple Azure subscriptions into a hierarchy. Policies and role-based access control can be applied at the management group level and inherited by subscriptions beneath them. This makes management groups useful for organizations with many subscriptions that need consistent governance, access control, and compliance settings. Resource groups organize resources within a subscription, while management groups operate at a higher level.

Question 202

Which Azure RBAC role allows a user to manage resources but does not allow them to assign roles to other users?

1. Owner
2. User Access Administrator
3. Contributor
4. Reader

Correct Answer: 3

Explanation

The Contributor role allows users to create, modify, and delete Azure resources, but it does not allow them to assign Azure RBAC roles to other users. The Owner role includes full resource management and permission to assign access. User Access Administrator primarily manages access permissions, while Reader provides read-only access. Therefore, Contributor is appropriate when users need to manage resources without managing permissions.

Question 203

Which Azure service can be used to store secrets, passwords, certificates, and encryption keys securely?

1. Azure Storage
2. Azure Key Vault
3. Azure Monitor
4. Azure Advisor

Correct Answer: 2

Explanation

Azure Key Vault is designed to securely store and manage sensitive information such as secrets, passwords, certificates, and cryptographic keys. Applications and Azure services can retrieve these values without storing sensitive information directly in application code or configuration files. Access can be controlled using Microsoft Entra ID and Azure RBAC. Azure Storage is intended for data storage, while Monitor and Advisor provide monitoring and recommendations.

Question 204

Which Azure feature allows a virtual machine to use an automatically managed identity to access Azure resources securely?

1. Managed Identity
2. Resource Lock
3. Azure Policy
4. Availability Set

Correct Answer: 1

Explanation

Managed identities allow Azure resources such as virtual machines to authenticate to supported Azure services without storing credentials in code or configuration files. Azure automatically manages the identity’s credentials. A virtual machine can use its managed identity to access resources such as Azure Key Vault or Storage when appropriate permissions are assigned. This improves security because administrators do not need to manually create and maintain application secrets.

Question 205

Which Azure storage redundancy option keeps three copies of data within a single Azure region across separate availability zones?

1. LRS
2. ZRS
3. GRS
4. RA-GRS

Correct Answer: 2

Explanation

Zone-Redundant Storage, or ZRS, synchronously replicates data across three Azure availability zones within the same region. This protects data from failures affecting an individual availability zone. Locally Redundant Storage keeps copies within a single datacenter or location, while GRS and RA-GRS provide replication to a secondary region. ZRS is useful when applications require higher availability within a single Azure region.

Question 206

Which Azure storage redundancy option replicates data asynchronously to a secondary Azure region?

1. LRS
2. ZRS
3. GRS
4. Premium SSD

Correct Answer: 3

Explanation

Geo-Redundant Storage, or GRS, replicates data from the primary Azure region to a secondary region. Replication to the secondary region is asynchronous. This provides protection against a regional outage. GRS is different from ZRS, which maintains copies across availability zones within the same region. Premium SSD is a disk performance option rather than a storage account redundancy configuration.

Question 207

Which Azure Storage access tier is most appropriate for data that is accessed frequently?

1. Archive
2. Cool
3. Hot
4. Offline

Correct Answer: 3

Explanation

The Hot access tier is designed for data that is accessed frequently. It generally provides lower access costs compared with less frequently accessed tiers, although storage costs can be higher. The Cool tier is intended for data accessed less frequently, while Archive is designed for rarely accessed long-term data with higher retrieval latency. Selecting the appropriate tier can help optimize Azure Storage costs.

Question 208

Which Azure Storage access tier is designed for long-term data that is rarely accessed?

1. Hot
2. Cool
3. Archive
4. Premium

Correct Answer: 3

Explanation

The Archive access tier is designed for data that is rarely accessed and needs to be retained for long periods. It offers lower storage costs but has higher data retrieval latency and additional retrieval considerations. Archive is useful for long-term backups, historical records, and compliance data. Hot storage is intended for frequently accessed data, while Cool is more appropriate for data accessed less frequently but still requiring relatively quick access.

Question 209

Which Azure service provides a managed DNS hosting service for domain names?

1. Azure DNS
2. Azure Bastion
3. Azure Firewall
4. Azure Load Balancer

Correct Answer: 1

Explanation

Azure DNS is a managed hosting service for DNS domains. It allows administrators to host DNS zones and manage DNS records using Azure infrastructure. Azure DNS uses the global Azure network and integrates with Azure resource management. Azure Private DNS can instead be used for private DNS zones within virtual networks. Bastion provides secure VM access, Firewall provides network security, and Load Balancer distributes network traffic.

Question 210

Which Azure service provides secure browser-based RDP and SSH access to virtual machines without requiring a public IP address on the VM?

1. Azure VPN Gateway
2. Azure Bastion
3. Azure Traffic Manager
4. Azure DNS

Correct Answer: 2

Explanation

Azure Bastion provides secure RDP and SSH connectivity to virtual machines through the Azure portal. Virtual machines do not need public IP addresses for this connection method. Bastion is deployed within an Azure virtual network and helps reduce exposure of management ports to the public internet. VPN Gateway is used for network connectivity, Traffic Manager manages DNS-based traffic routing, and Azure DNS provides DNS hosting.

Question 211

Which Azure networking service distributes incoming traffic across multiple virtual machines at the transport layer?

1. Azure Load Balancer
2. Azure Traffic Manager
3. Azure DNS
4. Azure Bastion

Correct Answer: 1

Explanation

Azure Load Balancer distributes incoming network traffic across multiple backend resources such as virtual machines. It operates at Layer 4 and supports TCP and UDP traffic. It can provide high availability by directing traffic only toward healthy backend instances. Traffic Manager works at the DNS level, while Azure DNS manages DNS records. Azure Bastion is designed for secure administrative access to virtual machines.

Question 212

Which Azure service uses DNS-based routing to direct users toward an appropriate application endpoint?

1. Azure Load Balancer
2. Azure Traffic Manager
3. Azure Firewall
4. Network Security Group

Correct Answer: 2

Explanation

Azure Traffic Manager is a DNS-based traffic routing service. It can direct users to different application endpoints according to routing methods such as performance, priority, weighted, or geographic routing. Traffic Manager does not directly carry application traffic; instead, DNS responses influence which endpoint clients use. Azure Load Balancer distributes traffic at the network level within supported Azure environments.

Question 213

Which Azure feature can prevent users from accidentally deleting an important resource?

1. Resource Lock
2. Azure Advisor
3. Azure Monitor
4. Azure DNS

Correct Answer: 1

Explanation

Azure Resource Locks help protect important resources from accidental changes or deletion. A CanNotDelete lock prevents deletion while still allowing authorized users to modify the resource. A ReadOnly lock prevents both modifications and deletion. Resource locks are useful for protecting production resources, storage accounts, and other critical infrastructure. They provide an additional protection layer beyond Azure RBAC permissions.

Question 214

Which Azure Policy effect can prevent the creation of resources that violate a defined policy?

1. Audit
2. Deny
3. Disabled
4. Append

Correct Answer: 2

Explanation

The Deny effect prevents resource operations that violate the policy definition. For example, an organization can use a Deny policy to prevent resources from being deployed outside approved Azure regions. Audit only records non-compliant resources without blocking deployment. Disabled turns off the policy, while Append can add specific properties during resource creation. Deny is therefore the appropriate effect when enforcement is required.

Question 215

Which Azure service provides recommendations for improving cost, security, reliability, and performance?

1. Azure Advisor
2. Azure DNS
3. Azure Bastion
4. Azure Storage Explorer

Correct Answer: 1

Explanation

Azure Advisor analyzes Azure deployments and provides personalized recommendations across areas such as cost, security, reliability, operational excellence, and performance. These recommendations can help administrators identify opportunities to optimize resources and improve their Azure environment. Advisor does not directly replace monitoring or governance services. Azure Monitor focuses on telemetry and alerts, while Azure Policy enforces organizational rules.

Question 216

Which Azure service allows administrators to analyze logs using a query language such as KQL?

1. Azure Load Balancer
2. Log Analytics Workspace
3. Azure Bastion
4. Azure DNS

Correct Answer: 2

Explanation

A Log Analytics workspace collects and stores supported monitoring and log data so administrators can analyze it using Kusto Query Language, or KQL. It is commonly used with Azure Monitor to investigate application and infrastructure activity, troubleshoot problems, and create analytical queries. Services such as Azure Load Balancer, Bastion, and DNS perform networking functions rather than providing a centralized log analysis environment.

Question 217

Which Azure service can collect metrics and logs from Azure resources and provide alerts when conditions are met?

1. Azure Monitor
2. Azure Policy
3. Azure Advisor
4. Azure Resource Manager

Correct Answer: 1

Explanation

Azure Monitor collects and analyzes telemetry such as metrics and logs from Azure resources and applications. Administrators can create alert rules that detect conditions such as high CPU usage, failed requests, or other monitored events. Alerts can trigger configured actions through action groups. Azure Policy focuses on governance and compliance, Advisor provides recommendations, and Resource Manager provides the management layer for Azure resources.

Question 218

Which Azure Monitor component defines who should be notified or what action should occur when an alert is triggered?

1. Action Group
2. Resource Group
3. Management Group
4. Availability Set

Correct Answer: 1

Explanation

An Action Group defines the actions Azure Monitor should perform when an alert is triggered. Actions can include sending email or SMS notifications, invoking automation, or integrating with supported notification and incident-management mechanisms. Alert rules determine the condition that triggers an alert, while the action group determines the response. Resource groups and management groups are organizational structures rather than alert response mechanisms.

Question 219

Which Azure service provides information about planned maintenance, service issues, and health advisories affecting Azure resources?

1. Azure Service Health
2. Azure Advisor
3. Azure Storage
4. Azure DNS

Correct Answer: 1

Explanation

Azure Service Health provides personalized information about Azure service incidents, planned maintenance, and health advisories that may affect resources or services. It helps administrators understand whether an Azure platform issue may impact their environment. Service Health differs from Azure Monitor, which primarily monitors resource and application telemetry. Organizations can also configure alerts to receive notifications about relevant service health events.

Question 220

Which Azure tool provides an interactive command-line environment directly from the Azure portal?

1. Azure Cloud Shell
2. Azure Advisor
3. Azure Resource Graph
4. Azure Service Health

Correct Answer: 1

Explanation

Azure Cloud Shell provides an interactive shell environment accessible directly through the Azure portal. It supports command-line tools such as Azure CLI and Azure PowerShell, allowing administrators to manage Azure resources without installing these tools locally. Cloud Shell is useful for running administrative commands, scripts, and resource-management operations from a browser. Azure Advisor, Resource Graph, and Service Health serve different management and monitoring purposes.