View Full Microsoft AZ-104 Exam Dumps and Practice Test Dumps.

 

Question 81

You need to allow an Azure virtual machine to communicate with another VM in the same virtual network. Which component provides the private network interface for the VM?

1. Network Interface
2. Public IP Address
3. Azure Load Balancer
4. Route Table

Correct Answer: 1

Explanation

A Network Interface (NIC) connects an Azure virtual machine to a virtual network. It provides the VM with a private IP address and allows network communication through configured subnets, network security groups, and routing. A public IP is used for internet-facing connectivity, while a route table controls traffic paths. An Azure Load Balancer distributes traffic between resources but does not directly provide the VM’s network interface. Therefore, the Network Interface is the correct component for connecting the VM to the virtual network.

Question 82

You need to create a secure connection between an Azure virtual network and an on-premises network over the public internet. Which Azure service should you use?

1. Azure ExpressRoute
2. Azure VPN Gateway
3. Azure Traffic Manager
4. Azure Front Door

Correct Answer: 2

Explanation

Azure VPN Gateway provides encrypted connections between Azure virtual networks and on-premises networks over the public internet. It commonly uses IPsec or IKE-based VPN connections to secure traffic. ExpressRoute also connects on-premises infrastructure to Azure, but it uses a private dedicated connection rather than the public internet. Traffic Manager is a DNS-based traffic distribution service, while Front Door provides global application delivery. Therefore, Azure VPN Gateway is the appropriate choice for an encrypted site-to-site connection over the internet.

Question 83

You want to restrict inbound traffic to a subnet based on source IP address, destination port, and protocol. Which Azure feature should you configure?

1. Azure Firewall
2. Network Security Group
3. Azure Traffic Manager
4. Route Table

Correct Answer: 2

Explanation

A Network Security Group (NSG) allows you to control inbound and outbound network traffic using security rules. Rules can specify source and destination addresses, ports, protocols, and traffic direction. NSGs can be associated with subnets or network interfaces to control access to virtual machines and other resources. Azure Firewall provides broader centralized network security capabilities, while a route table controls routing rather than access. Traffic Manager distributes application traffic. Therefore, an NSG is the appropriate solution for controlling traffic using these specific conditions.

Question 84

You need to provide a VM with a stable private IP address that should not change when the VM is restarted. What should you configure?

1. Dynamic private IP
2. Static private IP
3. Dynamic public IP
4. Azure DNS

Correct Answer: 2

Explanation

A static private IP address remains assigned to a network interface until it is manually changed or the configuration is removed. This is useful when applications or services depend on a consistent internal IP address. Dynamic private IP addresses are assigned automatically and can change when a resource is stopped or deallocated. Public IP settings control internet-facing connectivity and do not provide a stable private address. Azure DNS resolves names to addresses but does not determine the VM’s private IP assignment. Therefore, a static private IP is the correct choice.

Question 85

Which Azure service provides centralized monitoring of metrics and logs from Azure resources and applications?

1. Azure Monitor
2. Azure Policy
3. Azure Advisor
4. Azure Resource Manager

Correct Answer: 1

Explanation

Azure Monitor is Microsoft’s monitoring service for collecting and analyzing telemetry from Azure resources, applications, and other environments. It can collect metrics, logs, activity data, and diagnostic information to help identify performance problems and operational issues. Azure Policy is used to enforce organizational rules, while Azure Advisor provides recommendations for reliability, security, performance, and cost. Azure Resource Manager provides the management layer for deploying and organizing resources. Therefore, Azure Monitor is the correct service for centralized monitoring and telemetry analysis.

Question 86

You need to automatically apply a tag to resources when they are created according to organizational requirements. Which Azure service should you use?

1. Azure Monitor
2. Azure Policy
3. Azure Advisor
4. Azure Backup

Correct Answer: 2

Explanation

Azure Policy allows organizations to enforce rules and standards across Azure resources. Policies can require specific tags, deny resource deployments that do not meet requirements, or automatically modify resource configurations when supported through policy effects. This helps maintain consistent governance across subscriptions and resource groups. Azure Monitor focuses on monitoring, Advisor provides recommendations, and Backup protects data and workloads. Therefore, Azure Policy is the correct service for enforcing organizational tagging requirements and other resource governance rules.

Question 87

A company wants to protect a storage account from accidental deletion of blobs. Which feature should you enable?

1. Blob Soft Delete
2. Azure Firewall
3. Network Watcher
4. Azure Advisor

Correct Answer: 1

Explanation

Blob Soft Delete protects blobs from accidental deletion or overwrite by retaining deleted or overwritten data for a configured retention period. During that period, the data can be restored if necessary. This provides an additional layer of protection for important storage data. Azure Firewall provides network security, Network Watcher provides network monitoring and diagnostics, and Azure Advisor provides recommendations. Therefore, Blob Soft Delete is the appropriate feature when the primary concern is recovering accidentally deleted or overwritten blobs.

Question 88

You need to transfer large amounts of data to Azure Storage using a physical device because the network connection is too slow. Which Azure service should you use?

1. Azure Data Box
2. Azure File Sync
3. Azure Storage Explorer
4. Azure Backup

Correct Answer: 1

Explanation

Azure Data Box is designed for transferring large amounts of data to and from Azure using physical devices. Microsoft ships a secure Data Box device to the customer, who copies the data onto it and returns the device for upload into Azure. This approach is useful when transferring data over the network would take too long or consume significant bandwidth. Azure File Sync synchronizes file shares, Storage Explorer manages storage resources, and Azure Backup provides data protection. Therefore, Azure Data Box is the correct solution.

Question 89

You need to provide shared file storage that can be accessed by multiple Azure virtual machines using the SMB protocol. Which service should you use?

1. Azure Blob Storage
2. Azure Files
3. Azure Queue Storage
4. Azure Table Storage

Correct Answer: 2

Explanation

Azure Files provides managed cloud file shares that can be accessed by multiple virtual machines and applications. Azure Files supports common file-sharing protocols such as SMB, making it suitable for shared directories and applications that require a traditional file system. Blob Storage is optimized for object data, Queue Storage is designed for message storage, and Table Storage provides NoSQL key-value storage. Therefore, Azure Files is the appropriate service when multiple Azure VMs need access to the same shared files through SMB.

Question 90

You need to organize Azure resources according to departments such as Finance, HR, and Sales. Which feature should you use?

1. Tags
2. Availability Sets
3. Network Security Groups
4. Private Endpoints

Correct Answer: 1

Explanation

Azure tags are name-value pairs that can be assigned to resources to categorize and organize them. For example, an organization can use a Department tag with values such as Finance, HR, and Sales. Tags can also help with cost reporting, resource management, and governance. Availability Sets improve VM availability, Network Security Groups control network traffic, and Private Endpoints provide private connectivity to supported services. Therefore, tags are the most appropriate feature for categorizing resources based on organizational departments.

Question 91

You need to ensure that a critical Azure resource cannot be accidentally deleted by administrators. Which feature should you configure?

1. Azure Policy
2. Resource Lock
3. Azure Advisor
4. Azure Monitor

Correct Answer: 2

Explanation

Azure Resource Locks protect resources from accidental modification or deletion. A Delete lock prevents users from deleting the resource while still allowing permitted operations. A ReadOnly lock prevents changes as well as deletion. Resource locks can be applied at different scopes, including subscriptions, resource groups, and individual resources. Azure Policy enforces organizational rules but is not specifically designed as a deletion safeguard. Therefore, a Resource Lock is the correct feature for preventing accidental deletion of critical resources.

Question 92

You need to create a private connection from a virtual network to an Azure Storage account without sending traffic over the public internet. Which feature should you use?

1. Public IP address
2. Private Endpoint
3. Azure Traffic Manager
4. Network Watcher

Correct Answer: 2

Explanation

An Azure Private Endpoint provides a private IP address from a virtual network for accessing supported Azure services such as Storage accounts. Traffic between the virtual network and the service can remain on the Microsoft Azure network instead of using a publicly accessible endpoint. This improves security and helps reduce exposure to the public internet. A public IP address provides internet-facing connectivity, Traffic Manager distributes traffic using DNS, and Network Watcher provides network diagnostics. Therefore, Private Endpoint is the correct choice.

Question 93

You need to automatically increase or decrease the number of VM instances based on application demand. Which Azure service should you use?

1. Virtual Machine Scale Sets
2. Azure DNS
3. Azure Files
4. Azure Bastion

Correct Answer: 1

Explanation

Azure Virtual Machine Scale Sets allow you to deploy and manage a group of load-balanced virtual machines. Scale sets support automatic scaling based on metrics such as CPU utilization and application demand. This allows the number of VM instances to increase during busy periods and decrease when demand falls. Azure DNS manages name resolution, Azure Files provides managed file shares, and Azure Bastion provides secure browser-based access to VMs. Therefore, Virtual Machine Scale Sets are the appropriate solution for automatic VM scaling.

Question 94

You want administrators to connect to Azure virtual machines through the Azure portal without assigning public IP addresses to the VMs. Which service should you use?

1. Azure Bastion
2. Azure Load Balancer
3. Azure DNS
4. Azure Front Door

Correct Answer: 1

Explanation

Azure Bastion provides secure Remote Desktop Protocol and Secure Shell connectivity to virtual machines directly through the Azure portal. VMs do not require public IP addresses because Bastion provides the secure access path through the virtual network. This reduces exposure of management ports such as RDP and SSH to the public internet. Azure Load Balancer distributes network traffic, Azure DNS provides name resolution, and Front Door provides global application delivery. Therefore, Azure Bastion is the correct service for secure portal-based VM administration.

Question 95

You need to assign a user permission to manage resources but prevent the user from assigning roles to other users. Which Azure RBAC role is most appropriate?

1. Owner
2. Contributor
3. Reader
4. Global Administrator

Correct Answer: 2

Explanation

The Contributor role allows a user to create, manage, and delete Azure resources but does not allow the user to assign Azure RBAC roles to other users. The Owner role includes full management access and permission to assign roles. Reader provides read-only access and cannot make resource changes. Global Administrator is a Microsoft Entra role and is not the standard Azure resource management role for this requirement. Therefore, Contributor provides the required resource management permissions without role-assignment privileges.

Question 96

You need to give a user read-only access to all resources within a resource group. Which role should you assign?

1. Owner
2. Contributor
3. Reader
4. User Access Administrator

Correct Answer: 3

Explanation

The Reader role allows users to view Azure resources and their configurations without making changes. When assigned at the resource group scope, the user can view resources within that resource group while retaining read-only permissions. Owner provides full management and role-assignment capabilities, while Contributor allows resource modifications. User Access Administrator is primarily used to manage access permissions rather than provide general read-only resource visibility. Therefore, the Reader role is the correct choice for users who only need to view resources.

Question 97

You need to identify recommendations that can improve the reliability, security, performance, and cost efficiency of Azure resources. Which service should you use?

1. Azure Advisor
2. Azure Monitor
3. Azure Policy
4. Azure DNS

Correct Answer: 1

Explanation

Azure Advisor analyzes Azure resources and provides personalized recommendations across areas such as cost optimization, reliability, performance, and security. These recommendations help administrators identify opportunities to improve workloads and reduce unnecessary spending. Azure Monitor focuses on telemetry, logs, and metrics, while Azure Policy enforces organizational standards. Azure DNS manages domain name resolution. Therefore, Azure Advisor is the correct service when the goal is to receive recommendations for improving Azure resource configurations and efficiency.

Question 98

You need to estimate the monthly cost of a planned Azure deployment before creating the resources. Which tool should you use?

1. Azure Pricing Calculator
2. Azure Monitor
3. Azure Service Health
4. Azure Resource Graph

Correct Answer: 1

Explanation

The Azure Pricing Calculator helps estimate the expected cost of Azure services before deployment. You can select services such as virtual machines, storage, databases, and networking components, then configure their expected usage to calculate an estimated monthly cost. Azure Monitor is used for monitoring resources, Service Health provides information about Azure service issues, and Resource Graph helps query resource information. Therefore, the Azure Pricing Calculator is the appropriate tool for estimating the cost of a planned Azure solution.

Question 99

You want to receive an alert when Azure spending reaches a predefined monthly amount. Which feature should you configure?

1. Azure Cost Management Budget
2. Azure Resource Lock
3. Azure Availability Set
4. Azure Network Watcher

Correct Answer: 1

Explanation

Azure Cost Management budgets allow organizations to define spending thresholds and monitor costs against planned amounts. Notifications can be configured when actual or forecasted spending reaches specified percentages of the budget. This helps administrators detect unexpected spending and take corrective action before costs become excessive. Resource Locks protect resources, Availability Sets improve VM availability, and Network Watcher provides network monitoring capabilities. Therefore, an Azure Cost Management budget is the correct feature for monitoring spending against a predefined amount.

Question 100

You need to execute Azure CLI commands directly from a web browser without installing Azure CLI on your local computer. Which Azure feature should you use?

1. Azure Cloud Shell
2. Azure Portal Dashboard
3. Azure Advisor
4. Azure Service Health

Correct Answer: 1

Explanation

Azure Cloud Shell provides a browser-accessible command-line environment for managing Azure resources. It supports Azure CLI and PowerShell and is integrated with the Azure portal. Because Cloud Shell runs in Microsoft’s managed environment, users do not need to install the Azure CLI locally. Azure Portal Dashboard provides a graphical management interface, Advisor provides recommendations, and Service Health reports service-related information. Therefore, Azure Cloud Shell is the correct choice when you need to execute Azure CLI commands directly from a web browser.