Microsoft
1
/
41
Microsoft AZ-104 Flashcards 2026
Tap to flip
Terms in this set (41)
What Azure storage service is recommended for providing persistent storage to a Docker container running a Microsoft SQL Server instance?
Azure Files.
To use a unique encryption key for a specific blob container, separate from the storage account's key, you must first create an _____.
encryption scope
If an Azure backup policy has conflicting retention periods, such as a yearly retention of 10 years and a monthly retention of 36 months, which period is applied?
The longest retention period is applied, which is 10 years.
When an Azure web app is moved to a new resource group in a different region, what happens to the location of its associated App Service plan?
The App Service plan remains in its original region.
Does assigning the 'Storage Account Contributor' role to a user grant them permission to list and regenerate storage account keys?
No, this role does not include the `Microsoft.Storage/storageAccounts/listkeys/action` permission.
An administrator receives a 'Generic authorization exception' when trying to invite an external user to Azure AD. Which settings area should be checked to resolve this?
The 'External collaboration settings' under the Users settings blade.
A user with the 'Contributor' role at the subscription level can perform what action on a virtual machine within that subscription?
They have full access to manage all resources, including resizing a virtual machine.
Can a user with only the 'Reader' role on a resource group create a new storage account within it?
No, the Reader role grants read-only access and does not permit resource creation.
What is the smallest subnet size, represented by a CIDR mask, that can be used for an Azure container app environment?
A /28 subnet mask, which provides 16 IP addresses.
An Azure container app environment can only be connected to a virtual network that is located in the _____ Azure region as the environment itself.
same
Which PowerShell cmdlet is used to deploy an Azure Resource Manager (ARM) template to a specific resource group?
`New-AzResourceGroupDeployment`
In an Azure Kubernetes Service (AKS) cluster configured with Azure CNI, containers receive their IP addresses from the ____.
virtual network subnet CIDR
Services within an Azure Kubernetes Service (AKS) cluster are assigned IP addresses from the range defined by the ____.
service CIDR
In an Azure blob lifecycle management rule, what property is used to target blobs based on the number of days since they were last modified?
`daysAfterModificationGreaterThan`
An Azure Policy can be assigned to what four scopes in the management hierarchy?
Tenant Root Group, Management Group, Subscription, and Resource Group.
To create an Azure Monitor alert that sends an email when a resource lock is removed, what three components must be configured?
A resource (the scope), a condition (the activity log signal), and an action group (the notification).
For a VM data disk requiring the lowest latency and highest performance, which Azure managed disk type is the best choice?
Premium SSD.
To ensure a VM's data disk is resilient to a datacenter-level outage, which storage redundancy option should be selected?
Zone-redundant storage (ZRS).
If a VM is restored from a backup using the 'Replace existing' option, what happens to files created on its disks after the backup was taken?
They are lost, as the existing disks are overwritten with the state from the backup.
To grant developers the ability to deploy content to an Azure App Service web app using their Azure AD credentials, which role should be assigned following the principle of least privilege?
The 'Website Contributor' role.
To immediately move an Azure VM to a different host server due to planned maintenance, what action should be taken from the VM's portal blade?
Select 'Redeploy' from the 'Redeploy + reapply' blade.
Does assigning the 'Storage Account Key Operator Service Role' to a user allow them to list and regenerate that storage account's keys?
Yes, this role is specifically designed for that purpose.
To recover a VM to a previous point in time with minimal downtime for the existing VM, which restore configuration option should be used?
The 'Create new' restore configuration option, which creates a separate restored VM.
An existing NSG rule with priority 65000 denies traffic. To allow specific traffic, a new rule must be created with a _____ priority number.
lower (e.g., 100-4096)
For which types of Azure storage accounts are lifecycle management policies supported?
General-purpose v2, premium block blob, and Blob Storage accounts.
The Archive access tier for blobs is NOT supported for storage accounts using which redundancy options?
ZRS (Zone-redundant storage), GZRS, or RA-GZRS.
What is the first step required to connect two VNets that exist in separate subscriptions associated with different Azure AD tenants?
Provision virtual network gateways in each VNet to facilitate a VNet-to-VNet VPN connection.
To enable VMs across multiple VNets to resolve DNS names using a central DNS server located in one of the VNets, what networking configuration is required?
Virtual network peering between all the involved VNets.
Does moving an Azure VM to a different subscription also move it to a different physical host?
No, it is a change in billing and management scope, not a physical migration.
How can you automate the enforcement of a security rule, such as blocking a specific port, on all newly created Network Security Groups (NSGs) within a subscription?
By creating a custom Azure Policy definition and assigning it at the subscription scope.
Is VNet peering transitive, meaning if VNetA is peered with VNetB, and VNetB is peered with VNetC, can VNetA communicate with VNetC by default?
No, VNet peering is not transitive; a direct peering link must be established between VNetA and VNetC.
An inbound security rule must be configured in an NSG to allow internet traffic to an Azure Bastion host. What is the required destination port?
TCP port 443.
What is a primary method for ensuring traffic between two Azure VNets in the same region travels over the Microsoft backbone network?
Virtual Network (VNet) peering.
What is the quickest way to revert a deployment after swapping an App Service staging slot to production causes performance issues?
Swap the slots again to move the previous production code back into the production slot.
To restrict access to an Azure Storage account to only your corporate network and specific VNets, which setting should be configured first?
The 'Public network access' setting on the storage account's networking blade.
If an App Service Plan consistently shows high CPU utilization, the recommended action to improve performance by handling more load is to _____.
scale out (add more instances)
How can VMs in a highly restrictive VNet, with all outbound internet traffic blocked by an NSG, be granted access to an Azure Key Vault?
Create an outbound NSG rule allowing traffic to the 'AzureKeyVault' service tag.
What is the effect of an Azure Monitor alert processing rule configured with the 'Suppress notifications' action?
It prevents the alert's associated action groups from being triggered, effectively silencing notifications.
If an alert processing rule is set to suppress notifications for a specific time window, will an alert that fires after the window ends send a notification?
Yes, notifications will be sent as normal once the suppression window is over.
What is the function of the User Access Administrator role in Azure?
To manage user access to Azure resources, which includes the ability to assign roles to other principals.
Can a user with the Virtual Machine Contributor role assign access permissions for that VM to another user?
No, this role allows for managing the VM itself but not its access control (IAM) settings.