AZ-104 Questions 51-60: Identity, Governance, Storage, and Networking Review

0
0

Focus keyphrase: AZ-104 practice questions

Use these AZ-104 practice questions to review mixed Microsoft Azure Administrator scenarios across identity, governance, storage, virtual networking, and operational controls. This batch is designed as a realistic exam-readiness set after the core objective-domain runs.

These are original certification-style questions based on public Microsoft exam objectives and official Azure documentation. They are exam-like in wording and difficulty, but they are not copied, paraphrased, or reconstructed from real exam-dump content.

AZ-104Questions 51-60Mixed ReviewAzure Administrator
Where this fits in the series: This post continues the AZ-104 sequence after AZ-104 Questions 41-50: Azure Monitor, Backup, and Recovery. Questions 51-60 are a mixed review set that forces you to choose between similar-looking Azure administration tools instead of staying inside one obvious domain.

AZ-104 Questions 51-60: Identity, Governance, Storage, and Networking mixed review

For each item, choose the best answer unless the question explicitly says otherwise. Expect the exam to blend requirements: least privilege plus locks, private access plus DNS, storage protection plus lifecycle, or monitoring plus governance. That is where easy-looking AZ-104 questions get teeth.

Identity lens: RBAC controls Azure resource actions; Microsoft Entra roles control directory tasks.
Governance lens: Azure Policy evaluates compliance; resource locks prevent deletion or modification at the control plane.
Networking lens: Service endpoints, private endpoints, NSGs, and routes solve different traffic-control problems. Do not mix the labels just because they sound secure.
Exam tip: When two answers both sound protective, ask what layer is being protected: identity authorization, resource management operations, data-plane access, network path, or backup recovery. AZ-104 loves making those boundaries look blurry. Rude? Yes. Fair game? Also yes.
Domain: Manage Azure identities and governance — configure Azure RBAC

Question 51: Granting VM restart rights without broad resource access

Scenario: A help desk group must be able to restart virtual machines in a production resource group. The group must not create, delete, resize, or change networking for the VMs. You need to follow least privilege and use a built-in role if possible.

Choose one answer.

  1. Assign the Owner role at the subscription scope
  2. Assign the Virtual Machine Contributor role at the resource group scope
  3. Assign the Virtual Machine User Login role at the resource group scope
  4. Create a custom Azure RBAC role that allows only the Microsoft.Compute/virtualMachines/restart/action operation and assign it at the resource group scope

Correct answer: D — Create a custom Azure RBAC role that allows only the restart action and assign it at the resource group scope

Explanation: The requirement is narrower than common built-in roles. Azure RBAC supports custom roles when built-in roles grant too much permission. A custom role scoped to the production resource group can allow the VM restart action without granting create, delete, resize, or network modification rights.

Why the other options are wrong

  • A. Owner is far beyond least privilege and includes permission to manage access.
  • B. Virtual Machine Contributor can manage virtual machines and therefore grants more than restart-only access.
  • C. Virtual Machine User Login lets users sign in to VMs through supported login paths. It does not grant Azure management-plane restart permissions.

Official reference: Azure RBAC overview and Azure custom roles

Domain: Manage Azure identities and governance — protect resources with locks

Question 52: Preventing accidental deletion of a production resource group

Scenario: A production resource group contains several critical storage accounts and virtual networks. Administrators still need to update tags and change configuration settings, but nobody should be able to accidentally delete the resource group or its resources through Azure Resource Manager.

Choose one answer.

  1. Apply a CanNotDelete management lock to the production resource group
  2. Apply a ReadOnly management lock to the production resource group
  3. Create an Azure Policy assignment with the Audit effect for missing tags
  4. Enable blob soft delete on each storage account only

Correct answer: A — Apply a CanNotDelete management lock to the production resource group

Explanation: A CanNotDelete lock allows authorized users to read and modify resources but prevents deletion. Applying the lock at the resource group scope protects child resources from deletion through the management plane while still allowing permitted updates.

Why the other options are wrong

  • B. A ReadOnly lock is stricter: it prevents updates as well as deletion, which conflicts with the requirement to change settings.
  • C. An Audit policy reports noncompliance; it does not block deletion.
  • D. Blob soft delete protects blob data from certain deletion scenarios, but it does not prevent deletion of the resource group or non-storage resources.

Official reference: Lock your Azure resources

Domain: Manage Azure identities and governance — enforce standards with Azure Policy

Question 53: Automatically adding a cost center tag to new resources

Scenario: Finance requires every resource in a subscription to have a CostCenter tag. If a resource is created without the tag, Azure should add a default CostCenter value during deployment. Existing resources should later be remediated where possible.

Choose one answer.

  1. Create an Azure Policy definition that uses the Modify effect, assign it at the subscription scope, and create a remediation task for existing resources
  2. Create a resource group-level CanNotDelete lock
  3. Assign the Billing Reader role to all developers
  4. Create an Activity Log alert for the Microsoft.Resources/subscriptions/resourceGroups/write operation

Correct answer: A — Use an Azure Policy Modify effect with a remediation task

Explanation: Azure Policy can evaluate resources during create or update operations. The Modify effect can add or update properties such as tags when the request is processed, and remediation tasks can bring supported existing resources into compliance.

Why the other options are wrong

  • B. A lock protects against deletion or changes; it does not add required metadata.
  • C. Billing Reader grants cost visibility. It does not enforce tags.
  • D. Activity Log alerts can notify on management events, but they do not modify deployments or remediate existing resources.

Official reference: Azure Policy overview and Azure Policy Modify effect

Domain: Implement and manage storage — protect blob data from overwrite and deletion

Question 54: Recovering blobs after accidental overwrite

Scenario: A storage account hosts application-generated reports in Blob Storage. Operators sometimes overwrite reports by mistake and need to restore previous versions of individual blobs. The solution should support recovery from accidental overwrite and deletion without restoring the entire storage account.

Choose one answer.

  1. Enable blob versioning and blob soft delete on the storage account
  2. Enable only infrastructure encryption on the storage account
  3. Change the storage account replication type from LRS to ZRS
  4. Create a private endpoint for the blob service

Correct answer: A — Enable blob versioning and blob soft delete

Explanation: Blob versioning keeps previous versions when blobs are modified or overwritten. Blob soft delete helps recover deleted blobs within the configured retention period. Together, they address accidental overwrite and deletion at the object level.

Why the other options are wrong

  • B. Infrastructure encryption changes encryption behavior; it does not keep recoverable object versions.
  • C. Zone-redundant storage improves availability across zones, but replication is not a substitute for object-level version recovery.
  • D. A private endpoint controls network access to the storage account. It does not provide version history.

Official reference: Blob versioning and Soft delete for blobs

Domain: Implement and manage storage — control storage network access

Question 55: Allowing storage access only from a specific virtual network

Scenario: An application subnet must access an Azure Storage account over the Azure backbone. Public internet clients should be blocked. The application does not require a private IP address for the storage account, and the team wants a simple configuration tied to the subnet.

Choose one answer.

  1. Enable a service endpoint for Microsoft.Storage on the subnet and restrict the storage account firewall to that virtual network/subnet
  2. Create a public IP prefix and associate it with the storage account
  3. Assign the Reader role to the application subnet
  4. Create an Azure DNS private zone only, without changing the storage account firewall

Correct answer: A — Use a Microsoft.Storage service endpoint and storage firewall virtual network rule

Explanation: Service endpoints extend virtual network identity to supported Azure services. For Storage, enabling the Microsoft.Storage service endpoint on the subnet and adding a virtual network rule to the storage firewall allows access from that subnet while denying other public network traffic if the firewall is configured accordingly.

Why the other options are wrong

  • B. A public IP prefix reserves public IP ranges; it does not restrict Storage access by subnet.
  • C. RBAC permissions do not make a subnet a network source, and Reader is not a data access role for blobs.
  • D. DNS alone does not enforce access. The storage firewall or private endpoint configuration must actually control traffic.

Official reference: Configure Azure Storage firewalls and virtual networks and Virtual network service endpoints

Domain: Deploy and manage Azure compute resources — use managed identities

Question 56: Letting a VM read secrets without storing credentials

Scenario: A custom application running on an Azure VM needs to read secrets from Azure Key Vault. The security team does not want client secrets, certificates, or passwords stored on the VM. Access should be revocable through Azure permissions.

Choose one answer.

  1. Create a managed identity for the VM and grant it the required Key Vault permissions
  2. Store an app registration client secret in a local configuration file on the VM
  3. Enable boot diagnostics and place the secret in the serial console log
  4. Create a proximity placement group for the VM and Key Vault

Correct answer: A — Create a managed identity for the VM and grant Key Vault access

Explanation: Managed identities provide Azure-hosted resources with an identity in Microsoft Entra ID. The application can request tokens without storing credentials, and administrators can grant or revoke access to Key Vault through role assignments or vault access controls depending on the Key Vault permission model.

Why the other options are wrong

  • B. A stored client secret is exactly what the requirement is trying to avoid.
  • C. Boot diagnostics is for VM troubleshooting and would be an unsafe place for secrets.
  • D. Proximity placement groups affect compute placement latency. They do not create identity or authorization.

Official reference: Managed identities for Azure resources and Azure RBAC for Key Vault

Domain: Configure and manage virtual networking — secure PaaS access with Private Link

Question 57: Reaching Azure SQL Database through a private IP address

Scenario: A web application in a virtual network must connect to Azure SQL Database without sending traffic to the public endpoint. The database should be reachable through a private IP address in the virtual network, and name resolution should continue to use the normal Azure SQL hostname.

Choose one answer.

  1. Create a private endpoint for the Azure SQL server and configure the appropriate private DNS zone integration
  2. Create a service tag named Sql.Private and add it to an NSG rule
  3. Create a NAT gateway on the application subnet
  4. Enable IP forwarding on the web application NIC

Correct answer: A — Create a private endpoint and configure private DNS

Explanation: Azure Private Link exposes supported PaaS services through private endpoints in a virtual network. Private DNS integration maps the service hostname to the private endpoint address, so clients can use the normal service FQDN while traffic stays on the private path.

Why the other options are wrong

  • B. Service tags simplify NSG rules for Azure service IP ranges, but they do not give Azure SQL a private IP in your subnet.
  • C. NAT Gateway controls outbound internet SNAT for a subnet. It does not create private access to Azure SQL.
  • D. IP forwarding is used for network virtual appliances and routing scenarios, not PaaS private connectivity.

Official reference: Azure private endpoint overview and Azure private endpoint DNS configuration

Domain: Configure and manage virtual networking — use service tags in NSG rules

Question 58: Allowing outbound access to Azure Monitor without tracking IP ranges

Scenario: A locked-down subnet uses a network security group that denies most outbound traffic. Azure Monitor Agent on VMs in the subnet must reach Azure Monitor endpoints. The network team wants to avoid manually maintaining changing IP address ranges.

Choose one answer.

  1. Create an outbound NSG rule that allows the appropriate Azure Monitor service tag to the required destination ports
  2. Create a route table that sends all traffic to Internet as the next hop
  3. Disable the NSG on the subnet and rely only on VM Windows Firewall
  4. Add the VM private IP addresses to the Azure Monitor workspace access list

Correct answer: A — Use an Azure Monitor service tag in the outbound NSG rule

Explanation: Service tags represent groups of IP address prefixes for Azure services and are maintained by Microsoft. In supported NSG rules, they reduce the operational burden of tracking IP range changes for services such as Azure Monitor.

Why the other options are wrong

  • B. A broad internet route does not provide a least-privilege NSG allowance and may not even be valid for the desired forced-tunneling design.
  • C. Removing the subnet NSG weakens network controls instead of making a precise exception.
  • D. Log Analytics workspaces do not use a simple VM private-IP allow list to authorize Azure Monitor Agent traffic.

Official reference: Azure service tags overview and Network security groups

Domain: Monitor and maintain Azure resources — choose the right alert source

Question 59: Alerting when policy compliance drops

Scenario: An operations team has assigned an Azure Policy initiative that audits required security configuration. They want a recurring operational view of noncompliant resources and a way to trigger review when compliance state changes significantly. The solution should be based on policy compliance data rather than VM guest logs.

Choose one answer.

  1. Use Azure Policy compliance results and create reporting or alerting around policy states, such as querying policy resources with Azure Resource Graph or using policy compliance events
  2. Install IIS logging on every VM and search for HTTP 404 responses
  3. Create a CPU metric alert on every VM in the subscription
  4. Enable Azure Backup soft delete on all Recovery Services vaults

Correct answer: A — Use Azure Policy compliance data as the signal

Explanation: The requirement is about compliance state from Azure Policy. Azure Policy tracks compliant and noncompliant resources, and administrators can report on those states or build alerting workflows around policy events and compliance queries. Guest logs or infrastructure metrics are the wrong signal.

Why the other options are wrong

  • B. Web server logs do not represent Azure Policy compliance.
  • C. CPU metrics show workload performance, not governance compliance.
  • D. Backup soft delete protects backup data. It does not monitor policy initiative compliance.

Official reference: Get Azure Policy compliance data and Azure Policy overview

Domain: Implement and manage storage — choose redundancy for zone-level resiliency

Question 60: Keeping storage available during a zone outage

Scenario: A workload stores files in an Azure Storage account in a region that supports availability zones. The business requirement is to keep data synchronously replicated across multiple availability zones in the primary region. Cross-region replication is not required for this workload.

Choose one answer.

  1. Use locally redundant storage (LRS)
  2. Use zone-redundant storage (ZRS)
  3. Use read-access geo-redundant storage (RA-GRS)
  4. Use a management lock on the storage account

Correct answer: B — Use zone-redundant storage (ZRS)

Explanation: Zone-redundant storage synchronously replicates data across availability zones in the primary region. That matches the requirement for zone-level resiliency without cross-region replication.

Why the other options are wrong

  • A. LRS keeps multiple copies within a single datacenter in the primary region. It does not provide zone-level resiliency.
  • C. RA-GRS provides geo-replication with read access to the secondary region, which is more than the stated requirement and is not specifically the zone-synchronous option.
  • D. A management lock can protect against deletion or modification, but it has no effect on storage replication architecture.

Official reference: Azure Storage redundancy

Answer key: AZ-104 Questions 51-60

Question Correct answer Objective focus
51 D Azure RBAC and least privilege
52 A Management locks
53 A Azure Policy Modify and remediation
54 A Blob versioning and soft delete
55 A Storage firewall and service endpoints
56 A Managed identities and Key Vault access
57 A Private endpoints and private DNS
58 A NSG rules and service tags
59 A Azure Policy compliance data
60 B Storage redundancy
Quick review: If you missed several questions, revisit the boundary between Azure RBAC, Azure Policy, resource locks, and network controls. They often appear together in real admin work, but they solve different exam requirements.

Sources

📚 More questions from: AZ-104: Azure Administrator

Related QuestionMORE FROM AUTHOR