AZ-104 Questions 61-70: Mixed Administrator Scenarios and Exam Readiness

0
0

Focus keyphrase: AZ-104 practice questions

Use these AZ-104 practice questions to work through mixed Microsoft Azure Administrator scenarios across governance, storage security, private connectivity, virtual machines, backup, and monitoring. This set continues the AZ-104 series with exam-style decisions where more than one Azure service sounds tempting.

These are original certification-style questions based on the public Microsoft AZ-104 skills outline and official Azure documentation. They are written to feel realistic and exam-like without copying, paraphrasing, or reconstructing real exam-dump questions.

AZ-104Questions 61-70Mixed Administrator ScenariosAzure Administrator
Where this fits in the series: This post follows AZ-104 Questions 51-60: Identity, Governance, Storage, and Networking Review. Questions 61-70 stay in mixed-review mode, but lean harder into the operational choices administrators make after resources already exist.

AZ-104 Questions 61-70: Mixed administrator scenarios and exam readiness

For each item, choose the best answer unless the question explicitly says otherwise. Expect the exam to test the boundary between similar-looking tools: Azure Policy versus locks, private endpoints versus service endpoints, diagnostic settings versus alerts, and backup protection versus storage replication.

Governance lens: Policy evaluates and enforces rules; locks protect management operations; RBAC controls who can perform actions.
Networking lens: Private endpoints give a service a private IP in your virtual network; service endpoints keep public service endpoints but restrict access by subnet identity.
Operations lens: Diagnostic data, alert rules, action groups, backup policies, and recovery settings solve different parts of the monitoring-and-resilience story.
Exam tip: When the question says “prevent,” “detect,” “recover,” or “route privately,” pause before choosing the familiar feature. AZ-104 likes verbs. The verb usually tells you the service.
Domain: Manage Azure identities and governance — enforce resource standards with Azure Policy

Question 61: Blocking resource deployments outside approved regions

Scenario: A company allows production resources only in East US and West US 3. Developers sometimes choose other regions during deployment. You need to block new noncompliant deployments at the subscription scope while allowing the audit team to review compliance results.

Choose one answer.

  1. Create an Azure Policy assignment using an allowed locations policy with the Deny effect at the subscription scope
  2. Create an Activity Log alert for resource write operations in the subscription
  3. Apply a ReadOnly resource lock to every existing production resource group
  4. Assign the Reader role to developers at the subscription scope

Correct answer: A — Assign an allowed locations Azure Policy with the Deny effect

Explanation: Azure Policy is designed to evaluate resource configurations and enforce organizational standards. An allowed locations policy assigned at the subscription scope can deny deployments to regions that are not approved, and compliance results can be reviewed through Azure Policy compliance views.

Why the other options are wrong

  • B. Activity Log alerts can notify after management operations occur, but they do not block the deployment request.
  • C. A ReadOnly lock would interfere with updates to existing resource groups and does not create a subscription-wide regional rule for new deployments.
  • D. Reader removes deployment permissions, but it is not a targeted governance control and would prevent developers from deploying approved resources too.

Official reference: Azure Policy overview and Azure Policy built-in definitions

Domain: Manage Azure identities and governance — protect resources with management locks

Question 62: Preventing deletion without blocking routine changes

Scenario: A resource group contains a production virtual network, network security groups, and route tables. Network engineers must continue updating NSG rules and routes, but accidental deletion of the resource group or child resources must be prevented through Azure Resource Manager.

Choose one answer.

  1. Apply a ReadOnly lock to the resource group
  2. Apply a CanNotDelete lock to the resource group
  3. Enable Azure DDoS Network Protection on the virtual network
  4. Create a policy assignment with the Audit effect for network resources

Correct answer: B — Apply a CanNotDelete lock to the resource group

Explanation: A CanNotDelete management lock allows authorized users to read and modify resources, but prevents deletion through the management plane. Applying the lock at the resource group scope protects the resource group and child resources while still permitting routine configuration changes.

Why the other options are wrong

  • A. A ReadOnly lock is too restrictive because it prevents authorized updates, including many configuration changes.
  • C. DDoS Network Protection helps protect public endpoints from network attacks; it does not prevent Azure Resource Manager deletion.
  • D. Audit policy records compliance state but does not block deletion.

Official reference: Lock your Azure resources

Domain: Implement and manage storage — apply lifecycle management

Question 63: Moving older blobs to a lower-cost tier automatically

Scenario: A storage account contains log blobs in a container named app-logs. Logs are frequently accessed for the first 30 days, rarely accessed after that, and must be deleted after one year. You need the lowest administrative effort solution.

Choose one answer.

  1. Change the storage account replication type from LRS to GRS
  2. Enable blob versioning and manually delete old versions every month
  3. Create an Azure Storage lifecycle management rule that moves blobs to Cool after 30 days and deletes them after 365 days
  4. Create an Azure Monitor metric alert for Used capacity

Correct answer: C — Use Azure Storage lifecycle management

Explanation: Lifecycle management policies can automatically transition block blobs to cooler access tiers and delete blobs based on age conditions such as last modified time. This directly matches the requirement with minimal ongoing administration.

Why the other options are wrong

  • A. Replication improves durability and availability characteristics; it does not manage object age or access tiers.
  • B. Versioning helps preserve previous versions, but manual deletion is not low effort and does not automatically tier the active blobs.
  • D. A capacity alert can notify administrators about growth, but it does not move or delete blobs.

Official reference: Optimize costs by automating Azure Blob Storage access tiers

Domain: Implement and manage storage — secure storage connectivity

Question 64: Giving a storage account a private IP address in a virtual network

Scenario: An application running in an Azure virtual network must access Blob Storage through a private IP address in the application subnet. The security team wants to disable public network access to the storage account after testing. Name resolution from the virtual network should resolve the blob endpoint to the private address.

Choose one answer.

  1. Enable a Microsoft.Storage service endpoint only
  2. Create a NAT gateway for the application subnet
  3. Assign Storage Blob Data Reader to the virtual network
  4. Create a private endpoint for the blob service and configure the appropriate Private DNS zone linked to the virtual network

Correct answer: D — Create a private endpoint and configure Private DNS

Explanation: A private endpoint maps a supported Azure service to a private IP address in a virtual network. For Blob Storage, Private DNS configuration such as the privatelink.blob.core.windows.net zone lets clients in the linked virtual network resolve the service endpoint to the private endpoint address.

Why the other options are wrong

  • A. Service endpoints secure access from a subnet to the public service endpoint; they do not give the storage account a private IP in the subnet.
  • B. NAT Gateway provides outbound internet SNAT for subnets. It does not create private connectivity to Azure Storage.
  • C. RBAC roles are assigned to security principals, not virtual networks, and they do not establish network paths.

Official reference: What is a private endpoint? and Connect privately to a storage account using Azure Private Endpoint

Domain: Deploy and manage Azure compute resources — increase VM availability

Question 65: Placing two virtual machines across datacenter failure boundaries

Scenario: You are deploying two identical virtual machines for a stateful application in a region that supports availability zones. The application can replicate between the VMs. You need the best protection against a single datacenter failure in the region.

Choose one answer.

  1. Deploy both VMs into the same availability set
  2. Deploy each VM into a different availability zone in the same region
  3. Deploy both VMs into the same proximity placement group
  4. Deploy both VMs using the same managed disk SKU and no availability configuration

Correct answer: B — Deploy the VMs into different availability zones

Explanation: Availability zones are physically separate locations within an Azure region. Placing VMs in different zones can protect against a datacenter-level failure when the application can handle replication and failover between instances.

Why the other options are wrong

  • A. Availability sets spread VMs across fault and update domains within a datacenter-style boundary, but they do not provide the same datacenter-level isolation as zones.
  • C. Proximity placement groups are used to keep resources physically close for low latency, not to maximize isolation from datacenter failure.
  • D. Matching disk SKUs does not provide compute placement resiliency.

Official reference: Availability zones overview and Availability options for Azure Virtual Machines

Domain: Deploy and manage Azure compute resources — use managed identities

Question 66: Allowing a VM application to read Key Vault secrets without stored credentials

Scenario: A custom application runs on an Azure virtual machine and must read secrets from Azure Key Vault. Security policy forbids storing client secrets, passwords, or certificates on the VM. Access must be removable by changing Azure permissions.

Choose one answer.

  1. Create an app registration client secret and save it in a protected file on the VM
  2. Store the Key Vault secret value in a VM custom script extension setting
  3. Enable a managed identity on the VM and grant that identity the required Key Vault permissions
  4. Enable disk encryption on the VM and store the application password in source code

Correct answer: C — Use a managed identity and grant Key Vault permissions

Explanation: Managed identities give Azure resources an identity in Microsoft Entra ID without requiring administrators to manage credentials. The VM-hosted application can request tokens from the Azure Instance Metadata Service and access Key Vault according to assigned permissions.

Why the other options are wrong

  • A. A client secret stored on the VM violates the requirement to avoid local credentials.
  • B. VM extension settings are not a safe design for long-term application secrets and do not remove the need to handle secret material.
  • D. Disk encryption does not make hardcoded credentials acceptable, and source code is not a permissions boundary.

Official reference: Managed identities for Azure resources and Azure role-based access control for Key Vault

Domain: Configure and manage virtual networking — control subnet traffic with NSGs

Question 67: Allowing only web traffic to application VMs

Scenario: A subnet contains application virtual machines. The VMs should accept inbound HTTPS traffic from an Azure Application Gateway subnet, but direct inbound internet traffic to the VMs should be blocked. You need a subnet-level control that filters network traffic.

Choose one answer.

  1. Associate a network security group with the application subnet and create inbound rules that allow required traffic from the Application Gateway subnet while denying other inbound sources
  2. Create a private DNS zone for the application VMs
  3. Assign the Contributor role to the Application Gateway managed identity
  4. Create an Azure Policy assignment that audits public IP addresses

Correct answer: A — Use an NSG associated with the application subnet

Explanation: Network security groups filter inbound and outbound traffic for subnets and network interfaces. Applying an NSG to the application subnet with rules for the Application Gateway subnet and deny behavior for other sources addresses the traffic-filtering requirement.

Why the other options are wrong

  • B. DNS affects name resolution, not packet filtering.
  • C. RBAC permissions for a managed identity do not control VM inbound network traffic.
  • D. An audit policy can report resources that match a condition, but it does not filter traffic to the VMs.

Official reference: Network security groups overview

Domain: Monitor and maintain Azure resources — configure metric alerts and notifications

Question 68: Notifying operations when VM CPU stays high

Scenario: Operations staff need an email and Teams webhook notification when the average Percentage CPU metric for a production VM is greater than 85 percent for 10 minutes. The alert should evaluate metric data without requiring a custom log query.

Choose one answer.

  1. Create a Recovery Services vault and enable backup for the VM
  2. Create an Azure Monitor metric alert rule for the VM Percentage CPU metric and attach an action group with the email and webhook receivers
  3. Create a diagnostic setting that sends metrics to a storage account only
  4. Enable Microsoft Defender for Cloud recommendations for the subscription

Correct answer: B — Create a metric alert and use an action group

Explanation: Azure Monitor metric alerts evaluate platform metrics such as VM Percentage CPU. Action groups define notification and automation receivers, including email and webhook endpoints, so they are the right place to configure who gets notified.

Why the other options are wrong

  • A. VM backup supports recovery, not live CPU threshold notification.
  • C. A diagnostic setting can route telemetry, but by itself it does not evaluate a threshold or notify responders.
  • D. Defender for Cloud recommendations help improve security posture; they do not create this CPU metric alert.

Official reference: Azure Monitor alerts overview and Azure Monitor action groups

Domain: Monitor and maintain Azure resources — protect workloads with Azure Backup

Question 69: Backing up Azure VMs with a daily retention policy

Scenario: A finance VM must be backed up once per day and retained for 30 days. Administrators need to recover the full VM if the operating system becomes corrupted. The solution should use a native Azure backup service.

Choose one answer.

  1. Enable storage account blob soft delete for the VM disks
  2. Create an availability set and place the VM in it
  3. Create an Azure Monitor activity log alert for VM restart events
  4. Create a Recovery Services vault, define a VM backup policy with daily backups and 30-day retention, and enable backup for the VM

Correct answer: D — Use a Recovery Services vault with a VM backup policy

Explanation: Azure Backup protects Azure VMs through a Recovery Services vault and a backup policy that controls schedule and retention. This supports VM-level recovery scenarios such as restoring after operating system corruption.

Why the other options are wrong

  • A. Blob soft delete applies to blob objects in storage accounts; it is not the native VM backup configuration.
  • B. Availability sets help with planned and unplanned host-level availability events. They are not backups and do not provide point-in-time restore.
  • C. Activity Log alerts can notify on management events but do not create recoverable VM backups.

Official reference: Azure VM backup overview and Back up an Azure VM from the Azure portal

Domain: Monitor and maintain Azure resources — collect logs for analysis

Question 70: Sending platform logs to Log Analytics for KQL queries

Scenario: Security analysts need to run KQL queries against Azure Activity Log events and resource logs from a storage account. The logs should be retained in a central workspace for investigation and alerting.

Choose one answer.

  1. Create a resource lock on the storage account
  2. Enable a service endpoint on the analyst subnet
  3. Create diagnostic settings that send the required logs to a Log Analytics workspace
  4. Change the storage account access tier to Archive

Correct answer: C — Use diagnostic settings to send logs to Log Analytics

Explanation: Diagnostic settings route platform logs and metrics for Azure resources to destinations such as Log Analytics workspaces, storage accounts, or Event Hubs. Sending logs to Log Analytics supports centralized KQL querying, analytics, and log-based alert rules.

Why the other options are wrong

  • A. A resource lock protects management operations; it does not collect or centralize logs.
  • B. A service endpoint affects network access to supported Azure services. It does not send logs to a workspace.
  • D. Archive is a blob access tier for rarely accessed data. It is not a logging pipeline.

Official reference: Diagnostic settings in Azure Monitor and Log Analytics overview

Answer key: AZ-104 Questions 61-70

Question Correct answer Objective/domain
61 A Manage Azure identities and governance
62 B Manage Azure identities and governance
63 C Implement and manage storage
64 D Implement and manage storage / virtual networking
65 B Deploy and manage Azure compute resources
66 C Deploy and manage Azure compute resources / identity integration
67 A Configure and manage virtual networking
68 B Monitor and maintain Azure resources
69 D Monitor and maintain Azure resources
70 C Monitor and maintain Azure resources
Watch out: The answer key is intentionally not enough. For AZ-104, the explanation is where the exam logic lives: why a service solves the requirement, and why a nearby service does not. If you only memorize feature names, Azure will absolutely bonk you with an edge case.

Sources

📚 More questions from: AZ-104: Azure Administrator

Related QuestionMORE FROM AUTHOR