AZ-104 Questions 71-80: Networking, Compute, Storage, and Monitoring Review

0
0

Focus keyphrase: AZ-104 practice questions

Use these AZ-104 practice questions to review realistic Microsoft Azure Administrator decisions across networking, compute, identity, storage, monitoring, and recovery. This set continues the sequential AZ-104 practice series with questions 71-80.

Every question below is original and based on public Microsoft exam objectives and official Azure documentation. The goal is exam-like practice without copying, paraphrasing, or reconstructing real exam-dump content.

AZ-104Questions 71-80Azure AdministratorMixed Objective Review
Where this fits in the series: This post follows AZ-104 Questions 61-70: Mixed Administrator Scenarios and Exam Readiness. Questions 71-80 keep the mixed-review format and focus on the everyday boundary decisions Azure administrators are expected to recognize.

AZ-104 Questions 71-80: Networking, compute, storage, and monitoring review

Choose the best answer unless the question says otherwise. Read the verbs carefully: route, isolate, scale, authorize, collect, and recover usually point to different Azure services even when the scenario mentions the same resource type.

Networking watch: VNet peering is not automatically transitive. Hub-and-spoke designs often need routing and peering settings configured deliberately.
Identity watch: Management-plane roles do not automatically grant data-plane access to blob contents or Key Vault secrets.
Operations watch: Alerts, diagnostic settings, data collection rules, backups, and replication each solve a different operations problem.
Exam tip: If a user can create a storage account but cannot read blobs, think data-plane RBAC. If a VM has no public IP but admins still need RDP or SSH, think Azure Bastion. If guest OS telemetry needs collection, think Azure Monitor Agent plus a data collection rule.
Domain: Configure and manage virtual networking — configure VNet peering and routing

Question 71: Allowing spoke virtual networks to communicate through a hub appliance

Scenario: You have a hub virtual network that contains a network virtual appliance (NVA). Two spoke virtual networks are peered only with the hub. Spoke workloads must communicate with each other through the NVA for inspection. Direct spoke-to-spoke peering is not allowed.

Choose one answer.

  1. Enable gateway transit on both spoke virtual network peerings only
  2. Create user-defined routes in each spoke subnet that send the opposite spoke address range to the NVA, and allow forwarded traffic on the relevant peerings
  3. Create a private endpoint in each spoke virtual network for the NVA
  4. Assign the Network Contributor role to the NVA managed identity

Correct answer: B — Use UDRs to the NVA and allow forwarded traffic on the peerings

Explanation: VNet peering is not transitive by default. In a hub-and-spoke inspection design, each spoke needs routes that direct traffic for the other spoke to the NVA, and the peering configuration must allow forwarded traffic where the hub appliance forwards packets between networks.

Why the other options are wrong

  • A. Gateway transit is for sharing a virtual network gateway, such as VPN or ExpressRoute gateway connectivity. It does not make spoke-to-spoke NVA inspection work by itself.
  • C. Private endpoints expose supported platform services privately; they are not how you route traffic through an NVA.
  • D. RBAC can allow administrative changes, but it does not create packet-forwarding paths between virtual networks.

Official reference: Virtual network peering and Virtual network traffic routing

Domain: Configure and manage virtual networking — provide secure administrative access

Question 72: Connecting to a VM that has no public IP address

Scenario: Administrators need browser-based RDP and SSH access to virtual machines in a production virtual network. The VMs must not have public IP addresses, and inbound management ports must not be opened from the internet.

Choose one answer.

  1. Deploy Azure Bastion to the virtual network and connect to the VMs through the Azure portal or native client support
  2. Create public IP addresses for the VMs and restrict RDP and SSH with NSG source IP rules
  3. Enable IP forwarding on each VM network interface
  4. Create an Azure Firewall DNAT rule for each VM management port

Correct answer: A — Deploy Azure Bastion

Explanation: Azure Bastion provides secure RDP and SSH connectivity to VMs over private IP addresses without requiring public IPs on the target VMs. It avoids exposing inbound RDP or SSH directly to the internet.

Why the other options are wrong

  • B. Public IPs with NSG restrictions reduce exposure but still violate the requirement that VMs must not have public IP addresses.
  • C. IP forwarding is used for appliances that forward traffic; it does not provide secure administrator access.
  • D. DNAT publishes management access through a public firewall endpoint, which does not meet the no-internet-exposed-management requirement.

Official reference: What is Azure Bastion?

Domain: Deploy and manage Azure compute resources — configure scale sets and autoscale

Question 73: Scaling web front-end VMs based on CPU demand

Scenario: A stateless web application runs on identical Azure virtual machines behind a load balancer. The number of instances should increase when average CPU is high and decrease when demand drops. Administrators want Azure to manage the instance count automatically.

Choose one answer.

  1. Place the VMs in a proximity placement group
  2. Create a virtual machine scale set and configure autoscale rules based on the Percentage CPU metric
  3. Enable a CanNotDelete lock on the resource group
  4. Create an availability set and manually add or remove VMs during peak hours

Correct answer: B — Use a virtual machine scale set with autoscale rules

Explanation: Virtual machine scale sets are designed to deploy and manage a group of load-balanced VM instances. Autoscale rules can adjust the instance count based on metrics such as average CPU utilization.

Why the other options are wrong

  • A. Proximity placement groups reduce latency by keeping resources close, but they do not scale instance count.
  • C. A resource lock protects against deletion or modification but does not scale compute.
  • D. Availability sets improve availability across fault and update domains, but manual instance management does not meet the automatic scaling requirement.

Official reference: Virtual Machine Scale Sets overview and Autoscale overview

Domain: Deploy and manage Azure compute resources — use managed identities for Azure resources

Question 74: Letting an automation runbook manage Azure resources without a stored secret

Scenario: An Azure Automation runbook must start and stop virtual machines on a schedule. Security policy does not allow storing service principal secrets or certificates in the Automation account. Access should be controlled with Azure RBAC.

Choose one answer.

  1. Enable a managed identity for the Automation account and assign it the required role on the target resource group
  2. Store a username and password as plain text variables in the Automation account
  3. Create a shared access signature for each virtual machine
  4. Enable disk encryption on each VM before running the automation

Correct answer: A — Use the Automation account managed identity with RBAC

Explanation: Azure Automation supports managed identities, allowing runbooks to authenticate to Azure without stored credentials. Assigning the identity the required RBAC permissions scopes what the runbook can manage.

Why the other options are wrong

  • B. Plain text credentials violate the no-stored-secret requirement and are not a secure automation pattern.
  • C. Shared access signatures are used with services such as Storage, not to start and stop Azure VMs.
  • D. Disk encryption protects VM disks; it does not authenticate a runbook to Azure Resource Manager.

Official reference: Enable managed identity for Azure Automation and Azure RBAC overview

Domain: Implement and manage storage — authorize blob data access

Question 75: Allowing a user to read blobs but not manage the storage account

Scenario: A developer needs to download blobs from a specific container for troubleshooting. The developer should not be able to regenerate account keys, change networking settings, or delete the storage account.

Choose one answer.

  1. Assign the Contributor role at the storage account scope
  2. Assign the Storage Blob Data Reader role at the container or storage account scope
  3. Assign the Reader role at the subscription scope only
  4. Give the developer one of the storage account access keys

Correct answer: B — Assign Storage Blob Data Reader

Explanation: Storage Blob Data Reader grants read access to blob data without granting broad management-plane permissions over the storage account. Scoping the assignment to the container is even more precise when only one container is required.

Why the other options are wrong

  • A. Contributor is a management-plane role and is much broader than required. It can manage many resource settings.
  • C. Reader lets the user view resource metadata, but it does not grant access to blob contents.
  • D. Account keys provide broad data-plane access and should not be shared for least-privilege troubleshooting.

Official reference: Assign an Azure role for access to blob data and Authorize access to blobs using Microsoft Entra ID

Domain: Implement and manage storage — configure Azure Files and synchronization

Question 76: Keeping an on-premises file server while tiering cold files to Azure

Scenario: A branch office uses a Windows file server for departmental shares. The company wants to keep local SMB access for users, centralize the data in Azure Files, and reduce local disk usage by tiering infrequently accessed files to the cloud.

Choose one answer.

  1. Configure Azure File Sync with cloud tiering enabled for the server endpoint
  2. Use AzCopy on a weekly schedule to copy changed files to Blob Storage
  3. Create a private endpoint for an Azure SQL Database
  4. Enable immutable blob storage on the file server volume

Correct answer: A — Configure Azure File Sync with cloud tiering

Explanation: Azure File Sync can centralize Windows Server file shares in Azure Files while keeping local server endpoints for fast local access. Cloud tiering can keep frequently used files local and tier colder files to Azure to reduce local storage consumption.

Why the other options are wrong

  • B. AzCopy can copy data, but it does not provide continuous namespace synchronization, local caching, or cloud tiering for a file server.
  • C. A private endpoint for Azure SQL Database is unrelated to file-share synchronization.
  • D. Immutable blob storage applies to blob data retention scenarios, not Windows file server tiering.

Official reference: Azure File Sync planning and overview and Azure File Sync cloud tiering

Domain: Configure and manage virtual networking — simplify NSG rules with application security groups

Question 77: Applying NSG rules to application roles instead of IP addresses

Scenario: A subnet contains web, API, and database VMs. Their private IP addresses may change during redeployment. You need NSG rules that allow web VMs to reach API VMs and API VMs to reach database VMs without maintaining many individual IP address rules.

Choose one answer.

  1. Create application security groups for each application tier and reference the ASGs in NSG rules
  2. Create a public IP prefix for each application tier
  3. Enable forced tunneling to an on-premises firewall for all subnets
  4. Create an Azure DNS private zone for each VM name

Correct answer: A — Use application security groups in NSG rules

Explanation: Application security groups let you group VM network interfaces by application role and use those groups as sources or destinations in NSG rules. This avoids hardcoding individual private IP addresses for tier-to-tier rules.

Why the other options are wrong

  • B. Public IP prefixes reserve public IP ranges; they do not group private VM NICs for NSG rule logic.
  • C. Forced tunneling changes routing, but it does not simplify role-based NSG rule definitions.
  • D. Private DNS helps name resolution, not NSG source and destination grouping.

Official reference: Application security groups and Network security groups overview

Domain: Monitor and maintain Azure resources — collect guest telemetry from virtual machines

Question 78: Collecting Windows event logs from Azure VMs

Scenario: Security operations needs Windows Security event logs and selected performance counters from Azure virtual machines in a Log Analytics workspace. You want to use the current Azure Monitor agent-based collection model.

Choose one answer.

  1. Configure a diagnostic setting on the resource group only
  2. Install the Azure Monitor Agent on the VMs and associate a data collection rule that sends the required data to the workspace
  3. Create an Activity Log alert for VM write operations
  4. Enable blob versioning on the storage account that stores VM disks

Correct answer: B — Use Azure Monitor Agent with a data collection rule

Explanation: Azure Monitor Agent collects guest operating system telemetry from VMs. Data collection rules define what data to collect, such as Windows events and performance counters, and where to send it, such as a Log Analytics workspace.

Why the other options are wrong

  • A. Diagnostic settings can route Azure platform logs and metrics for supported resources, but they do not collect guest OS event logs from VMs by themselves.
  • C. Activity Log alerts evaluate Azure management-plane events, not Windows Security logs inside the guest OS.
  • D. Blob versioning protects blob versions and is unrelated to VM guest telemetry collection.

Official reference: Azure Monitor Agent overview and Data collection rules in Azure Monitor

Domain: Monitor and maintain Azure resources — configure disaster recovery for Azure VMs

Question 79: Replicating a VM to another Azure region for disaster recovery

Scenario: A business-critical VM runs in East US. The company needs the ability to fail over the VM to another Azure region during a regional outage. Backups alone are not considered sufficient because the recovery process must support planned and unplanned failover workflows.

Choose one answer.

  1. Enable Azure Site Recovery replication for the VM to a target Azure region
  2. Create an availability set in East US and place the VM in it
  3. Enable soft delete for blobs in the storage account
  4. Create an Azure Monitor metric alert for VM availability

Correct answer: A — Enable Azure Site Recovery replication

Explanation: Azure Site Recovery supports disaster recovery by replicating Azure VMs to another region and orchestrating failover and failback workflows. This is different from backup, which focuses on point-in-time recovery rather than regional DR orchestration.

Why the other options are wrong

  • B. An availability set improves resiliency within a region against host-level failures, not recovery to another region.
  • C. Blob soft delete protects blob objects from accidental deletion; it does not replicate and orchestrate VM failover.
  • D. A metric alert can notify administrators, but it does not provide a recovery environment or failover process.

Official reference: About Azure VM disaster recovery to another Azure region and Azure Site Recovery overview

Domain: Manage Azure identities and governance — assign least-privilege management roles

Question 80: Letting a help desk restart VMs without broader resource changes

Scenario: Help desk staff must start, restart, and stop virtual machines in one resource group. They should not be able to create virtual networks, modify storage accounts, assign roles, or delete resources. You need the least-privilege built-in role assignment.

Choose one answer.

  1. Assign Owner at the subscription scope
  2. Assign Contributor at the resource group scope
  3. Assign Virtual Machine Contributor at the resource group scope
  4. Assign User Access Administrator at the resource group scope

Correct answer: C — Assign Virtual Machine Contributor at the resource group scope

Explanation: Virtual Machine Contributor can manage virtual machines but does not grant broad permissions across all resource types or permission to assign access. Scoping the role to the target resource group keeps the assignment narrower than subscription-wide access.

Why the other options are wrong

  • A. Owner at subscription scope is far too broad and includes permission to delegate access.
  • B. Contributor at the resource group scope allows managing many resource types in that resource group, not just VM operations.
  • D. User Access Administrator is for managing role assignments; it does not match routine VM operations and would create an access-control risk.

Official reference: Azure built-in roles for compute and Azure built-in privileged administrator roles

Answer key: AZ-104 Questions 71-80

Question Correct answer Objective/domain Quick reason
71 B Virtual networking Spoke-to-spoke inspection through an NVA requires routes and forwarded-traffic support.
72 A Virtual networking Azure Bastion provides private RDP/SSH without VM public IP addresses.
73 B Compute Scale sets plus autoscale rules adjust instance count from metrics.
74 A Compute / identity Managed identity removes stored credentials and uses RBAC for scope.
75 B Storage Storage Blob Data Reader grants blob-read data-plane access without account management.
76 A Storage Azure File Sync with cloud tiering keeps local SMB access while tiering cold files.
77 A Virtual networking Application security groups simplify NSG rules for VM application roles.
78 B Monitoring Azure Monitor Agent and data collection rules collect guest OS logs and counters.
79 A Monitoring and maintenance Azure Site Recovery provides cross-region VM replication and failover orchestration.
80 C Identity and governance Virtual Machine Contributor at resource group scope is narrower than Owner or Contributor.
Watch out: In AZ-104 questions, “can manage the resource” and “can read the data inside the resource” are often different permission paths. Azure RBAC has management-plane roles and data-plane roles; do not assume one automatically grants the other.

Sources

📚 More questions from: AZ-104: Azure Administrator

Related QuestionMORE FROM AUTHOR