AZ-104 Questions 81-90: Identity, Storage, Compute, Networking, and Monitoring Review

0
0

Focus keyphrase: AZ-104 practice questions

Use these AZ-104 practice questions to review realistic Azure Administrator decisions across identity, governance, storage protection, private connectivity, compute deployment, monitoring, updating, and backup. This post continues the sequential AZ-104 practice series with questions 81-90.

Every question below is original and based on public Microsoft exam objectives and official Azure documentation. The goal is exam-like practice without copying, paraphrasing, or reconstructing real exam-dump content.

AZ-104Questions 81-90Azure AdministratorMixed Objective Review
Where this fits in the series: This post follows AZ-104 Questions 71-80: Networking, Compute, Storage, and Monitoring Review. Questions 81-90 keep the mixed-review format and focus on practical administrator choices that often appear similar until you separate management plane, data plane, network path, and operations requirements.

AZ-104 Questions 81-90: Identity, storage, compute, networking, and monitoring review

Choose the best answer unless the question says otherwise. Watch for exact requirement words such as least privilege, private access, recover previous versions, automated patching, and query-based alert.

Identity watch: Azure RBAC controls Azure resource actions. Microsoft Entra group rules control membership. They solve different problems.
Storage watch: Soft delete, versioning, immutable retention, lifecycle management, and private endpoints each protect or connect to data differently.
Operations watch: Azure Backup, Azure Monitor alerts, Update Manager, and deployment slots are not interchangeable just because they all improve reliability.
Exam tip: When a question asks for the minimum administrative permission, avoid broad roles like Owner or Contributor. When it asks for blob contents, think data-plane roles. When it asks for resource configuration, think management-plane RBAC.
Domain: Manage Azure identities and governance — configure Azure RBAC

Question 81: Allowing operators to restart VMs without changing networking

Scenario: A support team must start, stop, restart, and redeploy virtual machines in a production resource group. The team must not be able to modify virtual network settings, storage accounts, role assignments, or resource locks.

Choose one answer.

  1. Assign the Owner role at the subscription scope
  2. Assign the Contributor role at the resource group scope
  3. Assign the Virtual Machine Contributor role at the resource group scope
  4. Assign the Reader role at the resource group scope and share the VM local administrator password

Correct answer: C — Assign Virtual Machine Contributor at the resource group scope

Explanation: Virtual Machine Contributor allows management of virtual machines but does not grant broad permission to manage virtual networks, storage accounts, or access control. Scoping the role to the production resource group limits where the support team can act.

Why the other options are wrong

  • A. Owner is far too broad and includes permission to manage access.
  • B. Contributor is also broader than required and can modify many non-VM resources.
  • D. Reader does not allow VM restart operations, and sharing local administrator credentials is not an Azure RBAC solution.

Official reference: Azure built-in roles for compute and Azure RBAC overview

Domain: Manage Azure identities and governance — manage users and groups

Question 82: Automatically maintaining group membership for a department

Scenario: You need a Microsoft Entra group that automatically includes user accounts whose department attribute equals Finance. Users should be added or removed from the group when the attribute changes. Administrators should not maintain the membership manually.

Choose one answer.

  1. Create an assigned security group and delegate the Groups Administrator role to the finance manager
  2. Create a dynamic user group with a membership rule based on the department attribute
  3. Create a Microsoft 365 group and enable self-service join requests
  4. Create an Azure RBAC custom role with a condition that references the department attribute

Correct answer: B — Create a dynamic user group

Explanation: Dynamic membership rules in Microsoft Entra ID can evaluate user attributes, such as department, and automatically maintain group membership. This meets the requirement without manual updates.

Why the other options are wrong

  • A. Assigned groups require manual membership management or automation outside the group rule.
  • C. Self-service joining does not automatically track the department attribute.
  • D. Azure RBAC custom roles define permissions for Azure resources; they do not maintain Entra group membership.

Official reference: Dynamic membership rules for groups in Microsoft Entra ID

Domain: Implement and manage storage — protect blob data

Question 83: Recovering deleted blobs and overwritten blob versions

Scenario: A storage account contains project documents in Blob Storage. Administrators must be able to recover blobs that are accidentally deleted and restore a previous version when a user overwrites a blob with incorrect content.

Choose one answer.

  1. Enable blob soft delete and blob versioning
  2. Enable infrastructure encryption only
  3. Enable secure transfer required and disable shared key access
  4. Create a read-only resource lock on the storage account

Correct answer: A — Enable blob soft delete and versioning

Explanation: Blob soft delete helps recover deleted blobs within the configured retention period. Blob versioning preserves previous versions when a blob is modified, which supports recovery from accidental overwrites.

Why the other options are wrong

  • B. Infrastructure encryption protects data at rest but does not retain deleted or overwritten blob versions.
  • C. These settings improve access security, not recovery from deletion or overwrite.
  • D. A read-only lock may prevent management changes and some writes, but it is not the standard blob-level recovery feature and can disrupt normal operations.

Official reference: Soft delete for blobs and Blob versioning

Domain: Implement and manage storage — configure blob lifecycle management

Question 84: Moving older reports to cool storage automatically

Scenario: A container stores monthly PDF reports. Reports are accessed frequently for 30 days, rarely after 90 days, and must remain available for occasional download for seven years. You need to reduce storage cost with minimal administrative effort.

Choose one answer.

  1. Create a lifecycle management rule that moves blobs to the cool tier after 30 days and to the archive tier after 90 days if archive retrieval latency is acceptable
  2. Convert the storage account to premium block blob storage
  3. Create a daily AzCopy job that downloads all reports to a virtual machine disk
  4. Enable point-in-time restore for containers only

Correct answer: A — Use blob lifecycle management tiering rules

Explanation: Lifecycle management policies can automatically transition blobs between access tiers based on age or last access conditions. This is designed for cost optimization when data becomes colder over time.

Why the other options are wrong

  • B. Premium storage is optimized for performance, not long-term low-cost retention of infrequently accessed reports.
  • C. Copying blobs to a VM disk increases operational work and does not use native storage lifecycle features.
  • D. Point-in-time restore is a data protection feature; it does not automatically reduce cost by tiering older blobs.

Official reference: Optimize costs by managing the data lifecycle and Access tiers for blob data

Domain: Configure and manage virtual networking — configure private access to Azure services

Question 85: Reaching a storage account from a VNet without public network access

Scenario: An application running on Azure VMs must access a storage account by using a private IP address from its virtual network. Public network access to the storage account should be disabled after the private path is validated.

Choose one answer.

  1. Create a private endpoint for the required storage subresource and configure private DNS resolution
  2. Add an inbound NSG rule that allows TCP 443 from the Internet service tag
  3. Assign the Storage Account Contributor role to each VM network interface
  4. Create an Azure Load Balancer rule that forwards traffic to the storage account public endpoint

Correct answer: A — Use a storage private endpoint with private DNS

Explanation: A private endpoint gives supported Azure services, including Storage, a private IP address in a virtual network. Private DNS configuration lets clients resolve the service name to the private endpoint address instead of the public endpoint.

Why the other options are wrong

  • B. Allowing internet traffic does the opposite of disabling public access.
  • C. RBAC controls authorization; it does not create a private network path.
  • D. Azure Load Balancer is not used to privately front a platform storage account endpoint.

Official reference: Connect privately to a storage account using private endpoint and Azure Private Endpoint DNS configuration

Domain: Deploy and manage Azure compute resources — deploy App Service workloads

Question 86: Releasing a web app update with a quick rollback path

Scenario: A production Azure App Service web app needs a new version deployed for validation before users see it. Administrators want to warm up the new version, test it with a separate URL, then swap it into production with minimal downtime and a simple rollback option.

Choose one answer.

  1. Create a deployment slot, deploy the new version to the slot, validate it, and then swap the slot with production
  2. Scale the App Service plan from Basic to Free during deployment
  3. Enable FTP deployment directly to the production site during business hours
  4. Create a Recovery Services vault and restore the web app after every deployment

Correct answer: A — Use deployment slots and swap

Explanation: Deployment slots provide separate live apps with their own host names. You can validate a new release in a staging slot and swap it with production, which supports warm-up and a fast rollback by swapping back.

Why the other options are wrong

  • B. Scaling down does not provide staged validation and may remove features needed by the app.
  • C. Direct production deployment increases risk and does not provide a clean warm-up or rollback mechanism.
  • D. Azure Backup-style restore is not the intended release mechanism for App Service updates.

Official reference: Set up staging environments in Azure App Service

Domain: Deploy and manage Azure compute resources — configure high availability

Question 87: Increasing availability across datacenter failures

Scenario: A stateless application runs on multiple Azure VMs in a region that supports availability zones. The application must remain available if a single datacenter zone in the region has an outage. Traffic should be distributed to healthy VM instances.

Choose one answer.

  1. Deploy VM instances across availability zones and place them behind a Standard Load Balancer
  2. Place all VM instances in a single availability set in one zone
  3. Assign a public IP address directly to each VM and use manual DNS updates during an outage
  4. Enable accelerated networking on one VM only

Correct answer: A — Use availability zones with a Standard Load Balancer

Explanation: Availability zones are physically separate locations within supported Azure regions. Deploying instances across zones and using a Standard Load Balancer helps distribute traffic across healthy instances and improves resilience to a zone-level failure.

Why the other options are wrong

  • B. Availability sets protect against fault and update domain failures inside a datacenter scope, not zone-level datacenter failures.
  • C. Manual DNS failover is slower and less reliable than load-balanced health probing.
  • D. Accelerated networking improves network performance but does not provide multi-zone availability.

Official reference: What are Azure availability zones? and Azure Load Balancer SKUs

Domain: Monitor and maintain Azure resources — manage updates

Question 88: Scheduling OS updates for Azure and hybrid servers

Scenario: Operations needs a native Azure service to assess and schedule operating system updates for Azure VMs and Azure Arc-enabled servers. The solution should support maintenance windows and centralized update compliance reporting.

Choose one answer.

  1. Use Azure Update Manager
  2. Create an Azure Policy initiative that denies VM creation without tags
  3. Enable Azure Network Watcher connection troubleshoot
  4. Create a storage lifecycle management policy

Correct answer: A — Use Azure Update Manager

Explanation: Azure Update Manager provides update assessment and deployment capabilities for Azure VMs and Azure Arc-enabled servers. It supports scheduled patching, maintenance configurations, and compliance visibility.

Why the other options are wrong

  • B. Azure Policy can enforce configuration rules but is not the update scheduling service.
  • C. Network Watcher helps diagnose network connectivity, not operating system patch deployment.
  • D. Storage lifecycle management affects blob tiering and deletion, not server updates.

Official reference: Azure Update Manager overview

Domain: Monitor and maintain Azure resources — configure alerts

Question 89: Alerting when a KQL query finds repeated application errors

Scenario: Application logs are stored in a Log Analytics workspace. You need an alert when a Kusto Query Language (KQL) query returns more than 20 matching error records during a five-minute evaluation window. The alert should notify an action group.

Choose one answer.

  1. Create a log search alert rule that runs the KQL query and uses an action group
  2. Create an Activity Log alert for all Delete operations in the subscription
  3. Create a metric alert on the VM Percentage CPU metric
  4. Configure a diagnostic setting on the workspace to send logs to a storage account only

Correct answer: A — Create a log search alert rule

Explanation: Log search alert rules evaluate queries against Log Analytics data and can trigger when the query result meets a defined threshold. Action groups define who or what is notified when the alert fires.

Why the other options are wrong

  • B. Activity Log alerts monitor Azure control-plane events, not arbitrary KQL results from application logs.
  • C. Metric alerts evaluate platform or custom metrics, not a KQL count of log records.
  • D. Diagnostic settings route data; they do not create threshold-based notifications.

Official reference: Create or edit a log search alert rule and Azure Monitor action groups

Domain: Monitor and maintain Azure resources — configure backup and recovery

Question 90: Protecting Azure VMs with daily backup and file recovery

Scenario: Several Azure VMs require daily backups. Administrators must be able to restore an entire VM if it is lost and recover individual files when a user deletes a file inside the guest operating system. The backup schedule and retention should be centrally managed.

Choose one answer.

  1. Use a Recovery Services vault with an Azure VM backup policy
  2. Create a resource group lock on each VM resource
  3. Enable boot diagnostics and store screenshots in a storage account
  4. Create an Azure Monitor metric alert for disk read operations

Correct answer: A — Use Azure Backup for Azure VMs

Explanation: Azure Backup protects Azure VMs through a Recovery Services vault and backup policy. It supports scheduled backups, retention management, full VM restore scenarios, and file recovery from recovery points.

Why the other options are wrong

  • B. A lock can help prevent accidental deletion of the VM resource but does not create recoverable backup points.
  • C. Boot diagnostics helps troubleshoot startup issues; it is not a backup solution.
  • D. Monitoring disk reads does not provide VM or file restore capability.

Official reference: About Azure VM backup and Recover files from Azure VM backup

Answer key: AZ-104 questions 81-90

Question Correct answer Objective focus
81 C Least-privilege Azure RBAC for VM operations
82 B Dynamic Microsoft Entra group membership
83 A Blob soft delete and blob versioning
84 A Blob lifecycle management and access tiers
85 A Private endpoint access to Azure Storage
86 A App Service deployment slots and swap
87 A Availability zones and Standard Load Balancer
88 A Azure Update Manager
89 A Log search alert rules and action groups
90 A Azure Backup for Azure VMs
Watch out: Many AZ-104 questions hide the answer in the scope. A storage private endpoint solves network path, not authorization. A data-plane role grants blob access, not storage account configuration. A backup policy creates restore points, while a lock only prevents management changes.

Sources

📚 More questions from: AZ-104: Azure Administrator

Related QuestionMORE FROM AUTHOR