AZ-104 — frequently asked questions

Cont2 is listed under 'Planned Changes,' meaning it does not exist in the current environment. Exam answers rely on existing resources unless stated otherwise.

Yes, Azure Files shares (like share1 and share2) support a directory structure similar to traditional file systems, allowing for organized content.

A VPN gateway's public IP is assigned when the gateway is created and cannot be changed later, so an existing VPN gateway cannot accept a new standalone public IP.

Azure associates public IP addresses with the VM's network interface (NIC1), not with the virtual machine resource itself, so you must attach IP1 to NIC1.

That setting only filters which VNets and IP addresses may reach the storage account's public endpoint. Allowed traffic still leaves the VNet for the public endpoint, so it can traverse the internet.

No. A shared access signature is a time-limited authorization credential; it grants access but does not change the network path, so packets still use the storage account's public endpoint.

It assigns a private IP from your VNet to the storage service, and name resolution returns that private IP so VM1 talks to storage1 entirely over the virtual network and Microsoft backbone.

An NSG only allows or denies traffic; it does not alter the path. A private endpoint is needed to give storage1 a private IP in the VNet and keep traffic on the Microsoft backbone.

No. Virtual WAN is for hub-and-spoke network transit and branch connectivity, not for privately accessing a PaaS storage account. A private endpoint is the correct service.

Dynamic groups automatically add or remove members based on attributes like department, eliminating manual updates and minimizing administrative effort.

No, Microsoft Entra bulk import only supports CSV files. XML is not a supported format for creating multiple users.

A Recovery Services vault stores backup items and recovery points for VMs, files and workloads. It has no key-management API, so it cannot regenerate storage account access keys on a schedule.

No. Lifecycle management policies only transition or delete blobs in the account based on age or last-access time; the account's key1 and key2 values are untouched.

Tenant restrictions and Microsoft cloud settings in Cross-tenant access control resource access or B2B with other Microsoft clouds, not the domains that can receive guest invitations.

It lets you allow or deny B2B invitations by domain; selecting 'Allow invitations only to the specified domains' and adding fabrikam.com enforces the requirement.

Conditions can only be added to role assignments containing blob, queue or table data actions. Owner and Storage Account Contributor are management-plane roles without blob data actions, so no condition can be attached.

It only covers Azure Backup backup/restore and read operations on the storage account, not general container and blob access, and it does not support RBAC conditions.

Alert rules act on metrics, activity logs or log queries and notify action groups asynchronously; they cannot display an interactive warning to the person generating the SAS, which the SAS expiry policy does.

Enabled warns the user but still allows the longer SAS to be created; Required blocks creation of any SAS whose expiry exceeds the configured interval.

No. It only grants listkeys and regeneratekey on the storage account; reading blob or file data requires a data-plane role such as Storage Blob Data Reader.

It can manage the account, but it is far broader than required; the key operator role follows least privilege for listing and regenerating keys only.

Geo-redundant replication is not a supported source for a ZRS conversion; the account must first be changed to LRS, so storage2 does not qualify directly in this question.

Premium block blob and premium file share accounts do support ZRS, but a premium page-blob account does not — check the account type shown in the table before assuming a premium account qualifies.

It grants read access and lists keys but lacks Microsoft.Storage/storageAccounts/regeneratekey/action, so key rotation is not permitted.

Assign the Storage Account Key Operator Service Role, which includes both listkeys and regeneratekey actions.

Their disk and VM configurations are listed among the scenarios ADE does not support, such as unsupported disk types or Write Accelerator-enabled sizes, so ADE cannot be enabled on them.

No. Microsoft's ADE documentation lists Basic-tier VMs and VMs created with the classic deployment method as unsupported scenarios, one of the rules that narrows this case study to VM2 and VM3.

Because a Recovery Services vault can protect only VMs in its own Azure region; VM2 and VMB are in a different region than Vault1.

No. Azure Backup region affinity depends on the VM's location, not its resource group, so being in a different resource group does not block protection.

It only uploads a DSC configuration to Azure Storage and does not apply it to the VMSS instances. You need an extension that actually executes configuration on each VM.

Yes, the DSC extension is a valid alternative, but the question only offers the publish cmdlet, not the extension itself. The Custom Script Extension remains the best listed answer.

ACI runs containers quickly but has no native autoscaling; scaling requires external orchestration or scripts, so it is not a valid recommendation here.

Yes. App Service autoscale rules apply to App Service plans, including plans hosting containerized web apps, making it a valid answer alongside Container Apps.

ACR-Tasks-Network is not the identity deploying the container instance; AcrPull must be granted to the principal that actually pulls image1 from Registry1.

The identity used by the container instance or deployment process, such as its managed identity or service principal, must have AcrPull on Registry1.

It only changes the registry's data-plane endpoint for restricted or private network scenarios. It supplies no credentials, so Azure Container Instances still fails to authenticate and pull image1 from Registry1.

Enable the Registry1 admin user and pass the username/password to the container instance, or assign a service principal or managed identity the AcrPull role so ACI can authenticate.

A subscription move only changes the resource's management boundary and ARM template scope; the VM keeps running on its current Azure host, so it does not trigger a redeployment.

Use the Redeploy option in the VM's Help section (or az vm redeploy), which stops, moves, and restarts the VM on a new Azure node.

The current host cluster may not stock that SKU; deallocation releases VM1's hardware so Azure can place it on a cluster that offers the size.

No. Availability set configuration affects resiliency and management, not the host cluster's SKU inventory, so it cannot make the intended size appear.

The Azure portal automatically uses the registry's admin credentials to pull the image when you select an Azure Container Registry image for a container instance.

No, CLI deployments require explicit --registry-username and --registry-password; enabling the admin user alone does not pass credentials.

Private Endpoints require the client to be connected to a Virtual Network. Your home office typically lacks a direct VNet connection, making IP-based firewall rules via Public Network Access the simpler solution.

No. IAM (Access Control) manages permissions for who can perform actions on the data. Network settings control which devices/IPs can establish a connection to the storage account.

Virtual network gateway is for S2S/VNet peering gateways. It doesn't accept arbitrary IP next hops for general route table entries.

An NVA is a third-party device like a firewall or load balancer deployed in Azure, which requires a Virtual appliance next hop type.

Route tables define how traffic leaves a subnet. Since a NIC belongs to a specific subnet, it inherits the routes defined at the subnet level automatically.

Yes. NSGs can be applied to both subnets and individual NICs to filter traffic, whereas route tables are exclusively subnet-level objects for directing traffic paths.

Azure reserves the first 4 IPs and the last IP (gateway) in every subnet, leaving 123 usable IPs out of 128 total.

A /25 subnet uses 7 bits for hosts (32-25), resulting in 2^7 = 128 total addresses.

The scenario states all VMs are already in RG1; creating new resource groups would require moving them, which goes beyond the requested logical association and changes the existing structure.

Management groups govern subscriptions hierarchically (policies, RBAC, compliance). This environment has one subscription and asks only about organizing resources inside RG1, so they don't apply.

Microsoft documents that the usage model is locked at creation and cannot be changed afterward, so a restored or reconfigured provider keeps its original Per Authentication setting.

No. Creation of new MFA providers stopped on September 1, 2018; MFA is now delivered through Microsoft Entra ID P1/P2 or Microsoft 365 licenses.

Initial triggers a full sync cycle — Full Import, Full Sync, and Export on all connectors — which is far slower than the targeted Delta cycle needed for one urgent change.

Run Start-ADSyncSyncCycle -PolicyType Delta from an elevated PowerShell prompt on the DirSync1 Azure AD Connect server to push only the latest directory changes.

File1 was added to the Cloud endpoint. The on-premises agents rely on a detection job to find new cloud content, which runs periodically (every 24 hours), not instantly.

It uses the Windows USN Journaling feature on the server to monitor file system changes and trigger an immediate sync session with the Azure file share.

No, legacy BlobStorage accounts do not support object replication. You must use General Purpose V2 (StorageV2) or Premium Block Blob accounts.

BlobStorage is a legacy optimized type that does not support replication. BlockBlobStorage is a premium tier that does support object replication and versioning.

A running VM is pinned to the hardware cluster it lives on, and the size list only shows sizes that cluster supports. Deallocating the VM releases the slot and reveals more sizes.

Not as the first step. Deallocate VM1, resize it, then start it; only if the new size is unsupported on the set's cluster would the whole availability set need to move.

Because VNET4 lives in a different resource group. The Azure Firewall FAQ requires the firewall, its VNet, and its public IP to be in the same resource group, and AF1 must be in RG1.

Yes. Azure Firewall must stay in the same resource group as its VNet, so separating them can cause the deployment to fail or behave unexpectedly.

GRS does replicate across geographic locations, but the secondary is inaccessible to users unless Microsoft performs a failover, so it fails the requirement to read from the secondary.

The official product name is read-access geo-redundant storage (RA-GRS). Despite the wording quibble, B is the only option that delivers read access to the secondary region.

In the resource group, open Deployments, select Jon Ross's deployment, then choose Export template or View template to see the original JSON.

They focus only on the Overview resource list and miss that the Deployments section lives inside the same blade, giving access to the stored template.

All availability set members must sit on compatible cluster hardware. When that cluster has no capacity for the target size, Azure can only reallocate the whole set, which requires deallocating every VM in it.

No. A resize within the same VM size family usually succeeds while the other VMs keep running. Only an allocation failure pointing to a hardware or capacity change forces you to stop the entire set.

No. Azure supports hot-detaching a data disk from a running VM as long as no application is actively writing to it, so stopping the VM is unnecessary.

Yes. Once detached, the disk can be attached to another VM, which should be running to accept the attachment.

Azure limits an availability set to a maximum of 20 update domains (and 3 fault domains), so values above 20 fail ARM template validation and the deployment is rejected.

Update domains are logical batches rebooted one at a time during planned maintenance, so with 20 domains only a fifth of the VMs are affected at any moment and the rest stay online.

Microsoft lists Owner, Contributor, Reader, and Network Contributor as the accepted subscription-scope roles for enabling Traffic Analytics, so Network Contributor satisfies the check.

No — workspace access is configured separately, but it does not affect the role requirement for the account enabling Traffic Analytics.

It generates a brand-new snapshot of the VM's current state rather than retrieving the submitted deployment artifact, so any later changes and the second storage account are excluded.

Open the resource group containing the resources, select Deployments in the left menu, choose the deployment by timestamp, then open Template, Parameters, and Outputs.

The maximum varies by region, so the template must express the intent of using the largest supported value. A hardcoded 3 could be invalid in regions limited to 2.

Standard availability sets support up to 3 fault domains in most regions (2 in some), while extended availability sets support up to 20. Update domains max out at 20.

Add-AzImage does not exist in the Az PowerShell module. Image resources are created with New-AzImage after the VHD is already in blob storage.

Add-AzVhd -ResourceGroupName $rg -Destination <blob-storage-URI> -LocalFilePath <path-to-local-vhd>, which uploads the VHD to Azure storage.

Gateway transit is offered only by the VNet that hosts the gateway (VirtualNetworkA). VirtualNetworkB has no gateway to offer, so it must instead select 'Use remote gateway' to reach networks through VirtualNetworkA's gateway.

The peering gateway settings are already working. The P2S VPN client package must be downloaded and reinstalled after the peering change so the client receives the updated route configuration.

Alternatives such as Azure Bastard (Bastion) or RDP over a public IP exist, but among the listed VPN options only P2S targets individual client devices, making it the intended AZ-104 answer.

Only one replica owns the AG listener at a time. Client IP affinity would pin a client to a backend that has lost ownership after failover, so its connections fail until affinity expires or the probe drops the node.

Create a TCP 1433 load-balancing rule with Floating IP (direct server return) Enabled, Session persistence None, and a health probe against the availability group listener resource.

Only the replica that owns the listener IP should receive the client's connection. Direct server return delivers packets to that VM without rewriting the destination address, so the reply is sourced from the listener IP.

For this exam question, yes, it is the setting that meets the stated goal. In a full deployment you also need an internal load balancer, a backend pool containing the SQL VMs, and a TCP health probe on the replicas.