Important Microsoft AZ-104 Exam Questions

Answer: B

Explanation:

Azure Storage account access keys are highly privileged credentials that provide full control over the storage account, including access to all data and the ability to regenerate keys. Because of the security implications, listing and regenerating storage account keys is classified as a management-plane operation, not a data-plane operation.

The Reader and Data Access role allows a user to:

View storage account properties (Reader)

Read data within storage services such as blobs or files (Data Access)

However, according to Microsoft Azure RBAC documentation, this role does not include permissions to list or regenerate storage account keys. Key management operations require permissions such as:

Microsoft.Storage/storageAccounts/listKeys/action

Microsoft.Storage/storageAccounts/regenerateKey/action

These permissions are included in roles such as:

Storage Account Contributor

Contributor

Owner

Because the Reader and Data Access role lacks key management permissions, assigning this role to User1 does not allow them to list or regenerate storage account keys for storage1.

Microsoft explicitly documents that only management roles, not data access roles, can manage storage account keys. Therefore, the proposed solution does not meet the goal.

Answer: A, D

Explanation:

In Microsoft Azure, Role-Based Access Control (RBAC) defines what actions users can perform on resources. The Contributor role is one of the built-in Azure roles that provides extensive permissions but excludes access management rights.

According to the Microsoft Azure Administrator documentation under ''Built-in roles for Azure resources'', the Contributor role has the following definition:

''Grants full access to manage all Azure resources, including the ability to create and manage resources, but does not grant permission to assign roles or manage access rights.''

This means that a Contributor can perform any configuration or management task on a resource (such as starting, stopping, resizing, or modifying a virtual machine) but cannot grant or modify permissions for other users.

Let's analyze each option in this context:

A . Add a data disk --- Correct

A Contributor can attach, detach, or manage data disks for the VM. These actions involve resource management operations under the Microsoft.Compute/virtualMachines namespace, which are permitted to the Contributor role. Microsoft Documentation Reference (Compute Resource Provider Operations):

Contributors can ''create, update, and delete virtual machines, disks, and configurations.''

B . Configure a daily backup --- Incorrect

Configuring a daily backup requires permissions within the Recovery Services vault or Backup vault resource type (Microsoft.RecoveryServices/vaults/*). The Contributor role on the VM does not automatically grant access to vault-level resources. Hence, User1 cannot configure or schedule a daily backup without additional permissions on the vault.

C . Assign User2 the Contributor role for VM1 --- Incorrect

Assigning or modifying RBAC roles requires the Owner or User Access Administrator role because it involves operations under the Microsoft.Authorization/roleAssignments/* permission. The Contributor role does not include these permissions. Therefore, User1 cannot assign roles to others.

D . Upload an image of VM1 to an Azure compute gallery --- Correct

The Contributor can capture or generalize a VM and upload its image to an Azure Compute Gallery, as this operation falls under the VM and image management permissions (Microsoft.Compute/galleries/images/*). This action is considered a resource management operation and does not require ownership or RBAC rights beyond Contributor.

E . Assign User2 the Reader role for VM1 --- Incorrect

Answer: B

Explanation:

According to the Microsoft Azure Administrator (AZ-104) official documentation and study guides, when a virtual machine (VM) in Azure is scheduled for maintenance, you can proactively move the VM to another host to minimize downtime. This process is called a self-service maintenance move.

When Azure schedules maintenance events that could affect the underlying host hardware, customers have the option to move their virtual machines within the same region and subscription to a healthy host by using either the Azure portal, PowerShell, or the Azure CLI. The operation that performs this action is called Redeploy or Maintenance Redeploy.

In this scenario, the proposed action --- moving the VM to another subscription from the resource group blade --- does not satisfy the requirement. Moving a VM between subscriptions involves deallocation and redeployment, which does not guarantee that the VM will move to a new host to avoid maintenance. In fact, the VM will remain unavailable during the move process and may need to be reconfigured.

The correct solution to move a VM to another host immediately is to perform a self-service maintenance operation or redeploy the VM. This can be done by selecting the VM in the Azure portal, navigating to Help + support Maintenance, and choosing ''Move to a different host'', or by using the Redeploy button under the VM settings.

Thus, moving the VM to another subscription does not meet the maintenance mitigation goal.

Answer: B

Explanation:

Azure Monitor metrics such as Network In and Network Out only provide aggregated performance data --- i.e., the total volume of bytes entering or leaving a network interface card (NIC). These metrics are useful for monitoring throughput, trends, or network utilization but do not capture or inspect packet-level data between two virtual machines.

To inspect network traffic between two Azure VMs (such as between VM1 and VM2), you must use Azure Network Watcher's Packet Capture or Connection Monitor feature.

According to the Microsoft Azure Administrator study guide and official documentation:

''Use Azure Network Watcher to monitor, diagnose, and view metrics for resources in a virtual network. The Packet Capture feature enables you to capture network traffic to and from a virtual machine and save it to an Azure Storage account for analysis.''

Therefore, simply creating metrics in Azure Monitor on Network In/Out will not meet the goal, because metrics do not provide detailed traffic inspection, only summary statistics.

To fulfill the requirement (''inspect all the network traffic from VM1 to VM2 for three hours''), the correct approach would be to use Network Watcher Packet Capture, specifying VM1 as the target, capturing outbound traffic to VM2's IP, and setting the session duration for 3 hours.

Hence, the given solution does not meet the goal.

Answer: D

Explanation:

Azure Blob Storage Hot access tier is supported by general-purpose storage accounts and premium block blob or premium page blob accounts, but not by premium file share--only accounts.

From Microsoft Azure Storage documentation:

Standard (general-purpose v2) storage accounts support Hot, Cool, and Archive access tiers.

Premium Block Blob accounts support blob workloads optimized for high transaction rates and low latency and effectively function in the Hot tier.

Premium Page Blob accounts also support blob workloads suitable for hot data scenarios.

Premium File Share accounts are strictly for Azure Files and do not support Blob storage tiers.

Evaluation of the table:

storage1 (Standard) Supports Hot tier

storage2 (Premium -- Block blobs) Supports blob workloads (Hot equivalent)

storage3 (Premium -- File shares) No blob support

storage4 (Premium -- Page blobs) Supports blob workloads

Final Answer:

D . storage1, storage2, and storage4 only