Free Microsoft AZ-104 Practice Exam with Questions & Answers | Set: 3

In Azure Storage, to ensure that newly added content cannot be modified or deleted for a fixed retention period, you must configure a container-level immutable storage policy, also known as a time-based retention policy or immutability policy. This feature is implemented through a stored access policy in Azure Blob Storage using the WORM (Write Once, Read Many) capability.

According to Microsoft’s Azure Storage documentation, immutability policies can be configured in two ways:

Time-based retention policy – prevents data from being modified or deleted for a fixed duration (e.g., 1 year).

Legal hold – preserves data until the hold is explicitly cleared.

To implement the time-based retention policy, you configure a container-level access policy under Immutable blob storage settings. Once configured, any new blobs written to the container will be locked for the specified retention period and cannot be modified or deleted, ensuring compliance with retention regulations like SEC 17a-4(f) or GDPR.

The access level, access tier, or IAM settings do not provide this immutability. They control access permissions, performance, and user roles but do not enforce write-once protection.

Thus, the correct approach is to configure an access policy that enforces immutability for one year.

The azcopy copy command copies a directory (and all of the files in that directory) to a blob container. The result is a directory in the container by the same name.

Azure management groups allow administrators to organize multiple subscriptions and apply governance policies such as Azure Policy and RBAC across a hierarchy. Policies assigned at a higher-level management group are inherited by all child management groups and subscriptions beneath it. When two or more policies conflict, Deny policies always override Allow policies as per Microsoft’s official documentation (Microsoft Learn: Azure Policy Overview – Inheritance and Enforcement Logic).

In this question:

Policy Assignments

Tenant Root Group has a “Not allowed resource types” policy that denies virtualNetworks creation.

ManagementGroup12 has an “Allowed resource types” policy that allows virtualNetworks creation.

Because Subscription2 resides under ManagementGroup12, it inherits the allowed policy. However, Subscription1 resides under ManagementGroup21, which is a child of ManagementGroup11, both of which fall under the Tenant Root Group — inheriting the deny rule.

✅ Conclusion:

Subscription1 → Denied (inherits “Not allowed resource types: virtualNetworks”)

Subscription2 → Allowed (inherits “Allowed resource types: virtualNetworks”)

Creating Resources

In Subscription1, you cannot create a virtual network due to the deny policy from the Tenant Root Group.

In Subscription2, you can create a virtual machine, as no deny policy prevents it.

Moving Subscriptions

According to Azure governance hierarchy rules, subscriptions can be moved between management groups if the user has proper RBAC permissions (Owner or User Access Administrator). There are no policy restrictions preventing Subscription1 from being moved from ManagementGroup21 to ManagementGroup11, as this is within the same management group hierarchy.

Final Verified Answer (as per Microsoft Azure Administrator Documentation):

Statement

Answer

You can create a virtual network in Subscription1

❌ No

You can create a virtual machine in Subscription2

✅ Yes

You can move Subscription1 to ManagementGroup11

✅ Yes

Official Microsoft Azure Reference (Document Extract Summary):

“Azure Policy effects are inherited by all child resources. A ‘deny’ effect from a parent management group overrides any ‘allow’ effects from descendant scopes. Policies at higher scopes take precedence in conflicts.”

“Subscriptions can be moved between management groups within the same hierarchy when permissions are sufficient.”

(Source: Microsoft Learn — Azure Policy Overview, Management Groups Overview, and RBAC Permissions for Governance Management)

In this scenario, Contoso Ltd. must designate a new user named Admin1 as the service administrator of the Azure subscription and ensure that Admin1 receives email alerts about service outages.

In Azure, there are three classic administrative roles associated with subscriptions:

Account Administrator – The individual who created the subscription and manages billing.

Service Administrator – The primary contact responsible for managing services and resources in the subscription.

Co-Administrator – Has the same management privileges as the Service Administrator but cannot change subscription associations.

According to Microsoft Azure Administrator documentation, to change the Service Administrator, you must perform the following steps:

In the Azure portal, navigate to Subscriptions.

Select the specific subscription.

Under Settings, choose Properties.

In the Service Administrator field, update the name and email address to that of the new administrator (in this case, Admin1).

This modification ensures that Admin1 becomes the Service Administrator, and Azure will automatically send service-related notifications and outage alerts to that user’s registered email address, as defined by Microsoft’s subscription notification process.

Option B (IAM settings) is used for Role-Based Access Control (RBAC) and assigning Azure Resource Manager roles such as Owner, Contributor, or Reader. However, RBAC roles do not change the Service Administrator at the subscription level — that’s only done through the Properties blade.

Options C (AAD Properties) and D (AAD Groups) are unrelated to subscription-level administrative settings.

Therefore, the verified and Microsoft-documented answer is:

✅ A. From the Subscriptions blade, select the subscription, and then modify the Properties.

Final Verified Answer: ✅ A. From the Subscriptions blade, select the subscription, and then modify the Properties.

A Shared Access Signature (SAS) defines how, when, and from where a storage resource can be accessed. The exhibit shows the following important configuration details for SAS1:

Validity period: January 1, 2025 through January 1, 2028 → both access attempts occur within the valid timeframe.

Allowed IP addresses: Not specified → access is allowed from any IP address.

Allowed protocols: HTTPS only

Signing key: key1

Scenario 1 – Azure Storage Explorer

Azure Storage Explorer accesses Azure Storage using the HTTPS REST API. Because:

The access is within the SAS validity period,

No IP restriction is configured,

HTTPS is allowed,

the connection succeeds. However, the SAS configuration shown does not include write or list permissions, meaning access is limited to read-only operations.

✔ Result: Will have read-only access

Scenario 2 – net use to connect to Azure file share

The net use command connects to Azure Files using SMB (port 445). SMB traffic does not use HTTPS.

Because the SAS explicitly restricts access to HTTPS only, SMB-based access is blocked, regardless of IP address or validity period.

Microsoft Azure documentation clearly states:

“When HTTPS only is selected, requests that use HTTP or SMB are denied.”

✔ Result: Will have no access

Final Answer Summary

Scenario

Result

Storage Explorer over HTTPS

Will have read-only access

SMB (net use) connection

Will have no access

✅ Final Verified Answer:

First scenario: Will have read-only access

Second scenario: Will have no access

Box 1: 2

There are 10 update domains. The 14 VMs are shared across the 10 update domains so four update domains will have two VMs and six update domains will have one VM. Only one update domain is rebooted at a time.

Therefore, a maximum of two VMs will be offline.

Box 2: 7

There are 2 fault domains. The 14 VMs are shared across the 2 fault domains, so 7 VMs in each fault domain.

A rack failure will affect one fault domain so 7 VMs will be offline.

Active Directory Federation Services is a feature and web service in the Windows Server Operating System that allows sharing of identity information outside a company’s network.

Scenario: Technical Requirements include:

Prevent user passwords or hashes of passwords from being stored in Azure.

A Recovery Services vault is a logical container that stores the backup data for each protected resource, such as Azure VMs. When the backup job for a protected resource runs, it creates a recovery point inside the Recovery Services vault.

Scenario:

There are three application tiers, each with five virtual machines.

Move all the virtual machines for App1 to Azure.

Ensure that all the virtual machines for App1 are protected by backups.

Statement 1: Yes

Contoso is moving the existing product blueprint files to Azure Blob storage which will ensure that the blueprint files are stored in the archive storage tier.

Use unmanaged standard storage for the hard disks of the virtual machines. We use Page Blobs for these.

Statement 2: No

Azure Table storage stores large amounts of structured data. The service is a NoSQL datastore which accepts authenticated calls from inside and outside the Azure cloud. Azure tables are ideal for storing structured, non-relational data. Common uses of Table storage include:

1. Storing TBs of structured data capable of serving web scale applications

2. Storing datasets that don ' t require complex joins, foreign keys, or stored procedures and can be denormalized for fast access

3. Quickly querying data using a clustered index

4. Accessing data using the OData protocol and LINQ queries with WCF Data Service .NET Libraries

Statement 3: No

File Storage can be used if your business use case needs to deal mostly with standard File extensions like *.docx, *.png and *.bak then you should probably go with this storage option.