Free Microsoft AZ-104 Practice Exam with Questions & Answers | Set: 3

The Traffic Manager Contributor role is not related to Traffic Analytics. Traffic Manager is a service that provides DNS-based load balancing and traffic routing across different regions and endpoints. Traffic Manager Contributor is a role that allows you to create and manage Traffic Manager profiles, endpoints, and geographies1.

Traffic Analytics is a service that provides visibility into user and application activity in your cloud networks. Traffic Analytics analyzes Azure Network Watcher network security group (NSG) flow logs to provide insights into traffic flow in your Azure cloud. With Traffic Analytics, you can visualize network activity, identify hot spots, secure your network, optimize your network deployment, and pinpoint network misconfigurations2.

To enable Traffic Analytics for an Azure subscription, you need to have a role that grants you the following permissions at the subscription level:

Microsoft.Network/applicationGateways/read

Microsoft.Network/connections/read

Microsoft.Network/loadBalancers/read

Microsoft.Network/localNetworkGateways/read

Microsoft.Network/networkInterfaces/read

Microsoft.Network/networkSecurityGroups/read

Microsoft.Network/publicIPAddresses/read

Microsoft.Network/routeTables/read

Microsoft.Network/virtualNetworkGateways/read

Microsoft.Network/virtualNetworks/read

Microsoft.OperationalInsights/workspaces/*

Some of the built-in roles that have these permissions are Owner, Contributor, or Network Contributor3. However, these roles also grant other permissions that may not be necessary or desirable for enabling Traffic Analytics. Therefore, the best practice is to use the principle of least privilege and create a custom role that only has the required permissions for enabling Traffic Analytics4.

Therefore, to meet the goal of ensuring that an Azure AD user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription, you should create a custom role with the required permissions and assign it to Admin1 at the subscription level.

Azure Virtual Network (VNet) peering allows two virtual networks to communicate privately across the Azure backbone network. According to Microsoft Azure Administrator documentation, VNet peering can be of two main types:

Regional VNet Peering: within the same Azure region and cloud type.

Global VNet Peering: across Azure regions, but within the same Azure cloud.

Microsoft Azure operates multiple sovereign clouds, which are logically and physically isolated:

Azure Global/Public Cloud (used by most commercial customers).

Azure Government Cloud (for U.S. government agencies and contractors, physically isolated from the public cloud).

Azure China Cloud (operated by 21Vianet, completely independent of Microsoft’s global Azure).

Per Microsoft Learn – Virtual Network Peering Documentation, the following restrictions apply:

“VNet peering cannot be established between Azure sovereign clouds (such as between Azure Government, Azure China, and Azure Public regions). Peering is only supported within the same cloud type, whether within a region or across regions.”

Based on the table:

VNet1 (East US, Azure Government)

VNet2 (West US 2, Public)

VNet3 (China East, Azure China)

Analysis of each peering configuration:

Peering 1–2 (Azure Government ↔ Public Cloud): ❌ Not supported.

Azure Government and Azure Public are separate environments — no peering across these cloud boundaries.

Peering 1–3 (Azure Government ↔ Azure China): ❌ Not supported.

These are two isolated sovereign clouds with independent infrastructure.

Peering 3–2 (Azure China ↔ Public Cloud): ❌ Not supported.

Azure China is operated by 21Vianet and cannot connect directly with the Public Azure cloud.

Therefore, no cross-cloud peering is supported among these networks.

If all VNets were within Public Azure (e.g., East US, West US 2, and North Europe), global VNet peering would be allowed. However, in this scenario, each VNet resides in a different cloud type, so no peering is possible between them.

Azure Monitor can collect data directly from your Azure virtual machines into a Log Analytics workspace for analysis of details and correlations. Installing the Log Analytics VM extension for Windows and Linux allows Azure Monitor to collect data from your Azure VMs.

Azure Log Analytics workspace is also used for on-premises computers monitored by System Center Operations Manager.

The provided ARM template defines a storage account named storageaccount1 of kind StorageV2 and SKU Standard_LRS.

1️⃣ Public IP Access (Yes):

In the template, the networkAcls property sets "defaultAction": "Allow", meaning that access to the storage account is open to all public networks by default. Since no ipRules or virtualNetworkRules are defined, there are no restrictions based on IP addresses. Therefore, any server — including one with public IP 131.107.103.10 — can connect successfully.

(Reference: Azure Storage firewall and virtual network documentation — when defaultAction is Allow, storage accepts all incoming requests over the public endpoint.)

2️⃣ Archive Tier Availability (Yes):

Because the storage account is of kind StorageV2, it supports blob access tiers — Hot, Cool, and Archive — at both the account and individual blob levels. The ARM template specifies "accessTier": "Hot", which is the default access tier for the account. However, this does not restrict individual blobs from being set to a different tier (e.g., Archive) later. Azure Blob Storage in a StorageV2 account allows per-blob tiering, enabling you to optimize costs based on access patterns.

(Reference: Azure Storage documentation — "Blob storage lifecycle management" and "Blob access tiers overview.")

3️⃣ Azure AD Authentication for File Shares (No):

The ARM template enables encryption and HTTPS but does not configure Azure Active Directory Domain Services (Azure AD DS) authentication for Azure Files. Global administrators in Azure AD cannot access SMB file shares using their Azure AD credentials unless Azure Files AD DS integration is explicitly configured. Since no such property (e.g., azureFilesIdentityBasedAuthentication) exists in this template, access would still require storage account keys or shared access signatures (SAS), not Azure AD credentials.

(Reference: Azure Files authentication overview — Azure AD DS authentication requires explicit configuration.)

✅ Final Verified Answers:

A server that has public IP 131.107.103.10 can access storageaccount1 → Yes

Individual blobs in storageaccount1 can be set to use the archive tier → Yes

Global administrators in Azure AD can access a file share hosted in storageaccount1 by using their Azure AD credentials → No

You must identify the correct storage account for flow logging of IP traffic from VM5 that satisfies the retention requirement of eight months.

Step 1 — Review the Requirements

Flow logs are stored in a StorageV2 (general purpose v2) account.

The selected storage account must support Network Watcher flow logs.

Data must be retained for eight months (≈ 240 days).

Step 2 — Evaluate Each Storage Account

Storage Account

Kind

Region

Remarks

storage1

Storage (general purpose v1)

West US

Does not support flow logs (deprecated type).

storage2

StorageV2 (general purpose v2)

East US

Fully supports flow logs and lifecycle management.

storage3

BlobStorage

East US 2

Not suitable — supports blobs only, not log structure or lifecycle retention.

storage4

FileStorage

Central US

File-only — cannot store flow logs.

Step 3 — Compliance with Flow Log Retention

Flow logs for Network Watcher NSG flow logging are supported only by StorageV2 accounts. You can use Azure Storage lifecycle management to automatically delete logs after a set period — such as 240 days (8 months) — to comply with retention requirements.

Official Microsoft Note:

“Network security group (NSG) flow logs are stored in Azure StorageV2 (General Purpose v2) accounts, which support lifecycle management for log retention.” — Azure Network Watcher documentation.

Conclusion

storage2 is the only StorageV2 account.

It’s located in East US, matching VM5’s region (East US) — this satisfies performance and compliance requirements.

Explanation

Scenario:

1. Web administrators will deploy Azure web apps for the marketing department.

2. Each web app will be added to a separate resource group.

3. The initial configuration of the web apps will be identical.

4. The web administrators have permission to deploy web apps to resource groups.

Steps:

1 --> Create a resource group, and then deploy a web app to the resource group.

2 --> From the Automation script blade of the resource group , click Add to Library.

3 --> From the Templates service, select the template, and then share the template to the web administrators .

Azure role-based access control (Azure RBAC) for Azure file shares requires identity-based authentication integration. According to the Microsoft Azure Administrator documentation, this feature is only supported for StorageV2 (general purpose v2) and FileStorage account types.

In this scenario:

You are required to grant Group4 read-only access using Azure RBAC on Azure file shares.

The technical requirement specifies:

“Whenever possible, grant Group4 Azure RBAC read-only permissions to the Azure file shares.”

From the case study data:

Storage Account

Kind

Identity-based Access

storage1

Storage (general purpose v1)

Azure AD DS

storage2

StorageV2

Disabled

storage3

BlobStorage

N/A

storage4

FileStorage

Azure AD DS

The Storage (general purpose v1) type (storage1) does not support Azure AD or Azure RBAC integration for file shares. Microsoft documentation clearly states that “StorageV1 accounts must be upgraded to StorageV2 to support Azure AD authentication and RBAC role assignments.”

Meanwhile, FileStorage (storage4) already supports Azure AD Domain Services (Azure AD DS) and RBAC role assignment; hence no further modification is required there. However, to make storage1 compatible, it must be converted from StorageV1 to StorageV2.

Once converted to StorageV2, you can then:

Enable identity-based access for Azure file shares.

Assign Azure RBAC roles (e.g., Storage File Data Reader) to Group4.

Microsoft-Documented Requirements Summary:

Supported Account Types: StorageV2 or FileStorage

Unsupported: StorageV1 and BlobStorage

Required RBAC Roles for Read-Only Access:

Storage File Data Reader (or custom read-only role)

Thus, to meet the organization’s requirement to provide Azure RBAC read-only permissions, you must change the account type of storage1 to StorageV2, ensuring both storage1 and storage4 can be managed with Azure RBAC.

Statement 1: Yes

All client computers in the Paris office will be joined to an Azure AD domain.

A virtual network named Paris-VNet that will contain two subnets named Subnet1 and Subnet2.

Microsoft Windows Server Active Directory domains, can resolve DNS names between virtual networks. Automatic registration of virtual machines from a virtual network that's linked to a private zone with auto-registration enabled. Forward DNS resolution is supported across virtual networks that are linked to the private zone.

Statement 2: Yes

A virtual network named ClientResources-VNet that will contain one subnet named ClientSubnet You plan to create a private DNS zone named humongousinsurance.local and set the registration network to the ClientResources-VNet virtual network.

As this is a registration network so this will work.

Statement 3: No

Only VMs in the registration network, here the ClientResources-VNet, will be able to register hostname records. Since Subnet4 not connected to Client Resources Network thus not able to register its hostname with humongoinsurance.local

To meet the technical requirement that User1 can create initiative definitions and User4 can assign initiatives to RG2, we must understand how Azure Policy roles operate according to Microsoft Azure documentation and AZ-104 study guides.

Azure Policy uses role-based access control (RBAC) to determine who can create, manage, and assign policies or initiatives (policy sets). The key roles relevant to this task are:

Resource Policy Contributor – Allows users to create, edit, and delete policy definitions and initiative definitions, but does not allow assignment of policies or initiatives. This role is required for users who will design or build the policy logic (definitions).

Therefore, User1, who needs to create initiative definitions, must have the Resource Policy Contributor role.

Scope: Subscription (Sub1) – because initiatives are created at subscription or management group level.

Contributor – Provides full access to manage resources, except granting permissions. Contributors can assign existing policies or initiatives to resource groups or subscriptions if they have sufficient permissions.

Therefore, User4, who needs to assign initiatives to RG2, must be assigned the Contributor role at the RG2 scope.

Other roles:

Security Admin is related to Microsoft Defender for Cloud security settings, not policy creation.

Resource Policy Contributor for RG2 would not meet the requirement because creating definitions typically requires subscription-level access.

According to Microsoft Docs (“Azure built-in roles for Policy”):

“The Resource Policy Contributor role allows users to create, edit, and delete Azure policy and initiative definitions. To assign policies or initiatives, users need the Contributor or Owner role at the appropriate scope.”

Hence, the configuration should be:

User1: Resource Policy Contributor for Sub1

User4: Contributor for RG2

You can opt in and configure additional recipients to receive your Azure invoice in an email. This feature may not be available for certain subscriptions such as support offers, Enterprise Agreements, or Azure in Open.

Select your subscription from the Subscriptions page. Opt-in for each subscription you own. Click Invoices then Email my invoice.

Click Opt in and accept the terms.

Scenario: During the testing phase, auditors in the finance department must be able to review all Azure costs from the past week.