Microsoft AZ-104 Practice Test 15
Question 140
A user mounts an Azure Files share but receives Access denied for one folder. What additional permissions apply?
- Create an Azure Files share snapshot of the desired recovery point.
- Verify SMB TCP port 445 connectivity along the client network path.
- Browse the relevant Azure Files snapshot and copy back the specific prior file.
- Inspect file-system ACLs on the target folder as well as the share-level role.
Explanation
Correct Answer
D:Share-level authorization and folder ACLs are cumulative controls. Access to the share does not automatically grant access to every directory.
Incorrect Answers
A:Share snapshots preserve point-in-time share state for compatible recovery operations. They are not a full cross-region disaster recovery plan. This matters here because a user mounts an Azure Files share but receives Access denied for one folder. What additional permissions apply.
B:SMB traffic depends on TCP 445 reachability unless supported alternate network connectivity is used. Share permission changes cannot correct a network port block. This matters here because a user mounts an Azure Files share but receives Access denied for one folder. What additional permissions apply.
C:Snapshots enable selective recovery of prior file versions. Increasing the live share quota cannot recover overwritten contents.
Question 141
An application needs a standard object container reachable through Azure Blob REST APIs rather than a mounted network drive. Which resource should be created?
- Inspect the signed credential's blob write permission and current storage locks or policies.
- Share soft-delete recovery applies only inside the configured retention window.
- Use Microsoft Azure Storage Explorer with permitted connection credentials.
- Create a private blob container under the appropriate Azure Storage account.
Explanation
Correct Answer
D:Blob containers organize data objects addressed through the Blob service API. They differ from SMB file shares.
Incorrect Answers
A:Interactive tools still obey data-plane access and resource constraints. A working list operation does not prove permission to write blob contents.
B:A deleted share that exceeds the retention period is not ordinarily recoverable through that feature. An independent backup may be necessary. This matters here because an application needs a standard object container reachable through Azure Blob REST APIs rather than a mounted….
C:Storage Explorer is a graphical Azure Storage client for supported account services. It does not grant privileges beyond the chosen authorization.
Question 142
A developer expects to open a blob container using a Windows UNC path without a gateway. What misconception should be corrected?
- Turn on Azure Files share soft delete with an appropriate retention period.
- Use Blob REST or supported client tools for blob objects rather than native Azure Files SMB paths.
- Use a page blob with supported aligned range operations.
- Use a Blob container endpoint as a Windows SMB UNC path without an Azure Files service.
Explanation
Correct Answer
B:Blob Storage is object-oriented; an SMB file share requires the Azure Files service or another compatible gateway. This matters here because a developer expects to open a blob container using a Windows UNC path without a gateway. What misconception should….
Incorrect Answers
A:Share soft delete retains eligible deleted file shares so the entire share can be recovered. Share snapshots focus on content states and do not replace share deletion protection. This matters here because a developer expects to open a blob container using a Windows UNC path without a gateway. What misconception should….
C:Page blobs expose range-based operations and are suited to certain virtual-disk-like workloads. Block blobs emphasize staged object uploads.
D:A Blob container endpoint speaks object-storage APIs; pointing a Windows UNC path at that address does not create an SMB service. Azure Files exposes supported SMB shares, which are a different service from a Blob container.
Question 143
An ARM template is deployed in two regions and needs a different location without source edits. Which template component should define that input?
- Put the deployment identity object ID in the resource location field instead of connecting the location parameter.
- Hardcode the deployment’s first region in every resource definition and change an unrelated Bicep dependency declaration.
- Declare a location parameter and reference it in resource properties.
- Use a for expression to generate resources with index-based unique names.
Explanation
Correct Answer
C:Parameters separate deployment-time choices from reusable resource definitions. Hard-coded locations require editing source for each environment.
Incorrect Answers
A:An identity object ID is not an Azure region. The template must bind the location parameter to the resource location property in each deployment.
B:A dependency affects deployment ordering, not regional configuration. A location parameter referenced from resource properties permits the template to target different regions without editing source.
D:Bicep loops create repeated resource instances with parameter-driven counts. Each instance needs a valid unique name.
Question 144
A Bicep file has a location parameter but the resource remains in the fixed old region. What should be checked?
- Verify that the resource's location property actually references the parameter.
- Assign a managed identity resource ID as the location of every resource even when a location parameter is supplied.
- Repeat az deployment group create without wiring the Bicep location parameter into the resource location property.
- Index the relevant array or use each loop item to derive the intended subnet reference.
Explanation
Correct Answer
A:Defining a parameter does not apply it unless the resource expression uses that input. An unrelated default does not override a literal resource location.
Incorrect Answers
B:An identity ID cannot provide the requested Azure location. Reference the location parameter from the resource location expression.
C:Running the same deployment cannot override a hard-coded region in a resource declaration. The resource must actually read the chosen location parameter.
D:Loop inputs can vary by iteration. An unindexed constant can incorrectly attach every NIC to the same subnet.
Question 145
A pipeline must pass a newly created storage account's primary blob endpoint to its next task. Which ARM construct should publish it?
- Declare a named output in the module and reference module.outputs from the parent.
- Add an output expression referencing the deployed account's blob endpoint.
- Read the storage account name from deployment logs and omit an output for its primary Blob endpoint.
- Index the relevant array or use each loop item to derive the intended subnet reference.
Explanation
Correct Answer
B:Outputs return derived deployment values to callers. A parameter is an input and does not automatically expose the deployed endpoint.
Incorrect Answers
A:Module outputs are explicit values made available to callers. A variable inside a module is not automatically visible in the parent.
C:The pipeline requires the actual endpoint URI, not just a resource name shown in logs. A declared output can expose the deployed account endpoint to downstream tasks.
D:Loop inputs can vary by iteration. An unindexed constant can incorrectly attach every NIC to the same subnet. This matters here because a pipeline must pass a newly created storage account's primary blob endpoint to its next task. Which ARM construct….
Question 146
An ARM deployment succeeds but pipeline outputs lacks the account URI. What should be corrected?
- Declare a named output in the module and reference module.outputs from the parent.
- Declare and reference a named deployment output derived from the resource property.
- Investigate the proposed deletion and deployment mode before executing the actual deployment.
- Avoid exposing sensitive values through ordinary deployment outputs and use protected secret handling.
Explanation
Correct Answer
B:Downstream consumers can read only exported outputs. The template must explicitly expose the value with correct type and expression.
Incorrect Answers
A:Module outputs are explicit values made available to callers. A variable inside a module is not automatically visible in the parent. This matters here because an ARM deployment succeeds but pipeline outputs lacks the account URI.
C:What-if output helps identify potentially destructive effects. Approval should not rely only on a successful syntax validation.
D:Secure input types do not justify publishing secrets as unprotected outputs. Logs and outputs require independent controls.
Question 147
A deployment creates an App Service plan and its web app, with the web app waiting for the plan. How should ordering be modeled?
- Declare a location parameter and reference it in resource properties.
- Add a deployment output containing the App Service plan's resource ID and assume publishing it forces the web app to wait for the plan.
- Use an unrelated managed identity resource ID as the web app hosting-plan reference and expect it to order the plan deployment.
- Declare resource dependencies or reference the plan's symbolic resource in Bicep.
Explanation
Correct Answer
D:Azure Resource Manager constructs an execution graph from dependencies. A fixed sleep interval does not guarantee a plan exists.
Incorrect Answers
A:Parameters separate deployment-time choices from reusable resource definitions. Hard-coded locations require editing source for each environment. This matters here because a deployment creates an App Service plan and its web app, with the web app waiting for the plan.
B:An output exposes a completed deployment value to the caller; it does not establish the web app's resource-creation order. Refer to the plan's symbolic resource or define its dependency explicitly.
C:A managed identity is not an App Service plan. Reference the declared hosting plan resource or declare the appropriate plan dependency.
Question 148
An Azure VM must use a CPU-optimized SKU to run a batch job that does little memory processing. Which selection should be evaluated?
- Choose an E-series memory-optimized VM solely for its large RAM quota without checking the job's CPU-to-memory ratio.
- Move the existing VM to another resource group and assume its CPU-to-memory sizing changes automatically.
- Choose an appropriate compute-optimized VM size that satisfies CPU and region capacity needs.
- Check managed disk and other retained resource charges separately from VM compute.
Explanation
Correct Answer
C:Azure VM families trade off CPU, memory, disk and price. A general-purpose or memory-optimized shape may cost more for the required CPU workload.
Incorrect Answers
A:An E-series memory-heavy selection may be useful for in-memory workloads, but this batch job is CPU-bound. Verify vCPU-to-RAM ratio and supported VM availability before sizing any disk, rather than paying for memory the task does not need.
B:A resource-group move changes administrative location, not the VM SKU. Evaluate eligible CPU-optimized VM sizes and resizing constraints for the batch job.
D:Deallocation ends normal allocated compute charges but does not automatically delete attached managed disks or public IP resources.
Question 149
A requested VM size is not offered in a target region though available elsewhere. What is the first check?
- Verify the VM SKU's region availability, quota and current capacity constraints.
- Raise regional vCPU quota and assume it will make an unavailable VM SKU appear in the regional catalog.
- Verify accelerated networking is enabled on the supported VM NIC and image path.
- Enable encryption at host for supported virtual machines and disk configurations.
Explanation
Correct Answer
A:A VM size may be regionally unsupported or limited by quotas. An image existing in the region does not guarantee compute capacity.
Incorrect Answers
B:Quota permits more instances of an available supported SKU; it does not add a VM family that the region does not offer. Check per-region size availability first, then verify quota for the selected family.
C:SR-IOV accelerated networking depends on compatible VM size and NIC configuration. Public IP presence is unrelated.
D:Encryption at host covers eligible host-side data paths beyond ordinary persistent managed disk encryption. Support depends on region, VM and disk options.
Question 150
A data processor must keep files after host maintenance and cannot risk loss on the temporary VM disk. Where should files be stored?
- Attach an appropriately sized persistent Azure managed data disk and mount it in the guest.
- Enable encryption at host for supported virtual machines and disk configurations.
- Expand the guest filesystem on the VM's temporary disk and assume that makes the files survive host redeployment.
- Ensure application state and load balancing support failover, not merely VM placement.
Explanation
Correct Answer
A:Managed disks provide durable Azure storage tied to the VM, whereas temporary disks can lose data on deallocation or host events.
Incorrect Answers
B:Encryption at host covers eligible host-side data paths beyond ordinary persistent managed disk encryption. Support depends on region, VM and disk options. This matters here because a data processor must keep files after host maintenance and cannot risk loss on the temporary VM disk.
C:A larger partition on temporary storage remains temporary; maintenance and deallocation can erase that data. Use a persistent managed data disk or appropriate durable service for files that must survive host changes.
D:Infrastructure placement increases availability but cannot automatically make a single-host stateful app stateless. Health routing and data continuity are separate needs.
