Microsoft AZ-104 Practice Test 55
Question 540
A lifecycle policy marks data eligible but an affected blob remains in its original tier. What should be inspected?
- Review previous-version lifecycle age filters and actual retention requirements.
- Add an explicitly scoped lifecycle deletion rule for expired blobs where authorized.
- Check rule filters, last modification or access tracking, eligibility and execution timing.
- Stage block data with Put Block and finalize with Put Block List.
Explanation
Correct Answer
C:Lifecycle rules evaluate selected blob types and conditions asynchronously. Matching rules and supported tier transitions determine which objects move.
Incorrect Answers
A:Lifecycle policies can remove eligible past versions. Recovery expectations must align with the configured cleanup window. This matters here because a lifecycle policy marks data eligible but an affected blob remains in its original tier.
B:Archive movement does not delete an object. Retention expiry needs a separate supported delete policy. This matters here because a lifecycle policy marks data eligible but an affected blob remains in its original tier.
D:Block blobs support staged blocks and an explicit commit list, providing a controlled final object assembly. This matters here because a lifecycle policy marks data eligible but an affected blob remains in its original tier.
Question 541
A security team wants temporary blobs automatically deleted after 90 days, rather than merely archived. Which lifecycle action is required?
- Configure soft delete and assume a blob will be permanently removed on day 90 without a lifecycle deletion rule.
- Configure a Blob lifecycle delete action with the appropriate age condition.
- Commit the staged blocks through the block list operation.
- Create Blob Storage lifecycle management rules with supported age-based tier actions.
Explanation
Correct Answer
B:Delete actions remove eligible objects after the configured condition, whereas tier transitions change cost and retrieval behavior. This matters here because a security team wants temporary blobs automatically deleted after 90 days, rather than merely archived. Which….
Incorrect Answers
A:Soft delete provides a recovery window after deletion; it does not initiate the deletion. Define a Blob lifecycle management rule to delete eligible objects after the specified age.
C:Uncommitted blocks do not constitute the normal committed blob object. Finalization requires an ordered committed block list. This matters here because a security team wants temporary blobs automatically deleted after 90 days, rather than merely archived. Which….
D:Lifecycle management can transition eligible blobs to access tiers and delete objects based on configured rules. Manual browsing is not required. This matters here because a security team wants temporary blobs automatically deleted after 90 days, rather than merely archived. Which….
Question 542
A policy transitions blobs to Archive but data remains after the legal retention deadline. What must change?
- Move eligible block blobs to the Archive access tier under supported redundancy and retention.
- Select the desired blob version ID or promote a previous version through the supported API.
- Check rule filters, last modification or access tracking, eligibility and execution timing.
- Add an explicitly scoped lifecycle deletion rule for expired blobs where authorized.
Explanation
Correct Answer
D:Archive movement does not delete an object. Retention expiry needs a separate supported delete policy. This matters here because a policy transitions blobs to Archive but data remains after the legal retention deadline.
Incorrect Answers
A:The Archive tier stores offline data at lower capacity cost with rehydration requirements. It is unsuitable for immediate reads. This matters here because a policy transitions blobs to Archive but data remains after the legal retention deadline.
B:Blob versions have distinct identifiers. Ordinary reads without a version selector target the current committed blob. This matters here because a policy transitions blobs to Archive but data remains after the legal retention deadline.
C:Lifecycle rules evaluate selected blob types and conditions asynchronously. Matching rules and supported tier transitions determine which objects move. This matters here because a policy transitions blobs to Archive but data remains after the legal retention deadline.
Question 543
A script deploys multiple VM resources and their names must include an index. What Bicep language feature fits?
- Keep deterministic identifiers for resources intended to be managed in place.
- Use a for expression to generate resources with index-based unique names.
- Run separate az deployment group create commands for each VM and omit the Bicep loop and index expression.
- Include the copy index or another unique value in the generated resource name.
Explanation
Correct Answer
B:Bicep loops create repeated resource instances with parameter-driven counts. Each instance needs a valid unique name. This matters here because a script deploys multiple VM resources and their names must include an index. What Bicep language feature fits.
Incorrect Answers
A:A new resource name is a different ARM resource identity. Repeated idempotent deployments require consistent target IDs and scope.
C:Repeated CLI calls are not the Bicep language mechanism for indexed resource declarations. A for-expression and deterministic names model those multiple instances in one template.
D:Repeated resource instances must have distinct resource identities in their scope. The loop count alone does not generate unique names. This matters here because a script deploys multiple VM resources and their names must include an index. What Bicep language feature fits.
Question 544
A Bicep loop creates repeated NIC definitions but references only one subnet ID. How can each instance map correctly?
- Index the relevant array or use each loop item to derive the intended subnet reference.
- Use one static subnet symbolic reference for every NIC generated in the loop, regardless of the loop index.
- Change a normal resource declaration to a correctly scoped existing resource declaration where appropriate.
- Avoid exposing sensitive values through ordinary deployment outputs and use protected secret handling.
Explanation
Correct Answer
A:Loop inputs can vary by iteration. An unindexed constant can incorrectly attach every NIC to the same subnet. This matters here because a Bicep loop creates repeated NIC definitions but references only one subnet ID. How can each instance map correctly.
Incorrect Answers
B:A single fixed reference sends each NIC to the same subnet, contradicting the requirement to map instances individually. Index the appropriate subnet collection or derive the association from each loop item.
C:A normal declaration describes desired deployment state. An existing declaration is the Bicep mechanism for referencing resources not created by this file. This matters here because a Bicep loop creates repeated NIC definitions but references only one subnet ID. How can each instance map correctly.
D:Secure input types do not justify publishing secrets as unprotected outputs. Logs and outputs require independent controls. This matters here because a Bicep loop creates repeated NIC definitions but references only one subnet ID. How can each instance map correctly.
Question 545
A Bicep resource requires a VM managed identity ID created in the same deployment. Which syntax supplies it?
- Use stable resource names and declarative configuration under Resource Manager.
- Reference a child module's output name without actually declaring an output or reading the new identity resource's .id property.
- Set an explicit dependsOn array without referencing the created identity resource’s id property.
- Reference the identity resource's symbolic id property.
Explanation
Correct Answer
D:Bicep symbolic resource references expose derived IDs and establish dependencies where needed. Guessing an ID is brittle.
Incorrect Answers
A:Resource Manager reconciles the declared identities on repeated deployments. Randomizing identifiers can create additional resources.
B:An undeclared module output cannot supply a managed identity ID to the consumer. Reference the identity's symbolic.id in the same file, or explicitly declare and consume a module output when crossing module boundaries.
C:Dependency declarations control ordering but do not supply a resource identifier to another property. Use the identity’s symbolic.id value in the consumer and allow Bicep to infer the dependency.
Question 546
A template hardcodes a principal ID expected to be created during deployment, leading to errors. What should change?
- Check the plan's resource ID and the web app's inferred or explicit dependency.
- Investigate the proposed deletion and deployment mode before executing the actual deployment.
- Use the actual deployed identity's properties or output values rather than a guessed principal ID.
- Review resource semantics and run Bicep lint or what-if before production deployment.
Explanation
Correct Answer
C:Principal IDs are assigned by the platform. Expressions must read the created identity rather than predict an opaque GUID.
Incorrect Answers
A:A reference to an incorrect plan ID may fail even when both resources are described. Correct symbolic dependency and valid ID resolution are needed. This matters here because a template hardcodes a principal ID expected to be created during deployment, leading to errors.
B:What-if output helps identify potentially destructive effects. Approval should not rely only on a successful syntax validation. This matters here because a template hardcodes a principal ID expected to be created during deployment, leading to errors.
D:A conversion pass does not prove that generated resources preserve operational intent. Validation and human review remain important. This matters here because a template hardcodes a principal ID expected to be created during deployment, leading to errors.
Question 547
A web deployment has an administrator password parameter that must be protected from deployment logs. Which type should be declared?
- Add an if condition to the relevant resource or module declaration.
- Decompile the ARM template to Bicep and inspect the generated source.
- Add an explicit dependsOn list to the VM deployment while keeping the administrator password as a plain string parameter.
- Use a secureString or @secure() parameter and an approved secret supply path.
Explanation
Correct Answer
D:Secure parameters reduce unintended exposure of secret values in deployment details. Plaintext defaults in source control are unsafe.
Incorrect Answers
A:Bicep conditional deployment lets a template include optional resources based on a parameter. Manually deleting source lines is not reusable. This matters here because a web deployment has an administrator password parameter that must be protected from deployment logs. Which type….
B:Bicep decompilation provides a translation starting point. Generated output can require manual cleanup and validation. This matters here because a web deployment has an administrator password parameter that must be protected from deployment logs. Which type….
C:Dependency ordering cannot hide confidential parameter values. The password should use secureString or an @secure() Bicep parameter and an approved secret-supply mechanism to avoid accidental disclosure.
Question 548
An Azure NIC has accelerated networking disabled after VM migration to a smaller size. What is the likely cause?
- Force accelerated networking on an unsupported smaller VM family without restoring a supported size.
- Recheck accelerated-networking compatibility of the target VM SKU and NIC state.
- Verify the VM SKU's region availability, quota and current capacity constraints.
- Review deployment to availability sets or availability zones with appropriate redundancy.
Explanation
Correct Answer
B:Not every VM SKU supports accelerated networking. A resize can change which NIC features are available. This matters here because an Azure NIC has accelerated networking disabled after VM migration to a smaller size. What is the likely cause.
Incorrect Answers
A:Accelerated networking availability is constrained by the VM series and size. A migration to a smaller unsupported SKU can disable that path; inspect the NIC flag and supported SKU eligibility before remediation.
C:A VM size may be regionally unsupported or limited by quotas. An image existing in the region does not guarantee compute capacity. This matters here because an Azure NIC has accelerated networking disabled after VM migration to a smaller size. What is the likely cause.
D:Placement across distinct update domains can reduce simultaneous planned maintenance impact. Plain independent VMs may share risk. This matters here because an Azure NIC has accelerated networking disabled after VM migration to a smaller size. What is the likely cause.
Question 549
A critical workload must encrypt eligible VM temporary disk and disk-cache data at the host. Which security setting fits?
- Attach an appropriately sized persistent Azure managed data disk and mount it in the guest.
- Direct new connections to healthy backend instances rather than the failed VM.
- Enable encryption at host for supported virtual machines and disk configurations.
- Recognize that the VM temporary disk is nonpersistent through certain host lifecycle events.
Explanation
Correct Answer
C:Encryption at host covers eligible host-side data paths beyond ordinary persistent managed disk encryption. Support depends on region, VM and disk options. This matters here because a critical workload must encrypt eligible VM temporary disk and disk-cache data at the host. Which security setting fits.
Incorrect Answers
A:Managed disks provide durable Azure storage tied to the VM, whereas temporary disks can lose data on deallocation or host events. This matters here because a critical workload must encrypt eligible VM temporary disk and disk-cache data at the host. Which security setting fits.
B:Load balancer health probing can remove unhealthy backend targets. A single healthy VM may still be a capacity limitation. This matters here because a critical workload must encrypt eligible VM temporary disk and disk-cache data at the host. Which security setting fits.
D:Temporary storage is local to the VM host and should not hold irreplaceable application content. Use persistent managed disks for durable data. This matters here because a critical workload must encrypt eligible VM temporary disk and disk-cache data at the host. Which security setting fits.
Question 550
A deployment enables a customer-managed disk encryption key but leaves host temporary paths unaddressed. What additional option is relevant?
- Attach an appropriately sized persistent Azure managed data disk and mount it in the guest.
- Review deployment to availability sets or availability zones with appropriate redundancy.
- Check managed disk and other retained resource charges separately from VM compute.
- Review encryption-at-host support and configuration separately from managed disk encryption.
Explanation
Correct Answer
D:Managed disk server-side encryption and encryption at the host operate at different layers. Configuring one does not imply the other. This matters here because a deployment enables a customer-managed disk encryption key but leaves host temporary paths unaddressed. What….
Incorrect Answers
A:Managed disks provide durable Azure storage tied to the VM, whereas temporary disks can lose data on deallocation or host events. This matters here because a deployment enables a customer-managed disk encryption key but leaves host temporary paths unaddressed. What….
B:Placement across distinct update domains can reduce simultaneous planned maintenance impact. Plain independent VMs may share risk. This matters here because a deployment enables a customer-managed disk encryption key but leaves host temporary paths unaddressed. What….
C:Deallocation ends normal allocated compute charges but does not automatically delete attached managed disks or public IP resources. This matters here because a deployment enables a customer-managed disk encryption key but leaves host temporary paths unaddressed. What….
