Microsoft AZ-104 Practice Test 63
Question 620
An admin wants to prevent deletion of one database but keep neighboring resources in the group editable and deletable. Where should the lock reside?
- Use a management group and grant Reader at the approved ancestor scope.
- Apply the delete lock at the containing resource group so that every neighboring database is blocked too.
- Attach the CanNotDelete lock at the database resource scope.
- Check subscription-level compute vCPU quotas for the applicable region and VM family.
Explanation
Correct Answer
C:A resource-specific lock protects only the selected asset rather than every descendant in the resource group. Parent locks could have a wider blast radius. This matters here because an admin wants to prevent deletion of one database but keep neighboring resources in the group editable and deletable.
Incorrect Answers
A:Management groups organize subscriptions and permit inherited governance policies and role grants. They do not contain VMs directly. This matters here because an admin wants to prevent deletion of one database but keep neighboring resources in the group editable and deletable.
B:Lock inheritance makes a resource-group lock broader than the requested single-database protection. Apply CanNotDelete at the specific database resource scope after checking any existing parent locks.
D:Quota is evaluated per subscription and relevant region/family. A storage account capacity metric cannot establish available VM family quota. This matters here because an admin wants to prevent deletion of one database but keep neighboring resources in the group editable and deletable.
Question 621
A delete lock added at subscription scope blocks unrelated test resources. How should the scope be corrected?
- Remove the overly broad lock under authorization and reapply protection only at the required resource scope.
- Inspect the VM tags directly and the existence of a tag-inheritance policy.
- Leave the subscription-wide deletion lock intact and add a narrower lock to the production resource.
- Check Azure Activity Log for Microsoft.Authorization/locks write or delete operations.
Explanation
Correct Answer
A:Management locks inherit from ancestors. The right scope is the smallest protecting the intended asset.
Incorrect Answers
B:Tagging the parent group is not equivalent to tagging each child. Cost reporting by resource tag needs metadata on the actual billable resource. This matters here because a delete lock added at subscription scope blocks unrelated test resources.
C:A narrower child lock does not cancel the broad inherited subscription lock. An authorized administrator must remove or correct the parent lock, then reapply CanNotDelete only where protection is required.
D:Resource lock changes are Azure control-plane operations that can be traced to authorized callers. VM guest logs do not capture this operation reliably. This matters here because a delete lock added at subscription scope blocks unrelated test resources.
Question 622
A platform team needs to group subscriptions by business unit while delegating policy administration. What should it design?
- Use a management group and grant Reader at the approved ancestor scope.
- Open Azure Service Health and configure relevant service-health alerts.
- Create an Azure Policy initiative containing the required policy definitions.
- Build a management-group hierarchy aligned to governance boundaries.
Explanation
Correct Answer
D:Management groups support broad governance scope and administrative inheritance. Naming individual subscription resources is not an effective hierarchy. This matters here because a platform team needs to group subscriptions by business unit while delegating policy administration.
Incorrect Answers
A:Management groups organize subscriptions and permit inherited governance policies and role grants. They do not contain VMs directly. This matters here because a platform team needs to group subscriptions by business unit while delegating policy administration.
B:Service Health reports subscription-affecting incidents and planned maintenance. The Resource Health blade targets individual asset condition. This matters here because a platform team needs to group subscriptions by business unit while delegating policy administration.
C:Initiatives group definitions for assignment and aggregate compliance reporting. Resource locks do not combine definitions into policy packages. This matters here because a platform team needs to group subscriptions by business unit while delegating policy administration.
Question 623
One subscription appears under the wrong policy branch and receives incompatible rules. What operation should be reviewed?
- Inspect and correct its management-group parent relationship after assessing inherited policies.
- Apply consistent resource tags for businessUnit and environment to relevant resources.
- Resource-group deletion also initiates deletion of its contained resources, subject to protections.
- Review inherited policy assignments at the subscription's new management-group ancestry.
Explanation
Correct Answer
A:A subscription's parent management group controls inherited assignments. Moving it changes policy and RBAC conditions and needs impact review. This matters here because one subscription appears under the wrong policy branch and receives incompatible rules. What operation should be….
Incorrect Answers
B:Tags provide dimensions for grouping costs where billing meters support them. A display name alone is an unreliable allocation category. This matters here because one subscription appears under the wrong policy branch and receives incompatible rules. What operation should be….
C:Resource group lifetime governs the resources inside. Locks and dependencies may prevent or complicate removal, so deletion must be reviewed carefully. This matters here because one subscription appears under the wrong policy branch and receives incompatible rules. What operation should be….
D:A management hierarchy move changes effective ancestor governance. A child's local settings cannot simply override an inherited deny effect. This matters here because one subscription appears under the wrong policy branch and receives incompatible rules. What operation should be….
Question 624
A company's operations team wants to evaluate Azure Policy compliance every week and triage drift. Which service state should be queried?
- Use Azure Policy compliance state and assignment evaluation details for the reporting scope.
- Inspect policy evaluation details and the allowedLocations parameter in the effective assignment.
- Use an Azure Policy audit effect on the relevant resource properties.
- Review and update the approved SKU parameter in the effective Azure Policy assignment under change control.
Explanation
Correct Answer
A:Compliance records identify evaluated resources and policies with noncompliant states. A tag listing alone does not indicate whether a complex initiative passes. This matters here because a company's operations team wants to evaluate Azure Policy compliance every week and triage drift. Which service….
Incorrect Answers
B:A deny decision depends on evaluated resource properties and assignment parameters. Changing unrelated tags will not fix a location outside the allowlist. This matters here because a company's operations team wants to evaluate Azure Policy compliance every week and triage drift. Which service….
C:Audit records noncompliance while allowing operations to proceed. Deny would prevent resources that violate the configured rule. This matters here because a company's operations team wants to evaluate Azure Policy compliance every week and triage drift. Which service….
D:Policy parameters determine the allowed set. VM Owner cannot override a deny rule by resubmitting the same noncompliant SKU. This matters here because a company's operations team wants to evaluate Azure Policy compliance every week and triage drift. Which service….
Question 625
An auditor asks for record-level storage requests for an incident, beyond aggregate capacity metrics. What should be enabled?
- Enable Secure transfer required on the Azure storage account.
- Provide auditors one expiring blob SAS and assume that automatically produces historical request logs.
- Route Azure Storage resource logs through Azure Monitor diagnostic settings to an authorized sink.
- Inspect the browser preflight request and storage CORS response headers.
Explanation
Correct Answer
C:Request logs can capture relevant operation details for investigating data-plane usage. Metrics alone summarize activity without full request context.
Incorrect Answers
A:The secure-transfer flag requires HTTPS for supported storage requests. Encryption at rest protects a different data state. This matters here because an auditor asks for record-level storage requests for an incident, beyond aggregate capacity metrics.
B:A SAS delegates operations but does not configure resource-level audit retention. Enable Storage diagnostic resource logs, route them to a controlled destination and check actual request fields and retention.
D:Browsers enforce cross-origin policy while command-line clients normally do not. The difference can arise even when the underlying authentication succeeds. This matters here because an auditor asks for record-level storage requests for an incident, beyond aggregate capacity metrics.
Question 626
Storage diagnostic logs are missing from Log Analytics although account metrics exist. Which configuration should be reviewed?
- Compare the caller's observed public IPv4 egress address with the storage firewall allowlist.
- Inspect diagnostic settings, selected log categories, destination and retention configuration.
- Configure the storage account firewall's selected public IP address rules.
- Review the specific trusted-services exception and its supported service eligibility.
Explanation
Correct Answer
B:Platform metrics do not imply that resource logs were exported. Diagnostic routing and log categories must be explicitly supported and enabled. This matters here because storage diagnostic logs are missing from Log Analytics although account metrics exist. Which configuration should be….
Incorrect Answers
A:NAT and corporate proxy egress addresses may differ from the client's private address. A matching token cannot bypass an excluded network. This matters here because storage diagnostic logs are missing from Log Analytics although account metrics exist. Which configuration should be….
C:Storage network ACLs restrict accepted source networks. A correct SAS does not override a rejected source IP. This matters here because storage diagnostic logs are missing from Log Analytics although account metrics exist. Which configuration should be….
D:Trusted-service bypass is a defined network exception for supported workloads. It is not a blanket pass for every Azure-hosted VM. This matters here because storage diagnostic logs are missing from Log Analytics although account metrics exist. Which configuration should be….
Question 627
A browser-based application gets a CORS error from Azure Blob Storage despite the user's SAS being valid. What should be configured?
- Define the permitted origin, methods and headers in the storage service's CORS rules.
- Issue a new user delegation SAS without allowing the browser application's origin in the storage CORS policy.
- Confirm whether the service and operation qualify for trusted-service network bypass.
- Enable Secure transfer required on the Azure storage account.
Explanation
Correct Answer
A:CORS governs browser cross-origin checks and is independent of storage authentication. A valid token cannot eliminate an unsupported browser origin.
Incorrect Answers
B:Successful SAS authorization cannot satisfy a browser preflight denied by CORS. Configure allowed origins, methods and headers for the storage service, and verify the OPTIONS/actual request behavior.
C:The trusted-services list applies to designated services, not every resource merely because it runs in Azure. A regular VM may require an explicit network allow rule. This matters here because a browser-based application gets a CORS error from Azure Blob Storage despite the user's SAS being valid.
D:The secure-transfer flag requires HTTPS for supported storage requests. Encryption at rest protects a different data state. This matters here because a browser-based application gets a CORS error from Azure Blob Storage despite the user's SAS being valid.
Question 628
A direct curl request succeeds but the same request from a web page is blocked by the browser. What does this suggest?
- Check the second subnet's service endpoint configuration and individual storage firewall rule.
- Inspect signed start time, expiry and client clock skew relative to storage service time.
- Inventory which clients still use key1 rather than key2 or identity-based access.
- Inspect the browser preflight request and storage CORS response headers.
Explanation
Correct Answer
D:Browsers enforce cross-origin policy while command-line clients normally do not. The difference can arise even when the underlying authentication succeeds. This matters here because a direct curl request succeeds but the same request from a web page is blocked by the browser. What does this suggest.
Incorrect Answers
A:Allowing one subnet does not automatically allow every sibling subnet. Service endpoint and storage ACL changes are subnet-specific. This matters here because a direct curl request succeeds but the same request from a web page is blocked by the browser. What does this suggest.
B:A SAS may reject requests before its start time or after expiry. Time validation is independent of the user's RBAC role.
C:Applications pinned to a regenerated key fail authentication until updated. Having two keys enables a controlled rotation pattern. This matters here because a direct curl request succeeds but the same request from a web page is blocked by the browser. What does this suggest.
Question 629
An organization needs clients to access Azure Files using private IP paths over SMB. Which endpoint subresource is required?
- Create a private endpoint targeting the storage file service.
- Configure only a blob private endpoint and assume SMB traffic to Azure Files uses it.
- Create and approve a separate file-subresource private endpoint and its DNS mapping.
- Review management-plane listKeys permissions and remove unnecessary key exposure.
Explanation
Correct Answer
A:Azure Files SMB uses the file subresource. A blob private endpoint secures a different host name and protocol endpoint. This matters here because an organization needs clients to access Azure Files using private IP paths over SMB. Which endpoint subresource is….
Incorrect Answers
B:Azure Files SMB uses the file subresource, not the blob endpoint. Creating a blob-only private endpoint cannot deliver private TCP 445 connectivity to an Azure Files share; provision and resolve the file private endpoint in the relevant VNet.
C:Private endpoints target storage subresources such as blob or file independently. A blob endpoint does not privately expose the file service. This matters here because an organization needs clients to access Azure Files using private IP paths over SMB. Which endpoint subresource is….
D:Possession of account keys can grant data operations independently of role-based blob authorizations. Key-listing rights are sensitive and should be tightly controlled.
Question 630
The file endpoint resolves privately but a client still cannot connect on SMB port 445. What should be tested?
- Create and approve a separate file-subresource private endpoint and its DNS mapping.
- Check TCP port 445 reachability and intervening firewall or ISP rules.
- Associate the service SAS with a stored access policy on the relevant container.
- Reassign a blob data role instead of testing whether TCP 445 can traverse the client's route and firewalls.
Explanation
Correct Answer
B:Correct DNS and private endpoint state do not guarantee SMB connectivity. Network filtering of TCP 445 can block mounting. This matters here because the file endpoint resolves privately but a client still cannot connect on SMB port 445.
Incorrect Answers
A:Private endpoints target storage subresources such as blob or file independently. A blob endpoint does not privately expose the file service. This matters here because the file endpoint resolves privately but a client still cannot connect on SMB port 445.
C:Stored access policies can control supported service SAS permissions and timing and can be modified or removed to revoke linked SAS authorization. This matters here because the file endpoint resolves privately but a client still cannot connect on SMB port 445.
D:SMB file access requires successful TCP port 445 transport in addition to identity and share permissions. Private DNS resolution alone does not prove that network devices or service-provider policies permit the port.
