Microsoft AZ-104 Practice Test 65
Question 640
A developer attempts a nonaligned page-blob write and receives an alignment error. What constraint should be reviewed?
- Use an online cool or cold Blob Storage access tier appropriate to access frequency.
- Use valid page-aligned offsets and lengths for page blob writes.
- Use an append blob for supported append-only record operations.
- Inspect the signed credential's blob write permission and current storage locks or policies.
Explanation
Correct Answer
B:Page blobs impose alignment rules on range updates. An arbitrary byte offset is not a valid page-write boundary.
Incorrect Answers
A:Cool and cold tiers allow online retrieval with different storage, transaction, and minimum retention pricing. Archive is offline. This matters here because a developer attempts a nonaligned page-blob write and receives an alignment error. What constraint should be reviewed.
C:Append blobs allow appending blocks without replacing the whole object. Page blobs target range-based reads and writes. This matters here because a developer attempts a nonaligned page-blob write and receives an alignment error. What constraint should be reviewed.
D:Interactive tools still obey data-plane access and resource constraints. A working list operation does not prove permission to write blob contents. This matters here because a developer attempts a nonaligned page-blob write and receives an alignment error. What constraint should be reviewed.
Question 641
A big object upload should split into parallel chunks and commit only after all blocks are present. Which blob upload protocol fits?
- Use an append blob for supported append-only record operations.
- Grant a scoped SAS or appropriate data role constrained to the destination container.
- Enable soft delete rather than staging blocks and committing a block list for a parallel large-blob upload.
- Stage block data with Put Block and finalize with Put Block List.
Explanation
Correct Answer
D:Block blobs support staged blocks and an explicit commit list, providing a controlled final object assembly. This matters here because a big object upload should split into parallel chunks and commit only after all blocks are present. Which blob….
Incorrect Answers
A:Append blobs allow appending blocks without replacing the whole object. Page blobs target range-based reads and writes. This matters here because a big object upload should split into parallel chunks and commit only after all blocks are present. Which blob….
B:Container-scoped permissions limit an external workflow's access surface. Storage account keys would expose broader authorization. This matters here because a big object upload should split into parallel chunks and commit only after all blocks are present. Which blob….
C:Parallel block upload requires Put Block operations followed by Put Block List to commit the ordered blocks. Deletion retention cannot assemble an uploaded block blob.
Question 642
The uploader staged blocks but the object is absent from ordinary listing. What did it omit?
- Treat the object as append-only or use a different blob type for arbitrary overwrites.
- Initiate blob rehydration to a supported online tier and await completion.
- Select the desired blob version ID or promote a previous version through the supported API.
- Commit the staged blocks through the block list operation.
Explanation
Correct Answer
D:Uncommitted blocks do not constitute the normal committed blob object. Finalization requires an ordered committed block list. This matters here because the uploader staged blocks but the object is absent from ordinary listing. What did it omit.
Incorrect Answers
A:Append blob semantics permit adding data at the end instead of arbitrary middle writes. The access pattern determines blob type.
B:Archived blobs are not directly readable. Rehydration moves the object to an accessible tier and may take hours depending on priority. This matters here because the uploader staged blocks but the object is absent from ordinary listing. What did it omit.
C:Blob versions have distinct identifiers. Ordinary reads without a version selector target the current committed blob. This matters here because the uploader staged blocks but the object is absent from ordinary listing. What did it omit.
Question 643
The pipeline logs the value of a secret because it is emitted in a normal output. What should be corrected?
- Use stable resource names and declarative configuration under Resource Manager.
- Write the VM administrator credential into a normal Bicep output because the deployment pipeline logs only its name.
- Avoid exposing sensitive values through ordinary deployment outputs and use protected secret handling.
- Print the pipeline identity object ID alongside the secret and assume the ordinary output is then protected.
Explanation
Correct Answer
C:Secure input types do not justify publishing secrets as unprotected outputs. Logs and outputs require independent controls. This matters here because the pipeline logs the value of a secret because it is emitted in a normal output.
Incorrect Answers
A:Resource Manager reconciles the declared identities on repeated deployments. Randomizing identifiers can create additional resources. This matters here because the pipeline logs the value of a secret because it is emitted in a normal output.
B:Ordinary deployment output values can be recorded by the deployment or pipeline and exposed to readers. Mark sensitive output values secure where supported or avoid emitting secrets, and source them through approved secret handling.
D:Adding a nonsensitive identifier does not redact a secret emitted through a normal output. Avoid ordinary outputs for sensitive material and use supported secure secret handling.
Question 644
An ARM deployment must target the subscription instead of one resource group. Which Bicep setting declares this?
- Set targetScope to subscription and use resource types supported at that scope.
- Add an if condition to the relevant resource or module declaration.
- Use the deployment command for the file's intended target scope and resource-group context.
- Call az deployment group create for policy resources declared at subscription scope.
Explanation
Correct Answer
A:Bicep targetScope selects the deployment level. Resource groups and policy assignments can use subscription context under appropriate templates. This matters here because an ARM deployment must target the subscription instead of one resource group. Which Bicep setting declares this.
Incorrect Answers
B:Bicep conditional deployment lets a template include optional resources based on a parameter. Manually deleting source lines is not reusable. This matters here because an ARM deployment must target the subscription instead of one resource group. Which Bicep setting declares this.
C:Deployment scope affects available resource types and evaluation context. A resource-group template cannot simply be run as a subscription-scoped deployment. This matters here because an ARM deployment must target the subscription instead of one resource group. Which Bicep setting declares this.
D:Resource-group deployment targets the wrong Azure hierarchy level for subscription-level resources. Align Bicep targetScope with an az deployment sub invocation and authorized scope.
Question 645
A Bicep file declares targetScope resourceGroup but includes management-group-only resources. Why does it fail?
- Align the deployment targetScope and resource declarations with supported scope types.
- Change only the CLI resource-group argument while leaving a management-group resource declared under targetScope resourceGroup.
- Use the deployment command for the file's intended target scope and resource-group context.
- Guard dependent references and outputs consistently when the resource is conditionally deployed.
Explanation
Correct Answer
A:Azure Resource Manager enforces resource type availability at scopes. Changing a command flag alone cannot make a resource valid at the wrong scope. This matters here because a Bicep file declares targetScope resourceGroup but includes management-group-only resources. Why does it fail.
Incorrect Answers
B:An incorrect resource scope is a template semantic mismatch. Adjust the target scope or use valid scoped modules; changing the group argument does not make a management-group resource legal.
C:Deployment scope affects available resource types and evaluation context. A resource-group template cannot simply be run as a subscription-scoped deployment. This matters here because a Bicep file declares targetScope resourceGroup but includes management-group-only resources. Why does it fail.
D:Conditional resources can be omitted, so unguarded references can fail. The dependency graph and expressions must handle the disabled case. This matters here because a Bicep file declares targetScope resourceGroup but includes management-group-only resources. Why does it fail.
Question 646
An administrator needs to understand a failed ARM deployment where two resources returned individual provider errors. Where should troubleshooting begin?
- Check the plan's resource ID and the web app's inferred or explicit dependency.
- Use stable resource names and declarative configuration under Resource Manager.
- Inspect the failed deployment's operation records and provider error details.
- Change a normal resource declaration to a correctly scoped existing resource declaration where appropriate.
Explanation
Correct Answer
C:Deployment operations report the specific resource and provider error, such as quota or invalid property. The top-level status is often insufficient.
Incorrect Answers
A:A reference to an incorrect plan ID may fail even when both resources are described. Correct symbolic dependency and valid ID resolution are needed. This matters here because an administrator needs to understand a failed ARM deployment where two resources returned individual provider errors.
B:Resource Manager reconciles the declared identities on repeated deployments. Randomizing identifiers can create additional resources. This matters here because an administrator needs to understand a failed ARM deployment where two resources returned individual provider errors.
D:A normal declaration describes desired deployment state. An existing declaration is the Bicep mechanism for referencing resources not created by this file. This matters here because an administrator needs to understand a failed ARM deployment where two resources returned individual provider errors.
Question 647
A deployment error says RequestDisallowedByPolicy. What should be checked before changing template syntax?
- Review the exact policy assignment and evaluated compliance condition blocking the resource.
- Add an output expression referencing the deployed account's blob endpoint.
- Rename the deployment and rerun az deployment group create to bypass a RequestDisallowedByPolicy denial.
- Change an identity symbolic reference until Azure Policy stops reporting RequestDisallowedByPolicy.
Explanation
Correct Answer
A:Policy denial is an external governance constraint, not necessarily malformed Bicep syntax. Inspect the evaluated rule and required parameter changes.
Incorrect Answers
B:Outputs return derived deployment values to callers. A parameter is an input and does not automatically expose the deployed endpoint. This matters here because a deployment error says RequestDisallowedByPolicy.
C:Azure Policy evaluates the requested resource configuration, not just a deployment's name. Inspect the effective policy assignment and rejected property before attempting an authorized correction.
D:Policy denial is based on evaluated resource properties and effective policy assignments. Renaming an unrelated identity reference does not correct the rejected condition.
Question 648
A VM has no public IP yet an administrator reaches it through Bastion. How is this possible?
- Bastion connects through the VNet to the VM's private IP rather than requiring a VM public address.
- Configure an SSH public key for the Linux admin and protect the private key outside Azure.
- Direct new connections to healthy backend instances rather than the failed VM.
- Use a supported VM extension or configuration-management mechanism with the required script.
Explanation
Correct Answer
A:A VNet-hosted Bastion host brokers approved sessions to private VM addresses. A public IP on each guest is not necessary. This matters here because a VM has no public IP yet an administrator reaches it through Bastion. How is this possible.
Incorrect Answers
B:SSH public-key login avoids password reuse and supports controlled key management. The VM stores only the public key for verification. This matters here because a VM has no public IP yet an administrator reaches it through Bastion. How is this possible.
C:Load balancer health probing can remove unhealthy backend targets. A single healthy VM may still be a capacity limitation. This matters here because a VM has no public IP yet an administrator reaches it through Bastion. How is this possible.
D:Post-deployment automation is repeatable and can report success or failure. RDPing into each instance is operationally fragile. This matters here because a VM has no public IP yet an administrator reaches it through Bastion. How is this possible.
Question 649
A VM has multiple app servers and is expected to recover automatically when one host fails. What additional infrastructure is needed?
- Run redundant VM instances behind suitable load balancing with health checks.
- Use an application health extension or load-balancer health probe with an appropriate endpoint.
- Supply supported custom data and configure the guest initialization service to consume it.
- Use a suitable VM scale set upgrade policy with health-aware rollout controls.
Explanation
Correct Answer
A:A VM instance alone cannot provide service-level failover. Multiple healthy instances and a distribution layer are needed.
Incorrect Answers
B:Power-on state is not proof of application readiness. Health integration should observe the workload rather than only VM provisioning state. This matters here because a VM has multiple app servers and is expected to recover automatically when one host fails. What additional….
C:VM custom data makes bootstrap content available, but whether scripts execute depends on the guest image and cloud-init or other handlers. This matters here because a VM has multiple app servers and is expected to recover automatically when one host fails. What additional….
D:Scale-set upgrade policies determine how instance model changes are applied. Health gates and batch sizes reduce rollout risk. This matters here because a VM has multiple app servers and is expected to recover automatically when one host fails. What additional….
Question 650
A load balancer reports one backend unhealthy while other VMs are ready. Which behavior should be expected?
- Include required dependent resources and validate move restrictions before executing.
- Use an application health extension or load-balancer health probe with an appropriate endpoint.
- Ensure application state and load balancing support failover, not merely VM placement.
- Direct new connections to healthy backend instances rather than the failed VM.
Explanation
Correct Answer
D:Load balancer health probing can remove unhealthy backend targets. A single healthy VM may still be a capacity limitation. This matters here because a load balancer reports one backend unhealthy while other VMs are ready. Which behavior should be expected.
Incorrect Answers
A:Azure resource moves have dependency and provider constraints. Omitting related network assets can invalidate the move. This matters here because a load balancer reports one backend unhealthy while other VMs are ready. Which behavior should be expected.
B:Power-on state is not proof of application readiness. Health integration should observe the workload rather than only VM provisioning state. This matters here because a load balancer reports one backend unhealthy while other VMs are ready. Which behavior should be expected.
C:Infrastructure placement increases availability but cannot automatically make a single-host stateful app stateless. Health routing and data continuity are separate needs. This matters here because a load balancer reports one backend unhealthy while other VMs are ready. Which behavior should be expected.