Microsoft AZ-104 Practice Test 75
Question 740
An analytics workspace needs directory-aware Blob Storage and POSIX-like ACLs without an SMB share. What feature should be enabled?
- Increase an ordinary SMB file share quota and expect POSIX-like directory ACL behavior in Azure Blob Storage.
- Use Azure Data Lake Storage Gen2 hierarchical namespace in a compatible account.
- Replace a hierarchical Blob namespace with an SMB share and assume POSIX-style ACLs remain available.
- Inspect per-share quota usage and the selected Azure Files performance model.
Explanation
Correct Answer
B:Hierarchical namespace supports directories and ACLs for data-lake workloads, with Blob API integration. Design must check feature compatibility. This matters here because an analytics workspace needs directory-aware Blob Storage and POSIX-like ACLs without an SMB share. What feature….
Incorrect Answers
A:Azure Files share quota does not enable a hierarchical namespace or POSIX-like directory ACLs for blobs. Those capabilities belong to an appropriately configured Azure Data Lake Storage Gen2 account.
C:An Azure Files SMB share does not provide the hierarchical namespace and POSIX-like ACL model expected by a data lake workload. Enable compatible Azure Data Lake Storage Gen2 hierarchical namespace for the Blob account instead.
D:A share may reach its own size ceiling before the containing account is full. Quota and tier limits govern available writes. This matters here because an analytics workspace needs directory-aware Blob Storage and POSIX-like ACLs without an SMB share. What feature….
Question 741
A data lake user sees a file but cannot traverse a parent directory. What ACL permission matters?
- Increase Azure Files share capacity because a data lake user cannot traverse a parent directory, without checking its ACLs.
- Inspect the signed credential's blob write permission and current storage locks or policies.
- Inspect file-system ACLs on the target folder as well as the share-level role.
- Inspect the execute or traverse ACL on each parent directory in the hierarchical namespace.
Explanation
Correct Answer
D:Directory traversal can be required to reach child objects. File read permission alone does not bypass missing parent execute rights. This matters here because a data lake user sees a file but cannot traverse a parent directory. What ACL permission matters.
Incorrect Answers
A:A capacity change does not grant access through a directory in hierarchical namespace. Evaluate the execute/traverse permission on each ancestor path and the applicable identity or group ACL.
B:Interactive tools still obey data-plane access and resource constraints. A working list operation does not prove permission to write blob contents. This matters here because a data lake user sees a file but cannot traverse a parent directory. What ACL permission matters.
C:Share-level authorization and folder ACLs are cumulative controls. Access to the share does not automatically grant access to every directory. This matters here because a data lake user sees a file but cannot traverse a parent directory. What ACL permission matters.
Question 742
An external partner must upload into one blob container without seeing other containers. Which authorization scope should be chosen?
- Create a private blob container under the appropriate Azure Storage account.
- Enable container soft delete and assume the partner automatically receives write permission only to that one container.
- Grant a scoped SAS or appropriate data role constrained to the destination container.
- Stage block data with Put Block and finalize with Put Block List.
Explanation
Correct Answer
C:Container-scoped permissions limit an external workflow's access surface. Storage account keys would expose broader authorization. This matters here because an external partner must upload into one blob container without seeing other containers. Which authorization scope….
Incorrect Answers
A:Blob containers organize data objects addressed through the Blob service API. They differ from SMB file shares. This matters here because an external partner must upload into one blob container without seeing other containers. Which authorization scope….
B:Recovery settings do not authenticate or authorize a partner. Use a narrowly scoped SAS or an appropriate data role for the specified container and operation.
D:Block blobs support staged blocks and an explicit commit list, providing a controlled final object assembly. This matters here because an external partner must upload into one blob container without seeing other containers. Which authorization scope….
Question 743
A declarative Azure deployment runs twice and should update existing named resources rather than create duplicates. What principle enables this?
- Generate a fresh managed-identity principal ID on every deployment and rely on that to make resource creation idempotent.
- Index the relevant array or use each loop item to derive the intended subnet reference.
- Generate new random resource names on every deployment while using a stable output name for each run.
- Use stable resource names and declarative configuration under Resource Manager.
Explanation
Correct Answer
D:Resource Manager reconciles the declared identities on repeated deployments. Randomizing identifiers can create additional resources. This matters here because a declarative Azure deployment runs twice and should update existing named resources rather than create duplicates.….
Incorrect Answers
A:Idempotent resource updates depend on stable resource identifiers and declarative state, not on changing the identity of the pipeline caller.
B:Loop inputs can vary by iteration. An unindexed constant can incorrectly attach every NIC to the same subnet. This matters here because a declarative Azure deployment runs twice and should update existing named resources rather than create duplicates.….
C:An output name cannot make separately named resources idempotent. Stable resource identities and declarative desired state allow the deployment to converge rather than create new resources on each run.
Question 744
A team changes the resource name on every build and accumulates extra resources. What should be corrected?
- Use the deployment command for the file's intended target scope and resource-group context.
- Guard dependent references and outputs consistently when the resource is conditionally deployed.
- Append the running identity principal ID to resource names on every build so the names are always new.
- Keep deterministic identifiers for resources intended to be managed in place.
Explanation
Correct Answer
D:A new resource name is a different ARM resource identity. Repeated idempotent deployments require consistent target IDs and scope. This matters here because a team changes the resource name on every build and accumulates extra resources.
Incorrect Answers
A:Deployment scope affects available resource types and evaluation context. A resource-group template cannot simply be run as a subscription-scoped deployment. This matters here because a team changes the resource name on every build and accumulates extra resources.
B:Conditional resources can be omitted, so unguarded references can fail. The dependency graph and expressions must handle the disabled case. This matters here because a team changes the resource name on every build and accumulates extra resources.
C:Changing the resource name at each build creates more resources. Use stable declarative names for resources that should be updated in place.
Question 745
An engineer wants to export a resource group's existing resource definitions as an initial ARM template. Which portal capability is relevant?
- Run a deployment against the resource group instead of exporting its existing definitions as an initial ARM template.
- Use a for expression to generate resources with index-based unique names.
- Decompile the ARM template to Bicep and inspect the generated source.
- Export the resource group's template and review the generated representation.
Explanation
Correct Answer
D:Template export can capture many existing resource definitions for adaptation. Exports are not guaranteed complete reusable production source. This matters here because an engineer wants to export a resource group's existing resource definitions as an initial ARM template. Which….
Incorrect Answers
A:Deploying changes resources; it does not retrieve the current resource group's definitions for review. Use the portal's Export template capability and validate the generated representation.
B:Bicep loops create repeated resource instances with parameter-driven counts. Each instance needs a valid unique name. This matters here because an engineer wants to export a resource group's existing resource definitions as an initial ARM template. Which….
C:Bicep decompilation provides a translation starting point. Generated output can require manual cleanup and validation. This matters here because an engineer wants to export a resource group's existing resource definitions as an initial ARM template. Which….
Question 746
The exported ARM template contains environment-specific IDs and unsupported read-only properties. What should be done before reuse?
- Declare a location parameter and reference it in resource properties.
- Replace environment-specific IDs with one unrelated identity resource ID and redeploy the unreviewed exported template.
- Decompile the ARM template to Bicep and inspect the generated source.
- Review and parameterize environment references and remove invalid generated properties.
Explanation
Correct Answer
D:Exported templates often contain source-environment identifiers and properties that cannot be redeployed unchanged. Editing and validation are necessary. This matters here because the exported ARM template contains environment-specific IDs and unsupported read-only properties.
Incorrect Answers
A:Parameters separate deployment-time choices from reusable resource definitions. Hard-coded locations require editing source for each environment. This matters here because the exported ARM template contains environment-specific IDs and unsupported read-only properties.
B:An exported template requires valid parameters, scopes, and supported writable properties; substituting an identity ID does not make invalid IDs or read-only fields reusable.
C:Bicep decompilation provides a translation starting point. Generated output can require manual cleanup and validation. This matters here because the exported ARM template contains environment-specific IDs and unsupported read-only properties.
Question 747
A team maintains an ARM JSON resource-group deployment and needs to inspect the potential deletion impact of complete versus incremental mode before making changes. Which review action is prudent?
- Skip what-if and execute complete-mode ARM deployment to discover which existing resources will be deleted.
- Declare a named output that lists resource IDs but skip the what-if inspection of complete-mode deletions.
- Use what-if and review the deployment mode's deletion semantics before execution.
- Investigate the proposed deletion and deployment mode before executing the actual deployment.
Explanation
Correct Answer
C:Complete mode can remove resources omitted from supported deployment scopes, while incremental mode usually retains them. Destructive changes require explicit approval. Microsoft now recommends incremental deployments and Azure deployment stacks for managed resource deletions because complete mode is being deprecated; the what-if check is a review safeguard, not an instruction to use complete mode in new designs.
Incorrect Answers
A:Applying complete mode is not a non-destructive way to evaluate potential deletion. First examine the intended deployment mode and its predicted changes using a scoped what-if review.
B:Output declarations reveal values after deployment and do not predict the effects of deployment mode. Inspect the scoped what-if result and review potential resource deletions before approving complete-mode execution.
D:What-if output helps identify potentially destructive effects. Approval should not rely only on a successful syntax validation. This matters here because a team maintains an ARM JSON resource-group deployment and needs to inspect the potential deletion impact of….
Question 748
A VM must run inside a region with reserved capacity for critical applications during high demand. Which option can help availability?
- Place supported VM instances in different availability zones within the region.
- Consider an eligible Azure capacity reservation group for supported VM sizes and regions.
- Move to a multi-zone or multi-region resiliency design where supported.
- Publish a versioned image definition in Azure Compute Gallery with supported regional replication.
Explanation
Correct Answer
B:Capacity reservations can secure capacity for specified VM size and zone/region combinations. They are separate from quotas and redundancy. This matters here because a VM must run inside a region with reserved capacity for critical applications during high demand. Which option can….
Incorrect Answers
A:Zones provide distinct facility-level fault isolation in supported regions. An availability set alone does not span separate zones. This matters here because a VM must run inside a region with reserved capacity for critical applications during high demand. Which option can….
C:Availability sets reduce host-level correlated failures but do not create independent zonal or regional facilities. This matters here because a VM must run inside a region with reserved capacity for critical applications during high demand. Which option can….
D:Compute Gallery stores and distributes reusable image versions for consistent provisioning across locations. It is more structured than cloning one VM manually. This matters here because a VM must run inside a region with reserved capacity for critical applications during high demand. Which option can….
Question 749
A VM deployment has enough regional subscription vCPU quota, but Azure returns AllocationFailed because the selected availability zone lacks capacity for the requested VM size. What is the next capacity-focused action?
- Try an eligible VM size or availability zone with available physical capacity, or plan a supported capacity reservation where appropriate.
- Disable password authentication under approved access policy and limit SSH ingress through NSG or Bastion.
- Include required dependent resources and validate move restrictions before executing.
- Request another increase to the already sufficient regional vCPU quota without considering zonal capacity or VM SKU availability.
Explanation
Correct Answer
A:An AllocationFailed capacity result is different from quota exhaustion. Because quota has already been checked, the operator should evaluate actual host availability in the selected zone, choose another eligible zone or size, or use a supported capacity reservation when planned guarantees are required.
Incorrect Answers
B:Key authentication alone does not prohibit password guessing if the daemon still accepts passwords. Network exposure should also be narrowed. This matters here because a VM deployment has enough regional subscription vCPU quota, but Azure returns AllocationFailed because the selected….
C:Azure resource moves have dependency and provider constraints. Omitting related network assets can invalidate the move. This matters here because a VM deployment has enough regional subscription vCPU quota, but Azure returns AllocationFailed because the selected….
D:Increasing unused quota does not create physical capacity in the specific failed zone. Address the allocation constraint by checking available zones, sizes and reservations.
Question 750
A web application needs accelerated disk performance but the selected VM size supports only Standard HDD. What should the admin evaluate?
- Resize only the guest filesystem while retaining a VM SKU that cannot use the requested premium managed disk tier.
- Choose an appropriate compute-optimized VM size that satisfies CPU and region capacity needs.
- Choose a VM SKU and disk tier combination that supports the required managed disk capability.
- Choose a VM size that supports the required number of NICs and approved networking configuration.
Explanation
Correct Answer
C:Disk type eligibility and host throughput are constrained by VM size and region. Storage requirements must be validated with compute selection.
Incorrect Answers
A:Guest filesystem size does not enable disk types unsupported by the VM family or region. Select a compatible VM size and disk SKU after verifying both eligibility and throughput limits.
B:Azure VM families trade off CPU, memory, disk and price. A general-purpose or memory-optimized shape may cost more for the required CPU workload. This matters here because a web application needs accelerated disk performance but the selected VM size supports only Standard HDD.
D:NIC count support varies by VM SKU. A configuration outside the supported count cannot be fixed by adding subnets alone. This matters here because a web application needs accelerated disk performance but the selected VM size supports only Standard HDD.
