Azure AZ-104Free Microsoft Azure Administrator practice test

Correct answer: B. Lsv3-series

Lsv3-series VMs are storage-optimized with directly attached local NVMe SSDs designed for high-throughput, low-latency storage workloads. Dsv5-series is general-purpose and does not provide local NVMe storage. Esv5-series is memory-optimized but also lacks local NVMe. Bsv2-series is burstable and intended for workloads with variable CPU needs, not high-speed local storage.

Correct answer: B. Add an entry for the disk in /etc/fstab using the disk's UUID

Linux uses /etc/fstab to define filesystems that should be mounted at boot time. Adding an entry with the disk's UUID ensures the data disk mounts automatically after reboot. Disk caching settings affect I/O performance, not mount behavior. Replacing the OS disk is disruptive and unrelated to mounting data disks. Write Accelerator is a feature for M-series VMs to accelerate log writes, not a mount mechanism.

Correct answer: A. Set min count 2, max count 20; create a scale-out rule CPU > 75% over 10 min and a scale-in rule CPU < 30% over 15 min on the autoscale profile

Azure VMSS autoscale profiles support metric-based rules with configurable thresholds, evaluation windows, and instance count boundaries (min/max). Setting scale-out on CPU > 75% over 10 min and scale-in on CPU < 30% over 15 min with min 2 / max 20 exactly matches the requirement. Scheduled autoscale acts on time patterns, not live CPU metrics. Predictive autoscale alone cannot enforce the threshold-triggered windows specified. A custom script extension is a fragile anti-pattern that duplicates built-in platform capability.

Correct answer: A. Use Azure Resource Mover to move the VM resource and its dependent disks to West Europe

Azure Resource Mover is the purpose-built service for moving VMs and their dependent resources (disks, NICs, NSGs) between Azure regions while validating dependencies. The snapshot-export-recreate approach works but is a manual multi-step workaround rather than the recommended Azure-native path. The Azure portal Move button on a resource group only supports subscription or resource group moves within the same region, not cross-region. VM region is an immutable property; it cannot be changed via CLI without recreating the resource.

Correct answer: B. Encryption at host

Encryption at host encrypts data at rest on the physical host before it is written to Azure Storage, covering the VM's OS disk, data disks, and temp disk in a single setting. It supports customer-managed keys stored in Azure Key Vault Standard tier (Premium tier is not required), and operates at the host layer rather than inside the guest OS. ADE encrypts volumes inside the guest OS using BitLocker or dm-crypt and requires Key Vault, but does not encrypt the temp disk by default and operates at a different layer. SSE-PMK is automatic storage-level encryption with Microsoft-managed keys, not customer-controlled. Confidential disk encryption is specific to Confidential VMs and ties encryption to a vTPM, which is a different security model.

Correct answer: B. Deploy all three VMs across two Availability Zones in the same region

Azure guarantees a 99.99% VM uptime SLA when two or more instances are deployed across two or more Availability Zones in the same region. Availability Zones are physically separate datacenters with independent power, cooling, and networking. An Availability Set provides a 99.95% SLA against hardware and planned maintenance events within a single datacenter, which does not meet 99.99%. Deploying all VMs in the same Availability Zone provides no redundancy against zone-level failures. A proximity placement group reduces network latency but provides no uptime SLA guarantee.

Correct answer: B. Disable public network access on the ACR, create a private endpoint in the hub VNet, and configure private DNS zone resolution in all spoke VNets

Disabling public access and using a private endpoint places the registry on the Azure private network; the private DNS zone ensures spoke VMs resolve the registry hostname to a private IP rather than the public endpoint. Peered spoke VNets inherit DNS resolution from the hub when configured correctly, making the registry reachable only from within the network. Service endpoints with firewall rules still expose the public endpoint and are a weaker isolation model. Allowlisting individual VM IPs is operationally fragile and does not prevent all public internet paths. Geo-replication addresses availability and latency, not network isolation.

Correct answer: B. Enable the ACR built-in retention policy to purge untagged manifests after 7 days

ACR Premium tier includes a built-in retention policy that automatically deletes untagged manifests after a configurable number of days (1–365), with no custom code or external orchestration required. This feature is exclusive to the Premium SKU. A Logic App calling the REST API achieves the same result but requires custom workflow maintenance. An Azure Function triggered by Event Grid fires per push event, not on a retention schedule, and would require additional logic. While 'az acr purge' via a Container Instance is a valid workaround, it is more complex than the native retention policy and requires scheduling infrastructure.

Correct answer: C. Azure Container Apps with the Consumption workload profile

Azure Container Apps with the Consumption workload profile scales to zero when idle (zero cost at idle), scales out rapidly on incoming requests, and supports container-native workloads without managing orchestration infrastructure. ACI is serverless and fast to start but does not natively scale to zero based on traffic patterns the way Container Apps do; billing continues for the full duration the container is running. AKS requires node pool management and incurs VM costs even at zero traffic. App Service Free tier does not support custom containers on a truly serverless consumption model.

Correct answer: B. Scale up the App Service Plan to Standard S3 (4 vCPUs, 7 GiB RAM)

Scaling up (vertical scaling) upgrades the App Service Plan to a larger SKU with more vCPUs and RAM, which directly addresses the memory exhaustion without adding instances. Scaling out adds more instances of the same size and does not increase per-instance RAM. Memory-based autoscale would add instances rather than increase per-instance memory, leaving the root cause unresolved. Moving to an ASE provides network isolation and higher limits but is a major infrastructure change that is disproportionate to the stated problem.