100% Latest & Updated Microsoft AZ-104 Practice Test Questions, Exam Dumps & Verified Answers!
30 Days Free Updates, Instant Download!
Question 480
An administrator places two VMs in zones 1 and 2 and also keeps their dependent database on a single-zone VM in zone 1. A zone-1 incident still interrupts the application. What architectural weakness remains?
- Two VMs in different zones always make every connected service zone redundant
- Add a zone-redundant public load balancer to the two web VMs while leaving the database on its sole zone-1 VM
- Enable Azure Site Recovery only for the zone-1 web VM and leave the sole database VM without a tested cross-zone recovery arrangement
- The application still depends on a single-zone database despite spreading only the web-tier VMs
Explanation
Correct Answer
D:Availability-zone resilience is end-to-end. Spreading one stateless tier cannot keep the service available if a required stateful dependency remains wholly inside the failed zone.
Incorrect Answers
A:Zone selection affects those VM resources, not automatically the database or external dependencies. The single-zone database is still a failure point.
B:A zone-redundant frontend can keep routing to healthy web instances after a zone loss, but it cannot make a database that exists only in zone 1 available. The required stateful backend still fails and interrupts the application; that dependency needs a cross-zone resilience design.
C:Protecting the web VM helps recover a stateless tier, but the application still requires its stateful database in the failed zone. Without a resilient or recoverable database dependency and tested failover, the service remains unavailable despite other recovery features.
Question 481
A zonal VM runs in availability zone 2. An operator tries to attach a zonal managed disk pinned to zone 1 and Azure rejects the attachment. What placement relationship should be corrected?
- Use a compatible disk deployed for the VM’s zone or another supported shared placement design
- Attach the zone-1 managed disk to the zone-2 VM in read-only mode, because zone placement requirements apply only to writable disks
- Attach a snapshot of the zone-1 disk directly as the VM data disk; snapshots are attachable regardless of their source zone
- Move the zone-1 disk resource into the VM’s resource group and assume resource-group membership changes its physical availability zone
Explanation
Correct Answer
A:Zonal disks and zone-pinned VMs have location compatibility requirements. A disk pinned to another zone is not automatically attachable across the region.
Incorrect Answers
B:Read-only attachment behavior does not override a managed disk’s zonal compatibility requirements. This disk is pinned to another availability zone, so the platform cannot attach it to the stated zone-2 VM merely by withholding write permission. Create or select a disk whose placement and type are supported for the target VM.
C:A managed disk snapshot is a recovery source, not an attachable managed disk that can be presented to a running VM as-is. To move disk content across zones, first create an eligible new managed disk from the snapshot in a supported destination zone and then attach that disk. Directly attaching the snapshot would not satisfy the compute disk resource requirement.
D:A resource group is a management scope and can contain Azure resources in different physical locations. Moving a managed disk between resource groups does not change its zone assignment. The attachment failure is due to the disk and VM having incompatible zonal placement; use an eligible disk in the VM zone or another supported design.
Question 482
An enterprise runs matching Azure workloads in two subscriptions and labels each VM as 'Zone 1' so they will supposedly share one physical datacenter for latency. A disaster-recovery planner cautions that zone IDs across subscriptions are logical, not guaranteed identical physical facilities. Which design principle follows?
- Remove all zone selections and assume default VM creation always places both VMs together
- Enable Azure Monitor alerts at the same severity and infer identical zone mapping from matching notifications
- Use supported zone mapping and placement guidance rather than assuming Zone 1 in different subscriptions is the same facility
- Assign both virtual machines the same resource-group tag named Zone1 to force physical co-location
Explanation
Correct Answer
C:Azure availability zones are identified by logical numbers that can map differently between subscriptions. Matching labels alone cannot certify physical co-location or shared failure boundaries; resilient and low-latency architectures need the correct placement assumptions.
Incorrect Answers
A:Non-zonal placement has its own availability behavior and does not force common physical facilities. Removing zone requests would not prove the intended relationship between subscriptions.
B:Alert severity controls event priority, not physical hardware placement. Identical alert rules do not establish which datacenter hosts the workloads.
D:Tags do not control Azure's physical datacenter placement. A matching metadata value has no ability to align zone mappings across subscription boundaries.
Question 483
A Windows failover-cluster project uses two Azure VMs in the same availability zone. Both nodes need to attach a common Premium SSD managed data disk for coordinated clustered access. The disk currently has the default single-writer attachment configuration and is detached. Which disk property should be set for a supported two-node shared-disk design?
- Set maxShares to 2 on the supported data disk, then use cluster-level coordination of shared block access
- Enable the disk as an OS disk on both VMs, because Azure shared disks require the same boot volume
- Keep the Premium SSD disk in its default single-attach mode and add both cluster VMs to an availability set, assuming the set permits simultaneous disk attachments
- Attach the unmodified single-attach disk to both nodes simultaneously and let Azure infer cluster ownership from VM names
Explanation
Correct Answer
A:Supported Azure managed disks use maxShares greater than one to permit attachment to multiple VMs; setting it to two allows a two-node cluster. Change maxShares while the disk is detached, as specified, and configure the guest cluster to coordinate write access. Shared attachment doesn't itself supply filesystem consistency.
Incorrect Answers
B:Shared Premium SSD disks are data disks, not a method to boot multiple VMs from one OS disk. Two independent cluster nodes require their own boot disks while they coordinate access to a common data LUN. Making it an OS disk would violate the shared-disk design.
C:Availability sets address placement across fault and update domains. They do not change a disk's sharing limit; the supported Premium SSD data disk must have maxShares set appropriately and cluster-aware coordination enabled before multiple VMs can attach it.
D:Azure doesn't infer multiattach permission from matching VM names or a shared subnet. A normal single-attach disk rejects incompatible additional attachments. The disk must be a supported shared SKU with maxShares configured appropriately, and the guest cluster must handle concurrent writers safely.
Question 484
An Azure administrator adds managed data disks to three virtual machines in an availability set. An engineer assumes that the Azure managed disks always share the same physical fault domain, so their VMs cannot obtain storage fault isolation. Which managed-disk placement behavior should be checked?
- Check the platform's managed-disk fault-domain alignment for VMs placed in the availability set
- Change all disk caching settings to ReadWrite to assign independent physical fault domains
- Assign all disks the same resource tag so Azure replicates the fault-domain membership
- Use a proximity placement group as a replacement for disk fault-domain distribution
Explanation
Correct Answer
A:Azure aligns managed disks with their VM's fault-domain placement for availability-set workloads where supported. This supports separation of storage fault exposure across the available VM fault domains, unlike assuming every disk is on one shared failure boundary.
Incorrect Answers
B:Disk caching controls guest I/O caching behavior and performance. It does not choose a managed disk's infrastructure fault domain or substitute for availability-set placement.
C:Tags annotate Azure resources but don't control hardware placement. They cannot align or separate managed-disk storage fault domains for an availability-set workload.
D:Proximity placement groups seek low-latency co-location, not the same resilience mechanism as fault-domain distribution. Using one does not establish the desired separation of fault risks.
Question 485
Two standalone Azure VMs already share a proximity placement group to reduce measured east-west latency. Following planned host maintenance, the group’s colocation status becomes Not aligned and identifies one affected VM. Both VMs are otherwise healthy. What supported remediation most directly restores the proximity alignment constraint?
- Delete the proximity placement group and place the VMs into separate regions so that network latency is minimized
- Remove and reassign the proximity placement group on the still-running affected VM, leaving its host allocation intact
- Stop (deallocate) and restart the affected standalone VM as guided by colocation status; review wider allocation constraints if that does not realign it
- Update the proximity placement group VM-size intent while keeping the already-running misaligned VM allocated
Explanation
Correct Answer
C:Microsoft documents the Not aligned status for a proximity placement group when at least one VM is no longer colocation-aligned. For standalone VMs, stop (deallocate) and restart the affected resource to seek aligned placement again; if allocation constraints prevent success, broader group deallocation and restart may be necessary. Availability-set or scale-set members require their separate group-level handling, which the scenario excludes.
Incorrect Answers
A:Deleting the group removes the existing colocation intent, and separating VMs into different regions would ordinarily increase physical distance rather than restore low-latency alignment. The maintenance event has disrupted alignment inside an existing group, not demonstrated a need for cross-region placement. Recovery should address the placement allocation of affected resources.
B:Changing the proximity placement group association for a running VM is not an in-place host realignment operation; changing placement association requires stopping and deallocating an affected VM as appropriate. Leaving the affected VM on the same allocation does not repair the reported Not aligned colocation state. Use the documented deallocate/start realignment flow.
D:Size intent helps Azure plan suitable deployment capacity, but editing intent does not relocate the already-running affected VM back into the group’s latency envelope. The observed issue is current physical colocation after host maintenance; deallocating and restarting the affected VM is the direct documented step, with larger-group remediation only if needed.
Question 486
An availability set was created with five update domains. Six VMs are deployed into it, and a planned maintenance event will rotate through update domains. A reviewer expects each of the six VMs to occupy a different update domain. Which allocation behavior must the maintenance plan account for?
- The sixth VM shares an update domain with the first VM; maintenance is staggered by update domain, not one domain per VM
- Azure silently creates a sixth update domain when the sixth VM joins the set
- All six VMs must restart at exactly the same moment because fault domains override update-domain placement
- The sixth VM is automatically relocated to an availability zone in another Azure region
Explanation
Correct Answer
A:Availability sets distribute VMs over the configured number of update domains and reuse those domains when VM count exceeds the domain count. With five update domains, the sixth VM is assigned to the same update domain as the first. Planned Azure maintenance operates on update domains rather than guaranteeing a distinct domain for every VM.
Incorrect Answers
B:The update-domain count is configured on the availability set and doesn't expand dynamically because one more VM has joined. Azure reuses existing domains. Assuming an automatic sixth domain could cause the team to misunderstand which VMs may restart together in planned host maintenance.
C:Fault domains protect against shared physical fault boundaries, while update domains stage planned maintenance restarts. Azure normally processes one update domain at a time and allows time for recovery before another. A failure to distinguish these two placements leads to an incorrect simultaneous-restart assumption.
D:An availability set is a VM placement construct within a region, not automatic cross-region or cross-zone migration. Adding a sixth VM doesn't send it to another region. For regional or zonal resiliency, separately design workload replicas and zone or region placement.
Question 487
An availability set contains two healthy web VMs. A Standard Load Balancer has a frontend, a load-balancing rule, a backend address pool and an operational HTTP probe. Web1 receives connections, but Web2 never appears among the backend addresses even though its HTTP service responds locally and both VMs have the same availability-set membership. What must the operator correct first to make Web2 eligible for load-balanced traffic?
- Associate Web2’s correct NIC IP configuration or private backend address with the intended load-balancer backend pool
- Increase the availability set’s update-domain count so Web2 is automatically registered into the backend address pool
- Create an inbound NAT rule directed to Web2 and assume the one-to-one NAT path also distributes normal pool traffic
- Disable the HTTP health probe so the load balancer automatically adds every VM in the availability set to the backend pool
Explanation
Correct Answer
A:Backend address pool membership defines which NIC IP configurations or explicitly listed VM private addresses are candidates for a load-balancing rule. Web2 is absent from that pool, so a passing service probe or shared availability set cannot make it a backend. Register the supported Web2 NIC IP configuration or backend address in the same pool, then verify the load-balancing rule and probe.
Incorrect Answers
B:Update domains stagger planned platform maintenance for VMs in an availability set. Their count has no automatic relationship to a Standard Load Balancer’s address-pool membership. Raising that count cannot enroll Web2 as a backend; the relevant NIC IP configuration or address must be associated with the pool.
C:An inbound NAT rule forwards a specified frontend protocol and port to one particular backend address/port. It does not make an omitted VM participate in the load-balancing rule’s shared backend pool. The request distribution path requires Web2 to be included in that pool rather than creating a separate one-to-one NAT mapping.
D:Disabling a required health probe does not change which backend addresses are configured and removes a necessary signal for healthy traffic routing. The scenario explicitly states Web2 is not in the pool, so probe changes cannot repair the missing association and may make otherwise healthy traffic handling less reliable.
Question 488
A region supports an availability set configured with two fault domains. Three replicas of a stateless application are added to this one set. A reviewer claims that all three VMs are now guaranteed to be in three different power-and-network fault domains. What is the decisive limit of that claim?
- The claim is valid because Azure dynamically creates a third fault domain for every new VM regardless of the set configuration
- The third VM is guaranteed to receive a new availability zone even if the set has no availability-zone placements
- A set configured with two fault domains provides only two fault-domain groups; three VMs cannot occupy three distinct groups in that set
- An availability set with two fault domains permits a maximum of two virtual machines and always rejects a third VM
Explanation
Correct Answer
C:Fault domains represent distinct physical failure groups sharing common power and networking. An availability set configured with exactly two of them can distribute three VMs across the available groups, but the pigeonhole principle means at least two replicas share a fault domain. The reviewer’s three-independent-domain guarantee is therefore impossible without a different placement design.
Incorrect Answers
A:Availability-set fault-domain cardinality is configured when the set is created and is not expanded automatically each time a VM is added. With two configured fault domains, Azure can distribute replicas across those two power-and-network failure groups but cannot invent a third independent group. Increasing VM count does not change the count of distinct fault domains.
B:Availability sets use fault and update domains inside a regional deployment and do not automatically create or guarantee zone-spread for the third VM. Availability zones are a separate placement architecture. The question explicitly specifies a two-fault-domain set, so adding a third replica cannot grant an unstated third-zone guarantee.
D:Azure availability sets can contain more VMs than their configured number of fault domains. The platform distributes those VMs over the available failure groups rather than enforcing a one-VM-per-fault-domain maximum. A third VM may be provisioned, but the architecture cannot guarantee three independently isolated physical fault domains.
Question 489
A stateless API runs in a Virtual Machine Scale Set. Over several weeks, incoming traffic varies sharply through the day, and operations wants instance count to increase after sustained CPU load and decrease when demand falls. Which feature best implements this behavior?
- A static NIC private IP address
- Azure Monitor autoscale rules for the scale set
- Increase the static VMSS instance count to the expected daily maximum and leave it unchanged
- Configure a metric alert that emails the operator without any autoscale rule
Explanation
Correct Answer
B:Autoscale rules can evaluate supported metrics such as CPU and adjust scale-set capacity within configured bounds and cooldown behavior. That maps directly to elastic instance counts driven by demand.
Incorrect Answers
A:A private IP address describes how an instance is addressed. It does not monitor utilization or change the number of running compute instances.
C:Fixed capacity may cover the busiest period but wastes resources when usage falls, and it does not automatically respond to sustained metric changes.
D:An alert can notify staff of load, but it does not itself change instance count. The objective is automated capacity adjustment as demand changes.
Question 490
A VM scale set serves an HTTP API from many instances. Automatic upgrade and repair policies need an explicit signal that differentiates unhealthy application instances from otherwise running VMs. What scale-set capability should be considered?
- Configure a supported application health signal such as the Application Health extension
- Use only the VMSS instance count to infer that each API backend is healthy
- Use VMSS instance provisioningState = Succeeded as the sole signal that its HTTP API is serving requests successfully
- Enable automatic repairs using VM power-state monitoring alone and assume any running VM has a healthy HTTP application
Explanation
Correct Answer
A:Application health information lets VMSS evaluate whether instances meet the workload health condition. It provides a more meaningful criterion than VM power state alone for repairs and upgrades.
Incorrect Answers
B:An instance may be running while its application returns errors. Instance count alone cannot identify application-specific failures.
C:ProvisioningState reports the management-plane deployment state, not the health of the running HTTP API. An instance can finish provisioning while its process is down or returns failing responses. Automatic upgrades and repairs require a supported application health signal or probe aligned with the actual backend behavior, not merely a provisioning-success value.
D:Power or instance provisioning state does not establish that an HTTP listener answers requests correctly. A VM can be running while its API fails health checks. VMSS upgrade and repair decisions need a supported application health signal such as the Application Health extension rather than treating VM running state as application health.
Microsoft Azure Administrator (AZ-104) Practice Tests