Microsoft AZ-104 - Microsoft Azure Administrator - Deploy and manage Azure Compute Resources - Azure VMs and Containers & AKS - Review Questions

AZ-104 Azure Virtual Machines: Review

1. You are creating an Azure VM. Which resource connects the VM to a subnet in an Azure virtual network?

A. Network interface

B. Availability set

C. Recovery Services vault

D. Disk encryption set

2. A VM requires secure administrative access through the Azure portal without assigning a public IP address to the VM. Which service should you consider?

A. Azure Traffic Manager

B. Azure Bastion

C. Azure NAT Gateway

D. Azure DNS

3. Which VM family is generally suited to a workload that runs below its CPU baseline most of the time but occasionally needs to burst above it?

A. B-series

B. H-series

C. L-series

D. N-series

4. A B-series VM has exhausted its accumulated CPU credits. What happens when the workload continues to demand CPU above the baseline?

A. Azure automatically adds another VM.

B. The VM is automatically deallocated.

C. CPU performance is limited to the baseline until credits accumulate.

D. Azure automatically changes the VM to a memory-optimized size.

5. Which type of Azure VM disk should generally be used to store application data that must persist if a VM is deallocated or redeployed?

A. Temporary disk

B. Ephemeral OS disk

C. Managed data disk

D. Processor cache

6. Which two managed disk types are used as data disks rather than OS disks?

A. Standard HDD and Standard SSD

B. Premium SSD and Standard SSD

C. Ultra Disk and Premium SS

D v2D. Premium SSD and Standard HDD

7. Which statement about server-side encryption for Azure managed disks is correct?

A. It must always be enabled manually after deployment.

B. It automatically encrypts managed disk data at rest.

C. It requires an NSG to encrypt disk data.

D. It encrypts data only when Azure Backup is enabled.

8. Which feature extends encryption to supported VM host-side disk caches and temporary disks?

A. Encryption at host

B. Availability set

C. Azure Load Balancer

D. Azure Monitor Agent

9. Azure Disk Encryption uses which guest operating-system technologies?

A. Windows Defender on Windows and Secure Boot on Linux

B. BitLocker on Windows and DM-Crypt on Linux

C. Azure RBAC on Windows and Microsoft Entra ID on Linux

D. TLS on Windows and SSH on Linux

10. You need to move a VM from one resource group to another. What happens to the VM’s Azure region?

A. The VM automatically moves to another region.

B. The VM remains in its existing region.

C. The VM is automatically copied to three regions.

D. The VM moves to the resource group’s paired region.

11. You need to relocate a supported Azure VM workload to a different Azure region. Which service can help coordinate the move?

A. Azure Resource Mover

B. Azure Policy

C. Azure Key Vault

D. Azure DNS

12. You plan to resize an Azure VM. The requested size is unavailable on the VM’s current hardware cluster. What might you need to do before resizing?

A. Delete the VM’s OS disk.

B. Deallocate the VM.

C. Delete the virtual network.

D. Disable Microsoft Entra ID.

13. An application needs to continue operating if an entire availability zone becomes unavailable. Which deployment best supports that requirement?

A. One VM in one availability zone

B. Two application VMs deployed across different availability zones

C. One VM with two NICs in the same subnet

D. Two data disks attached to one VM

14. What are the two types of domains used by an Azure availability set to distribute VMs?

A. DNS domains and routing domains

B. Fault domains and update domains

C. Public domains and private domains

D. Application domains and security domains

15. What does scaling out an Azure Virtual Machine Scale Set do?

A. Adds VM instances to increase capacity.

B. Removes VM instances to reduce capacity.

C. Increases the size of a VM’s OS disk.

D. Changes the Azure region of every instance.

16. Which statement best describes Flexible orchestration for Azure Virtual Machine Scale Sets?

A. It can manage standard Azure VMs and supports greater flexibility in individual VM configurations.

B. It requires every instance to be managed only through the Uniform scale-set VM API.

C. It cannot use availability zones.

D. It requires every deployment to use a dedicated host.

17. A scale set has automatic instance repairs enabled. What must be configured so it can determine whether an instance is unhealthy?

A. A supported application health signal, such as the Application Health Extension or an applicable load-balancer probe

B. An Azure DNS public zone

C. An Azure Storage lifecycle policy

D. A resource lock on every VM

18. An application running on an Azure VM needs to retrieve a secret from Azure Key Vault without storing an application password on the VM. What is the best choice?

A. Assign a public IP address to the VM.

B. Enable a managed identity and grant it the required Key Vault access.

C. Add the VM to an availability set.

D. Enable a network security group flow log.

19. Which statement accurately describes Azure Site Recovery?

A. It replaces the need for all VM backups.

B. It helps replicate and orchestrate recovery of supported workloads, but replication can have a nonzero recovery point objective.

C. It guarantees zero data loss in every disaster.

D. It automatically initiates failover for every regional outage by default.

20. A user needs to manage tags on 10 VMs while following least privilege. Which built-in role is the best starting point?

A. Owner

B. Contributor

C. Tag Contributor

D. Virtual Machine Contributor

Answer Key and Explanations

Question	Answer	Explanation
1	A	A network interface connects the VM to a VNet subnet and holds its network configuration.
2	B	Azure Bastion provides managed RDP or SSH access to a VM over its private IP address.
3	A	B-series VMs are designed for workloads with variable CPU use and occasional bursts.
4	C	When credits are exhausted, the VM’s CPU performance is limited to its baseline until credits accumulate again.
5	C	A managed data disk is intended for persistent application data. Temporary disk data can be lost during lifecycle events.
6	C	Ultra Disk and Premium SSD v2 are data-disk-only options.
7	B	Azure automatically applies server-side encryption to managed disk data at rest.
8	A	Encryption at host covers supported host-side disk caches and temporary disks.
9	B	Azure Disk Encryption uses BitLocker for Windows and DM-Crypt for Linux. ADE is scheduled for retirement on September 15, 2028.
10	B	Moving a resource to another resource group changes its management grouping; it does not change its Azure region.
11	A	Azure Resource Mover can help coordinate supported cross-region VM moves.
12	B	If the target size is unavailable on the current cluster, the VM may need to be deallocated before resizing.
13	B	Multiple application instances across different zones, with appropriate traffic routing and data design, can help the application survive a zone outage.
14	B	Availability sets distribute VMs across fault domains and update domains.
15	A	Scale out increases capacity by adding instances; scale in removes instances.
16	A	Flexible orchestration manages standard Azure VMs and supports more individual configuration flexibility than the shared Uniform model.
17	A	Automatic repairs need a supported application health signal to identify unhealthy instances.
18	B	A managed identity lets the application obtain an Entra token without storing a client secret. The identity still needs Key Vault permissions and network access.
19	B	Site Recovery supports replication and recovery orchestration. Replication can lag, so some data loss is possible.
20	C	Tag Contributor permits tag management without granting broad VM-management rights. The user may also need read access to view the VMs in the portal.

Bonus questions

Question: A subscription contains 10 VMs. User1 must be able to tag all 10 through the Azure portal, following least privilege. What should you do?

Answer from the supplied options: Modify the Access control (IAM) settings and assign an appropriate Azure role.

For a practical configuration, consider the built-in Tag Contributor role at the narrowest scope covering the intended VMs. The role permits tag management without granting general VM management permissions. The user also needs appropriate read access to discover and view the VMs in the portal; evaluate existing access and add Reader at an appropriate scope if needed. A custom role granting broad Microsoft.Compute/virtualMachines/*/write permissions is more permissive than necessary. Microsoft Learn

Exam tip: IAM assigns roles to identities. Azure Policy can enforce or modify tagging behavior, but it is not the normal mechanism for granting User1 permission to tag resources.

Question: During creation of a Windows Server VM, which setting should you configure to make it part of a VM scale set?

Answer: Availability options on the Basics tab. Select the scale-set option and the applicable Flexible orchestration configuration.

Updated placement note: The supplied statement that an existing VM generally must be recreated to join a scale set is outdated. Microsoft now documents attaching an eligible existing VM to a Flexible orchestration scale set, subject to requirements and limitations. Availability-set membership remains a separate placement consideration.

Exam tip: Think in layers: availability zones address a zone failure, Backup provides recovery points, and Site Recovery orchestrates recovery of replicated workloads.

Azure Containers and AKS: 20 Multiple-Choice Review Questions

1. Your application requires Kubernetes APIs, multiple node pools, and detailed control over workload scheduling. Which Azure service should you use?

A. Azure Container Instances

B. Azure Container Apps

C. Azure Kubernetes Service

D. Azure Container Registry

2. You need to run a one-time containerized task without managing virtual machines or a Kubernetes cluster. Which service is most appropriate?

A. Azure Container Instances

B. Azure Container Registry

C. Azure Kubernetes Fleet Manager

D. Azure Virtual Machine Scale Sets

3. You need container hosting with managed ingress, application revisions, and automatic replica scaling. Which service should you choose?

A. Azure Container Registry

B. Azure Container Instances

C. Azure Virtual Machines

D. Azure Container Apps

4. Which statement correctly describes management responsibilities in AKS?

A. Azure manages all application code and permissions.

B. Azure operates the control plane; customers remain responsible for their workloads and security configuration.

C. Customers must maintain the control-plane virtual machines.

D. Azure automatically configures all application backup and recovery requirements.

5. Which statement correctly describes the relationship between images, containers, and pods?

A. An image is a running process, and a container stores multiple pods.

B. A pod is an image repository containing container versions.

C. An image packages an application; a container runs from an image; a pod contains one or more containers.

D. Every pod must contain at least two application containers.

6. What is the relationship between an Azure container registry and a repository?

A. A registry contains repositories that group related container images.

B. A repository contains multiple Azure subscriptions.

C. A registry runs containers stored in its repositories.

D. A repository is a Kubernetes node that downloads images.

7. Which combination contains three supported automatic triggers for ACR Tasks?

A. Pod restarts, node failures, and container exits

B. Resource group deletion, VM resizing, and DNS updates

C. User sign-ins, role assignments, and storage access

D. Source-code updates, tracked base-image updates, and scheduled timers

8. An ACR task rebuilds an image after a base-image security update. What must happen before existing application instances use the updated image?

A. The registry must be changed to the Premium tier.

B. The updated image must be deployed to replacement containers.

C. The existing containers must be assigned new managed identities.

D. The image repository must be renamed.

9. Which ACR tier supports geo-replication and private endpoints?

A. Basic

B. Standard

C. Premium

D. All tiers

10. An AKS workload cannot pull an image from a private ACR. Which checks should you perform first?

A. Verify the image reference, pull permissions, and network/DNS connectivity.

B. Verify the pod’s persistent volume backup schedule.

C. Verify the Application Insights sampling rate.

D. Verify the cluster’s global traffic-routing priority.

11. Which statement about ACI container groups is correct?

A. Each container must run on a different host.

B. Multi-container groups support only Windows containers.

C. Containers in a group cannot share storage volumes.

D. Containers share a lifecycle and local network; multi-container groups support Linux.

12. An ACI batch job should restart only when its process exits unsuccessfully. Which restart policy should you configure?

A. Always

B. OnFailure

C. Never

D. OnSchedule

13. An application must retain files when its container is replaced. Which approach is appropriate?

A. Store the files in the container’s writable filesystem.

B. Add more tags to the container image.

C. Mount a persistent Azure Files share in a supported configuration.

D. Increase the container’s memory allocation.

14. What does horizontal scaling do in Azure Container Apps?

A. Adds or removes application replicas.

B. Increases CPU automatically inside each running replica.

C. Replaces the application’s container image with a larger image.

D. Changes the application’s Azure region.

15. A container app must create additional replicas as messages accumulate in Azure Service Bus. Which scale trigger should you use?

A. HTTP traffic

B. Memory usage

C. CPU usage

D. Custom event-driven scaling

16. Which statement correctly compares HPA and Cluster Autoscaler in AKS?

A. HPA scales nodes; Cluster Autoscaler scales container images.

B. HPA scales pod replicas; Cluster Autoscaler scales nodes in enabled node pools.

C. Both only change the memory assigned to existing pods.

D. Both require an administrator to add each new replica manually.

17. How does Azure CNI Pod Subnet differ from Azure CNI Overlay?

A. Pod Subnet gives every pod a public IP; Overlay gives every pod a public DNS name.

B. Pod Subnet requires Windows nodes; Overlay requires GPU nodes.

C. Pod Subnet uses a VNet subnet for pod addresses; Overlay uses a separate pod CIDR outside the VNet address space.

D. Pod Subnet disables private connectivity; Overlay disables service discovery.

18. You need to trace a request across several microservices and identify a slow database dependency. Which capability is most appropriate?

A. Application Insights with application instrumentation

B. ACR repository retention

C. ACI restart policies

D. AKS node labels

19. Which statement correctly distinguishes container security controls?

A. Image signing removes vulnerabilities, while mTLS signs container images.

B. Vulnerability scanning automatically encrypts service traffic.

C. A valid image signature guarantees that an image contains no vulnerabilities.

D. Scanning finds known vulnerabilities, signature verification checks integrity and signer trust, and mTLS protects service communication.

20. You deploy an application to AKS clusters in two regions. What else is needed for a practical disaster recovery solution?

A. Only identical cluster names in both regions

B. Traffic routing, data protection, consistent deployments, dependency access, recovery capacity, and tested failover procedures

C. Only a larger system node pool in the primary region

D. Only a second copy of the application’s Dockerfile

Answer Key and Explanations

1. C — Azure Kubernetes Service

AKS provides managed Kubernetes while allowing you to use Kubernetes APIs, configure multiple node pools, and control workload placement through resource requests, labels, affinity, taints, and tolerations. Container Apps abstracts more of Kubernetes, ACI runs container groups, and ACR stores images.

2. A — Azure Container Instances

ACI is suitable for running an isolated container or a short-lived task without managing servers or a Kubernetes cluster. You specify the image, CPU, memory, networking, and restart policy. For a one-time task, the Never restart policy is often appropriate.

3. D — Azure Container Apps

Container Apps provides managed application hosting with ingress, revisions, and automatic horizontal scaling. It is useful for web applications, APIs, microservices, and event-driven workers when you do not need direct Kubernetes cluster management.

4. B — Azure operates the control plane; customers manage their workloads and security configuration

Azure operates AKS control-plane components such as the API server, scheduler, controllers, and etcd. Customers remain responsible for application code, workload configuration, permissions, data protection, and operational settings. The amount of node-management automation depends on the AKS deployment model and configuration.

5. C — An image packages an application; a container runs from it; a pod contains containers

An image is a packaged template containing application code and dependencies. A container is a running instance of that image. A pod is Kubernetes’ smallest scheduling unit and can contain one primary container or multiple closely related containers that share networking and configured storage.

6. A — A registry contains repositories

An ACR registry contains repositories, and each repository groups related images and their versions. For example, in myregistry.azurecr.io/webapp:v1, the registry is myregistry.azurecr.io, the repository is webapp, and the tag is v1. A registry stores images; it does not host the running application.

7. D — Source-code updates, tracked base-image updates, and scheduled timers

ACR Tasks supports automated builds triggered by source changes, tracked base-image changes, or schedules. Tasks can also run on demand. These capabilities support repeatable builds and image maintenance without requiring a local build server.

8. B — Deploy the updated image to replacement containers

Rebuilding produces a new image, but it does not modify containers already running from an older image. A deployment process must create replacement containers using the updated image. Testing and approval should occur before rollout, and rebuilding only fixes dependencies that actually receive suitable updates.

9. C — Premium

ACR Premium supports geo-replication and Private Link with private endpoints. Geo-replication helps distribute images across regions, while private endpoints provide private network access to the registry. Vulnerability assessment is a separate security integration, such as Microsoft Defender for Cloud.

10. A — Verify the image reference, permissions, and connectivity

An image pull can fail because the repository or tag is incorrect, the pulling identity lacks permission, or the registry cannot be reached through the configured network and DNS path. The required pull role depends on the registry’s permission mode: commonly AcrPull for RBAC-only registries or Container Registry Repository Reader for ABAC-enabled registries.

11. D — Shared lifecycle and network; Linux supports multi-container groups

ACI containers in a group are scheduled together and share a lifecycle, local network, allocated group resources, and access to configured volumes. Multi-container groups support Linux. A common example combines an application container with a supporting logging sidecar.

12. B — OnFailure

OnFailure restarts a container when its process exits with an error. Always restarts it after either successful or unsuccessful completion, while Never prevents automatic restart after exit. OnSchedule is not an ACI restart policy.

13. C — Mount an Azure Files share

Files stored only in a container’s writable filesystem should be treated as ephemeral. A mounted Azure Files share can retain data independently of an individual container’s lifecycle in supported configurations. Persistence does not replace backup, so important data also needs an appropriate recovery strategy.

14. A — Adds or removes replicas

Horizontal scaling changes the number of application replicas. Increasing the CPU or memory allocated to a replica is a separate sizing change. Container Apps can scale replicas according to configured rules, subject to minimum and maximum replica settings and available capacity.

15. D — Custom event-driven scaling

Service Bus message backlog is an external event signal, so configure a custom event-driven rule using the KEDA azure-servicebus scaler. Specify the queue or topic subscription, message threshold, authentication, and replica limits. CPU, memory, and HTTP rules do not directly measure the Service Bus backlog.

16. B — HPA scales pods; Cluster Autoscaler scales nodes

The Horizontal Pod Autoscaler adjusts workload replica counts based on configured metrics. Cluster Autoscaler adjusts node counts in enabled node pools when pods cannot be scheduled because capacity is insufficient, or when nodes can safely be removed. These mechanisms can work together.

17. C — VNet pod subnet versus separate overlay pod CIDR

Azure CNI Pod Subnet assigns pods addresses from a separate subnet within the VNet. Azure CNI Overlay assigns pods addresses from a separate pod CIDR outside the VNet address space, reducing VNet IP consumption. Overlay traffic leaving the pod network is translated to the node IP.

18. A — Application Insights

With suitable instrumentation, Application Insights provides distributed traces, request telemetry, and dependency performance information. This helps identify which service or database call slowed a transaction. Container Insights complements it with container logs and Kubernetes inventory and events.

19. D — Scanning, signature verification, and mTLS address different risks

Vulnerability scanning identifies known weaknesses in image components. Signature verification checks whether an artifact has been altered and whether its signer is trusted. Mutual TLS authenticates communicating services and encrypts their traffic. None of these controls alone establishes every required authorization rule or guarantees that an application is secure.

20. B — A complete, tested recovery design

A second cluster does not automatically replicate data or provide working failover. Recovery requires traffic routing and health checks, data replication or restore procedures, consistent application configuration, image availability, networking, identities, secrets, and sufficient capacity. Define recovery time and recovery point objectives, then test that the design meets them.

Bonus

Scenario: A container app named cont1 must create replicas based on messages received in Azure Service Bus.

Correct answer: Event-driven.

Configure a custom event-driven scale rule using the KEDA azure-servicebus scaler. The rule monitors the configured queue or topic subscription and scales the app according to the message-count threshold and replica limits.

The scaler needs permission and connectivity to inspect the Service Bus entity. Depending on the supported configuration, authentication can use a connection secret or an appropriately authorized managed identity.

As the message backlog grows, Container Apps can add replicas; as it drains, the app can scale in. It can scale to zero when the rule and minimum replica settings permit it.

The other answers do not directly measure the Service Bus backlog:

• CPU usage measures processor utilization.

• HTTP traffic measures incoming HTTP demand.

• Memory usage measures memory utilization.

Exam tip: Service Bus messages → custom event-driven scale rule. HTTP demand → HTTP scale rule. CPU and memory rules do not independently scale an app to zero.