AZ 104 RENEWAL EXAM 2026 FINAL
PAPER EXAM SCRIPT WITH VERIFIED
SOLVED QUESTIONS
⩥ You have an Azure subscription that contains a storage account named
account1. You plan to upload the disk files of a virtual machine to
account1 from your on-premises network. The on-premises network uses
a public IP address space of 131.107.1.0/24. You plan to use the disk
files to provision an Azure virtual machine named VM1. VM1 will be
attached to a virtual network named VNet1. VNet1 uses an IP address
space of 192.168.0.0/24. You need to configure account1 to meet the
following requirements: Ensure that you can upload the disk files to
account1. Ensure that you can attach the disks to VM1. Prevent all other
access to account1. Which two actions should you perform? Each
correct selection presents part of the solution. NOTE: Each correct
selection is worth one point.
A. From the Firewalls and virtual networks blade of account1, add the
131.107.1.0/24 IP address range.
B. From the Firewalls and virtual networks. Answer: Answer: AB
By default, storage accounts accept connections from clients on any
network. To limit access to selected networks, you must first change the
default action. Azure portal
1. Navigate to the storage account you want to secure. 2. Click on the
settings menu called Firewalls and virtual networks.
,3. To deny access by default, choose to allow access from 'Selected
networks'. To allow traffic from all networks, choose to allow access
from 'All networks'.
4. Click Save to apply your changes. Grant access from a Virtual
Network Storage accounts can be configured to allow access only from
specific Azure Virtual Networks. By enabling a Service Endpoint for
Azure Storage within the Virtual Network, traffic is ensured an optimal
route to the Azure Storage service. The identities of the virtual network
and the subnet are also transmitted with each request.
⩥ You have an Azure Active Directory (Azure AD) tenant named
contosocloud.onmicrosoft.com. Your company has a public DNS zone
for contoso.com. You add contoso.com as a custom domain name to
Azure AD. You need to ensure that Azure can verify the domain name.
Which type of DNS record should you create?
A. PTR
B. MX
C. NSEC3
D. RRSIG. Answer: Answer: B
TXT or MX : Correct You can use either a TXT or MX record to verify
the custom domain in the Azure AD. MX records can serve the purpose
of TXT records Questions & Answers PDF P-56 www.dumpskey.com
,SRV : Incorrect SRV records are used by various services to specify
server locations. When specifying an SRV record in Azure DNS
DNSKEY : Incorrect Choice This will verify that the records are
originating from an authorized sender. NSEC : Incorrect Choice This is
Part of DNSSEC. This is used for explicit denial-of-existence of a DNS
record. It is used to prove a name does not exist.
⩥ You have an Azure virtual machine named VM1. Azure collects
events from VM1. You are creating an alert rule in Azure Monitor to
notify an administrator when an error is logged in the System event log
of VM1. You need to specify which resource type to monitor. What
should you specify?
A. metric alert
B. Azure Log Analytics workspace
C. virtual machine
D. virtual machine extension. Answer: Answer: B
Explanation: Azure Monitor can collect data directly from your Azure
virtual machines into a Log Analytics workspace for analysis of details
and correlations. Installing the Log Analytics VM extension for
Windows and Linux allows Azure Monitor to collect data from your
Azure VMs. Azure Log Analytics workspace is also used for on-
premises computers monitored by System Center Operations Manager.
, ⩥ You have two Azure virtual machines named VM1 and VM2. You
have two Recovery Services vaults named RSV1 and RSV2. VM2 is
protected by RSV1. You need to use RSV2 to protect VM2. What should
you do first?
A. From the RSV1 blade, click Backup items and stop the VM2 backup.
B. From the RSV1 blade, click Backup Jobs and export the VM2
backup.
C. From the RSV1 blade, click Backup. From the Backup blade, select
the backup for the virtual machine, and then click Backup.
D. From the VM2 blade, click Disaster recovery, click Replication
settings, and then select RSV2 as the Recovery Services vault. Answer:
Answer: D
The Azure Site Recovery service contributes to your disaster recovery
strategy by managing and orchestrating replication, failover, and
failback of on-premises machines and Azure virtual machines (VMs).
⩥ You have an Azure subscription that contains a web app named
webapp1. You need to add a custom domain named www.contoso.com
to webapp1. What should you do first?
A. Upload a certificate.
B. Add a connection string.
C. Stop webapp1.
PAPER EXAM SCRIPT WITH VERIFIED
SOLVED QUESTIONS
⩥ You have an Azure subscription that contains a storage account named
account1. You plan to upload the disk files of a virtual machine to
account1 from your on-premises network. The on-premises network uses
a public IP address space of 131.107.1.0/24. You plan to use the disk
files to provision an Azure virtual machine named VM1. VM1 will be
attached to a virtual network named VNet1. VNet1 uses an IP address
space of 192.168.0.0/24. You need to configure account1 to meet the
following requirements: Ensure that you can upload the disk files to
account1. Ensure that you can attach the disks to VM1. Prevent all other
access to account1. Which two actions should you perform? Each
correct selection presents part of the solution. NOTE: Each correct
selection is worth one point.
A. From the Firewalls and virtual networks blade of account1, add the
131.107.1.0/24 IP address range.
B. From the Firewalls and virtual networks. Answer: Answer: AB
By default, storage accounts accept connections from clients on any
network. To limit access to selected networks, you must first change the
default action. Azure portal
1. Navigate to the storage account you want to secure. 2. Click on the
settings menu called Firewalls and virtual networks.
,3. To deny access by default, choose to allow access from 'Selected
networks'. To allow traffic from all networks, choose to allow access
from 'All networks'.
4. Click Save to apply your changes. Grant access from a Virtual
Network Storage accounts can be configured to allow access only from
specific Azure Virtual Networks. By enabling a Service Endpoint for
Azure Storage within the Virtual Network, traffic is ensured an optimal
route to the Azure Storage service. The identities of the virtual network
and the subnet are also transmitted with each request.
⩥ You have an Azure Active Directory (Azure AD) tenant named
contosocloud.onmicrosoft.com. Your company has a public DNS zone
for contoso.com. You add contoso.com as a custom domain name to
Azure AD. You need to ensure that Azure can verify the domain name.
Which type of DNS record should you create?
A. PTR
B. MX
C. NSEC3
D. RRSIG. Answer: Answer: B
TXT or MX : Correct You can use either a TXT or MX record to verify
the custom domain in the Azure AD. MX records can serve the purpose
of TXT records Questions & Answers PDF P-56 www.dumpskey.com
,SRV : Incorrect SRV records are used by various services to specify
server locations. When specifying an SRV record in Azure DNS
DNSKEY : Incorrect Choice This will verify that the records are
originating from an authorized sender. NSEC : Incorrect Choice This is
Part of DNSSEC. This is used for explicit denial-of-existence of a DNS
record. It is used to prove a name does not exist.
⩥ You have an Azure virtual machine named VM1. Azure collects
events from VM1. You are creating an alert rule in Azure Monitor to
notify an administrator when an error is logged in the System event log
of VM1. You need to specify which resource type to monitor. What
should you specify?
A. metric alert
B. Azure Log Analytics workspace
C. virtual machine
D. virtual machine extension. Answer: Answer: B
Explanation: Azure Monitor can collect data directly from your Azure
virtual machines into a Log Analytics workspace for analysis of details
and correlations. Installing the Log Analytics VM extension for
Windows and Linux allows Azure Monitor to collect data from your
Azure VMs. Azure Log Analytics workspace is also used for on-
premises computers monitored by System Center Operations Manager.
, ⩥ You have two Azure virtual machines named VM1 and VM2. You
have two Recovery Services vaults named RSV1 and RSV2. VM2 is
protected by RSV1. You need to use RSV2 to protect VM2. What should
you do first?
A. From the RSV1 blade, click Backup items and stop the VM2 backup.
B. From the RSV1 blade, click Backup Jobs and export the VM2
backup.
C. From the RSV1 blade, click Backup. From the Backup blade, select
the backup for the virtual machine, and then click Backup.
D. From the VM2 blade, click Disaster recovery, click Replication
settings, and then select RSV2 as the Recovery Services vault. Answer:
Answer: D
The Azure Site Recovery service contributes to your disaster recovery
strategy by managing and orchestrating replication, failover, and
failback of on-premises machines and Azure virtual machines (VMs).
⩥ You have an Azure subscription that contains a web app named
webapp1. You need to add a custom domain named www.contoso.com
to webapp1. What should you do first?
A. Upload a certificate.
B. Add a connection string.
C. Stop webapp1.
