Microsoft Updated AZ-104 Exam Questions and Answers by luis

According to the Microsoft Azure Administrator (AZ-104) Study Guide and Azure Role-Based Access Control (RBAC) documentation, permissions to link an Azure Private DNS zone to a virtual network require access to both the virtual network resource and the DNS zone resource.

The process of linking a DNS zone to a virtual network establishes name resolution for the resources within that VNet through the Private DNS zone. To perform this operation, the user must have:

“Microsoft.Network/virtualNetworks/*” permissions (to modify and manage VNet settings).

“Microsoft.Network/privateDnsZones/*” permissions (to manage DNS zone links).

These permissions are granted by two built-in roles:

Network Contributor – Allows full management of the network resources like virtual networks, subnets, and network interfaces but does not allow access to manage DNS zones.

Private DNS Zone Contributor – Allows management of private DNS zones and their link configurations.

Therefore, to grant User1 the ability to link Zone1.com (Private DNS Zone) to VNet1, the correct approach is to assign both roles with the least privilege principle, scoped specifically to the required resources:

Network Contributor on VNet1

Private DNS Zone Contributor on zone1.com

Assigning the permissions at the resource level (and not at the resource group or subscription level) ensures compliance with the principle of least privilege, a core requirement of Azure governance.

This setup enables User1 to perform the exact operation (linking the Private DNS Zone to the VNet) while preventing unnecessary access to unrelated resources.

Final Verified Answer:

✅ Roles: Network Contributor and Private DNS Zone Contributor only

✅ Resources: VNet1 and zone1.com only

To determine which virtual machines can be encrypted, we must refer to the technical requirement:

“Whenever possible, use Azure Disk Encryption and a key encryption key (KEK) to encrypt the virtual machines.”

According to the Microsoft Azure Administrator documentation, Azure Disk Encryption (ADE) uses BitLocker for Windows virtual machines and DM-Crypt for Linux virtual machines to encrypt OS and data disks. However, not all VM types and disk configurations are supported for ADE.

From the provided configuration:

VM

OS

Description

Disk Type

VM1

RHEL

Uses ephemeral OS disks

❌ Not supported

VM2

Windows Server 2022

Has a basic volume

✅ Supported

VM3

RHEL

Uses standard SSDs

✅ Supported by DM-Crypt, but not optimal

VM4

Windows Server 2022

Uses Write Accelerator disks

✅ Supported

VM5

Windows Server 2022

Has a dynamic volume

❌ Not supported by ADE

Step-by-step Analysis (Based on Microsoft Docs):

Ephemeral OS disks (VM1):

These are not compatible with Azure Disk Encryption because they are stored on local temporary storage and are not persisted to Azure Storage.

“Ephemeral OS disks cannot be encrypted using Azure Disk Encryption because they reside on local VM storage.” — [Microsoft Learn: Azure Disk Encryption prerequisites]

Dynamic volumes (VM5):

Azure Disk Encryption does not support dynamic disks — only basic disks are supported.

“Azure Disk Encryption does not support dynamic disks; only basic disks can be encrypted.” — [Microsoft Learn: ADE limitations]

Write Accelerator disks (VM4):

These disks can be encrypted if they are standard OS/data disks with Write Accelerator enabled. Microsoft confirms that ADE supports Write Accelerator–enabled disks on supported VM sizes.

Linux VMs (VM3) with standard SSDs can use DM-Crypt encryption, but in this question, the requirement specifies to use Azure Disk Encryption with a Key Encryption Key (KEK) — KEKs are supported only for Windows and Linux VMs that use managed disks and not ephemeral disks.

However, VM3 uses standard SSDs (supported by ADE) and VM2 and VM4 meet the technical requirement of using ADE with KEK, but Azure prefers Windows VMs for KEK integration because of BitLocker integration and Key Vault support.

Therefore, the verified supported VMs for Azure Disk Encryption with KEK are:

✅ VM2 (Windows Server 2022, basic volume)

✅ VM4 (Windows Server 2022, Write Accelerator disks)

Supporting Microsoft Documentation (Extracted):

“Azure Disk Encryption helps protect and safeguard your data to meet your organizational security and compliance commitments. It uses BitLocker for Windows VMs and DM-Crypt for Linux VMs.”

“ADE is not supported on ephemeral OS disks or dynamic disks.”

“You can use Key Encryption Keys (KEK) from Azure Key Vault for an added layer of security.”

(Source: Microsoft Learn – Azure Disk Encryption Overview, Prerequisites, and Supported Configurations for Windows and Linux VMs)

 Stored access policies: ✅ 2

 Immutable blob storage policies: ✅ 1

From the scenario in the earlier case study (A. Datum Corporation):

The planned change requires creating a new container named cont2 in storage1, with the following:

Three stored access policies (Stored1, Stored2, Stored3)

A legal hold for immutable blob storage

Also, recall from the table:

storage1 has Hierarchical namespace = Yes (Data Lake Storage Gen2 enabled).

storage2 has Hierarchical namespace = No.

The question asks: “What is the maximum number of additional access policies you can create for cont2?”

According to Microsoft Azure Storage documentation:

A blob container can have a maximum of five stored access policies.

These policies allow shared access signatures (SAS) to be managed centrally, letting you define start times, expiry times, and permissions at the container level.

Since three stored access policies (Stored1, Stored2, Stored3) already exist, the maximum additional policies that can still be created is:

→ 5 (maximum allowed) – 3 (already existing) = 2

For immutable blob storage policies:

A container can have one active immutability policy at a time.

This can be either a time-based retention policy or a legal hold policy.

Since cont2 already has a legal hold applied, no additional immutable policy can coexist with it, but it can have one defined policy type (the legal hold).

Therefore:

Stored access policies: 2 additional policies can still be created.

Immutable blob storage policies: 1 policy (the existing legal hold).

This aligns exactly with Microsoft Learn: Azure Storage Blob Service limits and immutable storage documentation:

“A container may have up to five stored access policies. Immutable storage supports either a time-based retention policy or legal hold policy per container.”

Final Verified Answer:

✅ Stored access policies: 2

✅ Immutable blob storage policies: 1

In Microsoft Azure, encryption scopes are a StorageV2 (general-purpose v2) storage account feature that allows fine-grained control over encryption settings for data stored within a single account. According to Microsoft Azure Storage documentation, an encryption scope defines a specific encryption context that can be applied at the container or blob level and is supported in non-hierarchical namespace storage accounts (those without Data Lake Gen2 enabled).

In the given scenario:

storage1 has Hierarchical namespace = Yes (Data Lake Storage Gen2 enabled).

storage2 has Hierarchical namespace = No.

The plan was to create an encryption scope named Scope1 in storage2.

The technical requirement specifies that Scope1 must be used to encrypt storage services.

According to the Azure Administrator documentation on encryption scopes:

“Encryption scopes are supported for block blobs, append blobs, page blobs, Azure Files, queues, and tables in standard StorageV2 accounts. Encryption scopes are not supported in hierarchical namespace (Data Lake Gen2) enabled accounts.”

This means that Scope1—created in storage2, which does not have hierarchical namespace—can encrypt all blob data (containers and blobs) as well as file shares, queues, and tables.

However, storage1 cannot use encryption scopes because hierarchical namespace storage accounts (ADLS Gen2) manage encryption at the account level and do not support per-scope encryption.

Therefore, only storage2 can apply Scope1, and it can encrypt containers, blobs, file shares, queues, and tables.