AZ-104: Microsoft Azure Administrator – Practice Exam

Before deleting a Recovery Services vault, you must: (1) Stop all active backup jobs to detach protected items, (2) Disable the soft delete feature and delete all backup data so no retained data remains, and (3) Permanently remove any items still in the soft delete state. You do not need to delete the VMs themselves (only stop their backups), and enabling a Read lock would prevent deletion of the vault, not help with it.

Before deleting a Recovery Services vault you must: (1) Stop all active backup jobs to detach protected items from the vault, (2) Remove any backup items and their associated data, and (3) Disable the soft delete feature and permanently delete all retained backup data. Renaming the vault or changing the retention policy does not help remove dependencies. All protected items and data must be fully cleared before deletion is allowed.

To enforce these guidelines, you need: (1) Create an Azure Policy under the Compute category to restrict allowed VM SKUs (blocking N-series), and (2) Create a policy initiative that bundles a tag enforcement policy (require tags) and an allowed locations policy (restrict to West US). Conducting meetings or manually verifying tags are not automated governance solutions. Auditing VMs without managed disks is unrelated to the requirements.

Azure Key Vault’s managed storage account keys feature stores access keys as secrets, controls access through RBAC, and automatically regenerates keys on a defined schedule. Manual rotation via portal or scripts requires effort and lacks centralized auditing. Switching entirely to Entra ID auth is ideal but doesn’t address the need to continue using access keys. Key Vault provides the best combination of automation and security.

Cookie-based affinity in Application Gateway uses a gateway-managed cookie to keep a user session on the same backend server throughout the session. This maintains session state and consistency. URL path-based routing directs based on path, not persistence. SSL offloading reduces backend load but doesn’t address session persistence. Traffic Manager is for global DNS-based routing, not session affinity.

The ‘Export template’ option in the Azure portal captures the current resource configuration as an ARM template JSON file. This is the most accurate and efficient method since it reflects the actual deployed state. Running CLI commands with default settings won’t capture custom configurations. Writing templates manually is inefficient and error-prone. PowerShell template creation from scratch is unnecessary when export exists.