Free AZ-104 Exam Dumps Preview

- a standard SKU and a static IP address assignment

When availability zones are in scope for the gateway scenario, the public IP used with the VPN gateway must be a Standard SKU and must be Static. This aligns with zone-aware/zone-redundant requirements and is the supported pairing for resilient gateway deployments.

Why the other choices are not correct:
- Basic SKU public IPs and/or Dynamic assignment are not the correct combination for zonal gateway
scenarios.

Microsoft Exam Tips:
- For many Azure gateway/AZ questions, "Standard + Static" is the expected public IP pattern.

Summary:
- VPN gateway public IP requirements for zonal resilience.

AZ-104 Exam Objective Hierarchy:

4.0 Implement and manage virtual networking 4.1 Configure and manage virtual networks in Azure
4.1.3 Configure public IP addresses

Yes

This solution meets the goal.

You need to add VM1 and VM2 to the backend pool of LB1 (Internal, Standard SKU). VM2 currently has a Basic public IP SKU. Disassociating the Basic public IP from VM2's NIC removes an SKU mismatch/ compatibility blocker that can prevent backend pool association with Standard load-balancing components.

Why "No" is incorrect:
- Removing the Basic public IP from VM2 does not prevent backend pool membership; it enables compatibility with Standard scenarios.

Microsoft Exam Tips:
- If you see Standard LB and a Basic public IP in the same scenario, expect a SKU-alignment fix (remove/
replace Basic).
- Internal LB backend pool membership is about NIC configuration + compatibility.

Summary:
Standard internal Load Balancer backend pool membership and resolving Basic public IP compatibility issues.

AZ-104 Exam Objective Hierarchy:
4.0 Implement and manage virtual networking 4.3 Configure name resolution and load balancing 4.3.2 Configure an internal or public load balancer

Statement 1: Yes
Statement 2: Yes
Statement 3: No

Why this is correct:
- Statement 1 (Yes): The template explicitly allows inbound traffic to the storage account from the public IP 131.107.103.10 via an IP rule.
- Statement 2 (Yes): In supported storage account types, individual blobs can be moved to the Archive
access tier.
- Statement 3 (No): Being a Microsoft Entra (Azure AD) Global Administrator does not automatically grant data-plane access to an Azure file share; Azure Files identity-based access must be configured and
authorized appropriately.

Exam Tips:
- "Directory role" (Global Admin) ≠ "Azure RBAC role" (Owner/Contributor) and ≠ "data-plane permission."
Always separate these three in your head.

AZ-104 Exam Objective Hierarchy
2.0 Implement and manage storage (15-20%) 2.1 Configure access to storage 2.1.1 Configure network access to storage accounts 2.3 Configure Azure Files and Azure Blob Storage

2.3.1 Configure Azure Files
2.3.3 Configure Azure Blob Storage

Type: Microsoft.Compute/virtualMachines/extensions
Password: ProtectedSettings

Why this is correct:
- VM extensions are modeled as resources of type Microsoft.Compute/virtualMachines/extensions in ARM
templates.
- Secrets such as passwords should be placed in protectedSettings so they are not stored in plain text in
deployment history/logs.

Why the other options are incorrect:
- Putting passwords in settings exposes them in ARM template operations and may violate security
requirements.

Exam Tips:
- In ARM templates: settings = non-secret, protectedSettings = secret.

AZ-104 Exam Objective Hierarchy
3.0 Deploy and manage Azure compute resources (20-25%) 3.1 Automate deployment of resources by using templates 3.1.1 Create and execute an Azure Resource Manager template

Scenario: Evaluate Blob lifecycle rules and determine which statements are true on specific dates (June 6, June 7, June 16).

Selected values

On June 6, File1 will be stored in the Cool access tier. No

On June 7, File2 will be stored in the Cool access tier. Yes

On June 16, File2 will be stored in the Archive access tier. No

Lifecycle conditions use "daysAfter...GreaterThan" semantics (that is, "more than N days"), so a 5-day rule does not trigger exactly on day 5 but only after it has been exceeded. Rule2 (all blobs, >5 days since last
modification) is the earliest applicable action for File2, so File2 can transition to Cool around June 7.
Archive at >15 days for container2 requires exceeding 15 days; June 16 is not beyond 15 full days from June 1, so the Archive transition is not yet guaranteed on June 16.

Watch for "greater than" vs. "greater than or equal to" wording in lifecycle conditions; Azure uses "greater than." If multiple rules apply, the earliest threshold action typically happens first; later thresholds will not
apply until their conditions are met.

2.0 Implement and manage storage (15-20%) 2.3 Configure Azure Files and Azure Blob Storage
2.3.6 Configure blob lifecycle management

Step 1: Create a Recovery Services vault.
Step 2: Set Replication to Zone-redundant storage (ZRS).
Step 3: For VM1, create a backup policy and configure the backup.

Goal: Back up VM1 and ensure the backup data is stored across availability zones in the primary region.

Step 1: Create a Recovery Services vault.
- Azure Backup for VMs is managed through a Recovery Services vault.

Step 2: Set replication to Zone-redundant storage (ZRS).
- ZRS stores backup data synchronously across multiple availability zones in the region, aligning to the "stored across availability zones" requirement.

Step 3: Create a backup policy and configure backup for VM1.
- The policy defines schedule/retention and enabling backup actually protects the VM.

Why other actions are not selected:
- Configure a replication policy: that's typically Site Recovery wording, not Azure Backup.
- Set replication to LRS: does not meet the "across availability zones" requirement.

Microsoft Exam Tips:
- If the requirement says "across availability zones," look for ZRS.
- Azure Backup VM flow: Vault --> (Vault redundancy) --> Policy --> Enable backup.

Summary:
Configured Azure VM backups with zone-resilient storage by using a Recovery Services vault set to ZRS and applying a VM backup policy.

AZ-104 Exam Objective Hierarchy:
5 - Monitor and maintain Azure resources (10-15%) 5.2 - Implement backup and recovery 5.2.1 - Create a Recovery Services vault 5.2.3 - Create and configure a backup policy 5.2.4 - Perform backup and restore operations by using Azure Backup

- an internal load balancer
- an Azure Application Gateway

Users reach App1 from home and customer sites by using point-to-site and site-to-site VPNs. That means the application can be published on a private IP inside the virtual network and still be reachable to users over the VPN connections. You need to spread client connections across multiple Azure VMs running Windows Server 2016.

Both selected services provide a complete load-balancing solution for this scenario:

- an internal load balancer:
Using a private (internal) frontend IP, Azure Load Balancer can distribute TCP/UDP flows across backend VMs without exposing a public endpoint. This meets the requirement to spread connections across all virtual machines while keeping the service internal to the VNet/VPN-connected users.

- an Azure Application Gateway:
Application Gateway is a web (HTTP/HTTPS) load balancer. It can be deployed with a private frontend IP (internal endpoint) to provide Layer 7 load balancing to backend VMs, which also spreads connections across the virtual machines while keeping the endpoint private.

Why the other options are not correct:

- a public load balancer:
A public load balancer uses a public frontend IP and is intended for Internet-facing access. The scenario describes private access via VPN, so a public endpoint is unnecessary and changes the exposure profile.

- Traffic Manager:
Traffic Manager is DNS-based and is intended to distribute traffic to public-facing endpoints across regions; it does not function as an internal, connection-level load balancer for VPN-only access paths.

- an Azure Content Delivery Network (CDN):
CDN is for caching/accelerating static and cacheable content at edge locations, not for distributing direct VM connection flows for a line-of-business application.

Microsoft Exam Tips:
- First classify the access path: "users connect by VPN" strongly suggests an internal/private frontend (internal load balancer or internal Application Gateway).
- Know the service boundary:
- Load Balancer = Layer 4 (TCP/UDP), fast and simple.
- Application Gateway = Layer 7 (HTTP/HTTPS), web-aware routing features.

- DNS-based services (Traffic Manager) are commonly tested distractors when the requirement is connection distribution inside a region/VNet rather than global endpoint selection.

Summary:
- Choosing Azure load-balancing services for VPN-accessed applications
- Internal (private) load balancing with Azure Load Balancer
- Internal (private frontend) web load balancing with Azure Application Gateway
- Eliminating non-fit options (DNS-based Traffic Manager, CDN, public load balancer)

AZ-104 Exam Objective Alignment (Hierarchy) 4.0 Implement and manage virtual networking 4.3 Configure name resolution and load balancing 4.3.2 Configure an internal or public load balancer

The App Service plan to WebApp1 remains to West Europe. Policy2 applies to WebApp1.

Moving a resource between resource groups does not change the resource's region. WebApp1 remains in West Europe, and its App Service plan location remains West Europe as well.

However, governance controls (like Azure Policy) are evaluated based on scope. Once WebApp1 is moved into RG2, the policies assigned to RG2 (Policy2) become applicable at that new scope (subject to inheritance/exemptions). Therefore, the App Service plan remains in West Europe and Policy2 applies after the move.

Why other selections are incorrect:
- The App Service plan to WebApp1 moves to North Europe. Policy2 applies to WebApp1.: Resource moves do not migrate the app/service plan to another region.
- The App Service plan to WebApp1 moves to North Europe. Policy1 applies to WebApp1.: Wrong region outcome and wrong policy scope after move.
- The App Service plan to WebApp1 remains to West Europe. Policy1 applies to WebApp1.: After the move into RG2, RG2's policy scope is the relevant one (Policy2), not RG1's.

Microsoft Exam Tips:
- "Move to another resource group" typically changes scope (RBAC/Policy) but not location/region.
- When you see "Policy1/Policy2/Policy3" tied to RGs, the exam is testing policy scope inheritance.

Summary:
Moving WebApp1 to RG2 doesn't change its region, but it does change the policy scope, so RG2's policy applies.

AZ-104 Exam Objective Hierarchy:
1.0 Manage Azure identities and governance 1.3 Manage Azure subscriptions and governance
1.3.4 Manage resource groups

No

The goal is to view the date and time the resources were created in RG1. Since the resources were deployed by using templates, the most direct place to see the deployment timestamps (and drill into operations that show what was created) is the Resource group (RG1) > Deployments blade.

The proposed solution navigates to: Subscription > Programmatic deployment

That view is centered on subscription-level deployment artifacts and does not reliably provide the creation date and time for the specific resources in RG1 in the same way that RG-scoped Deployments does.
Therefore, it does not meet the goal.

What would meet the goal:

Go to RG1 > Deployments.

Select the relevant deployment to view the timestamp and deployment operations (which reflect the resource creation actions).

Microsoft Exam Tips:
If the question mentions "resources were deployed by templates" and asks "when were they created," think Resource group > Deployments (RG-scoped history).
Use the Activity log for "Create/Write" events when the question is about who, what, or when for resource operations, but for template deployments the fastest path is typically Deployments.

Summary:
Where to find timestamps for template-based deployments (RG-scoped deployment history) and why subscription-level "Programmatic deployment" is not the correct scope for confirming the creation time of resources in a specific resource group.

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and Manage Azure Compute Resources 3.1 Automate Deployment of Resources by Using Azure Resource Manager (ARM) Templates or Bicep Files 3.1.1 Interpret an Azure Resource Manager Template or a Bicep File

1. On the Azure portal menu, select Monitor, or search for and select Monitor from any page

2. Select Activity Log.

3. You see a summary of recent operations. A default set of filters is applied to the operations. Notice the information on the summary includes who started the action and when it happened.

References:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/view-activity-logs

1) Users that are assigned Role1 can assign Role1 to users. - No 2) Users that are assigned Role1 can deploy new virtual machines. - Yes
3) Users that are assigned Role1 can set a static IP address on a virtual machine. - Yes

Why these are correct:
1) NO - Assigning a role to a user requires permissions to create role assignments (for example, Microsoft.Authorization/roleAssignments/write). In the provided role JSON, Microsoft.Authorization write operations are excluded via notActions, which removes the ability to assign roles.
2) YES - The role includes broad compute actions (Microsoft.Compute/virtualMachines/*), which covers
creating/deploying VMs.
3) YES - Setting a VM's static IP involves write operations on networking resources (commonly the NIC / related networking objects). The role includes broad networking permissions (for example, Microsoft.Network/networkInterfaces/*), enabling that change.

AZ-104 Exam Objective Hierarchy
1.0 Manage Azure identities and governance (20-25%) 1.2 Manage access to Azure resources 1.2.2 Assign roles at different scopes
1.2.3 Interpret access assignments

Create a sign-in risk policy in Azure AD Identity Protection

"Two-step verification" in Microsoft Entra context generally refers to requiring an additional verification method (MFA). Among the provided options, Azure AD (Microsoft Entra) Identity Protection sign-in risk policy is the one that can enforce additional verification controls (such as requiring MFA) based on risk conditions.

The other choices (PIM, Identity Hub, Security Center policy) do not directly enable two-step verification for users.

Why other selections are incorrect:
- Enable Azure AD Privileged Identity Management.: PIM manages just-in-time privileged role activation; it is not the control to enable two-step verification for all users.
- Create and configure the Identity Hub.: Not an MFA enablement mechanism for Entra users.
- Configure a security policy in Azure Security Center.: Defender for Cloud/Security Center focuses on posture management and workload protection; it does not directly enable Entra two-step verification for
users.

Microsoft Exam Tips:
- When the answer set includes Identity Protection policies, Microsoft is often testing "risk-based MFA" rather than generic MFA setup language.
- PIM = privileged role governance; it is not the general mechanism to "turn on two-step verification."

Summary:
Given the options, Identity Protection sign-in risk policy is the only choice aligned with enforcing two-step verification (MFA) behavior.

AZ-104 Exam Objective Hierarchy:
1.0 Manage Azure identities and governance 1.1 Manage Microsoft Entra users and groups 1.1.2 Manage user and group properties

Scenario (condensed):

Create a SAS for storage1 / container 1.

Requirements:

SAS can only be used to enumerate and download blobs in container1

Use least privilege

Prompt:

Which THREE settings should you enable?

Answer (as shown in your screenshot/key):

Allowed resource types: Container

Allowed resource types: Object

Allowed permissions: Read

Why these are correct:

Container + Object scope the SAS to container-level and object (blob) operations.

Read permits downloading blob content (least privilege for download).

Important technical note (about the word "enumerate"):

Microsoft's definitions separate "Read" and "List." "Enumerate/list blobs" typically requires the "List" permission in addition to "Read."

Your exam item limits you to THREE selections, and your screenshot highlights Container + Object +
Read. If you see a variant of this question that allows a 4th or 5th checkbox, add "List" to satisfy
"enumerate/list."

Statement 1: Yes
All client computers in the Paris office will be joined to an Azure AD domain.
A virtual network named Paris-VNet that will contain two subnets named Subnet1 and Subnet2.
Microsoft Windows Server Active Directory domains, can resolve DNS names between virtual networks.
Automatic registration of virtual machines from a virtual network that's linked to a private zone with auto-registration enabled. Forward DNS resolution is supported across virtual networks that are linked to the private zone.

Statement 2: Yes
A virtual network named ClientResources-VNet that will contain one subnet named ClientSubnet You plan to create a private DNS zone named humongousinsurance.local and set the registration network to the ClientResources-VNet virtual network.
As this is a registration network so this will work.

Statement 3: No
Only VMs in the registration network, here the ClientResources-VNet, will be able to register hostname records. Since Subnet4 not connected to Client Resources Network thus not able to register its hostname with humongoinsurance.local

Create an access review.

The requirements describe a periodic, automated membership attestation where each member can confirm they still need access, and non-responders (or users who say "no") are automatically removed.
Microsoft Entra ID Governance "Access reviews" is designed for exactly this: you can schedule recurring reviews (for example, every 3 months), allow self-review by members, and auto-apply results to remove access for denied and (optionally) non-responding users.
Why the other options are not correct:
- Implement Azure AD Identity Protection: focuses on risk detection and remediation, not scheduled
membership attestation/removal.
- Change the Membership type of Group1 to Dynamic User: dynamic groups are rule-based; they do not provide a periodic "confirm I still need this" workflow.
- Implement Azure AD Privileged Identity Management (PIM): PIM manages privileged role activation/ eligibility; it's not the primary control for recurring group membership attestation by all members.

Microsoft Exam Tips:
- AZ-104 frequently tests governance controls that reduce admin overhead (recurring access reviews,
auto-apply results).
- Watch the distinction: "rules-based membership" (dynamic groups) vs "attestation workflow" (access
reviews).

Summary:
Covers Microsoft Entra ID Governance: recurring access reviews, self-attestation, and automated removal of access.

AZ-104 Exam Objective Hierarchy:
1.0 Manage Azure identities and governance 1.2 Manage access to Azure resources
1.2.3 Interpret access assignments

dependsOn: resourceId
storageProfile: imageReference

Why this is correct:
- dependsOn is used to control deployment order. Using resourceId() is the standard way to reference the full resource ID of a dependency (like a NIC) inside dependsOn.
- For a VM, storageProfile.imageReference is the standard property used to define the OS image
(publisher/offer/sku/version).

Why the other option is incorrect:
- reference(): Used to read runtime properties of an already-deployed resource; it's not the typical choice to define a dependency in dependsOn.
- If you chose something other than imageReference: you wouldn't be correctly specifying the VM's image metadata in the expected schema location.

Exam Tips:
- For ARM dependencies: think dependsOn + resourceId().
- For VM images: think storageProfile.imageReference.

Summary:
Use resourceId() for the NIC dependency and imageReference for the VM image selection.

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and manage Azure compute resources (20-25%) 3.1 Automate deployment of resources by using templates 3.1.1 Interpret an Azure Resource Manager template or a Bicep file

Modify the Directory-wide Groups settings.

You are granting access by assigning permissions to the built-in "All Users" group. User1 and User2 are members, but User3 and User4 are guests.

If your tenant is configured so that guest accounts are not included (or not eligible) for the "All Users" group, then assigning access to "All Users" will not grant access to the guest users. Updating the directory-wide group settings is the first step that ensures the "All Users" group behavior aligns with the intended
access model (members + guests).

Why the other options are not the best first step

Create a member account for User4:
- Not required. User4 already exists as a guest and can be granted access without converting to a
member.

Create a member account for User3:
- Not required for the same reason; also typically conflicts with least-privilege/least-change guidance.

Modify the External collaboration settings:
- These settings govern how guests are invited and what guests can do in the directory, but the immediate access problem (sharing to "All Users" and ensuring the guests are included/eligible for that group-based access) is addressed first by the directory-wide group configuration.

Exam objective hierarchy 1.0 Manage Azure identities and governance 1.1 Manage Microsoft Entra users and groups
1.1.4 Manage external users

The App Serviceplan for WebApp1 remains in WestEurope. Policy2 applies to WebApp1.

Moving a web app to a different resource group does not change its region; the underlying App Service plan remains in the same location. After the move, Azure Policy assignment evaluation is based on the new scope (RG2), so Policy2 applies (assuming Policy2 is assigned to RG2).

Why the other choices are not correct:
- Any option claiming the App Service plan "moves" regions is incorrect; region does not change just from a resource-group move.
- Any option claiming Policy1 applies after the move conflicts with the scope change described.

Microsoft Exam Tips:
- AZ-104: Location/region is a property of the resource; moving resource group changes management
scope, not geography.
- Policy assignment scope matters (MG/subscription/RG/resource).

Summary:
Resource group moves, App Service plan location behavior, Azure Policy scope effects.

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and manage Azure compute resources 3.2 Create and configure virtual machines 3.2.3 Move a virtual machine to another resource group, subscription, or region

From the Azure portal, modify the Managed Identity settings of VM1

This is the correct first step.

To allow a service running on VM1 to manage resources in RG1 using the identity of VM1, you must use a system-assigned managed identity (or user-assigned, but the question implies VM1's identity). The sequence is:

1) Enable the managed identity on VM1 (Identity blade / Managed Identity settings).
2) Assign the managed identity an Azure RBAC role at the correct scope (RG1) via RG1 > Access control
(IAM).

Because the question asks what you do first, enabling the managed identity on the VM is the first required step.

Why the other selections are not correct:
- Modify the Access control (IAM) settings of RG1: You cannot assign the VM's identity permissions until the managed identity exists/enabled on VM1.
- Modify the Access control (IAM) settings of VM1: RBAC for managing RG resources should be assigned at the RG scope, not on the VM resource, for this requirement.
- Modify the Policies settings of RG1: Azure Policy does not grant runtime permissions to the VM/service.

Microsoft Exam Tips:
- Managed Identity questions are usually a two-step: enable identity, then grant RBAC at the correct scope.
- "Using the identity of the VM" typically means system-assigned managed identity.

Summary:
Enable a VM managed identity first, then assign RBAC at the resource group scope.

AZ-104 Exam Objective Hierarchy:
1.0 Manage Azure identities and governance 1.2 Manage access to Azure resources

1.2.2 Assign roles at different scopes

Databricks SKU: Premium
Cluster configuration: Credential passthrough

Why this is correct:
- Credential passthrough is the feature that allows Azure Databricks to access ADLS Gen2 using the user's identity, which aligns with "permissions are granted directly to the data engineers" and minimizes
custom coding/extra security plumbing.
- Credential passthrough is available with the Premium plan, so Premium is required to meet the requirement while keeping development effort low.

Why the other options are incorrect:
- Standard: Does not provide the same identity features required for credential passthrough in Azure
Databricks.
- Managed identities / Secret scope: Commonly result in shared identity access (service principal/ managed identity), which does not directly enforce per-engineer folder permissions granted via ACLs.
- MLflow / Photon runtime: Not related to identity-based access to ADLS Gen2.

Exam Tips:
- If a question emphasizes "permissions granted directly to users" + "minimize dev effort," think per-user identity (credential passthrough), not shared secrets.
- Don't confuse performance/runtime features (Photon) with authentication/authorization features.

Summary:
Use Premium so you can enable credential passthrough and enforce ADLS Gen2 access using each engineer's identity.

AZ-104 Exam Objective Hierarchy:
2.0 Implement and manage storage (15-20%) 2.1 Configure access to storage

Upgrade the SKU.

- Geo-replication for Azure Container Registry is a Premium-tier capability.
- Since the registry is Standard SKU, the first step is to upgrade it to Premium, then configure geo-
replication.

Why the other options are incorrect:
- Enable Admin user / Add a scope map / Add an automation task / Create a cache rule: None of these change the service tier, so they do not enable geo-replication support.

Microsoft Exam Tips:
- ACR feature gating by SKU is a classic AZ-104 pattern (Basic vs Standard vs Premium).

Summary:
ACR tier-based capabilities (geo-replication).

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and manage Azure compute resources 3.3 Provision and manage containers in the Azure portal 3.3.1 Create and manage an Azure container registry

Session persistence to Client IP and protocol

To ensure a visitor is consistently serviced by the same backend web server (session affinity), you configure Azure Load Balancer "Session persistence" using the 3-tuple option: Client IP and protocol. This pins successive requests from the same client IP and protocol combination to the same backend instance.

Why other selections are not correct:
- Protocol to UDP: Protocol choice does not provide affinity by itself; session persistence is the setting that enforces "same backend per client."
- Session persistence to None: Explicitly disables affinity; requests can land on different backend
instances.
- Floating IP (direct server return) to Enabled: This is for specific load balancing/DSR scenarios and does not implement client session affinity.

Microsoft Exam Tips:
- For "sticky sessions" on Azure Load Balancer, look for "Session persistence / source IP affinity" wording.
"Client IP and protocol" is the 3-tuple affinity option.
- Remember: Load Balancer is Layer 4; affinity is hash/tuple-based, not cookie-based.

Summary:
Session persistence (source IP affinity) configuration on Azure Load Balancer.

AZ-104 Exam Objective Hierarchy:
4.0 Implement and manage virtual networking 4.3 Configure name resolution and load balancing 4.3.2 Configure an internal or public load balancer

Add-AzVhd

To use a generalized on-prem VHD as the basis for Azure VM creation, you must first upload the VHD to Azure Storage. Add-AzVhd is the Azure PowerShell cmdlet used to upload a VHD to a storage account, which is a prerequisite step before you can reference it to create an image/VM in Azure.

Why the other choices are not correct:
- Add-AzVM: used to create a VM, not upload a VHD.
- Add-AzImage / Add-AzImageDataDisk: not the standard cmdlet for uploading the VHD itself; you must upload the VHD first, then create an image referencing it.

Microsoft Exam Tips:
- Image workflows are commonly "upload VHD" --> "create image" --> "deploy VM(s)".

Summary:
- Uploading generalized VHDs to Azure via Azure PowerShell.

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and manage Azure compute resources 3.2 Create and configure virtual machines 3.2.1 Create a virtual machine

App1 can be moved to RG2: No
App1 can be moved to RG3: Yes App1 can be moved to RG4: Yes

You're moving an Azure resource (App1) between resource groups/subscriptions. The key constraint here is the resource lock applied to the destination resource group.

Why "App1 can be moved to RG2" = No

RG2 has a ReadOnly lock.

A ReadOnly lock blocks write operations and, importantly, prevents moving resources into or out of a locked scope.

Therefore, App1 cannot be moved into RG2 while that ReadOnly lock is in place.

Why "App1 can be moved to RG3" = Yes

RG3 has a Delete (CanNotDelete) lock.

A CanNotDelete lock prevents deletions, but still allows changes (write operations) that don't delete the resource.

Since a move is not a delete operation, the lock type itself does not block the move (assuming the
resource type supports move).

Why "App1 can be moved to RG4" = Yes

RG4 has no lock.

With no lock-based restriction, the move is allowed (again assuming the resource type supports move).

Microsoft Exam Tips:
A ReadOnly lock is the most restrictive: it blocks updates and blocks move operations.
A CanNotDelete lock blocks deletion only; it usually won't block configuration changes.
On exam questions, when you see "move" + "lock," immediately test whether the lock scope includes the source or destination.

Summary:
This question tests how resource locks affect the ability to move resources across resource groups/ subscriptions.

AZ-104 Exam Objective Hierarchy:

1.0 - Manage Azure identities and governance (20-25%) 1.3 - Manage Azure subscriptions and governance
1.3.2 - Configure resource locks

SecAdmin1 must answer the following question if he wants to reset his password: "In what city was your first job?": No

BillAdmin1 must answer the following question if he wants to reset his password: "What is your favorite food?": No

User1 must answer the following question if he wants to reset his password: "What was the name of your first pet?": Yes

This question is testing how SSPR security questions work and (critically) who is allowed to use them.

Key rule:
- Security questions are NOT available for administrator accounts in Microsoft Entra ID SSPR. When an admin resets a password, their policy enforces stronger methods (for example, Microsoft Authenticator) and explicitly prohibits security questions.

Apply that to the users:
- SecAdmin1 (Security administrator) = admin x security questions can't be used x the statement "must answer <specific security question>" is No.
- BillAdmin1 (Billing administrator) = admin x security questions can't be used x No.
- User1 (Reports reader) = not an admin x security questions ARE allowed.
And because the policy requires 3 questions to reset and exactly 3 questions are configured, User1 would have to answer all three-including "What was the name of your first pet?"-when using the security
questions method x Yes.

Microsoft Exam Tips:
- Watch for "administrator" roles (Security admin, Global admin, Billing admin, etc.). On the exam, that often changes what authentication/reset methods are permitted.
- If security questions are involved, remember they're generally weaker and often disallowed for admins.

Summary:
SSPR security questions can be used by standard users, but are not available for administrator accounts;
therefore only the non-admin user can be forced to answer a specific configured question.

AZ-104 Exam Objective Hierarchy:
1.0 - Manage Azure identities and governance (20-25%) 1.1 - Manage Microsoft Entra users and groups 1.1.5 - Configure self-service password reset (SSPR)

the new files on drive D

On Azure Windows VMs, drive D is commonly the temporary disk (local ephemeral storage). When you redeploy a VM (host move), the temporary disk can be reinitialized and data on it can be lost. Therefore, files created on drive D are the changes most likely to be lost after redeploy.

Why the other selections are not correct:
- the modified screen saver timeout:
This is a Windows/user configuration setting stored on the OS disk (C:) and typically persists through redeploy.
- the new desktop background:
This is a user profile setting stored on the OS disk (C:) and typically persists through redeploy.
- the new files on drive C:
Drive C is the OS disk (managed disk) and persists through redeploy.

Microsoft Exam Tips:
- AZ-104 often checks whether you know "temporary disk" behavior. Treat D:\ on many Windows Azure VMs as non-durable storage.
- Put anything you must keep on managed disks (OS disk/data disks), not the temporary disk.

Summary:
Azure VM redeploy impacts temporary (ephemeral) disk data; drive D is typically temporary.

AZ-104 Exam Objective Hierarchy:

(Note: Only a partial hierarchy is available in this chat. Mapping below is best-fit.) 3.0 Deploy and manage Azure compute resources 3.2 Create and configure virtual machines 3.2.x Manage virtual machine disks (temporary vs managed disks)

In Azure PowerShell, Get-AzRoleDefinition retrieves role definitions (built-in or custom). Piping the result to ConvertTo-Json outputs the role definition in JSON format, which is commonly used as a starting point for custom roles.

AZ-104 Exam Objective Hierarchy (Mapped to this question) 1.0 Manage Azure identities and governance (20-25%) 1.2 Manage access to Azure resources 1.2.1 Manage built-in Azure roles 1.2.2 Assign roles at different scopes

Box 1 (Can use Vault1 for backups): VM1 only
Box 2 (Can use Vault2 for backups): share1 only

Key rule: For Azure Backup using a Recovery Services vault, the vault must be in the SAME REGION as the protected data source.

Given resources/regions:
- Vault1 = Central US
- Vault2 = West US
- VM1 = Central US
- storage1 (hosts blob1 + share1) = West US
- SQL1 = East US

Therefore:
- Vault1 (Central US) can back up:
- VM1 (Central US) x
- share1 (West US) x (wrong region)
- blob1 x (blob container backups are not done via Recovery Services vault in this context)
- SQL1 (East US) x (wrong region and Azure SQL DB uses its own automated backups)

- Vault2 (West US) can back up:
- share1 (West US) x (Azure Files share backup requires the vault be in the same region as the storage
account)
- VM1 (Central US) x (wrong region)
- blob1 x (not protected via Recovery Services vault here)
- SQL1 (East US) x (wrong region)

- If the question shows multiple regions, expect "only items in the same region as the vault" to be the
constraint.
- Azure Files share backup aligns to the Storage Account region; VM backup aligns to the VM region.

Summary:
Chose VM1 for Vault1 (Central US match) and share1 for Vault2 (West US match) based on same-region Recovery Services vault requirements.

AZ-104 Exam Objective Hierarchy:

5 Monitor and maintain Azure resources (10-15%)
└─ 5.2 Implement backup and recovery
└─ 5.2.1 Create a Recovery Services vault

Live Metrics Stream in Application Insights

Live Metrics Stream provides near real-time telemetry (including request rate, failures, and dependency calls) so you can detect request errors and failed requests immediately during a traffic spike. That matches the requirement for immediate anomaly detection.

Why the other selections are not correct:
- Application Insights Search: Useful for querying/inspecting collected telemetry, but not the most
immediate "live stream" view.
- Log analytics workspace: Strong for analysis and queries, but not the quickest live signal for immediate detection during a spike.
- Client-side monitoring: Focuses on client/browser telemetry; does not directly provide immediate server request/dependency live stream view like Live Metrics.

Microsoft Exam Tips:
- "Immediately / real-time" with Application Insights typically maps to Live Metrics Stream.

Summary:
Real-time application observability using Application Insights Live Metrics.

AZ-104 Exam Objective Hierarchy:
5 Monitor and maintain Azure resources 5.1 Monitor resources in Azure 5.1.1 Interpret metrics in Azure Monitor

You can assign User1 the Microsoft Defender for Cloud Apps Discovery license. -> No
You can remove the Azure Active Directory Premium P2 license from User1. -> No
User2 is assigned the Azure Active Directory Premium P2. -> No

Why this is correct:
- "Microsoft Defender for Cloud Apps Discovery" is not assigned as an independent license in the way the
statement implies.
- If User1 receives Azure AD Premium P2 via group-based licensing, you don't remove it directly from the user; you change group membership or licensing assignment rules.
- Nested group membership does not result in license assignment to User2 when the license is assigned to Group1 and User2 is only in Group2 (nested).

Why the other options are incorrect:
- "Yes" to statement 3 assumes nested groups inherit group-based licenses automatically in this
configuration.

Exam Tips:
- Group-based licensing typically evaluates direct membership for assignment; nested groups can be a
trap.
- "Remove from a user" usually means remove from the assignment source (group), not toggle it off per-
user.

AZ-104 Exam Objective Hierarchy:
1.0 Manage Azure identities and governance (20-25%) 1.1 Manage Microsoft Entra users and groups 1.1.3 Manage licenses in Microsoft Entra ID

Change the size to D8s v3.

The change that will cause downtime is the one that requires a VM restart (or stop/deallocate) to apply.

Why the correct selection is correct:
- Change the size to D8s v3.
- Resizing a VM changes the underlying compute allocation. This typically requires a restart, and in some scenarios requires the VM to be stopped/deallocated to move to a different host cluster that supports the requested size. Either way, that introduces downtime.

Why the other selections are incorrect:
- Add a 500-GB managed disk.
- Data disks can generally be added to a running VM (the OS may need to rescan the bus/initialize disk in- guest, but the Azure action does not inherently require VM downtime).
- Attach an additional network interface.
- Whether you can add/attach a NIC depends on VM size and NIC limits, but if the platform supports it, NIC changes are often manageable; however, the question asks which "will cause downtime" and the
consistently downtime-causing action here is resizing.
- Add the Puppet Agent extension.
- VM extensions can typically be installed without stopping the VM; they run in-guest and may briefly impact performance but do not inherently require VM downtime.

Microsoft Exam Tips:
- "Resize VM" is a classic downtime trigger on AZ-104. When in doubt, assume resize requires restart and may require stop/deallocate.
- Adding disks and adding extensions are typically "online" operations.

Summary:
Operational impact of common VM changes; resizing is the most reliably downtime-causing action.

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and manage Azure compute resources 3.2 Create and configure virtual machines
3.2.4 Manage virtual machine sizes

service chaining and user-defined routes (UDRs)

To extend on-premises connectivity (terminating on the VPN gateway in VNet1) to workloads in a peered VNet (VNet2) while minimizing cost, you use hub-and-spoke style transit so the spoke can leverage the hub's connectivity. In exam phrasing, "service chaining + UDRs" aligns to routing/transit through the hub rather than deploying additional cost-bearing components (like new ExpressRoute circuits).

Why other selections are not correct:
- Azure Firewall with a private IP address: adds cost and is not required just to extend reachability.

- Azure Application Gateway: is for HTTP(S) L7 load balancing, not network transit from on-prem to a
peered VNet.
- ExpressRoute circuits to VNet2: adds significant cost; not the "minimize costs" approach.

Microsoft Exam Tips:
- For "minimize cost" with hub/spoke + on-prem, look for "use remote gateways / allow gateway transit" concepts (even if the option wording is indirect).

Summary:
- Hub/spoke transit for on-prem to peered VNets

AZ-104 Exam Objective Hierarchy:
4.0 Implement and manage virtual networking 4.1 Configure and manage virtual networks in Azure 4.1.2 Create and configure virtual network peering

Box 1: An Azure Key Vault
Box 2: An access policy

The ARM template must reference an administrative password securely. Best practice is to store the password as a secret in Azure Key Vault and allow the deployment engine (ARM) to retrieve it during deployment.

Why these selections are correct:
- An Azure Key Vault
- Provides secure storage for secrets (like admin passwords) so you don't hardcode credentials in the ARM template or parameter files.
- An access policy
- The template deployment needs permission to retrieve the secret during deployment (for example, enabling Key Vault access for template deployment / granting the required access). Microsoft's ARM + Key Vault guidance explicitly calls out enabling access so the template can retrieve the
secret. :contentReference[oaicite:0]{index=0}

Why the other options are not correct:
- An Azure Storage account
- Not required for securely storing the admin password for an ARM template.
- Azure Active Directory (AD) Identity Protection
- Identity Protection is about risk-based detection and remediation, not secret storage for templates.
- An Azure policy
- Azure Policy can enforce standards, but it doesn't store or provide a secret value to a template.
- A backup policy
- Unrelated to passing an admin password into an ARM deployment.

Microsoft Exam Tips:
- If the scenario says "ARM template needs a password/secret," think: Key Vault + allow template
deployment access.
- Exam writers love "don't hardcode secrets" patterns-Key Vault is the canonical answer.

Summary:
Secure secret handling for ARM template deployments by storing an admin password in Key Vault and granting the template deployment access.

AZ-104 Exam Objective Hierarchy:
3.0 - Deploy and manage Azure compute resources (20-25%) 3.1 - Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files 3.1.4 - Deploy resources by using an Azure Resource Manager template or a Bicep file

Change the size to D8s v3

Resizing a VM (changing its size/SKU) causes the VM to restart, which is downtime for an always-on application. Adding a managed disk and adding extensions/configuration management can typically be performed without requiring the VM to be deallocated in the same way resizing does (though extensions may cause transient workload impact, they are not generally treated as the mandatory restart/downtime operation in AZ-104). :contentReference[oaicite:27]{index=27}

Why the other selections are not correct:
- Add a 500-GB managed disk:
Data disks can be attached online without stopping the VM in most scenarios.
- Add the Puppet Agent extension:
VM extensions can be installed while the VM is running; not typically "the" downtime answer compared to
resizing.
- Enable Desired State Configuration Management:
Configuration management changes do not inherently require a VM restart.

Microsoft Exam Tips:
- Any change that forces a VM restart/deallocation is "downtime" in exam terms.
- VM sizing questions frequently test whether you recognize the restart requirement.

Summary:
VM resizing causes a restart and therefore downtime.

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and manage Azure compute resources 3.2 Create and configure virtual machines
3.2.4 Manage virtual machine sizes

azcopy copy D:\folder1
https://contosodata.blob.core.windows.net/public
--recursive

You are copying the contents of a local folder (D:\Folder1) to a blob container (public) in an Azure Storage account.
AzCopy is the supported tool for copying data from an on-premises/local path directly to Azure Blob Storage.

Why this answer is correct:
- `azcopy copy` supports uploading from a local directory to a blob container.
- The `--recursive` flag is required to copy all files and subfolders under D:\Folder1 (not just the folder
object itself).

Why the other choices are not correct:
- az storage blob copy start D:\Folder1
https://.../public
This is for blob-to-blob copy operations (server-side copy of blobs), not uploading from a local Windows path.
- azcopy sync D:\folder1
https://.../public
--snapshot
`sync` is for synchronization scenarios and the `--snapshot` parameter is not a valid way to target a "public container upload" for this requirement.
- az storage blob copy start-batch D:\Folder1
https://.../public

`start-batch` is for copying multiple blobs (storage-to-storage), not uploading a local folder from a drive
letter path.

Note (real-world execution):
Even if the destination container is public for read access, uploading still requires authorization (for example, AzCopy login or a SAS token).

Microsoft Exam Tips:
- For "copy data from on-prem/local to Azure Storage," default to AzCopy (or Storage Explorer). Azure CLI
`az storage blob copy` is primarily for storage-side blob copy operations.
- Watch for keywords: "contents of D:\Folder1" strongly implies a local filesystem source --> AzCopy copy
+ `--recursive`.

Summary:
This question tested selecting the correct tool/command to upload a local directory to an Azure Blob container using AzCopy, including the need for recursive copy.

AZ-104 Exam Objective Hierarchy:
2.0 Implement and manage storage 2.2 Configure and manage storage accounts 2.2.5 Manage data by using Azure Storage Explorer and AzCopy

User4 and Group2 only

You removed OU1 from synchronization scope and then ran a sync. With Microsoft Entra Connect, when an object is filtered out of scope (for example, by domain/OU filtering) and you apply the change correctly, Entra Connect will remove (delete) the previously synchronized objects that are now out of scope in Microsoft Entra ID.

Given the table:
- OU1 contains: User1, User2, User3, Group1
- OU2 contains: User4, Group2

After OU1 is excluded and synchronization runs, only the objects that remain in scope (OU2) will remain in Microsoft Entra ID:
- User4 (OU2) remains.
- Group2 (OU2) remains.

Group membership does not "preserve" out-of-scope objects: Even though Group2 previously contained members from OU1 (User2 and Group1), those OU1 objects are out of scope and are removed from Microsoft Entra ID during the cleanup. Group2 can still exist, but the out-of-scope members will not remain in the directory.

Why the other selections are not correct:
- Any answer that still includes User1, User2, User3, or Group1 is incorrect because those objects are in OU1, which was removed from synchronization scope, and filtered objects are deleted in Microsoft Entra ID when the change is applied.

Microsoft Exam Tips:
- AZ-104 frequently tests how "scope" changes in Microsoft Entra Connect affect object lifecycle in Microsoft Entra ID. When you change domain/OU filtering, expect "Full Import" requirements and potential
mass-deletion safeguards (prevent accidental deletes).
- Remember: group nesting does not override sync scope. If the source objects fall out of scope, they will be removed from Microsoft Entra ID after the sync applies the change.

Summary:
This question tested Microsoft Entra Connect domain/OU filtering behavior and the impact on which on-premises AD objects remain synchronized into Microsoft Entra ID after scope changes.

AZ-104 Exam Objective Hierarchy:
1.0 Manage Azure identities and governance 1.1 Manage Microsoft Entra users and groups 1.1.2 Manage user and group properties

No

The proposed action (moving the virtual machine to a different subscription) is a management-scope move and does not directly perform an immediate host migration to avoid maintenance impact. Redeploy is the operation that migrates the VM to a new Azure host. Therefore, this does not meet the goal.

Why the other selection is incorrect:
- Yes: This is incorrect because the action described is not the host-relocation mechanism.

Microsoft Exam Tips:
- If the requirement is "different host," ignore subscription/resource-group moves unless the question explicitly asks for those scopes.

Summary:
Moving to another subscription doesn't guarantee immediate relocation to a new host; Redeploy does.

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and manage Azure compute resources 3.2 Create and configure virtual machines 3.2.3 Move a virtual machine to another resource group, subscription, or region

Assign User1 the User Access Administrator role for VNet1

The requirement is for User1 to be able to assign the Reader role for VNet1 to other users. Assigning RBAC roles requires permission to create role assignments (for example, `Microsoft.Authorization/ roleAssignments/write`) at the appropriate scope. Microsoft documents that Owner and User Access
Administrator are built-in roles that allow users to create role assignments. Therefore, assigning User Access Administrator at the VNet1 scope enables User1 to delegate Reader on that VNet without granting full resource management rights like Contributor.

Why other selections are incorrect:
- Assign User1 the Contributor role for VNet1.: Contributor can manage the resource, but it does not grant permission to manage access/role assignments by default.
- Remove User1 from the Security Reader and Reader roles to Subscription1.: Removing roles does not grant the ability to assign Reader; it reduces visibility instead.
- Assign User1 the Network Contributor role for VNet1.: Network Contributor manages network resources but does not inherently grant role-assignment permissions to delegate access.

Microsoft Exam Tips:
- If the verb in the requirement is "assign roles / grant access," think Owner or User Access Administrator (or RBAC Admin roles) at the required scope.
- Least privilege in delegation scenarios often means User Access Administrator instead of Contributor/
Owner.

Summary:
This tests RBAC delegation: to allow a user to assign Reader to a resource scope, grant a role that permits role assignments at that scope-User Access Administrator.

AZ-104 Exam Objective Hierarchy:
1.0 Manage Azure identities and governance 1.2 Manage access to Azure resources 1.2.2 Assign roles at different scopes

No

Forcing on-premises Active Directory replication (for example, via AD Sites and Services / Global Catalog replication) only affects replication between on-prem domain controllers. It does not trigger Microsoft Entra Connect (DirSync) to synchronize changes from on-premises AD to Microsoft Entra ID. Therefore, this solution does not meet the goal of replicating user information to Azure AD immediately.

Microsoft Exam Tips:
- Don't confuse "AD replication between DCs" with "sync to Entra ID." They are different pipelines.

Summary:
Difference between on-prem AD replication and Entra Connect synchronization.

AZ-104 Exam Objective Hierarchy:
1.0 Manage Azure identities and governance 1.1 Manage Microsoft Entra users and groups 1.1.1 Create users and groups

No

User1 created a NEW Azure Active Directory (Microsoft Entra ID) tenant:
external.contoso.onmicrosoft.com.

Admin roles shown in the scenario (for User2: Global administrator in "Azure Active Directory") apply to the ORIGINAL tenant (contoso.onmicrosoft.com), not automatically to the newly created tenant.

Therefore, instructing User2 to create user accounts in the NEW tenant does not meet the goal unless User2 is first added to the new tenant and granted the necessary permissions there.

What would be required to make it work

- Add/invite User2 into external.contoso.onmicrosoft.com, then
- Assign an appropriate admin role in THAT tenant (for example, User Administrator or Global
Administrator), then
- User2 can create the new user accounts.

Exam Tips:
- Treat each tenant as a separate security boundary: roles/permissions do not "carry over" to a different
tenant.
- For creating users, look for "User Administrator" (least privilege) rather than "Global Administrator," when
possible.

Summary:
Because external.contoso.onmicrosoft.com is a different tenant, User2's admin role in the original tenant does not grant rights in the new tenant; so the proposed solution does not meet the goal.

EXAM OBJECTIVE ALIGNMENT (Hierarchy)
1.0 Manage Azure identities and governance 1.1 Manage Microsoft Entra users and groups 1.1.1 Create users and groups

Create a route table.

To manage outbound traffic from VNET1 through Azure Firewall, you must force egress to the firewall by using user-defined routes (UDRs). The first step is to create a route table, add routes (commonly 0.0.0.0/0) with next hop type Virtual appliance pointing to the firewall's private IP, and then associate the route table to the appropriate subnet(s). Without the route table/UDR, traffic will not be steered to Firewall1 for policy enforcement.

Why other selections are not correct:

- Configure Hybrid Connection Manager: App Service connectivity feature; unrelated to VNet egress
routing.
- Upgrade App1 to Premium SKU: Not required to route VNet egress through Azure Firewall.
- Create an Azure Network Watcher: Monitoring service; it does not enforce outbound routing through the
firewall.

Microsoft Exam Tips:
- "Send outbound through Azure Firewall" almost always implies UDR/route table.
- Azure Firewall is not automatically on-path; you must route traffic to it.

Summary:
Using a route table (UDR) to steer VNet outbound traffic through Azure Firewall.

AZ-104 Exam Objective Hierarchy:
4.0 Implement and manage virtual networking 4.1 Configure and manage virtual networks in Azure 4.1.4 Configure user-defined network routes

Scenario summary (from exhibit): Storage account contoso2024 contains container1 (Blob) with File1 and share1 (Azure Files) with File2.
User permissions: User1 = Reader role; User2 = Storage Account Contributor role; User3 = has an access
key.
Storage account setting: Allow storage account key access = Disabled.

User1 can read File1: No
User2 can read File2: No
User3 can read File1 and File2: No

Reader and Storage Account Contributor are management-plane (Azure Resource Manager) roles and do not grant storage data-plane read permissions to blobs or files.
When 'Allow storage account key access' is disabled, requests authorized with the account access keys (Shared Key) are rejected.
To read blob data using Microsoft Entra ID, the user needs a data-plane role such as Storage Blob Data Reader at the appropriate scope. Azure Files has its own data access roles.

Shared Key disabled: "Azure Storage rejects all subsequent requests ... authorized with the account access keys or shared access signatures (SAS)."
Reader role limitation: "It doesn't provide read permissions to data in Azure Storage ..."
Management-plane vs data-plane: "These roles do not provide access to data in a storage account."

2.0 Implement and manage storage (15-20%) 2.1 Configure access to storage
2.1.4 Manage access keys

Scale up ASP1.

You must enable backups and configure a custom domain. In exam contexts, App Service backup/restore features are tied to having an appropriate App Service plan tier that supports backup capabilities.
Therefore, the first step is to scale up the App Service plan so the required features are available, and then configure backups and the custom domain.

Why the other selections are incorrect:
- Configure a WebJob for App1: WebJobs do not enable backups or custom domain configuration.
- Scale out ASP1: Scale out increases instance count; it does not change feature availability by pricing tier.
- Configure the application settings for App1: App settings are unrelated to enabling backups or custom
domains.

Microsoft Exam Tips:
- "Scale up" changes the SKU/tier (feature set). "Scale out" changes instance count.
- When a question says "enable feature X" and includes a lower tier, first validate the tier supports the
feature.

Summary:
This tests recognizing when you must scale up an App Service plan to enable required capabilities.

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and manage Azure compute resources 3.4 Create and configure Azure App Service 3.4.2 Configure scaling for an App Service plan 3.4.6 Configure backup for an App Service 3.4.5 Map an existing custom DNS name to an App Service

Basic App service plan does not support backup/restore.

The Backup and Restore feature requires the App Service plan to be in the Standard, Premium or Isolated tier. Since in question it is mentioned as a Basic service plan app so at first you need to do it to Scale up the service plan so that backup can be enabled on App1. Scale up: Get more CPU, memory, disk space, and extra features like dedicated virtual machines (VMs), custom domains and certificates, staging slots, autoscaling, and more. You scale up by changing the pricing tier of the App Service plan that your app belongs to.
Configure a WebJob for App1 : Incorrect WebJobs is a feature of Azure App Service that enables you to run a program or script in the same instance as a web app, API app, or mobile app. There is no additional cost to use WebJobs

Scale out ASP1 : Incorrect
Scale out: Increase the number of VM instances that run your app. You can scale out to as many as 30 instances, depending on your pricing tier. Configure the application settings for App1 : Incorrect.
This is the 2nd step you need to perform once azure service plan upgraded to standard. Most folks don't realize how easy it is to configure a backup copy of your Azure App Service to ensure you have restorable archive copies of your app and database. In order to take advantage of this, you'll need to log into your Azure account and go to your App Service that you created and look under Settings then you will see Backup

References:
https://azure.microsoft.com/en-in/pricing/details/app-service/windows/
https://docs.microsoft.com/en-us/azure/app-service/manage-scale-up
https://docs.microsoft.com/en-us/azure/app-service/webjobs-create
https://microsoft.github.io/AzureTipsAndTricks/blog/tip28.html

First dropdown: az
Second dropdown: aks

Why this is correct:
- The Azure CLI provides a built-in command to install the Kubernetes CLI (kubectl): `az aks install-cli`.
Selecting `az` and `aks` completes the command shown in the hotspot.

Why the other options are incorrect:
- docker: Docker does not install kubectl for you in this context.
- msiexec.exe: Not the Azure CLI method shown/required by the hotspot.
- Install-Module: PowerShell module install is not the CLI approach asked here.

Exam Tips:
- For AKS client tools: `az aks install-cli` installs kubectl; `az aks get-credentials` pulls cluster creds.

AZ-104 Exam Objective Hierarchy
3.0 Deploy and manage Azure compute resources (20-25%) 3.3 Provision and manage containers in the Azure portal 3.3.4 Manage sizing and scaling for containers, including Azure Kubernetes Service (AKS)

The screenshot shows the current state, not the desired final state.
Correct Selection (the TWO settings to modify)
Users can register applications Restrict access to Microsoft Entra administration portal What the changes accomplish (how you would toggle them)

Users can register applications: change from Yes -> No

Rationale: Setting "Register applications" to No prevents users from creating application registrations.

Restrict access to Microsoft Entra administration portal: change from No -> Yes
Rationale: Setting this to Yes adds friction for non-admins using the portal and explicitly does NOT block PowerShell or Microsoft Graph access.

Excerpts:
"Register applications: Setting this option to No prevents users from creating application registrations..."
"Restrict access... Setting this option to Yes adds a layer of friction..."
"It does not block programmatic access... via PowerShell, Microsoft Graph API..."

AZ-104 Exam Objective Hierarchy
1.0 Manage Azure identities and governance (20-25%) 1.1 Manage Microsoft Entra users and groups 1.1.2 Manage user and group properties

TXT or MX

To verify a custom domain name in Microsoft Entra ID, you must prove domain ownership by creating a DNS record that Microsoft can query publicly. Microsoft Entra domain verification supports creating either:

- a TXT record, or
- an MX record

After you add the required TXT or MX record to the public DNS zone for contoso.com, Microsoft Entra can verify the domain by detecting that record.

Why the other options are not correct:

- PTR:
PTR records are used for reverse DNS lookups (IP address --> name) and are not used to verify ownership of a forward DNS domain.

- NSEC3:
NSEC3 is a DNSSEC record type used to provide authenticated denial of existence; it is not used for Entra
custom domain verification.

- RRSIG:
RRSIG is a DNSSEC signature record type; it is not used for Entra custom domain verification.

Exam Tips:
- For Microsoft Entra custom domain verification, look for "prove ownership" = TXT (preferred) or MX
record.
- Ignore DNSSEC record types (RRSIG/NSEC3) unless the question is explicitly about DNSSEC; they are
common distractors.
- If the question says you already added the domain and "need Azure to verify it," the next step is always
"create the provided TXT/MX record at your DNS host/registrar."

Summary:
- Microsoft Entra custom domain verification
- DNS record types used for ownership proof (TXT or MX)
- Eliminating distractor DNS/DNSSEC record types

AZ-104 Exam Objective Alignment (Hierarchy) 1.0 Manage Azure identities and governance 1.1 Manage Microsoft Entra users and groups 1.1.2 Manage user and group properties

From the Azure portal, add a new guest user, and then specify [email protected] as the email address.

A vendor using a Microsoft account ([email protected]) should be onboarded to the tenant using Microsoft Entra B2B by inviting them as a guest user. Adding a guest user with that email address enables authentication to your tenant using that external identity.

Why the other options are not correct:
- Running New-AzureADUser and setting userPrincipalName to [email protected]: Creating a member user with a UPN like @outlook.com is not the intended B2B pattern for Microsoft account users, and typically you do not "create" external Microsoft accounts as member identities.
- Adding a custom domain and creating a new Azure AD user with username [email protected]: You can't verify/control the @outlook.com domain as your custom domain; B2B guest invitation is the correct
approach.
- Running New-AzureADUser from Cloud Shell with that UPN has the same issue as above.

Microsoft Exam Tips:
- AZ-104: External vendor + Microsoft account (outlook.com) almost always indicates B2B guest invite.
- "Guest" is the standard identity type for external collaboration access to a tenant.

Summary:
This question covered onboarding an external vendor into a tenant using Microsoft Entra B2B guest user invitation.

AZ-104 Exam Objective Hierarchy:
1.0 Manage Azure identities and governance 1.1 Manage Microsoft Entra users and groups
1.1.4 Manage external users

Create a network security group (NSG) that has an outbound security rule to deny destination port 3389 and apply the NSG to the network interface of VM1.

To prevent VM1 initiating RDP connections to VM2 on TCP 3389, you block the outbound traffic from VM1 where the destination port is 3389. Applying the NSG at the NIC of VM1 scopes the restriction precisely to
VM1, matching least impact.

Why other selections are not correct:
- Configure Azure Bastion: Provides secure management access; it does not block VM1-to-VM2 RDP.
- Deny source port 3389: Client source ports are ephemeral; you block by destination port for RDP.
- Inbound deny source port 3389: Incorrect direction/port usage; to stop VM1 initiating, you need an outbound rule on VM1 (or an inbound deny on VM2 for destination port 3389).

Microsoft Exam Tips:
- RDP is TCP destination port 3389; block by destination port, not source port.
- Apply NSG at NIC scope for the most targeted control when the requirement is "from VM1 only."

Summary:
Blocking VM-to-VM traffic using NSG outbound rules.

AZ-104 Exam Objective Hierarchy:
4.0 Implement and manage virtual networking 4.2 Configure secure access to virtual networks 4.2.1 Create and configure network security groups (NSGs) and application security groups

two update domains

Planned maintenance (platform updates) is sequenced by update domains so that Azure does not restart all VMs in the availability set at the same time. With two VMs (VM1 and VM2), configuring two update domains ensures the VMs are placed into different update domains so only one VM is restarted at a time during planned maintenance.

Why the other choices are not correct:

one update domain: Both VMs could be restarted together during planned maintenance (no rolling restart protection).

two fault domains / one fault domain: Fault domains protect primarily against unplanned hardware, network, or power failures (rack-level issues), not the sequencing of planned maintenance reboots.

Microsoft Exam Tips:
If the question mentions planned maintenance, platform updates, or rolling reboot, think Update Domains.
If the question mentions hardware failure, rack, power, or network switch, think Fault Domains.
With two VMs and a requirement to stay up during planned maintenance, you typically need at least two update domains.

Summary:
Availability Sets, update domains vs. fault domains, and how Azure sequences planned maintenance reboots.

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and Manage Azure Compute Resources 3.2 Create and Configure Virtual Machines 3.2.6 Deploy Virtual Machines to Availability Zones and Availability Sets

Create a Private DNS zone for privatelink.blob.core.windows.net and link it to the virtual network

The AKS cluster uses Azure CNI and must resolve/reach a Storage account exposed via a Private Endpoint in the same VNet. For Private Endpoints, name resolution must return the private IP of the endpoint. The standard pattern is:

1) Create the matching Private DNS zone (for Blob: `privatelink.blob.core.windows.net`) 2) Link it to the VNet so resources in that VNet (including AKS nodes/pods via CNI) resolve the storage
FQDN to the private endpoint IP.

Why the other selections are not correct:
- Enable kubenet networking: Changing the AKS network plugin is not the DNS fix and is not a typical in- place toggle for an existing cluster.
- Create an NSG rule to allow outbound TCP 443 to the Internet: Private Endpoint traffic is private; the issue here is DNS resolution to the private endpoint, not Internet egress.
- Enable Azure Firewall forced tunneling: This is unrelated to Private Endpoint DNS resolution and can
complicate routing.

Microsoft Exam Tips:
- Private Endpoint questions often reduce to DNS: create the `privatelink.*` private DNS zone and link it to
the VNet.
- If pods must resolve private endpoints, ensure the VNet DNS path used by AKS nodes/pods can reach the Private DNS zone.

Summary:
Private Endpoint + AKS Azure CNI: ensure correct Private DNS zone and VNet link for name resolution.

AZ-104 Exam Objective Hierarchy:
4.0 Implement and manage virtual networking 4.2 Configure secure access to virtual networks 4.2.5 Configure private endpoints for Azure PaaS 4.3 Configure name resolution and load balancing
4.3.1 Configure Azure DNS

Property: daysAfterModificationGreaterThan
Blob type: Blockblob

Why this is correct:

- "NOT updated for 45 days" maps to last-modified time, which corresponds to
daysAfterModificationGreaterThan.
- The scenario is targeting blob objects in the container; the correct blob type selection shown is Blockblob.

Why the other options are incorrect:
- daysAfterCreationGreaterThan keys off creation time, not last modification time.
- daysAfterLastAccessTimeGreaterThan is last-access time, not "updated/modified."
- Pageblob is a different blob type and would not match the intended object type selection.

Exam Tips:
- If the stem says "not updated/modified," think "Modification," not "Creation."
- "Last access time" requires separate enablement and is a different signal than modification.

Summary:
Use daysAfterModificationGreaterThan and Blockblob.

AZ-104 Exam Objective Hierarchy:
2.0 Implement and manage storage (15-20%)
2.2 Configure storage accounts

Yes

New-MgInvitation is specifically meant to invite external users to your tenant (B2B). It creates/uses a guest user object and sends an invitation email so the external users can redeem the invitation and access resources as guests.

Therefore, using New-MgInvitation for each external user meets the goal of creating guest user accounts for the 500 external users.

Why the other option is not correct:
- No: Would only be correct if invitations did not create guest users or did not onboard external identities, but invitations are designed for that exact purpose.

Microsoft Exam Tips:
- AZ-104: When you see "external users" + "guest accounts," the intended solution is almost always B2B invitation (unless explicitly stated otherwise).

Summary:
This question tested the correct approach for bulk onboarding external users as guest accounts.

AZ-104 Exam Objective Hierarchy:
1.0 Manage Azure identities and governance 1.1 Manage Microsoft Entra users and groups
1.1.4 Manage external users

You can create Azure SQL servers in ContosoRG1 only.

The exhibit shows an Azure Policy assignment using the built-in "Not allowed resource types" policy with the parameter set to deny the resource type Microsoft.Sql/servers (Azure SQL logical servers).

- Because the assignment scope is Subscription1, the deny effect applies across the subscription.
- Because ContosoRG1 is listed under Exclusions (notScopes), resources in ContosoRG1 are excluded from evaluation and enforcement.

Therefore, creating Azure SQL servers is blocked everywhere in Subscription1 except in ContosoRG1, where the exclusion allows the deployment.

Why the other answer texts are not correct:

- "You are prevented from creating Azure SQL servers anywhere in Subscription 1."
Incorrect because ContosoRG1 is excluded from the assignment.

- "You are prevented from creating Azure SQL Servers in ContosoRG1 only."
Incorrect because exclusions remove enforcement in ContosoRG1; enforcement applies outside it.

- "You can create Azure SQL servers in any resource group within Subscription 1."
Incorrect because the deny policy blocks Microsoft.Sql/servers across the subscription except the excluded scope.

Exam Tips:
- "Not allowed resource types" with enforcement enabled means the deployment request is denied at the
assigned scope.
- Always account for Exclusions (notScopes): excluded scopes are not evaluated/enforced.
- For "effect of policy" questions, compute: Assignment scope minus exclusions = where the deny applies.

Summary:
- Azure Policy deny effect using "Not allowed resource types"
- Assignment scope vs excluded scopes (notScopes)
- Practical impact: Microsoft.Sql/servers blocked everywhere except excluded RG

AZ-104 Exam Objective Alignment (Hierarchy) 1.0 Manage Azure identities and governance 1.3 Manage Azure subscriptions and governance 1.3.1 Implement and manage Azure Policy

VM1 and VM2 can connect to VNET1. - Yes
If an Azure datacenter becomes unavailable, VM1 or VM2 will be available. - Yes
If the East US 2 region becomes unavailable, VM1 or VM2 will be available. - No

Why:
- Both VMs are deployed with NICs in the same virtual network, so network connectivity to VNET1 is
expected.
- Deploying across Availability Zones in a region provides resiliency against a single datacenter/zone
failure.
- Availability Zones do not provide protection from a regional outage. To survive a full region outage, you need cross-region disaster recovery (paired regions, geo-redundant design, etc.).

AZ-104 Exam Objective Hierarchy (map for this question) 3.0 Deploy and manage Azure compute resources
3.1 Configure virtual machines
3.1.3 Configure high availability

4.0 Configure and manage virtual networking
4.1 Configure virtual networks

From the Directory roles blade, modify the directory role.

You need to assign the User Administrator directory role to AdminUser1. In Microsoft Entra ID, directory roles (admin roles) are assigned from Entra ID > Roles & admins (the Directory roles blade) or from the
user's Assigned roles page. Therefore, using the Directory roles blade to modify or assign the role is the correct approach.

Official-source excerpt (Microsoft Learn):

"Browse to Entra ID > Roles & admins ... Select the desired role ... Select Add assignments ..."

Why the other options are not correct:

From the Groups blade, invite the user account to a new group.
Group membership does not assign a Microsoft Entra directory role unless you specifically use a role-assignable group and assign the directory role to that group. The option only states "invite to a new group," which does not guarantee that the User Administrator role is granted.

From the Licenses blade, assign a new license.
Licensing does not assign directory roles. Roles are managed under Roles & admins (or the user's Assigned roles page), not through license assignment.

Microsoft Exam Tips:
Know the difference between Microsoft Entra ID directory roles (tenant-level admin roles such as User Administrator) and Azure RBAC roles (subscription or resource roles such as Owner or Contributor). They are assigned in different places and control different scopes.

Follow least-privilege principles: assign only the admin role required (here, User Administrator). In real environments, prefer Privileged Identity Management (PIM) or role-assignable groups to reduce standing privilege.

Summary:
This question tests how to assign a Microsoft Entra ID administrative role to a user by using the correct management surface (Directory roles / Roles & admins).

AZ-104 Exam Objective Hierarchy:
1.0 Manage Azure identities and governance 1.1 Manage Microsoft Entra users and groups 1.1.2 Manage user and group properties

Copy Budget.xls to Data.

Using Azure Backup "Replace existing" restores the VM disk content back to the selected restore point.
Any file-level changes made after the backup (like copying Budget.xls) won't be present after the disk content is replaced, so you must perform that file copy again.

Why other selections are not correct (in the context of what "Replace existing" impacts):
- Modify the size of VM1: VM size is a VM configuration setting, not a file-level disk content change.
- Reset the password for the built-in administrator account: The question's expected distinction is between disk content changes vs. VM configuration actions; the file copy is the clearly file-level change.
- Add a data disk: Disk replacement behavior is driven by the restore point's disk set; the tested remediation here is the post-backup file operation.

Microsoft Exam Tips:
- "Replace existing" is strongly associated with restoring disk content to a point-in-time state.

- File operations performed after the last backup generally must be re-applied after an in-place disk
replacement restore.

Summary:
Azure VM restore behavior with "Replace existing" and which post-backup changes must be re-done.

AZ-104 Exam Objective Hierarchy:
5.0 Monitor and maintain Azure resources 5.2 Implement backup and recovery 5.2.4 Perform backup and restore operations by using Azure Backup

Fraud alert

"Fraud alert" (report suspicious activity) enables users to report unexpected MFA prompts and can block/ flag the account depending on configuration. This aligns with the requirement that users can lock out their account when they receive an unsolicited MFA request.

Why the other choices are not correct:
- Block/unblock users: Admin control, not a user-driven "report MFA prompt" feature.
- Providers: MFA provider configuration; not the "report suspicious activity" function.
- Notifications: General MFA notification behavior; does not implement user fraud reporting/lockout.

Microsoft Exam Tips:
- AZ-104: "Unsolicited MFA prompt" maps to "report suspicious activity / fraud alert" concepts.

Summary:
MFA safety controls for reporting suspicious activity and account protection.

AZ-104 Exam Objective Hierarchy:
1.0 Manage Azure identities and governance 1.1 Manage Microsoft Entra users and groups 1.1.2 Manage user and group properties

- From the Firewalls and virtual networks blade of account1, add the 131.107.1.0/24 IP address range.
- From the Firewalls and virtual networks blade of account1, select Selected networks.

You must restrict access to the storage account so that:
1) You can upload disk files from your on-premises network (131.107.1.0/24), 2) VM1 can attach and use the disks, and
3) All other access is blocked.

How the selected actions meet the requirements:

- Select Selected networks:
This switches the storage account to a "deny by default" posture for its public endpoint, so only explicitly allowed networks/IP ranges can access the data plane. This satisfies the "prevent all other access" requirement when combined with an allow-list entry.

- Add the 131.107.1.0/24 IP address range:
This allow-lists your on-premises public IP range so you can upload the disk files from on-premises while all other public traffic remains blocked.

- VM1 can attach the disks:
Storage network rules do not block VM disk traffic (mount/unmount and disk I/O). Therefore, enabling Selected networks and allowing only the on-prem range will not prevent VM disk attachment/usage.

Why the other options are not correct:

- Add VNet1 from the Firewalls and virtual networks blade:
Not required to meet the stated requirements, because the goal is not "VM1 must access storage account data over the network," but rather "VM1 can attach the disks."

- Select Allow trusted Microsoft services to access this storage account:
This broadens access beyond the stated allow-list intent and is not required for the stated disk attach requirement.

- From the Service endpoints blade of VNet1, add a service endpoint:
This is used to enable VNet-based access to the storage account data plane (when you intend workloads in the VNet to access storage data). It is not required to satisfy the disk attach requirement.

Exam Tips:
- Interpret storage "Networking / Firewalls and virtual networks" as data-plane protection. Control-plane actions are not governed by these rules, and some platform behaviors (like VM disk traffic) are explicitly exempted.
- For "lock down storage but allow on-prem upload," the common pattern is:
enable Selected networks + add the on-prem public IP (CIDR) as an allowed IP range.
- Service endpoints are typically selected only when the requirement explicitly says that resources in a VNet must access storage over the data plane (for example, apps reading blobs).

Summary:
- Configuring Azure Storage firewall to allow only specific public IP ranges
- Enabling "deny by default" via Selected networks
- Understanding what storage network rules do and do not block (data plane vs VM disk traffic)

AZ-104 Exam Objective Alignment (Hierarchy) 2.0 Implement and manage storage 2.1 Configure access to storage 2.1.1 Configure Azure Storage firewalls and virtual networks

a route table that has custom routes

To force traffic from VNet1 to VNet2 through a Network Virtual Appliance (NVA), you must override the system routes by using a route table (UDR). You create a custom route for the VNet2 address space and set the next hop type to a **Virtual appliance** (the NVA's IP). This ensures the packet path is steered through NetVA1 for inspection instead of taking the default peering path.

Why the other choices are not correct:
- a local network gateway: Used for VPN/ExpressRoute on-premises connectivity definitions, not for steering east-west traffic between peered VNets through an NVA.
- a service endpoint: Secures PaaS access over the Azure backbone; it does not change routing between
VNets.
- IP address reservations: Reserving an IP does not control traffic paths.

Microsoft Exam Tips:
- AZ-104 frequently tests *traffic steering* patterns: UDR + "Virtual appliance" next hop is the canonical method to force inspection through an NVA.
- Distinguish "securing PaaS access" (service endpoints/private endpoints) from "routing control" (UDR).

Summary:
Routes and traffic steering in Azure virtual networks using route tables (UDRs) to force NVA inspection.

AZ-104 Exam Objective Hierarchy:
4.0 Implement and manage virtual networking 4.1 Configure and manage virtual networks in Azure 4.1.4 Configure user-defined network routes

the Calico network policy

To restrict pod-to-pod traffic in AKS using kubenet networking, you enable and use Calico network policies.
Network policies are the Kubernetes-native mechanism for defining allowed/denied pod traffic flows.

Why other selections are not correct:
- the Azure network policy: This option is not the expected choice for the kubenet-based restriction scenario in this question set.
- pod security policies: These govern pod security admission controls (and are deprecated), not pod
network traffic filtering.
- an application security group: ASGs apply to Azure NICs/VMs, not Kubernetes pod-level traffic controls.

Microsoft Exam Tips:
- If the requirement is "restrict traffic between pods," the keyword is NetworkPolicy (enforced by a network policy provider such as Calico).
- Separate "pod security" (admission/identity) from "pod network policy" (traffic filtering).

Summary:
Using Kubernetes network policies (Calico) in AKS to restrict pod-to-pod traffic.

AZ-104 Exam Objective Hierarchy:
4.0 Implement and manage virtual networking 4.2 Configure secure access to virtual networks 4.2.1 Create and configure network security groups (NSGs) and application security groups

No

Reader is a read-only role and does not provide the write permissions needed to enable or configure Network Watcher capabilities such as Traffic Analytics. Network Watcher capabilities require roles like Owner, Contributor, or Network Contributor (or a custom role with required actions). :contentReference
[oaicite:17]{index=17}

Why the other selection is not correct:
- Yes:
Reader does not grant the necessary permissions to configure/enable Traffic Analytics.

Microsoft Exam Tips:
- Reader cannot "enable" anything-assume "No" when configuration changes are required.
- For networking features, Network Contributor is frequently the least-privileged "yes" answer.

Summary:
Reader does not provide sufficient permissions to enable Traffic Analytics.

AZ-104 Exam Objective Hierarchy:
1.0 Manage Azure identities and governance 1.2 Manage access to Azure resources 1.2.2 Assign roles at different scopes

App Service plans are OS-specific (Windows vs. Linux). You can run multiple apps with different runtime stacks in the same plan only if they are compatible with the plan's OS and region.

Given the table:
- WebApp2 (ASP.NET v4.8) requires Windows App Service.
- WebApp4 (Ruby 2.6) is typically a Linux App Service runtime.
- WebApp1 (.NET Core 3.1 LTS) can run on Windows or Linux.
- WebApp3 (PHP 7.3) can run on Windows or Linux.

To minimize plans:
- Put the Windows-required app(s) (ASP.NET v4.8, and optionally .NET Core + PHP) in one Windows
plan.

- Put the Ruby app in one Linux plan.
=> Minimum is 2 plans.

Why the other selections are incorrect:
- You cannot host both Windows and Linux apps in the same App Service plan.
- 3 or 4
- Not required; you can consolidate all Windows-compatible apps into one Windows plan, and the Linux- only app into one Linux plan.

Microsoft Exam Tips:
- When you see mixed runtimes, immediately check for OS constraints (ASP.NET Framework => Windows; many Ruby stacks => Linux).
- The exam often expects "fewest plans" by consolidating where OS/region/pricing tier allow.

Summary:
Determining minimum App Service plans based on runtime and OS compatibility.

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and manage Azure compute resources 3.4 Create and configure Azure App Service 3.4.1 Provision an App Service plan

Yes - this meets the goal.

Why:
- RG1 contains resources that were deployed by using templates. In the Azure portal, the Resource group
> Deployments view shows the deployment history, including the deployment timestamp and deployment details. Those deployment records provide the date/time context for when the template deployment occurred (and therefore when the template-deployed resources in RG1 were created).

Why the alternative approach (Subscription > Programmatic deployment) is not the best fit:
- "Programmatic deployment" at the subscription level is oriented around subscription-scope deployments and does not directly target "resources created in RG1" the way the RG1 > Deployments blade does. The
question asks specifically about resources created in RG1, so the resource-group deployment history is the most direct path. (2)

Microsoft Exam Tips:
- For template-based deployments, remember: Resource group > Deployments is the primary place to validate *when* a deployment ran and *what* resources were created/updated by that deployment.
- If you're asked for deployment timing/evidence tied to a specific RG, prefer the RG's deployment history over subscription-wide views.

Summary:
- ARM template (or portal-generated template) deployment history
- Where to find deployment timestamps and deployment details in the Azure portal (RG > Deployments)

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and manage Azure compute resources 3.1 Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files 3.1.1 Interpret an Azure Resource Manager template or a Bicep file

Select one of the deployments from the deployment history.

You will see a history of deployment for the resource group, including the correlation ID.

Resource type: Microsoft.Resources/subscriptions/resourceGroups
Effect: Append

Why this is correct:
- The policy must ensure every new resource group has a required tag while still allowing users to create RGs from the portal.
- "Append" adds/modifies the tag on create/update requests instead of blocking them, which keeps creation possible and makes compliance reporting accurate.

Why the other options are incorrect:
- Deny: Would block resource group creation if the tag isn't present (violates the "must allow creation"
requirement).
- Audit-only effects: Would not enforce the tag (compliance report would show noncompliance rather than
remediating).
- DeployIfNotExists: Not the right fit for enforcing tags at create-time for resource groups in this scenario.

Exam Tips:
- For "force tags but don't block creation" exam patterns: Append (or sometimes Modify, depending on the
question/options).

AZ-104 Exam Objective Hierarchy
1.0 Manage Azure identities and governance (20-25%) 1.3 Manage Azure subscriptions and governance 1.3.1 Implement and manage Azure Policy

No

AzCopy is a command-line utility for transferring data to/from Azure Storage (blobs/files). It is not used for deploying Kubernetes YAML manifests to an AKS cluster. Therefore, running azcopy does not meet the goal of deploying a YAML file to AKS.

Why the alternative is not correct:
- Yes: Incorrect because azcopy does not interact with the Kubernetes API to create/update Kubernetes
resources.

Microsoft Exam Tips:
- Map tools to domains: azcopy = storage data transfer; kubectl = Kubernetes resource deployment.

Summary:
Validated that AzCopy is for Azure Storage transfers, not Kubernetes manifest deployment.

AZ-104 Exam Objective Hierarchy:
2.0 Implement and manage storage 2.2 Configure and manage storage accounts 2.2.5 Manage data by using Azure Storage Explorer and AzCopy

Resource group: RG1, RG2, or RG3
Location: West US only

Why this is correct:
- VMSS1 is in West US, and a VM you intend to add to that scale set must be created in the same region
(West US).
- In VMSS flexible (VM orchestration mode), VMs are "standard" VM resources that can be associated with the scale set; the key constraint in this scenario is the region.

Why the other options are incorrect:
- Any option that allows a non-West US location would prevent adding the VM to VMSS1 in West US.

Exam Tips:
- For scale-set association scenarios, region alignment is a hard constraint.
- Don't confuse the VMSS resource group with a strict "must deploy VM in same RG" rule for flexible mode
questions unless explicitly stated.

Summary:
Deploy VM1 in West US; resource group can be any of the listed RGs.

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and manage Azure compute resources (20-25%) 3.2 Create and configure VMs
3.2.4 Configure VM networking

Admin1 can delete VNet2. - Yes Admin2 can add a subnet to VNet1. - No
Admin1 can add a subnet to VNet2. - Yes

Why:
This question uses an Azure Resource Manager deployment stack command that enables deny settings (DenyWriteAndDelete) and sets ActionOnUnmanage=DetachAll.
- Deny settings are implemented through deny assignments on managed resources to prevent writes/ deletes outside the stack's managed lifecycle.
- RBAC still matters for what each administrator *could* do at their scope (subscription vs RG), but deny settings can restrict write/delete operations on resources managed by the stack.
The answer selections reflect that Admin2 (Contributor scoped to RG1) is blocked from making the requested modification, while Admin1 (Owner at subscription scope) can perform the requested actions.

AZ-104 Exam Objective Hierarchy (map for this question) 1.0 Manage Azure identities and governance

1.2 Manage access to Azure resources 1.2.1 Manage built-in Azure roles 1.2.2 Assign roles at different scopes 1.3 Manage Azure subscriptions and governance
1.3.4 Manage resource groups

A /25 subnet has 128 total IPv4 addresses. Azure reserves 5 addresses in every subnet (first 4 and last 1). 128 - 5 = 123 usable IP addresses (and thus up to 123 VM NIC private IPs, assuming one IP per VM NIC).

Why other selections are not correct:
- 128: ignores Azure reserved addresses.
- 251 / 25 / 24: do not match /25 capacity after reservations.

Microsoft Exam Tips:
- Always subtract Azure's 5 reserved IPs when asked for "maximum" hosts in a subnet.

Summary:
- Subnet sizing and Azure reserved IP addresses

AZ-104 Exam Objective Hierarchy:
4.0 Implement and manage virtual networking 4.1 Configure and manage virtual networks in Azure 4.1.1 Create and configure virtual networks and subnets

Cost analysis: Correct Option

In cost analysis blade of Azure, you can see all the detail for custom time span. You can use this to determine expenditure of last few day, weeks, and month. Below options are available in Cost analysis blade for filtering information by time span: last 7 days , last 30 days, and custom date range. Choosing the first option (last 7 days) auditors can view the costs by time span.

Cost analysis shows data for the current month by default. Use the date selector to switch to common date ranges quickly. Examples include the last seven days, the last month, the current year, or a custom date range. Pay-as-you-go subscriptions also include date ranges based on your billing period, which isn't bound to the calendar month, like the current billing period or last invoice. Use the <PREVIOUS and
NEXT> links at the top of the menu to jump to the previous or next period, respectively. For example, <PREVIOUS will switch from the Last 7 days to 8-14 days ago or 15-21 days ago.

Invoice: Incorrect Option

Invoices can only be used for past billing periods not for current billing period, i.e. if your requirement is to know the last week's cost then that also not filled by invoices because Azure generates invoice at the end of the month. Even though Invoices have custom timespan, but when you put in dates for a week, the pane would be empty.

Resource Provider: Incorrect Option

When deploying resources, you frequently need to retrieve information about the resource providers and types. For example, if you want to store keys and secrets, you work with the Microsoft.KeyVault resource provider. This resource provider offers a resource type called vaults for creating the key vault. This is not useful for reviewing all Azure costs from the past week which is required for audit.

Payment method: Incorrect Option

Payment methods is not useful for reviewing all Azure costs from the past week which is required for audit.

References:
https://docs.microsoft.com/en-us/azure/cost-management-billing/costs/quick-acm-cost-analysis
https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/download-azure-invoice-daily-usage-date

ContReg1

When the Admin user is enabled on an Azure Container Registry (ACR), the registry provides admin credentials where the username is the registry name. Therefore, the username used to sign in is ContReg1.

Why the other options are not correct:
- root / admin / administrator: these are not the ACR admin username format; ACR uses the registry name as the admin username.

Microsoft Exam Tips:
- AZ-104: Prefer Microsoft Entra ID / RBAC where possible; "Admin user" is typically a quick-access option and less ideal for production.
- Know the difference between ACR admin user vs. service principals / managed identity.

Summary:
ACR admin user credentials-username equals registry name.

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and manage Azure compute resources 3.3 Provision and manage containers in the Azure portal 3.3.1 Create and manage an Azure container registry

Change the priority of Rule3 to 450.

Goal: Allow inbound HTTPS (TCP/443) from the Internet to VM1.

From the exhibit:

There is a deny rule at priority 500 for TCP ports 80 and 443 (this blocks HTTPS).

Rule3 is an allow rule for ports 6000-7000 with protocol Any, source Any, destination VirtualNetwork, currently at priority 4000.

NSG evaluation is priority-based: lower numbers are evaluated first, and once a match occurs, processing stops.

If Rule3 is moved to priority 450:

It will be evaluated before the deny rule at priority 500.

TCP/443 matches Rule3 (443 is within 6000-7000; protocol Any includes TCP; source Any includes
Internet).

Destination VirtualNetwork matches the VM's private IP because VirtualNetwork represents the virtual network address space (and related connected address spaces).

Therefore, HTTPS (TCP/443) will be allowed before the deny rule at 500 can block it, meeting the goal.

Why the other options do not meet the goal:

Changing the priority of Rule6 to 100 will not help because Rule6 only covers ports 15000-16000, which does not include 443.

Deleting the TCP 80 deny rule does not remove the TCP 443 deny rule at priority 500, so HTTPS remains blocked.

Creating a new allow rule at priority 501 would still be evaluated after the deny rule at 500, so it would not take effect.

Least-privilege note (why this is better than allowing Rule5): Another available option would effectively allow a much larger port range (50000-60000). Changing Rule3 is the narrower change (6000-7000) and reduces the incremental attack surface compared to allowing thousands of ports.

Microsoft Exam Tips:
NSG troubleshooting usually follows a "first-match wins" model: identify the first rule (lowest priority number) that matches the traffic five-tuple.
For Internet-to-VM traffic, ensure an ALLOW rule for TCP/443 exists at a higher priority than any DENY rule affecting 443.
Prefer narrowly scoped allow rules (single port, specific source IP) over wide port ranges whenever possible.

Summary:
This question tested NSG priority evaluation and how to unblock HTTPS by ensuring an allow rule for TCP/443 is processed before a deny rule.

AZ-104 Exam Objective Hierarchy:
4.0 Implement and Manage Virtual Networking (15-20%) 4.2 Configure Secure Access to Virtual Networks 4.2.2 Create and Configure Network Security Groups (NSGs) and Security Rules

Assign User1 the Owner role for VNet1.

Assigning Azure RBAC roles requires permission to create role assignments at the target scope (Microsoft.Authorization/roleAssignments/write). The Owner role includes full management permissions for resources at scope, including the ability to assign roles. Therefore, giving User1 the Owner role on the VNet1 resource enables User1 to assign the Reader role for VNet1 to other users.

Other existing roles listed (Reader, Security Admin, Security Reader) do not grant permission to assign Azure RBAC roles for Azure resources.

In practice, assign User Access Administrator at the VNet1 scope to allow role assignment with fewer permissions than Owner.

Microsoft Exam Tips:
- AZ-104 frequently tests which roles can grant access: Owner and User Access Administrator are the key built-ins for creating role assignments.
- If the task is "let user assign roles," think "Owner" or "User Access Administrator" at the appropriate
scope.

Summary:
Azure RBAC requirements for delegating role assignment capability at resource scope.

AZ-104 Exam Objective Hierarchy:
1.0 Manage Azure identities and governance 1.2 Manage access to Azure resources 1.2.2 Assign roles at different scopes

From the Device settings blade, modify the Maximum number of devices per user setting.

User1 was able to join devices in the past but cannot now. A common cause is hitting the device quota (maximum number of Microsoft Entra joined/registered devices per user). When a user reaches this limit, they can't add more devices until devices are removed or the limit is increased. Updating Maximum number of devices per user directly addresses that failure mode.

Why other selections are incorrect:
- From the Device settings blade, modify the Users may join devices to Azure AD setting.: This controls who is allowed to join devices (all/selected), but the stem indicates User1 could join previously-making quota more likely than policy disallowing joins.
- Create a point-to-site VPN from the home network of User1 to Azure.: Entra join is an Internet-based identity action; it does not require VPN connectivity to Azure VNets.
- Assign the User administrator role to User1.: Joining devices does not require granting broad administrative roles; this violates least privilege and does not address device quota.

Microsoft Exam Tips:
- If a user "used to be able to do X" and now can't, check quotas/limits (device limits, group limits, license limits) before changing tenant-wide permissions.
- "Users may join devices" is about permission scope (All/Selected), not per-user device count.

Summary:
This tests Entra device join constraints: users can be blocked from joining new devices when they hit the
per-user device maximum.

AZ-104 Exam Objective Hierarchy:
1.0 Manage Azure identities and governance 1.1 Manage Microsoft Entra users and groups 1.1.2 Manage user and group properties

Restore VM1 by using the Replace existing restore configuration option.

To recover VM1 to a point eight days ago, you restore from an available recovery point in the Recovery Services vault. Using Replace existing restores the backed-up VM disks back onto the existing VM (in-place restore), returning the VM to the selected point in time.

Why other selections are not correct:
- Deallocate/Delete VM1: Not required to initiate restore and increases disruption.
- Restore using Create new: Restores to a new VM; useful in some scenarios, but the stated answer focuses on in-place recovery of the existing VM as the first action in this question set.

Microsoft Exam Tips:
- Know the two portal restore patterns: Replace existing (in-place) vs Create new (new VM).
- Read the stem carefully for whether they want "restore existing VM" vs "restore alongside."

Summary:
Restoring an Azure VM to a point-in-time recovery point using in-place restore.

AZ-104 Exam Objective Hierarchy:
5.0 Monitor and maintain Azure resources 5.2 Implement backup and recovery 5.2.4 Perform backup and restore operations by using Azure Backup

Box 1: A records for VM1: Private IP address only
Box 2: A records for VM2: Private IP address only

You configured a private Azure DNS zone (adatum.com) and enabled auto-registration from VNET1.
- In a Private DNS zone, auto-registration creates A records pointing to the VM's private IP address.
- Public IP addresses are not used for private-zone auto-registered A records (private DNS is for internal
name resolution inside VNets).

Why the other options are not correct:
- "Public IP address only" is incorrect: private DNS auto-registration doesn't publish public IPs.
- "Private IP address and public IP address" is incorrect for the same reason.
- "None" would only be correct if auto-registration were not enabled or the VM wasn't in the linked
registration VNet.

Microsoft Exam Tips:
- Auto-registration in Private DNS = A record -> private IP.
- Private DNS is for inside-VNet name resolution; public IPs belong to public DNS scenarios.

Summary:
This question tested what gets auto-registered in a Private DNS zone: VM hostnames mapped to private
IP addresses.

AZ-104 Exam Objective Hierarchy:
4.0 - Implement and manage virtual networking (15-20%) 4.3 - Configure name resolution and load balancing
4.3.1 - Configure Azure DNS

peering

To ensure traffic between two Azure virtual networks stays on the Microsoft backbone (and not the public internet), you configure virtual network peering. VNet peering enables private connectivity between
VNets (including across regions with global VNet peering) and uses Microsoft's backbone for that connectivity. (Reference 1). :contentReference[oaicite:0]{index=0}

Why the other options are not correct:
- a private endpoint: Private Endpoint is for privately accessing a specific PaaS resource (like Storage) via Private Link, not for full VNet-to-VNet routing.
- Express Route: ExpressRoute is for on-premises-to-Azure (or intersite) private connectivity, not required for Azure VNet-to-VNet within Azure.
- a route table: A UDR (route table) can influence routing, but it does not itself create private
interconnectivity between VNets.

Microsoft Exam Tips:
- AZ-104 commonly tests that VNet peering uses the Microsoft backbone and supports cross-region
peering (global VNet peering).
- Remember: peering requires compatible routing and non-overlapping address spaces.

Summary:
VNet-to-VNet private connectivity using virtual network peering.

AZ-104 Exam Objective Hierarchy:
4.0 Implement and manage virtual networking 4.1 Configure and manage virtual networks in Azure 4.1.2 Create and configure virtual network peering

Backup1 (Backup vault): Disk1
Recovery1 (Recovery Services vault): VM1

A Backup vault is used for newer Azure Backup scenarios such as Azure Disk Backup (and other modern workloads supported by Backup vaults).
A Recovery Services vault is used for Azure VM backups (and other legacy/RSV workloads).
App Service backup is configured at the App Service level, and Azure SQL Database has built-in backup/ restore features; neither is protected via these vault selections in this question.

5.0 Monitor and maintain Azure resources (10-15%) 5.2 Implement backup and recovery 5.2.1 Create a Recovery Services vault 5.2.3 Create and configure a backup policy 5.2.4 Perform backup and restore operations by using Azure Backup

The autoscale rule scales out by 1 when the memory threshold is exceeded for the configured evaluation window, and it can continue scaling out after cooldown until it hits the instance maximum. Since the maximum is set to 5 and the memory condition remains high for the entire 30-minute period, autoscale can increase the instance count up to the configured maximum.

Why the other choices are not correct:
- 2, 3, and 4 do not reflect the configured maximum (5) when the scale-out condition is sustained long enough to trigger multiple scale actions.

Microsoft Exam Tips:
- If the stem says the metric stays above threshold for a long interval and a Maximum is defined, the "maximum instances" answer is frequently the configured Maximum.

Summary:
- Azure Monitor autoscale behavior: scale-out actions, cooldown, and maximum instance limit.

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and manage Azure compute resources 3.4 Create and configure Azure App Service 3.4.2 Configure scaling for an App Service plan

an action group

To ensure a metric alert sends email to specific users, Azure Monitor uses an action group as the notification/action target. You configure the alert rule to use the action group, and the action group contains the email receivers (User1 and User2).

Why other selections are not correct:
- Mail-enabled security group / distribution group / Microsoft 365 group: These are email directory constructs, but Azure Monitor alert rules natively integrate with action groups for notification and automation.

Microsoft Exam Tips:
- Alert rule = detection; Action group = delivery/execution.
- If the question says "send email/SMS/webhook/runbook," the answer is almost always action group.

Summary:
Configuring Azure Monitor alert notifications using action groups.

AZ-104 Exam Objective Hierarchy:
5.0 Monitor and maintain Azure resources 5.1 Monitor resources in Azure 5.1.4 Set up alert rules, action groups, and alert processing rules in Azure Monitor

From the Azure portal, modify the value of the Managed Service Identity option for VM1.

You need a service running on VM1 to manage resources in RG1 using VM1's identity. The "identity of the VM" in Azure for this purpose is a managed identity (system-assigned managed identity).

Why the correct selection is correct:
- From the Azure portal, modify the value of the Managed Service Identity option for VM1.
- Enabling VM1's managed identity is the first step so the VM can obtain tokens as itself (without storing secrets). After enabling, you then grant that identity RBAC permissions on RG1 (e.g., Contributor) so it can manage resources.

Why the other selections are incorrect:
- From the Azure portal, modify the Access control (IAM) settings of VM1.
- IAM on VM1 controls who can manage VM1; it does not enable VM1 to authenticate as an identity to
manage RG1.
- From the Azure portal, modify the Policies settings of RG1.
- Policies enforce governance rules; they do not grant an identity to VM1 or authorize VM1 to manage
RG1.
- From the Azure portal, modify the Access control (IAM) settings of RG1.
- RBAC on RG1 is required eventually, but it is not the first step if VM1 does not yet have a managed identity. You must first enable the managed identity on VM1, then assign roles on RG1 to that identity.

Microsoft Exam Tips:
- Sequence matters: (1) enable managed identity, then (2) assign RBAC on the target scope (resource
group/subscription/resource).
- If the question says "using the identity of VM1," that strongly implies managed identity.

Summary:
Enabling a VM's managed identity so workloads can access Azure resources via RBAC without secrets.

AZ-104 Exam Objective Hierarchy:
1.0 Manage Azure identities and governance 1.2 Manage access to Azure resources 1.2.2 Assign roles at different scopes

Configure NSG flow logs

Azure Monitor Network Insights detections for suspicious network traffic rely on visibility into network flows.
NSG flow logs provide the underlying traffic records (accepted/denied flows) from NSGs to a storage account/Log Analytics pipeline that Network Watcher and Network Insights can analyze. Therefore, the first prerequisite is to enable/configure NSG flow logs.

Why other selections are not correct:
- Deploy Connection Monitor: Measures reachability/latency between endpoints; it does not provide NSG- level flow visibility for suspicious traffic detections.
- Configure data collection endpoints: Used with Azure Monitor Agent scenarios; not the prerequisite for
NSG-based flow analysis.
- Configure a private link: Connectivity/private access feature; unrelated to generating flow telemetry.

Microsoft Exam Tips:
- "Suspicious traffic / analyze traffic / NSG-based detections" strongly points to NSG flow logs.
- Connection Monitor is for connectivity health, not traffic classification/detection.

Summary:
Enabling NSG flow logs as the prerequisite telemetry source for suspicious traffic analysis.

AZ-104 Exam Objective Hierarchy:
5 Monitor and maintain Azure resources 5.1 Monitor resources in Azure

5.1.6 Use Azure Network Watcher and Connection Monitor

Azure Disk Encryption

Azure Disk Encryption (ADE) uses BitLocker/DM-Crypt at the VM (guest) level and integrates with Azure
Key Vault to store/manage the encryption keys and secrets. Because the disks are encrypted at the OS level, the encryption remains in effect even if the VM disks are copied/downloaded, and it applies to both OS and data disks.

Why the other options are not correct:
- customer-managed keys: Usually refers to storage service encryption (for Azure-managed disks/storage) using CMK; it doesn't inherently ensure "maintain encryption if downloaded" in the same guest-level sense
tested here.
- Confidential disk encryption: Targets Confidential VM scenarios and is not the standard requirement here; it's not the general-purpose answer for "store keys in Key Vault + persist if downloaded".
- encryption at host: Encrypts at the host level for data at rest but doesn't match the "keys in Key Vault + persist if downloaded" requirement as directly as ADE.

Microsoft Exam Tips:
- AZ-104 often distinguishes ADE (guest/volume encryption with Key Vault integration) from platform/host-
based encryption.
- Watch for phrasing about "keys stored in Key Vault" and "encryption persists if exported/downloaded" - that strongly signals ADE.

Summary:
- Selecting the correct disk encryption approach for VMs with Key Vault-managed keys and persistent disk
encryption.

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and manage Azure compute resources 3.2 Create and configure virtual machines
3.2.2 Configure Azure Disk Encryption

App1: Access control (IAM)
App2: Shared access signatures

Why this is correct:
- App1 uses a managed identity, so the best practice is to grant it Azure RBAC permissions on the storage account (Access control (IAM))-no secrets required.
- App2 must be restricted to 30 days. A SAS can be issued with an expiration time, making it an appropriate mechanism for time-bounded access.

Exam Tips:
- "No secrets / managed identity" --> RBAC (IAM).
- "Time-limited access" --> SAS with expiry.

AZ-104 Exam Objective Hierarchy
1.0 Manage Azure identities and governance (20-25%) 1.2 Manage access to Azure resources 1.2.2 Assign roles at different scopes 2.0 Implement and manage storage (15-20%) 2.1 Configure access to storage

2.1.2 Create and use shared access signatures (SAS)

Remove Microsoft.Compute/virtualMachines from the policy.

The policy blocks creation of both virtual networks and virtual machines in RG1. You already have VNET1, and you need to create VM2 and connect it to VNET1. Therefore, the first step is to allow VM creation by removing Microsoft.Compute/virtualMachines from the "not allowed resource types" policy assignment/ parameters. You do not need to allow new VNets.

Why the other selections are not correct:
- Remove Microsoft.Network/virtualNetworks from the policy:
This would allow creating new VNets, but your immediate blocker is VM creation (VM2).
- Create an Azure Resource Manager template:
A template deployment would still be denied by the policy.
- Add a subnet to VNET1:
A subnet does not resolve the policy restriction that prevents VM creation.

Microsoft Exam Tips:
- If a policy denies a resource type, any deployment method (portal, CLI, PowerShell, ARM/Bicep) is still
denied.
- Read the "resource type" carefully (AZ-104).

Summary:
Resolving an Azure Policy restriction that blocks VM creation.

AZ-104 Exam Objective Hierarchy:
1.0 Manage Azure identities and governance 1.3 Manage Azure subscriptions and governance 1.3.1 Implement and manage Azure Policy

Upgrade the account to general-purpose v2.

You have a general-purpose v1 storage account using LRS. Requirement: protect data if a zone fails,
minimizing cost/admin effort.

To use zone-redundant patterns (for example, ZRS where supported), you commonly need the account to be StorageV2 (general-purpose v2). The correct first step is to upgrade to general-purpose v2, and then (as a follow-on step) adjust replication to a zone-redundant option if available/appropriate.

Why the other options are not correct:
- Create a new storage account: higher administrative effort; not the "minimize effort" first move when an
upgrade path exists.
- Configure object replication rules: object replication is for blob replication between accounts/regions; it does not directly address zone failure within a region.
- Modify the replication setting immediately: the account type may not support the needed replication
choice until upgraded.

Microsoft Exam Tips:
- Storage resiliency questions often hinge on account kind (GPv1 vs GPv2) before redundancy choices.
- Remember: LRS protects within a datacenter; ZRS is the pattern that addresses zone-level failure (where
supported).

Summary:
Upgrade to StorageV2 first to enable modern capabilities and redundancy options.

AZ-104 Exam Objective Hierarchy:
2.0 Implement and manage storage 2.2 Configure and manage storage accounts
2.2.2 Configure Azure Storage redundancy

Assign Policy1 to: Tenant Root Group, ManagementGroup1, Subscription1, RG1, and VM1 only Exclude Policy1 from: ManagementGroup1, Subscription1, RG1, and VM1 only

Why this is correct:
- Azure Policy assignments can be scoped at management group, subscription, resource group, or
individual resource.
- When you assign at a higher scope (Tenant Root Group), you can exclude lower scopes/resources using exclusions (notScopes), which is why excluding the management group/subscription/resource group/ resource is valid.

Why the other options are not correct:
- Exclusions must be within (or below) the assignment scope; you can't exclude something "above" the
assignment.

Exam Tips:
- Assign high, then carve out with exclusions: scope --> notScopes.

AZ-104 Exam Objective Hierarchy
1.0 Manage Azure identities and governance (20-25%) 1.3 Manage Azure subscriptions and governance 1.3.1 Implement and manage Azure Policy
1.3.7 Configure management groups

Box 2: ManagementGroup1, Subscription1, RG1, and VM1
You can exclude a subscope from the assignment.

References:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview

Standard SKU public IP address

A public Standard Load Balancer frontend requires a Standard SKU public IP address. This is the supported and expected pairing for Standard SKU load balancing.

Why other selections are not correct:
- Basic SKU public IP address: Not the required SKU for a Standard public Load Balancer frontend.
- Dynamic public IP address (SKU-agnostic): SKU still matters; "dynamic" vs "static" is not a SKU
substitute.
- Any public IP address SKU works: Incorrect; Standard LB expects Standard public IP.

Microsoft Exam Tips:
- Memorize: Standard LB pairs with Standard Public IP for public frontends.
- SKU mismatches are a frequent AZ-104 trap.

Summary:
Use a Standard SKU public IP address for a public Standard Load Balancer frontend.

AZ-104 Exam Objective Hierarchy:
4.0 Implement and manage virtual networking 4.3 Configure name resolution and load balancing

4.3.2 Configure an internal or public load balancer

User1: Group1 only
User2: Group1 and Group2 only

Why:
You're evaluating which groups each user is included in based on the group's membership type and rule.

Group1 (Security | Dynamic user)
Membership rule: (user.city -startsWith "m")
- User1 city = Montreal --> starts with "m" --> included in Group1.
- User2 city = Melbourne --> starts with "m" --> included in Group1.
("-startsWith" is a valid operator in dynamic membership rules.)

Group2 (Microsoft 365 | Dynamic user)
Membership rule: (user.department -notIn ["HR"])
- The rule means: include users whose department is NOT HR.
- User1 department = Human resources (HR) --> excluded from Group2.
- User2 department = Marketing --> not HR --> included in Group2.
("-notIn" is used to exclude specified values from membership.)

Group3 (Microsoft 365 | Assigned)
- "Assigned" means users are members only if explicitly added.
- The scenario does not state that User1 or User2 were assigned to Group3 --> don't include Group3.

Why the other answer choices are incorrect:
- Any choice including Group3 is unsupported because no explicit assignment was provided.
- Any choice excluding Group1 is incorrect because both cities start with "m".
- Any choice excluding User2 from Group2 is incorrect because Marketing is not HR.

Microsoft Exam Tips:
- Dynamic group rules are evaluated strictly against user attributes; "Assigned" groups require explicit
membership.
- Watch for "distractor" fields (like licensing) that don't change whether a user matches a dynamic
membership rule.

Summary:
This question tested how to evaluate Microsoft Entra dynamic group membership using rule operators like
-startsWith and -notIn, and how "Assigned" membership differs from "Dynamic user".

AZ-104 Exam Objective Hierarchy:
1.0 Manage Azure identities and governance (20-25%) 1.1 Manage Microsoft Entra users and groups 1.1.2 Manage user and group properties

Yes

Selecting **Redeploy** for a VM forces Azure to shut down the VM and move it to a new node, which satisfies the requirement to move the VM to a different host immediately.

Microsoft Exam Tips:
- Redeploy is a "move to new host" action; it is commonly tested alongside maintenance scenarios.

Summary:
- VM redeploy to change underlying host node

AZ-104 Exam Objectives:

3.0 Deploy and manage Azure compute resources 3.2 Create and configure virtual machines 3.2.3 Move a virtual machine to another resource group, subscription, or region

adatum.com account: User5
adatum.onmicrosoft.com account: UserA

Why this is correct:
- The AD DS account used by Azure AD Connect needs sufficient directory permissions to create/read required objects and attributes (the exhibit indicates User5 fits that requirement).
- The Azure AD account used during setup must have privileges to configure directory synchronization (the exhibit indicates UserA fits that requirement).

Why the other options are incorrect:
- Accounts without the needed directory privileges cannot complete configuration tasks.

Exam Tips:
- AD Connect setup typically needs: one privileged on-prem AD account + one privileged Azure AD
account.

AZ-104 Exam Objective Hierarchy
1.0 Manage Azure identities and governance (20-25%) 1.1 Manage Microsoft Entra users and groups 1.1.2 Manage user and group properties

Operator (aggregation): summarize
Aggregation function: dcount
Visualization: render

Why this is correct:
- You need the number of *distinct* computers reporting Heartbeat per week. That is:
- summarize dcount(Computer) by endofweek(TimeGenerated)
- Then you render the results as a bar chart.

Why the other options are incorrect:
- count: counts rows, not distinct computers.
- project/extend: shape data but don't aggregate into weekly distinct counts.
- If you don't use render barchart: you may get the data but not the required bar chart visualization.

Exam Tips:
- Distinct count in KQL: dcount()
- Weekly binning commonly uses startofweek()/endofweek() or bin(TimeGenerated, 7d).

Summary:
Use summarize with dcount, grouped by week, and render as a bar chart.

AZ-104 Exam Objective Hierarchy:
5.0 Monitor and back up Azure resources (10-15%) 5.1 Monitor resources by using Azure Monitor
5.1.3 Query and analyze logs

Start VM1.

VM1 is currently in a Stopped (deallocated) state. Enabling Desired State Configuration (DSC) for an Azure VM relies on the VM's guest agent/extension mechanism to install and run the DSC components.
Those extensions require the VM agent to be running, which in turn requires the VM to be running.
Therefore, the first required action is to start VM1 so the DSC extension/registration can proceed.

Exam Tips:
- If a question involves installing/configuring a VM extension (DSC, Monitoring agent, etc.), confirm the VM
isn't Stopped/Deallocated.
- VM extensions depend on the Azure VM Agent; if the agent isn't running/ready, the extension workflow
will fail.

Summary:
Start VM1 first because DSC enablement is performed via VM extensions/agent-based actions that require the VM to be running.

Exam Objective Alignment (Hierarchy)
3.0 Deploy and manage Azure compute resources 3.2 Create and configure virtual machines

No

Selecting "Use dedicated data endpoint" for an Azure Container Registry does not address the root requirement for Azure Container Instances (ACI) to successfully pull an image from the registry. Dedicated data endpoints are a networking/configuration option for registry data-plane access patterns, but they do not, by themselves, provide ACI with valid authentication/authorization to pull images.

To deploy a container instance from an ACR image, you must ensure the container group has permission to pull from the registry (for example, by providing credentials or using an identity with pull permissions).
Therefore, the proposed solution does not meet the stated goal.

Microsoft Exam Tips:
- For ACI pulling from ACR, think "authentication and pull permissions" first (credentials/identity + AcrPull), then network path (public vs private endpoints/DNS).

Summary:
- Azure Container Instances deployment prerequisites with Azure Container Registry (authn/authz vs
networking).

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and manage Azure compute resources 3.3 Provision and manage containers in the Azure portal 3.3.1 Create and manage an Azure container registry 3.3.2 Provision a container by using Azure Container Instances

No

To review the ARM template used for a deployment in Azure, you typically access the deployment history and export/view the template from the deployment (commonly from the resource group's deployments area, or via the export template workflow). Accessing the Virtual Machine blade is not the correct place to retrieve the ARM template that was used in a resource group deployment. Therefore, this solution does not meet the goal.

Microsoft Exam Tips:
- "Review the ARM template that was used" usually means "deployment history/export template," most commonly found at the resource group level.

Summary:
Where to export/review an ARM template used for deployment.

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and manage Azure compute resources 3.1 Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files 3.1.5 Export a deployment as an Azure Resource Manager template or convert an Azure Resource Manager template to a Bicep file

Docker hub
ACR

For Azure App Service custom containers, common supported registry sources include Docker Hub and Azure Container Registry (ACR). These are explicitly called out as primary registry options in App Service container deployment guidance.

Why the other options are not correct:
- Virtual machine: A VM is compute infrastructure, not a container image registry source by itself.
- On-premises: The option as written is not a standard "image source" category in the App Service UI; App
Service guidance highlights Docker Hub and ACR as standard sources.

Microsoft Exam Tips:

- AZ-104: For App Service containers, expect "Docker Hub" and "ACR" as canonical image sources.
- Separate the concepts: "Where the image is stored" (registry) vs "where it runs" (App Service/VM/AKS).

Summary:
This question covered valid container image registry sources for deploying a containerized web app in Azure App Service.

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and manage Azure compute resources 3.4 Create and configure Azure App Service 3.4.3 Create an App Service

No

The proposed solution is too vague to guarantee the outcome. Simply "assign a built-in policy definition" does not inherently ensure that all new NSGs will include a deny rule for TCP/8080 between VNets-unless a specific built-in policy exists that enforces exactly that rule. In practice, implementing a very specific security rule requirement often requires a custom policy definition (or verifying that a suitable built-in definition exists and matches the intended rule logic). Without that specificity, the goal is not assured.

Microsoft Exam Tips:
- "Built-in policy" only works if you can name/identify the exact built-in definition that enforces the stated
requirement.
- Otherwise, expect "custom policy definition" as the realistic approach (AZ-104).

Summary:
Azure Policy must be specific enough to enforce the required NSG rule behavior.

AZ-104 Exam Objective Hierarchy:
1.0 Manage Azure identities and governance 1.3 Manage Azure subscriptions and governance 1.3.1 Implement and manage Azure Policy

Internet users: can connect to the container from any device
If Internet Information Services (IIS) in the container fail: the container will restart automatically

From the ARM template:
- The container group has ipAddress.type = "Public" and exposes TCP port 80.
=> Any internet client that can reach the public IP on port 80 can connect (OS does not matter).

- restartPolicy = "OnFailure"
=> If the container exits due to a failure, Azure Container Instances will automatically restart it.

So:
1) Public IP + port 80 => "can connect to the container from any device" 2) OnFailure => "the container will restart automatically"

Microsoft Exam Tips:
- "Public" IP in ACI means internet reachable (subject to NSGs/filters if present-none shown here).
- restartPolicy meanings to memorize:
- Always: always restart
- OnFailure: restart only on failure exit
- Never: do not restart

Summary:
- Azure Container Instances connectivity (public IP + exposed ports) and restartPolicy behavior.

AZ-104 Exam Objective Hierarchy:
3.0 Deploy and manage Azure compute resources (20-25%) 3.3 Create and manage container workloads
3.3.1 Configure Azure Container Instances

Change made to the data in storage1 can be rolled back after seven days: No
Only users located in the East US Azure region can connect to storage1: No
Three copies of storage1 will be maintained in the East US Azure region: Yes

Why this is correct:
- Soft delete retention is 7 days, which applies to restoring deleted blobs/containers within the retention period-not "rolling back changes after seven days."
- Resource region does not restrict access to only users in that region.
- Standard_LRS maintains three replicas in the primary region.

Why the other options are incorrect:
- "Yes" for rollback-after-7-days misstates what soft delete/versioning provides.
- "Yes" for user-location restriction is not how storage access works.
- "No" for three copies contradicts LRS behavior.

Exam Tips:
- LRS = 3 replicas in the primary region/datacenter.
- Soft delete retention window ≠ change rollback semantics.

AZ-104 Exam Objective Hierarchy:
2.0 Implement and manage storage (15-20%) 2.2 Configure and manage storage accounts
2.2.2 Configure Azure Storage redundancy
2.3 Configure Azure Files and Azure Blob Storage 2.3.4 Configure soft delete for blobs and containers
2.3.7 Configure blob versioning