Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 1:

  HOTSPOT

  You need to create an Azure Storage account that meets the following requirements:

  1. Minimizes costs 2. Supports hot, cool, and archive blob tiers 3. Provides fault tolerance if a disaster affects the Azure region where the account resides

  How should you complete the command? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  --kind 1: StorageV2

  --sku: Standard_GRS

  Explanation:

  You must create a storage account that (1) minimizes cost, (2) supports hot/cool/archive blob tiers, and (3) remains available if the *region* is impacted.

  Why {Dropdown 1} = StorageV2:

  - StorageV2 (general-purpose v2) supports Blob access tiers including hot, cool, and archive.

  - “Storage” (GPv1) is legacy and doesn’t provide the same tiering capabilities as the modern StorageV2 account.

  - “BlobStorage” is blob-only and is not the general recommended default compared to StorageV2 for broad storage scenarios.

  Why {Dropdown 2} = Standard_GRS:

  - GRS (Geo-Redundant Storage) replicates data to a *paired secondary region*, providing resiliency if the primary region experiences a disaster.

  - Standard tiers minimize cost compared to Premium options.

  - Standard_LRS keeps replicas only within the same region (does NOT satisfy “region disaster” resilience).

  - Standard_RAGRS is also geo-redundant, but it is typically chosen when you specifically need read access to the secondary region; the requirement only states “fault tolerance if a disaster affects the region,” which GRS already satisfies.

  References (APA):

  1. Microsoft Learn. (n.d.). az storage account create (Azure CLI). https://learn.microsoft.com/en-us/cli/azure/storage/account?view=azure-cli-latest#az-storage-account-create

  - Last updated: Unable to locate on page. Date accessed: 01/27/2026.

  2. Microsoft Learn. (2025, October 23). Storage account overview. https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview

  - Last updated: 2025-10-23. Date accessed: 01/27/2026.

  3. Microsoft Learn. (2025, September 9). Azure Storage redundancy. https://learn.microsoft.com/en-us/azure/storage/common/storage-redundancy

  - Last updated: 2025-09-09. Date accessed: 01/27/2026.

  4. Microsoft Learn. (n.d.). Access tiers for blob data. https://learn.microsoft.com/en-us/azure/storage/blobs/access-tiers-overview

  - Last updated: Unable to locate on page. Date accessed: 01/27/2026.

  Microsoft Exam Tips:

  - Remember the “region disaster” clue: that typically implies GRS/GZRS (geo), not LRS/ZRS (in-region).

  - StorageV2 is the modern default for most storage account scenarios and supports blob tiering (hot/cool/archive).

  Summary:

  This question tested Azure Storage account selection based on: account kind (tier support), redundancy (region resiliency), and cost tradeoffs.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15–20%) |__ 2.2 Configure and manage storage accounts |__ 2.2.1 Create and configure storage accounts |__ 2.2.2 Configure Azure Storage redundancy |__ 2.3 Configure Azure Files and Azure Blob Storage |__ 2.3.3 Configure storage tiers

• Question 2:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to manage outbound traffic from VNET1 by using Firewall1.

  What should you do first?

  A. Configure the Hybrid Connection Manager.
  B. Upgrade ASP1 to the Premium SKU.
  C. Create a route table.
  D. Create an Azure Network Watcher.
  C. Create a route table.

  ---

  Create a route table.

  To manage outbound traffic from VNET1 through Azure Firewall, you must force egress to the firewall by using user-defined routes (UDRs). The first step is to create a route table, add routes (commonly 0.0.0.0/0) with next hop type Virtual appliance pointing to the firewall’s private IP address, and then associate the route table with the appropriate subnet(s). Without the route table/UDR, traffic will not be steered to Firewall1 for policy enforcement.

  Why the other options are not correct:

  • Configure Hybrid Connection Manager: An App Service connectivity feature; unrelated to VNet egress routing.
  • Upgrade App1 to Premium SKU: Not required to route VNet egress through Azure Firewall.
  • Create an Azure Network Watcher: A monitoring service; it does not enforce outbound routing through the firewall.

  Exam Tips:

  • “Send outbound traffic through Azure Firewall” almost always implies UDR/route table.
  • Azure Firewall is not automatically on the traffic path; you must route traffic to it.

  Summary:
  Use a route table (UDR) to steer VNet outbound traffic through Azure Firewall.

  AZ-104 Exam Objective Hierarchy:
  4.0 Implement and manage virtual networking (15–20%)
  └── 4.1 Configure and manage virtual networks in Azure
    └── 4.1.4 Configure user-defined network routes

• Question 3:

  DRAG DROP

  You have a Microsoft Entra tenant.

  You need to ensure that when a new Microsoft 365 group is created, the group name is automatically formatted as follows:

  

  Which three actions should you perform in sequence in the Microsoft Entra admin center? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Box 1: Create a group naming policy.
  
  Box 2: Set Add prefix to Attribute.
  
  Box 3: Set Select type to Department.

  Why:

  Requirement: When a group named “Microsoft_365” is created, the group name must be automatically formatted as:
  
  <Department><Group name>

  This is implemented by using Microsoft Entra ID (Azure AD) Group naming policy with a prefix based on a user attribute.

  Why this order is correct:

  1. Create a group naming policy. You must first enable and configure the naming policy feature before specifying prefix or suffix rules.
  2. Set Add prefix to Attribute. Because the prefix must be dynamic and derived from a user attribute (not a fixed string).
  3. Set Select type to Department. Department is the user attribute to inject into the group name, satisfying the <Department> portion of the required format.

  Why the other actions are not selected:

  Set Add prefix to String, Set Add suffix to String, or Set Add suffix to Attribute:
  
  The requirement is specifically a prefix based on Department (not a suffix and not a static string).

  Customize the company branding:
  
  Unrelated to group naming conventions.

  Exam Tips:

  “<Department><Group name>” almost always means a prefix or suffix naming policy with Attribute = Department.

  If String is offered as a distractor, use it only when the prefix or suffix is constant (for example, “HR-”).

  Summary:

  Configured a Microsoft Entra group naming policy to prepend the creator’s Department attribute to the group name.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20–25%)
  1.1 Manage Microsoft Entra users and groups

• Question 4:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals.

  Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Active Directory (Azure AD) tenant named contoso.com.

  You have a CSV file that contains the names and email addresses of 500 external users.

  You need to create a guest user account in contoso.com for each of the 500 external users.

  Solution: You create a PowerShell script that runs the New-MgInvitation cmdlet for each external user.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  New-MgInvitation is specifically meant to invite external users to your tenant (B2B). It creates/uses a guest user object and sends an invitation email so the external users can redeem the invitation and access resources as guests.

  Therefore, using New-MgInvitation for each external user meets the goal of creating guest user accounts for the 500 external users.

  Why the other option is not correct:

  - No: Would only be correct if invitations did not create guest users or did not onboard external identities, but invitations are designed for that exact purpose.

  Microsoft Exam Tips:

  - AZ-104: When you see "external users" + "guest accounts," the intended solution is almost always B2B invitation (unless explicitly stated otherwise).

  Summary:

  This question tested the correct approach for bulk onboarding external users as guest accounts.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.4 Manage external users

• Question 5:

  You have an Azure subscription that contains the Microsoft Entra identities shown in the following table.

  

  You need to enable self-service password reset (SSPR).

  For which identities can you enable SSPR in the Azure portal?

  A. User1 only
  B. Group1 only
  C. User1 and Group1 only
  D. Group1 and Group2 only
  E. User1, Group1, and Group2
  D. Group1 and Group2 only

  ---

  Explanation

  -----------------------------------------------------------------------

  Group1 and Group2 only

  -----------------------------------------------------------------------

  In Microsoft Entra ID, Self-Service Password Reset (SSPR) can be enabled for:

  - None

  - Selected (targeted to a group)

  - All

  The question asks "For which identities can you enable SSPR in the Azure portal?" In that sense, you can target SSPR to a security group (Group1) or to a Microsoft 365 group (Group2), so "Group1 and Group2 only" best matches the set of identities that are valid targets.

  Important caveat: In the Entra admin center, when you use "Selected," you can only enable SSPR for ONE group at a time. So while both Group1 and Group2 are eligible targets, you would choose either Group1 OR Group2 in a given configuration.

  Why the other options are not correct:

  - User1 only: SSPR enablement is configured at the tenant level (None/Selected/All). "Selected" scopes to a group, not directly to an individual user in that setting.

  - Group1 only: Incomplete because a Microsoft 365 group is also a valid target type for "Selected."

  - User1, Group1, and Group2 / User1, Group1, and Group2: These imply simultaneously enabling at user + multiple group granularity in the portal scope selection, which is not how the setting is applied.

  -----------------------------------------------------------------------

  References:

  1. Microsoft. (n.d.). *Tutorial: Enable self-service password reset (SSPR) in Microsoft Entra ID.* Microsoft Learn.

  https://learn.microsoft.com/en-us/entra/identity/authentication/tutorial-enable-sspr Date Modified: Unable to locate date modified Date Accessed: 01/26/2026

  -----------------------------------------------------------------------

  Microsoft Exam Tips:

  - AZ-104: Expect SSPR questions to test (a) scope (None/Selected/All), (b) what "Selected" targets (a group), and (c) operational constraints such as "only one group can be selected" in the admin center.

  - If an answer option implies selecting multiple groups simultaneously for SSPR "Selected," treat it as suspicious unless the question is clearly asking about eligibility rather than configuration state.

  -----------------------------------------------------------------------

  Summary:

  SSPR scoping in Microsoft Entra ID is configured tenant-wide. "Selected" targets a group; both security groups and Microsoft 365 groups are eligible targets, but only one group can be selected at a time.

  -----------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.5 Configure self-service password reset (SSPR)

• Question 6:

  HOTSPOT

  You have an Azure Service Bus.

  You create a queue named Queue1. Queue1 is configured as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Message with TTL = 4 hours and never read: retained until manually deleted Message with TTL = 2 hours and read after 1 hour: deleted immediately

  Explanation (Why this is correct)

  - The queue is configured to dead-letter messages on expiration. When a message expires, it moves to the dead-letter sub-queue and remains there until removed.

  - If a message is successfully received/processed before expiration, it is removed from the queue (deleted).

  Explanation (Why the other options are not correct)

  - “Deleted immediately” is not correct for expired messages when dead-letter-on-expiration is enabled.

  - “Retained until manually deleted” is not correct for messages that are successfully consumed.

  Exam Tip

  - Dead-letter on expiration = “expired messages go to DLQ and stick around until cleaned up.”

  References (APA)

  - Microsoft. (n.d.). Dead-letter queues. https://learn.microsoft.com/en-us/azure/service-bus-messaging/service-bus-dead-letter-queues

  AZ-104 Exam Objective Hierarchy 5.0 Monitor and maintain Azure resources (10–15%) |__5.1 Monitor resources by using Azure Monitor

• Question 7:

  You have web apps in the West US, Central US and East US Azure regions.

  You have the App Service plans shown in the following table.

  

  You plan to create an additional App Service plan named ASP5 that will use the Linux operating system.

  You need to identify in which of the currently used locations you can deploy ASP5.

  What should you recommend?

  A. West US, Central US, or East US
  B. Central US only
  C. East US only
  D. West US only
  A. West US, Central US, or East US

  ---

  Explanation

  {template for answering question}

  --------------------------------------------------------------------------------

  West US, Central US, or East US

  --------------------------------------------------------------------------------

  An App Service plan is a set of compute resources created in a specific region, and you can create additional App Service plans in any region you choose (subject to service availability/quotas). The operating system selection (Linux vs Windows) is a property of the plan, but it does not limit you to only regions that already have Linux plans; you can create a new Linux plan in any of the currently used regions.

  Since your environment already uses App Service in West US, Central US, and East US, you can deploy the new Linux App Service plan (ASP5) in any of those regions.

  --------------------------------------------------------------------------------

  References:

  1. Azure App Service Plans (hosting plans overview) https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans Modified: 11/18/2025 Date Access: 01/24/2026

  2. Manage an App Service plan in Azure https://learn.microsoft.com/en-us/azure/app-service/app-service-plan-manage Modified: 11/18/2025 Date Access: 01/24/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: remember that App Service plans are regional "compute containers"; apps must run in the same region as their plan.

  - OS is set at the plan level; you typically create separate plans for Linux vs Windows, but region choice remains flexible.

  -------------------------------------------------------------------------------- Summary:

  App Service plan region scoping and deploying a new Linux plan across existing regions.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.4 Create and configure Azure App Service |__ 3.4.1 Provision an App Service plan

• Question 8:

  You have an Azure subscription that contains a user account named User1.

  You need to ensure that User1 can assign a policy to the tenant root management group.

  What should you do?

  A. Assign the Owner role for the Azure Subscription to User1, and then modify the default conditional access policies.
  B. Assign the Owner role for the Azure subscription to User1, and then instruct User1 to configure access management for Azure resources.
  C. Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources.
  D. Create a new management group and delegate User1 as the owner of the new management group.
  C. Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources.

  ---

  Explanation

  ---------------------------------------------------------------------------------------------------------------------------------

  Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources.

  ---------------------------------------------------------------------------------------------------------------------------------

  To assign an Azure Policy at the tenant root management group scope, User1 must have sufficient Azure RBAC permissions at that scope (management group-level permissions, not just subscription-level permissions).

  A Microsoft Entra Global Administrator can use the "Access management for Azure resources" toggle ("elevate access") to be assigned the User Access Administrator role at the tenant root scope (/). With that elevated access, User1 can then grant the necessary Azure roles at the tenant root management group (for example, Resource Policy Contributor/Owner as appropriate) and perform the policy assignment at that scope.

  Why the other options are not correct:

  - Assign Owner on the Azure subscription + conditional access changes:

  Subscription Owner does not automatically grant permissions at the tenant root management group scope, and conditional access is unrelated to Azure Policy assignment permissions.

  - Assign Owner on the subscription + instruct User1 to configure access management:

  The "Access management for Azure resources" elevation capability is only available to Microsoft Entra Global Administrators.

  - Create a new management group and delegate ownership:

  The requirement is to assign a policy to the tenant root management group. Creating a separate management group does not provide rights on the root scope.

  ---------------------------------------------------------------------------------------------------------------------------------

  References:

  (1) Elevate access to manage all Azure subscriptions and management groups (explains the Access management for Azure resources toggle and that it assigns User Access Administrator at root scope /) https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin Date accessed: 2026-01-22 Last updated: 2025-03-10

  (2) Organize your resources with management groups (root management group notes: no default access; Global Admins can elevate access; policy/role assignments at root apply broadly) https://learn.microsoft.com/en-us/azure/governance/management-groups/overview Date accessed: 2026-01-22 Last updated: 2025-07-21

  (3) Overview of Azure Policy (notes Azure RBAC roles used for policy operations, including Resource Policy Contributor) https://learn.microsoft.com/en-us/azure/governance/policy/overview Date accessed: 2026-01-22 Last updated: 2025-03-04

  ---------------------------------------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - If a question mentions the "tenant root management group," think "management group scope," not "subscription scope."

  - "Access management for Azure resources" is the exam-friendly phrasing for "elevate access," which temporarily grants User Access Administrator at root scope so you can assign roles at the top of the hierarchy.

  - Be cautious: changes at the tenant root management group can affect the entire directory hierarchy; least privilege and removal of elevated access are best practice after completing the task.

  ---------------------------------------------------------------------------------------------------------------------------------

  Summary:

  - Assigning Azure Policy at tenant root management group scope

  - Understanding why subscription-level roles are insufficient for root management group actions

  - Using Global Administrator elevation ("Access management for Azure resources") to obtain root-scope RBAC capability

  ---------------------------------------------------------------------------------------------------------------------------------

  AZ-104 Exam Objective Alignment (Hierarchy)

  ------------------------------------------ 1.0 Manage Azure identities and governance (20?5%) | 1.3 Manage Azure subscriptions and governance | 1.3.1 Implement and manage Azure Policy | 1.3.7 Configure management groups

• Question 9:

  HOTSPOT

  You have an Azure subscription.

  You need to implement a custom policy that meet the following requirements:

  *Ensures that each new resource group in the subscription has a tag named organization set to a value of Contoso.

  *Ensures that resource group can be created from the Azure portal. *Ensures that compliance reports in the Azure portal are accurate. How should you complete the policy? To answer, select the appropriate options in the answers area.

  

  

  ---

  Resource type: Microsoft.Resources/subscriptions/resourceGroups Effect: Append

  Explanation (Why this is correct)

  - The policy must ensure every *new* resource group has a required tag while still allowing users to create RGs from the portal.

  - “Append” adds/modifies the tag on create/update requests instead of blocking them, which keeps creation possible and makes compliance reporting accurate.

  Explanation (Why the other options are incorrect)

  - Deny: Would block resource group creation if the tag isn’t present (violates the “must allow creation” requirement).

  - Audit-only effects: Would not enforce the tag (compliance report would show noncompliance rather than remediating).

  - DeployIfNotExists: Not the right fit for enforcing tags at create-time for resource groups in this scenario.

  Exam Tip

  - For “force tags but don’t block creation” exam patterns: **Append** (or sometimes **Modify**, depending on the question/options).

  References (APA)

  - Microsoft. (n.d.). Azure Policy effects. Microsoft Learn. https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effects

  - Microsoft. (n.d.). Understand Azure Policy for tags. Microsoft Learn. https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies

  AZ-104 Exam Objective Hierarchy 1.0 Manage Azure identities and governance (20–25%) |__1.3 Manage Azure subscriptions and governance |__|__1.3.1 Implement and manage Azure Policy

• Question 10:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You manage a virtual network named VNet1 that is hosted in the West US Azure region.

  VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.

  You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.

  Solution: From Performance Monitor, you create a Data Collector Set (DCS).

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  -----------------------------------------------------------------------

  No

  -----------------------------------------------------------------------

  A Performance Monitor Data Collector Set (DCS) collects Windows performance and diagnostics data, not packet captures. It cannot inspect "all the network traffic" (packet-level) between VM1 and VM2 in Azure. Therefore, the proposed solution does not meet the goal.

  Why the other selection is incorrect:

  - Yes: Incorrect because PerfMon DCS is not designed for packet capture/inspection.

  -----------------------------------------------------------------------

  References:

  1. Performance Monitor (perfmon) overview https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/perfmon Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  2. Azure Network Watcher packet capture overview https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-packet-capture-overview Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -----------------------------------------------------------------------

  Microsoft Exam Tips:

  - When both Windows tooling (PerfMon) and Azure-native tooling (Network Watcher) appear in options, align with the requirement:

  - Packet inspection in Azure --> Network Watcher packet capture.

  Summary:

  PerfMon DCS does not provide packet-level inspection between two Azure VMs.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10?5%) |__ 5.1 Monitor resources in Azure |__ 5.1.6 Use Azure Network Watcher and Connection Monitor