Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 131:

  You plan to deploy a public Standard Load Balancer in Azure.

  Which public IP address SKU must you use for the load balancer frontend?

  A. Basic SKU public IP address
  B. Standard SKU public IP address
  C. Dynamic public IP address (SKU-agnostic)
  D. Any public IP address SKU works
  B. Standard SKU public IP address

  ---

  Explanation

  --------------------------------------------------------------------------------

  Standard SKU public IP address

  --------------------------------------------------------------------------------

  A public Standard Load Balancer frontend requires a Standard SKU public IP address. This is the supported and expected pairing for Standard SKU load balancing.

  Why other selections are not correct:

  - Basic SKU public IP address: Not the required SKU for a Standard public Load Balancer frontend.

  - Dynamic public IP address (SKU-agnostic): SKU still matters; "dynamic" vs "static" is not a SKU substitute.

  - Any public IP address SKU works: Incorrect; Standard LB expects Standard public IP.

  -------------------------------------------------------------------------------- References:

  1. Azure Load Balancer SKUs (frontend public IP considerations) https://learn.microsoft.com/en-us/azure/load-balancer/skus Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - Memorize: Standard LB pairs with Standard Public IP for public frontends.

  - SKU mismatches are a frequent AZ-104 trap.

  -------------------------------------------------------------------------------- Summary:

  Use a Standard SKU public IP address for a public Standard Load Balancer frontend.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.3 Configure name resolution and load balancing |__ 4.3.2 Configure an internal or public load balancer

• Question 132:

  You plan to use the Azure Import/Export service to copy files to a storage account.

  Which two files should you create before you prepare the drives for the import job? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. an XML manifest file
  B. a driveset CSV file
  C. a dataset CSV file
  D. a PowerShell PS1 file
  E. a JSON configuration file
  B. a driveset CSV file
  C. a dataset CSV file

  ---

  Explanation

  ---------------------------------------------------------------------------------------------------------------------------------

  a driveset CSV file a dataset CSV file

  ---------------------------------------------------------------------------------------------------------------------------------

  Before you prepare the physical drives for an Azure Import/Export *import* job (using the WAImportExport tool), you must provide two input CSV files:

  1) dataset.csv

  - Defines what data will be copied (files/folders) and the destination path/prefix in the target storage account.

  2) driveset.csv

  - Defines which disks (drive letters) are included in the job, and (depending on approach) includes information such as BitLocker key handling for the drives.

  These two CSV files are explicitly referenced as the required inputs when running the WAImportExport PrepImport process.

  Why the other options are not correct:

  - an XML manifest file:

  Not required to start drive preparation for an import job; the PrepImport workflow uses dataset.csv and driveset.csv.

  - a PowerShell PS1 file:

  Not required. The workflow is driven by the Import/Export tool parameters and CSV inputs, not a PowerShell script.

  - a JSON configuration file:

  Not required for WAImportExport import drive preparation.

  ---------------------------------------------------------------------------------------------------------------------------------

  References:

  (1) Preparing hard drives for an Azure Import/Export import job (dataset CSV and driveset CSV definitions; PrepImport command uses /InitialDriveSet and /DataSet) https://learn.microsoft.com/en-us/previous-versions/azure/storage/common/storage-import-export-tool-preparing-hard-drives-import Date accessed: 2026-01-22 Page last updated: 2017-06-29

  (2) Azure Import/Export service (mentions dataset.csv usage and driveset.csv for BitLocker key during drive preparation) https://learn.microsoft.com/en-us/azure/import-export/storage-import-export-service Date accessed: 2026-01-22 Page last updated: 2023-04-05

  ---------------------------------------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - If the question mentions Azure Import/Export drive preparation (WAImportExport), think "two CSVs":

  dataset.csv (what to copy + destination) and driveset.csv (which disks + encryption details).

  - Don't confuse Import/Export with AzCopy/Storage Explorer; Import/Export is for shipping encrypted drives to an Azure datacenter.

  ---------------------------------------------------------------------------------------------------------------------------------

  Summary:

  - Azure Import/Export service prerequisites for import drive preparation

  - Understanding the purpose of dataset.csv vs. driveset.csv in WAImportExport

  ---------------------------------------------------------------------------------------------------------------------------------

  AZ-104 Exam Objective Alignment (Hierarchy)

  ------------------------------------------ 2.0 Implement and manage storage (15?0%) | 2.2 Configure and manage storage accounts | 2.2.5 Manage data by using Azure Storage Explorer and AzCopy (Closest fit: this item tests storage data movement concepts; Import/Export is another data transfer method.)

• Question 133:

  HOTSPOT

  You have an Azure subscription that contains the storage accounts shown in the following table.

  

  You need to identify which storage accounts support lifecycle management, and which storage accounts support moving data to the Archive access tier.

  Which storage accounts should you use? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Lifecycle management: storage1, storage2, and storage3

  Archive access tier: storage2 only

  Why this is correct:

  - Lifecycle management policies apply to supported storage account kinds, including StorageV2 and blob-focused account kinds shown.

  - The Archive tier is not supported for all redundancy/account-kind combinations. In this table, only storage2 (BlobStorage with RA-GRS) supports moving data to Archive as required.

  Why the other options are incorrect:

  - Selecting storage1 (GZRS) or storage3 (BlockBlobStorage) for Archive conflicts with Archive tier support constraints.

  Exam Tips:

  - Archive tier support varies by redundancy (e.g., ZRS/GZRS constraints) and by account kind/performance tier.

  - “Lifecycle management” is broader than “Archive tier support.”

  Summary:

  All three support lifecycle management; only storage2 supports Archive.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15–20%) |__2.0 Implement and manage storage

• Question 134:

  You plan to create an Azure Storage account named storage1 that will contain a file share named share1.

  You need to ensure that share1 can support SMB Multichannel. The solution must minimize costs.

  How should you configure storage?

  A. Premium performance with locally-redundant storage (LRS)
  B. Standard performance with zone-redundant storage (ZRS)
  C. Premium performance with geo-redundant storage (GRS)
  D. Standard performance with locally-redundant storage (LRS)
  A. Premium performance with locally-redundant storage (LRS)

  ---

  Premium performance with locally-redundant storage (LRS)

  SMB Multichannel is an Azure Files capability that requires the performance characteristics provided by Premium Azure Files (FileStorage) rather than standard file shares. Since the solution must minimize costs while still supporting SMB Multichannel, you choose the least expensive option that is still Premium: Premium + LRS.

  Why the other options are not correct:

  - Standard performance with ZRS or LRS: Standard file shares won't satisfy the SMB Multichannel requirement.

  - Premium with GRS: Premium is correct, but GRS increases cost unnecessarily versus LRS when the goal is to minimize costs.

  Microsoft Exam Tips:

  - AZ-104: If you see Azure Files performance features (IOPS/throughput heavy features), suspect Premium file shares.

  - "Minimize costs" often means selecting the least expensive redundancy option that still meets feature requirements (commonly LRS).

  Summary:

  This question tested Azure Files feature requirements and selecting the cost-minimal storage redundancy that still meets the requirement.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage  |__ 2.3 Configure Azure Files and Azure Blob Storage |__ 2.3.1 Create and configure file shares in Azure Storage accounts

• Question 135:

  You have an Azure subscription that contains the resources shown in the following table.

  

  The Not allowed resource types Azure policy that has policy enforcement enabled is assigned to RG1 and uses the following parameters:

  1. Microsoft.Network/virtualNetworks 2. Microsoft.Compute/virtualMachines

  In RG1, you need to create a new virtual machine named VM2 which is connected toVNET1. What should you do first?

  A. Create an Azure Resource Manager template.
  B. AddasubnettoVNET1.
  C. Remove Microsoft. Network/virtualNetworks from the policy.
  D. Remove Microsoft.Compute/virtualMachines from the policy.
  D. Remove Microsoft.Compute/virtualMachines from the policy.

  ---

  Remove Microsoft.Compute/virtualMachines from the policy.

  The policy disallows specified resource types, including Microsoft.Compute/virtualMachines. Since you must create a new VM, you must remove that resource type from the disallowed list (or otherwise adjust the policy) so VM creation is permitted. The VNet already exists and isn't the immediate blocker to creating the VM.

  Why other selections are not correct:

  - Remove Microsoft.Network/virtualNetworks from the policy: does not address the VM creation block.

  - Create ARM template / add subnet: doesn't resolve a deny from a policy with enforcement enabled.

  Exam Tips:

  - If policy enforcement is enabled and a resource type is disallowed, the first fix is the policy definition/assignment-not deployment tooling.

  Summary:

  - Resolving Azure Policy "not allowed resource types" blocks

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance |__ 1.3 Manage Azure subscriptions and governance |__ 1.3.1 Implement and manage Azure Policy

• Question 136:

  HOTSPOT

  You have the Azure virtual machines shown in the following table.

  

  VNET1, VNET2, and VNET3 are peered.

  VM4 has a DNS server that is authoritative for a zone named Contoso.com and contains the records shown in the following table.

  

  VNET1 and VNET2 are linked to an Azure private DNS zone named Contoso.com that contains the records shown in the following table.

  

  The virtual networks are configured to use the DNS servers shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Statement 1: Yes Statement 2: No Statement 3: Yes

  Explanation (Why this is correct)

  - VM1 resolves via the DNS configuration available to it (based on VNet/NIC DNS settings and any linked private DNS zones).

  - VM2’s resolution differs due to its DNS path not matching the zone/forwarding setup needed to return 131.107.3.3 for server1.contoso.com.

  - VM3 resolves server2.contoso.com to the private DNS mapping shown, matching the “Yes” selection.

  Explanation (Why the other options are incorrect)

  - Assuming all VMs resolve identically is incorrect when their DNS settings (custom DNS vs Azure-provided DNS) or zone links differ.

  Exam Tip

  - DNS questions are usually about **who is your resolver** (Azure-provided vs custom DNS) and **where the zone is linked**.

  References

  - Microsoft. (n.d.). Name resolution for resources in Azure virtual networks. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances

  - Microsoft. (n.d.). Azure Private DNS overview. https://learn.microsoft.com/en-us/azure/dns/private-dns-overview

  AZ-104 Exam Objective Hierarchy 4.0 Implement and manage virtual networking (20–25%) |__4.3 Configure name resolution |__|__4.3.1 Configure Azure DNS

• Question 137:

  You have the Azure virtual network named VNet1 that contains a subnet named Subnet1. Subnet1 contains three Azure virtual machines. Each virtual machine has a public IP address.

  The virtual machines host several applications that are accessible over port 443 to users on the Internet.

  Your on-premises network has a site-to-site VPN connection to VNet1.

  You discover that the virtual machines can be accessed by using the Remote Desktop Protocol (RDP) from the Internet and from the on-premises network.

  You need to prevent RDP access to the virtual machines from the Internet, unless the RDP connection is established from the on-premises network. The solution must ensure that all the applications can still be accessed by the Internet users.

  What should you do?

  A. Modify the address space of the local network gateway.
  B. Remove the public IP addresses from the virtual machines.
  C. Modify the address space of Subnet1.
  D. Create a deny rule in a network security group (NSG) that is linked to Subnet1.
  D. Create a deny rule in a network security group (NSG) that is linked to Subnet1.

  ---

  Create a deny rule in a network security group (NSG) that is linked to Subnet1.

  To block RDP (TCP 3389) from the public Internet while still allowing HTTPS (TCP 443) from the Internet, you implement inbound NSG rules at the subnet scope:

  - Add a deny inbound rule for TCP 3389 with Source = Internet (or a broad public CIDR range), Destination = Subnet1, Action = Deny.

  - Ensure there is an allow inbound rule for TCP 3389 from the on-premises address ranges (over the S2S VPN).

  - Keep/ensure allow inbound for TCP 443 from the Internet to preserve application access.

  NSGs are the correct control for filtering inbound traffic to subnet/VM NICs. :contentReference[oaicite:5]{index=5}

  Why the other selections are not correct:

  - Modify the address space of the local network gateway:

  Address space changes do not directly control inbound RDP from the Internet.

  - Remove the public IP addresses from the virtual machines:

  This would also prevent Internet users from reaching the applications over 443 (violates requirement).

  - Modify the address space of Subnet1:

  Address space changes do not implement protocol/port-based access controls.

  Exam Tips:

  - For "block one port but allow another," think NSG inbound rules and rule priority/order.

  - Apply NSGs at the subnet scope when you want a consistent policy across multiple VMs.

  Summary:

  Restricting RDP from the Internet while preserving HTTPS access using NSG rules.

• Question 138:

  You have an Azure subscription that contains two resource groups named RG1 and RG2. RG1 contains the resources shown in the following table.

  

  You move VM1 to RG2.

  Which resources are in RG2 after the move?

  A. VM1 only
  B. VM1 and Disk1 only
  C. VM1.NIC1.and Disk1 only
  D. VMl.VNet1, NIC1, and Disk1
  C. VM1.NIC1.and Disk1 only

  ---

  VM1, NIC1, and Disk1 only

  When you move a virtual machine to another resource group, you typically move the VM resource and its dependent compute artifacts such as the network interface and managed disks. A virtual network does not have to move with the VM- VNets can reside in a different resource group than the VM/NIC, and the VM can continue to use the subnet as long as it remains in the same subscription/region and dependencies remain valid.

  Why the other options are not correct:

  - VM1 only: The VM depends on the NIC and OS disk; moving only the VM would leave required dependencies behind.

  - VM1 and Disk1 only: The NIC is also a core dependency of the VM.

  - Any option including VNet1: The VNet is not required to be moved for the VM/NIC to function; it can remain in RG1.

  Microsoft Exam Tips:

  - AZ-104: For "move VM" questions, think in dependency sets: VM + NIC(s) + managed disk(s) (and sometimes public IP/NSG, depending on what exists).

  - Moving resources does not change the region; cross-region moves require different approaches (for example, redeploy/replicate).

  Summary:

  Resource move behavior and dependency handling when moving an Azure VM between resource groups.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources  | |__ 3.2 Create and configure virtual machines | |__ 3.2.3 Move a virtual machine to another resource group, subscription, or region

• Question 139:

  HOTSPOT

  You have the following custom role-based access control (RBAC) role.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  1) Users that are assigned Role1 can assign Role1 to users. - No

  2) Users that are assigned Role1 can deploy new virtual machines. - Yes

  3) Users that are assigned Role1 can set a static IP address on a virtual machine. - Yes

  Why these are correct:

  1) NO - Assigning a role to a user requires permissions to create role assignments (for example, Microsoft.Authorization/roleAssignments/write). In the provided role JSON, Microsoft.Authorization write operations are excluded via notActions, which removes the ability to assign roles.

  2) YES - The role includes broad compute actions (Microsoft.Compute/virtualMachines/*), which covers creating/deploying VMs.

  3) YES - Setting a VM’s static IP involves write operations on networking resources (commonly the NIC / related networking objects). The role includes broad networking permissions (for example, Microsoft.Network/networkInterfaces/*), enabling that change.

  AZ-104 Exam Objective Hierarchy

  1.0 Manage Azure identities and governance (20–25%) |__1.2 Manage access to Azure resources |__|__1.2.2 Assign roles at different scopes |__|__1.2.3 Interpret access assignments

• Question 140:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your company has an azure subscription that includes a storage account, a resource group, a blob container and a file share.

  A colleague named Jon Ross makes use of a solitary Azure Resource Manager (ARM) template to deploy a virtual machine and an additional Azure Storage account.

  You want to review the ARM template that was used by Jon Ross.

  Solution: You access the Resource Group blade.

  Does the solution meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  --------------------------------------------------------------------------------

  Yes

  --------------------------------------------------------------------------------

  The resource group is the standard scope where deployments are recorded, and from the deployment history you can export/view the exact template that was used. Therefore, accessing the Resource Group blade (where you can access

  Deployments and export the template) meets the goal of reviewing the ARM template used by a colleague. [1]

  References:

  [1] Microsoft. "Export template in Azure portal." Microsoft Learn. Date modified: 2025-10-29. Date accessed: 2026-01-25. https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/export-template-portal

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - If the question says "template that was used," think "resource group deployments --> export template."

  Summary:

  Reviewing/exporting an ARM template from resource group deployment history.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.1 Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files |__ 3.1.5 Export a deployment as an Azure Resource Manager template or convert an Azure Resource Manager template to a Bicep file

  To view a template from deployment history:

  Go to the resource group for your new resource group. Notice that the portal shows the result of the last deployment. Select this link.

  

  You see a history of deployments for the group. In your case, the portal probably lists only one deployment. Select this deployment.

  

  The portal displays a summary of the deployment. The summary includes the status of the deployment and its operations and the values that you provided for parameters. To see the template that you used for the deployment, select View template.

  

  https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-export-template