Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 141:

  You need to create an Azure virtual machine named VM1 that requires a static private IP address configured inside the IP address space for the VNet in which the VM resides. How do you configure a static IP address for this Azure VM?

  A. After the VM has been created, create a new network interface and configure a static IP address for that network interface
  B. When creating a VM in the portal, select New next to private ip address and choose static after assigning the correct IP address
  C. When creating the VM in the portal, change the setting from dynamic to static on the networking tab under private IP address
  D. After the VM has been created, go to the network interface attached to the VM and change the IP configuration to static assignment
  D. After the VM has been created, go to the network interface attached to the VM and change the IP configuration to static assignment

  ---

  Explanation

  --------------------------------------------------------------------------------

  After the VM has been created, go to the network interface attached to the VM and change the IP configuration to static assignment

  --------------------------------------------------------------------------------

  In Azure, a VM's **private IP assignment method (Dynamic/Static)** is configured on the **network interface (NIC)** under **IP configurations**. To ensure the VM uses a specific static private IP within the VNet address space, you update the NIC's IP configuration to **Static** (and specify the address if required).

  Why the other options are not correct:

  - Create a new NIC and configure static IP for that NIC: unnecessary and disruptive; you can change the existing NIC configuration.

  - During VM creation, select "New" next to private IP and choose static: the portal workflow in many exam contexts expects static private IP configuration post-creation on the NIC; this option is not the standard/clearest method in the given choices.

  - During VM creation, change networking tab private IP from dynamic to static: similar issue-this is not the canonical operational step that is consistently correct across portal flows and exam phrasing, while NIC IP configuration is the definitive location.

  -------------------------------------------------------------------------------- References:

  1. Configure IP addresses for an Azure network interface https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/virtual-network-network-interface-addresses Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - Private IP settings live on the **NIC**, not "inside the VM."

  - Know where to set **Static private IP**: NIC --> IP configurations.

  -------------------------------------------------------------------------------- Summary:

  Set the VM's private IP assignment method to Static on the NIC IP configuration.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) | |__ 4.1 Configure and manage virtual networks in Azure | |__ 4.1.1 Create and configure virtual networks and subnets

• Question 142:

  HOTSPOT

  You have an Azure subscription that contains a resource group named RG1.

  You plan to use an Azure Resource Manager (ARM) template named template1 to deploy resources. The solution must meet the following requirements:

  1. Deploy new resources to RG1.

  2. Remove all the existing resources from RG1 before deploying the new resources.

  How should you complete the command? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Parameter: ResourceGroupName

  Mode: Complete

  Why this is correct:

  - The deployment targets RG1, so the command must specify the resource group name.

  - “Complete” mode removes resources that exist in the resource group but are not defined in the template, satisfying the requirement to remove existing resources before deploying the new set.

  Why the other options are incorrect:

  - Name / QueryString / Tag: Do not target the deployment to RG1.

  - All / Incremental: Incremental does not remove resources that aren’t in the template, so it won’t satisfy the “remove all existing resources” requirement.

  Exam Tips:

  - “Incremental” = add/update only (no deletions of “extra” resources).

  - “Complete” = enforce template as source of truth (removes resources not in template).

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20–25%) |__1.3 Manage Azure subscriptions and governance |__|__1.3.4 Manage resource groups

• Question 143:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your company's Azure subscription includes two Azure networks named VirtualNetworkA and VirtualNetworkB.

  VirtualNetworkA includes a VPN gateway that is configured to make use of static routing. Also, a site-to- site VPN connection exists between your company's on-premises network and VirtualNetworkA.

  You have configured a point-to-site VPN connection to VirtualNetworkA from a workstation running Windows 10. After configuring virtual network peering between VirtualNetworkA and VirtualNetworkB, you confirm that you are able to access VirtualNetworkB from the company's on-premises network. However, you find that you cannot establish a connection to VirtualNetworkB from the Windows 10 workstation.

  You have to make sure that a connection to VirtualNetworkB can be established from the Windows 10 workstation.

  Solution: You choose the Allow gateway transit setting on VirtualNetworkA.

  Does the solution meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  Selecting "Allow gateway transit" on VirtualNetworkA is not, by itself, sufficient to ensure that point-to-site (P2S) VPN clients can access a peered virtual network (VirtualNetworkB). P2S client connectivity to peered VNets typically requires appropriate peering settings and route propagation to the VPN client (often including re-downloading/reinstalling the VPN client profile after peering/route changes). If only "Allow gateway transit" is chosen, the required end-to-end P2S routing to the peered VNet may still be missing, so the solution does not meet the goal.

  References:

  1. Configure P2S VPN clients to access peered VNets (troubleshooting guidance) - Microsoft Learn https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-troubleshoot-peering Date Modified: As shown on page (Microsoft Learn) Date Accessed: 01/25/2026

  Microsoft Exam Tips:

  - For hub-and-spoke: "Allow gateway transit" and "Use remote gateways" are about sharing a gateway, but client routes still matter for P2S scenarios.

  Summary:

  - P2S VPN routing considerations when accessing peered VNets.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.1 Configure and manage virtual networks in Azure |__ 4.1.2 Create and configure virtual network peering

• Question 144:

  You have an Azure subscription mat contains a virtual machine named VM1 and an Azure function named App1. You need to create an alert rule that will run App1 if VM1 stops.

  What should you create for the alert rule?

  A. a security group that has dynamic device membership
  B. an action group
  C. an application security group
  D. an application group
  B. an action group

  ---

  Explanation

  --------------------------------------------------------------------------------

  an action group

  --------------------------------------------------------------------------------

  An Azure Monitor alert rule can trigger notifications and automation through an action group (email/SMS/voice, webhook, Logic App, Azure Function, ITSM, etc.). Therefore, to run App1 when VM1 stops, you configure the alert rule to use an action group as its action.

  Why the other options are not correct:

  - a security group that has dynamic device membership: This is for Microsoft Entra ID group membership management; it is not an Azure Monitor alert action mechanism.

  - an application security group: This is used for NSG rule scoping, not alert actions.

  - an application group: Not an Azure Monitor construct for alerting actions.

  -------------------------------------------------------------------------------- References:

  1. Create and manage action groups in Azure Monitor https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/action-groups Modified: 12/15/2025 Date Access: 01/24/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: Remember the alert components: Signal (metric/log/activity), Condition, and Action (Action group).

  - Action groups are reusable-create once, attach to many alert rules.

  -------------------------------------------------------------------------------- Summary:

  Azure Monitor alerts; action groups as the mechanism to trigger notifications/automation.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10?5%) |__ 5.1 Monitor resources in Azure |__ 5.1.4 Set up alert rules, action groups, and alert processing rules in Azure Monitor

• Question 145:

  HOTSPOT

  You create a Recovery Services vault backup policy named Policy1 as shown in the following exhibit:

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  {Dropdown 1}: 10 years

  {Dropdown 2}: 36 months

  Why this is correct：

  - The policy is configured with multiple retention layers:

  - Daily retention: 30 days

  - Weekly retention: Sundays for 10 weeks

  - Monthly retention: day 1 for 36 months

  - Yearly retention: March 1 for 10 years

  - Backup on “Sunday, March 1“ matches the yearly retention rule (March 1), and the longest applicable retention wins --> “10 years“.

  - Backup on “Sunday, November 1“ matches the monthly retention rule (day 1), which is longer than weekly retention --> “36 months“.

  Why the other options are not correct：

  - Choosing “10 weeks” for November 1 ignores that it also qualifies as a monthly retention point (day 1) with a longer duration.

  - Choosing “36 months” for March 1 ignores that it also qualifies as a yearly retention point (March 1) with a longer duration.

  Microsoft Exam Tips:

  - When a recovery point matches multiple retention tiers (daily/weekly/monthly/yearly), the exam usually expects you to pick the *longest* retention that applies.

  Summary

  - Hot Area Tracking (delta): Attempted +1 | Correct +1 | Incorrect +0 | Skipped +0

  - Mismatch/Duplicate Tracking (delta): Mismatch +0 | Duplicate +0

  AZ-104 Exam Objective Hierarchy

  5.0 - Monitor and maintain Azure resources (10–15%) |__ 5.2 - Implement backup and recovery |__ |__ 5.2.3 - Create and configure a backup policy

• Question 146:

  You have an Azure Active Directory (Azure AD) tenant named contoso.com.

  You have a CSV file that contains the names and email addresses of 500 external users.

  You need to create a guest user account in contoso.com for each of the 500 external users.

  Solution: You create a PowerShell script that runs the New-AzureADUser cmdlet for each user.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  New-AzureADUser creates a user object directly in the directory (typically as a member user) and does not perform the guest invitation workflow needed for external users. For bulk creation of guest users from a CSV, you typically use an invitation-based approach (for example, New-AzureADMSInvitation or Microsoft Graph invitations). Therefore, using New-AzureADUser for each external user does **not** meet the goal.

  Microsoft Exam Tips:

  - For "guest users," look for language like **invite** or **invitation** (guest flow) rather than "create user."

  - Many older AzureAD cmdlets are legacy; exam items often still reference them, but the concept remains "invitation for guests."

  Summary:

  Guest user onboarding requires an invitation workflow, not simply creating users with New-AzureADUser.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.4 Manage external users

• Question 147:

  You have an Azure subscription that contains a user account named User1. You need to ensure that User1 can assign a policy to the tenant root management group.

  What should you do?

  A. Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources.
  B. Assign the Global administrator role to User1, and then modify the default conditional access policies.
  C. Assign the Owner role to User1. and then modify the default conditional access policies.
  D. Assign the Owner role to User1. and then instruct User1 to configure access management for Azure resources.
  D. Assign the Owner role to User1. and then instruct User1 to configure access management for Azure resources.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Assign the Owner role to User1, and then instruct User1 to configure access management for Azure resources.

  --------------------------------------------------------------------------------

  - Assigning policy at the tenant root management group requires appropriate permissions at that scope (commonly Owner/Policy-related roles at the management group scope).

  - "Configure access management for Azure resources" aligns with the tenant-level elevation path used by a Global Administrator to gain Azure RBAC visibility/control at the tenant root, enabling assignments at the top scope. (1)

  - Once User1 has the required RBAC at the tenant root management group, they can assign policy there.

  Why the other selections are incorrect:

  - Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources.

  - Global Administrator alone does not inherently grant Azure RBAC to assign policy unless access is elevated; also the option omits ensuring User1 has the correct RBAC role needed to perform the assignment operation at the root MG.

  - Assign the Global administrator role to User1, and then modify the default conditional access policies.

  - Conditional Access is unrelated to assigning Azure Policy at management group scope.

  - Assign the Owner role to User1, and then modify the default conditional access policies.

  - Conditional Access is unrelated; the key is root-scope access, not CA policy changes.

  -------------------------------------------------------------------------------- References:

  1. Elevate access for a Global Administrator in Azure https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin Date Modified: Unable to locate date modified on page Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104 often tests the difference between **Entra roles** (Global Admin) and **Azure RBAC roles** (Owner).

  - Tenant-root operations typically require **elevation** + correct **scope** (management group vs subscription vs resource group).

  Summary:

  Permissions and elevation path needed to assign Azure Policy at the tenant root management group.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.3 Manage Azure subscriptions and governance |__ 1.3.1 Implement and manage Azure Policy |__ 1.3.7 Configure management groups |__ 1.2 Manage access to Azure resources |__ 1.2.2 Assign roles at different scopes

• Question 148:

  HOTSPOT

  You create an Azure web app named WebApp1. WebApp1 has the autoscale settings shown in the following exhibit.

  

  

  The scale out and scale in rules are configured to have a duration of 10 minutes and a cool down time of five minutes.

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  On August 8, 2018, if CPU is above the threshold for 5 minutes: 1 On July 8, 2018, if CPU is below the threshold for 60 minutes: 2

  Explanation (Why this is correct)

  - The autoscale configuration has a scheduled condition for July and a different/default behavior outside that schedule.

  - On August 8, the July schedule is not in effect, and the “5 minutes” condition is not enough to trigger a rule that requires a longer evaluation window, so the instance count stays at the default (1).

  - On July 8, the scheduled July condition applies. Sustained low CPU over an hour allows repeated scale-in (respecting cooldown) until the minimum for that condition is reached (2).

  Explanation (Why the other options are not correct)

  - Values above the defined minimum/maximum or that ignore the schedule window/evaluation duration are not valid.

  Exam Tip

  - Autoscale questions often hinge on **(1) schedule window**, **(2) evaluation duration**, and **(3) cooldown**.

  References (APA)

  - Microsoft. (n.d.). Autoscale in Azure. https://learn.microsoft.com/en-us/azure/azure-monitor/autoscale/autoscale-overview

  AZ-104 Exam Objective Hierarchy 3.0 Deploy and manage Azure compute resources (20–25%) |__3.1 Configure and manage virtual machines |__|__3.1.4 Configure and troubleshoot Web Apps

• Question 149:

  You have an Azure virtual machine named VM1 that runs Windows Server.

  You sign in to VM1 as a user named User1 and perform the following actions:

  1. Create files on drive C.

  2. Create files on drive D.

  3. Modify the screen saver timeout.

  4. Change the desktop background.

  You plan to redeploy VM1.

  Which changes will be lost after you redeploy VM1?

  A. the modified screen saver timeout
  B. the new desktop background
  C. the new files on drive D
  D. The new files on drive C
  C. the new files on drive D

  ---

  the new files on drive D

  On Azure Windows VMs, drive D is commonly the temporary disk (local ephemeral storage). When you redeploy a VM (host move), the temporary disk can be reinitialized and data on it can be lost. Therefore, files created on drive D are the changes most likely to be lost after redeploy.

  Why the other selections are not correct:

  - the modified screen saver timeout:

  This is a Windows/user configuration setting stored on the OS disk (C:) and typically persists through redeploy.

  - the new desktop background:

  This is a user profile setting stored on the OS disk (C:) and typically persists through redeploy.

  - the new files on drive C:

  Drive C is the OS disk (managed disk) and persists through redeploy.

  Microsoft Exam Tips:

  - AZ-104 often checks whether you know "temporary disk" behavior. Treat D:\ on many Windows Azure VMs as non-durable storage.

  - Put anything you must keep on managed disks (OS disk/data disks), not the temporary disk.

  Summary:

  Azure VM redeploy impacts temporary (ephemeral) disk data; drive D is typically temporary.

  AZ-104 Exam Objective Hierarchy:

  (Note: Only a partial hierarchy is available in this chat. Mapping below is best-fit.) 3.0 Deploy and manage Azure compute resources |__ 3.2 Create and configure virtual machines |__ 3.2.x Manage virtual machine disks (temporary vs managed disks)

• Question 150:

  You discover that VM3 does NOT meet the technical requirements. You need to verify whether the issue relates to the NSGs. What should you use?

  A. Diagram in VNet1
  B. the security recommendations in Azure Advisor
  C. Diagnostic settings in Azure Monitor
  D. Diagnose and solve problems in Traffic Manager Profiles
  E. IP flow verify in Azure Network Watcher
  E. IP flow verify in Azure Network Watcher

  ---

  Explanation

  Scenario: Litware must meet technical requirements including:

  Ensure that VM3 can establish outbound connections over TCP port 8080 to the applications servers in the Montreal office.

  IP flow verify checks if a packet is allowed or denied to or from a virtual machine. The information consists of direction, protocol, local IP, remote IP, local port, and remote port. If the packet is denied by a security group, the name of the rule that denied the packet is returned. While any source or destination IP can be chosen, IP flow verify helps administrators quickly diagnose connectivity issues from or to the internet and from or to the on-premises environment.

  References:

  https://docs.microsoft.com/en-us/azure/network-watcher/network-watcher-ip-flow-verify-overview