Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 151:

  HOTSPOT

  You have an Azure subscription that is linked to an Azure AD tenant. The tenant contains the custom role-based access control (RBAC) roles shown in the following table.

  

  From the Azure portal, you need to create two custom roles named Role3 and Role4. Role3 will be an Azure subscription role. Role4 will be an Azure AD role. Which roles can you clone to create the new roles? To answer, select the appropriate options in the answer area.

  

  

  ---

  Role3: Role1 and built-in Azure subscription roles only Role4: Role2 only

  Explanation (Why this is correct):

  - Role3 must be an Azure subscription (Azure RBAC) custom role, so cloning sources must come from Azure RBAC role definitions (existing custom role(s) like Role1 and built-in Azure RBAC roles).

  - Role4 must be an Azure AD (Microsoft Entra) custom role, so the clone source must be an Azure AD role definition. Given the exhibit’s constraints, Role2 is the clone source for the Azure AD custom role.

  Explanation (Why the other options are incorrect):

  - Options that include Azure AD roles as clone sources for an Azure subscription (RBAC) role (or vice-versa) mix two different role systems and won’t meet the “Role3 is subscription role / Role4 is Azure AD role” requirement.

  Exam Tips:

  - Azure RBAC roles = resource-plane authorization (subscriptions/resource groups/resources).

  - Microsoft Entra roles = directory-plane authorization (tenant-level directory tasks).

  References (APA):

  - Microsoft. (n.d.). Azure custom roles. https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20–25%) |__1.2 Manage access to Azure resources |__|__1.2.1 Manage built-in Azure roles |__|__1.2.2 Assign roles at different scopes

• Question 152:

  You have an Azure subscription that contains three virtual machines named VM1, VM2, and VM3. All the virtual machines are in an availability set named AVSet1.

  You need to scale up VM1 to a new virtual machine size, but the intended size is unavailable.

  What should you do first?

  A. Create a proximity placement group.
  B. Deallocate VM1.
  C. Convert AvSet1 into a managed availability set.
  D. Shut down VM3 and VM3.
  B. Deallocate VM1.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Deallocate VM1.

  --------------------------------------------------------------------------------

  - Resizing a VM can require the VM to be stopped/deallocated (especially when moving to a different hardware cluster or when capacity constraints exist).

  - Deallocating releases compute resources and is the correct "first step" before retrying an unavailable size.

  Why the other options are incorrect:

  - Create a proximity placement group: This optimizes latency; it does not solve immediate SKU capacity for a resize.

  - Convert AVSet1 into a managed availability set: Not applicable; availability sets are already "managed" constructs in ARM.

  - Shut down VM3 and VM3: Not a valid choice and not the standard first step for resizing VM1.

  References:

  1. Microsoft. (n.d.). Azure subscription and service limits, quotas, and constraints. Microsoft Learn.

  https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits Date Updated: Unable to locate in this capture (see page footer) Date Accessed: 01/26/2026

  Microsoft Exam Tips:

  - "Resize VM to a different size" frequently implies "Stop (deallocate) first."

  Summary:

  VM resize workflow and capacity constraints.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.2 Create and configure virtual machines |__ 3.2.4 Manage virtual machine sizes

• Question 153:

  You have an Azure subscription.

  You create a routing table named RT1.

  You need to add a route to RT1 that specifies the next hop IP address.

  Which next hop type should you select?

  A. Internet
  B. Virtual network gateway
  C. Virtual network
  D. Virtual appliance
  D. Virtual appliance

  ---

  Explanation

  {------------------------------------------------------------------------------------}

  Virtual appliance

  {------------------------------------------------------------------------------------}

  In an Azure route table (UDR), the Virtual appliance next hop type is the one where you specify an explicit next-hop IP address (for example, the private IP of a firewall/NVA).

  Not selected:

  - Internet: no next-hop IP is entered (system-defined).

  - Virtual network gateway: next hop is the gateway, not an arbitrary IP.

  - Virtual network: represents local VNet routing, not a specific next hop IP.

  References:

  1. Virtual network traffic routing (Virtual appliance requires specifying next hop IP) https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview Date Modified: 05/21/2025 Date Accessed: 01/24/2026

  2. Manage route tables (Virtual appliance requires next hop address) https://learn.microsoft.com/en-us/azure/virtual-network/manage-route-table Date Modified: 10/08/2025 Date Accessed: 01/24/2026

  Microsoft Exam Tips:

  - "Specify next hop IP address" is the giveaway for Virtual appliance.

  Summary:

  Choosing the route next hop type that requires a next hop IP.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) | |__ 4.1 Configure and manage virtual networks in Azure | |__ 4.1.4 Configure user-defined network routes

• Question 154:

  HOTSPOT

  You are creating an Azure Kubernetes Services (AKS) cluster as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  To ensure that you can create Windows containers in AKS1, you must: modify the Network configuration setting

  To ensure that you can integrate AKS1 with an Azure container registry, you must modify the: AKS-managed Azure Active Directory setting

  Validated answer (based on Microsoft Learn):

  To ensure that you can create Windows containers in AKS1: modify the Network configuration setting (to use an Azure CNI option).

  To integrate AKS1 with an Azure container registry: do **not** change AKS-managed Azure Active Directory; instead, grant the AKS identity access to ACR (e.g., `az aks update --attach-acr <acrName>` / assign `AcrPull`).

  Explanation Windows containers on AKS require Windows Server node pools. Microsoft Learn documentation states that Windows Server node pools are not supported with kubenet; you must use Azure CNI. In the portal, that requirement maps to changing the **Network configuration** from kubenet to an Azure CNI option.

  For Azure Container Registry (ACR) integration, Microsoft Learn describes integration as **granting the AKS identity permissions on the ACR** (for example using `az aks create/update --attach-acr` which assigns the `AcrPull` role). This is

  **not** achieved by enabling AKS-managed Microsoft Entra ID. Therefore, the second expected choice appears incorrect.

  Evidence (short excerpts) Excerpt: “Windows Server node pools are not supported with kubenet… To use Windows Server node pools, you must use Azure CNI.” Source: Microsoft Learn - Configure kubenet networking in Azure Kubernetes Service (AKS) Last updated on 2024-08-01 (as shown on Microsoft Learn page).

  URL: https://learn.microsoft.com/en-us/azure/aks/configure-kubenet Accessed: 2026-01-29

  Excerpt: “You can integrate ACR with an existing AKS cluster by using `az aks update --attach-acr`… (assigns AcrPull).” Source: Microsoft Learn - Authenticate with Azure Container Registry from Azure Kubernetes Service Last updated on 2025-11-06 (as shown on Microsoft Learn page).

  URL: https://learn.microsoft.com/en-us/azure/aks/cluster-container-registry-integration Accessed: 2026-01-29

  AZ-104 Exam Objective Hierarchy 3.0 Implement and manage compute resources |__3.3 Provision and manage containers in the Azure portal |__|__3.3.1 Create and manage Azure Container Registry |__|__3.3.4 Manage sizing and scaling for containers, including Azure Kubernetes Service (AKS)

• Question 155:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the resources shown in the following table.

  

  VM1 connects to VNET1.

  You need to connect VM1 to VNET2.

  Solution: You create a new network interface, and then you add the network interface to VM1.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  - Creating a new NIC and adding it to VM1 does not satisfy the requirement to connect VM1 to VNET2, because VM1 remains in West US while VNET2 is in East Asia.

  - Additional NICs must be created in the same region as the VM and connected to VNets in that region; you cannot attach a West US VM to an East Asia VNet using a new NIC alone.

  Why the other selection is incorrect:

  - Yes

  - This does not resolve the cross-region VNet constraint.

  -------------------------------------------------------------------------------- References:

  1. General Azure VM networking and regional alignment considerations (see Azure Virtual Network/VM networking docs) https://learn.microsoft.com/en-us/azure/virtual-network/ Date Modified: Unable to locate date modified on page Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: "Add a NIC" is a common distractor-always verify **region + VNet compatibility**.

  - To reach resources in another region, expect **peering**, **VPN Gateway**, or **ExpressRoute**, not cross-region NIC attachment.

  Summary:

  Why adding a NIC does not enable attaching a VM to a VNet in another region.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.1 Configure and manage virtual networks in Azure |__ 4.1.1 Create and configure virtual networks and subnets |__ 4.1.5 Troubleshoot network connectivity

• Question 156:

  DRAG DROP

  You have an Azure subscription that contains virtual machine named VM1.

  You need to back up VM. The solution must ensure that backups are stored across three availability zones in the primary region.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: Create a Recovery Services vault.
  
  Step 2: Set replication to zone-redundant storage (ZRS).
  
  Step 3: For VM1, create a backup policy and configure the backup.

  Explanation:

  Goal: Back up VM1 and ensure the backup data is stored across availability zones in the primary region.

  Step 1: Create a Recovery Services vault.
  
  Azure Backup for virtual machines is managed through a Recovery Services vault.

  Step 2: Set replication to zone-redundant storage (ZRS).
  
  ZRS stores backup data synchronously across multiple availability zones in the region, aligning with the “stored across availability zones” requirement.

  Step 3: Create a backup policy and configure backup for VM1.
  
  The policy defines the schedule and retention, and enabling backup protects the virtual machine.

  Why the other actions are not selected:

  Configure a replication policy: This typically refers to Azure Site Recovery, not Azure Backup.

  Set replication to LRS: Does not meet the “across availability zones” requirement.

  Exam Tips:

  If the requirement says “across availability zones,” look for ZRS.

  Azure Backup for virtual machines follows this flow: Vault → Vault redundancy → Policy → Enable backup.

  Summary:

  Configured Azure virtual machine backups with zone-resilient storage by using a Recovery Services vault set to ZRS and applying a VM backup policy.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10–15%)
  |__ 5.2 Implement backup and recovery
  |__ 5.2.1 Create a Recovery Services vault
  |__ 5.2.3 Create and configure a backup policy
  |__ 5.2.4 Perform backup and restore operations by using Azure Backup

• Question 157:

  You have an Azure Storage account named storage1 that contains a container named container1.

  You must provide a vendor read-only access to all blobs in container1 for 30 days. The vendor requires that access works over both HTTP and HTTPS. The vendor cannot authenticate with Microsoft Entra ID. You must be able to revoke the vendor's access immediately without regenerating the storage account keys.

  Which two actions should you perform on storage1? Each correct answer presents part of the solution.

  A. Create an account shared access signature (SAS) for storage1 with read permissions.
  B. Create a stored access policy (signed identifier) on container1.
  C. Generate a service shared access signature (SAS) for container1 that references the stored access policy (signed identifier) and grants read permissions.
  D. Rotate the storage account access keys after 30 days.
  E. Create a user delegation shared access signature (SAS) for container1.
  B. Create a stored access policy (signed identifier) on container1.
  C. Generate a service shared access signature (SAS) for container1 that references the stored access policy (signed identifier) and grants read permissions.

  ---

  Explanation

  ---------------------------------------------------------------------------

  Create a stored access policy (signed identifier) on container1.

  Generate a service shared access signature (SAS) for container1 that references the stored access policy (signed identifier) and grants read permissions.

  ---------------------------------------------------------------------------

  You need read-only access to all blobs in a container, the vendor must be able to use the URL over both HTTP and HTTPS, and you must be able to revoke access immediately without regenerating storage account keys.

  Create a stored access policy (signed identifier) on container1 is correct because stored access policies let you centrally control (and revoke) one or more service SAS tokens by changing/deleting the policy or expiring it. This allows immediate revocation without rotating account keys. (2)

  Generate a service SAS for container1 that references the stored access policy and grants read permissions is correct because a service SAS can be bound to the stored access policy using the signed identifier (si). When bound, you can manage the effective permissions/expiry server-side via the policy. Also, a service SAS supports an allowed protocol setting (signedProtocol/spr) where https,http is permitted (and is the default), meeting the "HTTP and HTTPS" requirement.

  (1)

  Create an account SAS for storage1 with read permissions is not correct because stored access policies apply to service SAS, not account SAS; an account SAS is not the right mechanism when you specifically want stored-policy-based revocation at the container level. (2)

  Rotate the storage account access keys after 30 days is not correct because the requirement is immediate revocation without regenerating keys; key rotation is disruptive and not immediate control for a single vendor.

  Create a user delegation SAS for container1 is not correct in this scenario because the vendor cannot authenticate with Microsoft Entra ID; user delegation SAS requires Entra-based authorization to create, and stored access policies do not apply to user delegation SAS. (2)

  Short Azure lesson:

  For container-level sharing with revocation, prefer a service SAS bound to a stored access policy. If a SAS is compromised, you can revoke it by deleting/renaming the policy or setting the policy expiry to a time in the past-no key rotation required. (2)

  ---------------------------------------------------------------------------

  References:

  1. Create a service SAS - Azure Storage (REST) https://learn.microsoft.com/en-us/rest/api/storageservices/create-service-sas Date Modified: Unable to locate date modified Date Access: 01/24/2026

  2. Define a stored access policy - Azure Storage (REST) https://learn.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy Date Modified: 07/11/2023 Date Access: 01/24/2026

  ---------------------------------------------------------------------------

  Microsoft Exam Tips:

  - AZ-104 frequently tests when to use: service SAS vs account SAS vs user delegation SAS.

  - If the question emphasizes "revoke without rotating keys," look for "stored access policy" bound to a service SAS.

  - Remember the SAS protocol control: signedProtocol (spr) can be https or https,http; HTTP-only is not valid. (AZ-104)

  --------------------------------------------------------------------------- Summary:

  Container-level delegated access using service SAS, protocol restrictions (HTTP/HTTPS), and immediate revocation via stored access policies.

  ---------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15?0%) | |__ 2.1 Configure access to storage | |__ 2.1.2 Create and use shared access signature (SAS) tokens | |__ 2.1.3 Configure stored access policies

• Question 158:

  You need to resolve the licensing issue before you attempt to assign the license again.

  What should you do?

  A. From the Groups blade, invite the user accounts to a new group.
  B. From the Profile blade, modify the usage location.
  C. From the Directory role blade, modify the directory role.
  B. From the Profile blade, modify the usage location.

  ---

  Explanation

  Scenario: Licensing Issue 1. You attempt to assign a license in Azure to several users and receive the following error message:

  "Licenses not assigned. License agreement failed for one user." 2. You verify that the Azure subscription has the available licenses.

  Solution:

  License cannot be assigned to a user without a usage location specified.

  Some Microsoft services aren't available in all locations because of local laws and regulations. Before you can assign a license to a user, you must specify the Usage location property for the user. You can specify the location under the User > Profile > Settings section in the Azure portal.

  https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/licensing-groupsresolve-problems

• Question 159:

  HOTSPOT

  You need to configure Azure Backup to back up the file shares and virtual machines.

  What is the minimum number of Recovery Services vaults and backup policies you should create? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Correct answer

  - Recovery Services vaults: 3

  - Backup policies: 6

  Detailed explanation (what is backed up vs not backed up, and why)

  1) Identify what must be backed up (per the question)

  - The question explicitly says: back up **file shares** and **virtual machines**.

  - Therefore, only:

  - Azure VMs (VM1–VM5), and

  - Azure Files shares (the file shares listed under storage accounts) are in scope.

  2) Determine the regions that contain in-scope workloads (from the case study tables) Virtual machines (by region):

  - West US: VM1, VM2, VM4

  - Central US: VM3

  - East US: VM5

  Storage accounts / file shares (by region):

  - storage1 (West US): has Azure Files share “sharea” x (in scope)

  - storage2 (East US): has Azure Files shares “shareb” and “sharec” x (in scope)

  - storage4 (Central US): has Azure Files share “shared” x (in scope)

  - storage3 (East US 2): “File share: Not applicable” x (NOT in scope for “file shares” backup)

  So, the regions that contain workloads we must protect are:

  - West US (VMs + Azure Files)

  - Central US (VMs + Azure Files)

  - East US (VMs + Azure Files)

  East US 2 contains only storage3, which has **no Azure Files share**, and the VM list shows **no VM in East US 2**. So East US 2 adds **nothing** to the “file shares and virtual machines” backup requirement.

  3) Why the minimum number of Recovery Services vaults is 3 (not 4) Key rule: Recovery Services vaults are **regional**, and protected items must be backed up to a vault in the **same region**.

  - Because the in-scope workloads exist across exactly **three** regions (West US, Central US, East US), the minimum is **one vault per region** --> **3 vaults**.

  Which storage accounts are backed up (Azure Files) vs not Backed up (Azure Files shares exist):

  - storage1 (West US): sharea x

  - storage2 (East US): shareb, sharec x

  - storage4 (Central US): shared x

  Not backed up (no Azure Files share; “file share: Not applicable”):

  - storage3 (East US 2): x (no file share to protect with Azure Files backup)

  4) Why the minimum number of backup policies is 6 Key rule: Backup policies are created **within a vault**, and policy types are **workload-specific**.

  - Azure VMs use a VM backup policy type.

  - Azure Files shares use an Azure Files backup policy type.

  Minimum per vault (to cover both workloads in that region):

  - 1 VM policy + 1 Azure Files policy = 2 policies per vault

  Across 3 vaults (West US + Central US + East US):

  - 3 vaults × 2 policies per vault = **6 policies**

  Official sources (Microsoft Learn) References (APA; include retrieved + last updated)

  - Microsoft. (2025, November 10). Backup Azure Recovery Services vault overview. Retrieved January 31, 2026, from https://learn.microsoft.com/en-us/azure/backup/backup-azure-recovery-services-vault-overview

  - Microsoft. (2025, December 9). Back up Azure VMs in a Recovery Services vault (prepare/create policy). Retrieved January 31, 2026, from https://learn.microsoft.com/en-us/azure/backup/backup-azure-vms-first-look-arm

  Exam tips

  - Read “what is being backed up” literally: Azure Backup for Azure Files protects **file shares**, not blob containers. If the table says “File share: Not applicable,” that storage account isn’t part of “file shares” backup scope.

  - Vault locality is a repeat exam theme: treat Recovery Services vaults as **per-region** objects for Azure Backup.

  - Policy counting trick: policies are **per vault** and **per workload type** --> (#vaults) × (#workload types in scope).

  AZ-104 exam objective mapping (complete branch for this question) 5.0 Monitor and maintain Azure resources (10–15%) |__5.2 Implement backup and recovery |__|__5.2.1 Create a Recovery Services vault |__|__5.2.3 Create and configure a backup policy

• Question 160:

  You have an Azure subscription that contains a container group named Group1. Group1 contains two Azure container instances as shown in the following table.

  

  You need to ensure that container2 can use CPU resources without negatively affecting container1.

  What should you do?

  A. Increase the resource limit of container1 to three CPUs.
  B. Increase the resource limit of container2 to six CPUs.
  C. Remove the resource limit for both containers.
  D. Decrease the resource limit of container2 to two CPUs.
  C. Remove the resource limit for both containers.

  ---

  Remove the resource limit for both containers.

  • Resource limits cap the maximum CPU a container can consume. If container2 needs to burst beyond its configured maximum, limits can prevent it from using available CPU on the host.
  • Removing limits allows containers to burst above their requested CPU when capacity exists, enabling container2 to consume additional CPU while still honoring scheduling based on requests.

  Why the other options are incorrect:

  • Increase container1 limit to three CPUs: This does not address container2’s ability to burst; it changes container1 instead.
  • Increase container2 limit to six CPUs: This could work conceptually, but it is not aligned with the provided requests and limits tradeoff the item is targeting (and may be constrained by host capacity).
  • Decrease container2 limit to two CPUs: Directly conflicts with the requirement for container2 to use more CPU when needed.

  Exam Tips:

  • For ACI or container group style questions, read “requests vs. limits” carefully: requests influence scheduling and reservation; limits influence throttling and capping.

  Summary:
  Container CPU requests and limits behavior and burst capability.

  AZ-104 Exam Objective Hierarchy:
  
  3.0 Deploy and manage Azure compute resources (20–25%)
  └── 3.3 Provision and manage containers in the Azure portal
    └── 3.3.2 Provision a container by using Azure Container Instances
    └── 3.3.4 Manage sizing and scaling for containers, including Azure Container Instances and Azure Container Apps