Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 161:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You manage a virtual network named VNet1 that is hosted in the West US Azure region.

  VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.

  You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.

  Solution: From Performance Monitor, you create a Data Collector Set (DCS).

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  No

  The goal is to "inspect all the network traffic from VM1 to VM2 for a period of three hours," which implies capturing/inspecting packet-level traffic.

  A Performance Monitor Data Collector Set (DCS) collects performance counters, event traces, and system diagnostics data; it does not perform packet capture or provide packet-level inspection between two VMs. Therefore, this solution does not meet the goal.

  Why the other selection is incorrect:

  - Yes: Incorrect because Performance Monitor DCS is not a packet capture tool and cannot inspect all network packets from VM1 to VM2.

  Microsoft Exam Tips:

  - If the question uses verbs like "inspect traffic," "capture packets," or "packet-level," default to **Network Watcher packet capture** (or equivalent packet capture tooling), not metrics or PerfMon counters.

  Summary:

  Performance Monitor DCS does not capture packets; it cannot inspect all network traffic between two Azure VMs.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources  |__ 5.1 Monitor resources in Azure |__ 5.1.6 Use Azure Network Watcher and Connection Monitor

• Question 162:

  HOTSPOT

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  The subscription contains the virtual machines shown in the following table.

  

  Each virtual machine contains only a private IP address.

  You create an Azure bastion for VNet1 as shown in the following exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  1) The Remote Desktop Connection client (mstsc.exe) can be used to connect to VM1 through Bastion1. -> No

  2) The Azure portal can use SSH to connect to VM2 through Bastion1. -> Yes

  3) The Azure portal can be used to connect to VM3 through Bastion1. -> No

  Why:

  - Bastion can be centralized in one VNet and used to reach VMs in a ”peered” VNet (so VM2 can be reached from Bastion1 via the portal).

  - ”VNet peering is not transitive”; since VM3 is in VNet3 and the peering path is VNet1 x VNet2 x VNet3, Bastion1 can’t reach VM3 through “two-hop” peering.

  - Using a ”native RDP client (mstsc.exe)” requires Bastion connection types/features that are not available for all SKUs; the screenshot shows Bastion Tier = ”Basic”, and Microsoft Learn notes some connection types require ”Standard SKU”.

  AZ-104 Exam Objective Hierarchy

  4.0 Implement and manage virtual networking (15–20%) |__4.1 Configure and manage virtual networks in Azure |__|__4.1.2 Create and configure virtual network peering |__4.2 Configure secure access to virtual networks |__|__4.2.3 Implement Azure Bastion

• Question 163:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You manage a virtual network named VNet1 that is hosted in the West US Azure region.

  VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.

  You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.

  Solution: From Azure Monitor, you create a metric on Network In and Network Out.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  -----------------------------------------------------------------------

  No

  -----------------------------------------------------------------------

  Azure Monitor metrics such as **Network In** and **Network Out** provide aggregate traffic volume for a resource (e.g., a VM NIC), but they do not provide packet contents or allow inspection of "all network traffic" between two specific VMs (VM1 --> VM2) at the packet level. Because the requirement is packet/traffic inspection over a three-hour window, metrics alone do not meet the goal.

  Why the other selection is incorrect:

  - Yes: Incorrect because metrics summarize throughput; they are not packet captures and do not reveal per-flow packet inspection details.

  -----------------------------------------------------------------------

  References:

  1. Packet capture in Azure Network Watcher (packet-level inspection capability) https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-packet-capture-overview Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -----------------------------------------------------------------------

  Microsoft Exam Tips:

  - Metrics are best for "how much" (volume/throughput) and trend analysis.

  - Packet capture is best for "what exactly is happening on the wire" (packets/headers/payload visibility depending on capture).

  Summary:

  Network In/Out metrics cannot inspect packet-level traffic from VM1 to VM2.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10?5%) |__ 5.1 Monitor resources in Azure |__ 5.1.6 Use Azure Network Watcher and Connection Monitor

• Question 164:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups.

  Another administrator plans to create several network security groups (NSGs) in the subscription.

  You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks.

  Solution: You assign a built-in policy definition to the subscription.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  No

  The proposed solution is too vague to guarantee the outcome. Simply "assign a built-in policy definition" does not inherently ensure that all new NSGs will include a deny rule for TCP/8080 between VNets-unless a specific built-in policy exists that enforces exactly that rule. In practice, implementing a very specific security rule requirement often requires a custom policy definition (or verifying that a suitable built-in definition exists and matches the intended rule logic). Without that specificity, the goal is not assured.

  Exam Tips:

  - "Built-in policy" only works if you can name/identify the exact built-in definition that enforces the stated requirement.

  - Otherwise, expect "custom policy definition" as the realistic approach (AZ-104).

  Summary:

  Azure Policy must be specific enough to enforce the required NSG rule behavior.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20–25%)
  └── 1.3 Manage Azure subscriptions and governance
    └── 1.3.1 Implement and manage Azure Policy

• Question 165:

  HOTSPOT

  You have Azure subscriptions named Subscription1 and Subscription2.

  Subscription1 has following resource groups:

  

  RG1 includes a web app named App1 in the West Europe location. Subscription2 contains the following resource groups:

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  App1 can be moved to RG2: No
  App1 can be moved to RG3: Yes
  App1 can be moved to RG4: Yes

  Why:
  You are moving an Azure resource (App1) between resource groups or subscriptions. The key constraint here is the resource lock applied to the destination resource group.

  Why "App1 can be moved to RG2" = No

  • RG2 has a ReadOnly lock.
  • A ReadOnly lock blocks write operations and, importantly, prevents moving resources into or out of a locked scope.
  • Therefore, App1 cannot be moved into RG2 while that ReadOnly lock is in place.

  Why "App1 can be moved to RG3" = Yes

  • RG3 has a Delete (CanNotDelete) lock.
  • A CanNotDelete lock prevents deletions but still allows changes (write operations) that do not delete the resource.
  • Since a move is not a delete operation, the lock type itself does not block the move (assuming the resource type supports being moved).

  Why "App1 can be moved to RG4" = Yes

  • RG4 has no lock.
  • With no lock-based restriction, the move is allowed (again assuming the resource type supports being moved).

  Exam Tips:

  • A ReadOnly lock is the most restrictive: it blocks updates and move operations.
  • A CanNotDelete lock blocks deletion only; it usually does not block configuration changes.
  • In exam questions, when you see “move” and “lock,” immediately check whether the lock scope includes the source or destination.

  Summary:
  This question tests how resource locks affect the ability to move resources across resource groups or subscriptions.

  AZ-104 Exam Objective Hierarchy:
  1.0 - Manage Azure identities and governance (20–25%)
  1.3 - Manage Azure subscriptions and governance
  1.3.2 - Configure resource locks

• Question 166:

  You have an Azure subscription that contains 100 virtual machines.

  You regularly create and delete virtual machines.

  You need to identify unattached disks that can be deleted.

  What should you do?

  A. From Azure Cost Management, view Cost Analysis
  B. From Azure Advisor, modify the Advisor configuration
  C. From Microsoft Azure Storage Explorer, view the Account Management properties
  D. From Azure Cost Management, view Advisor Recommendations
  D. From Azure Cost Management, view Advisor Recommendations

  ---

  Explanation

  -----------------------------------------------------------------------

  From Azure Cost Management, view Advisor Recommendations

  -----------------------------------------------------------------------

  Unattached managed disks are a common cost optimization opportunity. Azure Advisor produces cost recommendations (including idle/unattached resources), and Cost Management surfaces Advisor recommendations so you can quickly identify and act on them.

  Why the other selections are incorrect:

  - View Cost Analysis: Cost analysis shows spend trends; it does not directly enumerate unattached disks as actionable items.

  - From Azure Advisor, modify the Advisor configuration: Configuration is not the same as finding the specific unattached disks list.

  - From Storage Explorer, view account management properties: Storage Explorer is not used to identify unattached managed disks across subscriptions.

  ----------------------------------------------------------------------- References:

  1. Azure Advisor - Cost recommendations (Microsoft Learn) https://learn.microsoft.com/en-us/azure/advisor/advisor-cost-recommendations Date Modified: 07/07/2025 Date Accessed: 01/25/2026 2. Azure Cost Management + Billing - Advisor recommendations (Microsoft Learn) https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/advisor-recommendations Date Modified: Unable to locate in snippet Date Accessed: 01/25/2026

  ----------------------------------------------------------------------- Microsoft Exam Tips:

  - "Find idle/unattached resources to delete" --> Advisor (Cost) or Cost Management --> Advisor recommendations.

  - Cost Analysis is reporting; Advisor is prescriptive.

  ----------------------------------------------------------------------- Summary:

  This tests how to quickly find unattached disks using cost optimization recommendations.

  ----------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) 1.3 Manage Azure subscriptions and governance 1.3.6 Manage costs by using alerts, budgets, and Azure Advisor recommendations

• Question 167:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:

  

  User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.

  You need to create new user accounts in external.contoso.onmicrosoft.com.

  Solution: You instruct User2 to create the user accounts.

  Does that meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  ============================== Item 52 of 253 ============================== Answer

  -------------------------------------------------------------------------------- No

  -------------------------------------------------------------------------------- User1 created a NEW Azure Active Directory (Microsoft Entra ID) tenant: external.contoso.onmicrosoft.com.

  Admin roles shown in the scenario (for User2: Global administrator in "Azure Active Directory") apply to the ORIGINAL tenant (contoso.onmicrosoft.com), not automatically to the newly created tenant.

  Therefore, instructing User2 to create user accounts in the NEW tenant does not meet the goal unless User2 is first added to the new tenant and granted the necessary permissions there.

  What would be required to make it work

  --------------------------------------------------------------------------------

  - Add/invite User2 into external.contoso.onmicrosoft.com, then

  - Assign an appropriate admin role in THAT tenant (for example, User Administrator or Global Administrator), then

  - User2 can create the new user accounts.

  References (Microsoft Learn)

  --------------------------------------------------------------------------------

  - Add users to Microsoft Entra ID (create users):

  https://learn.microsoft.com/entra/identity/users/users-create-users

  - Microsoft Entra built-in roles (User Administrator / Global Administrator):

  https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference

  Exam Tips

  --------------------------------------------------------------------------------

  - Treat each tenant as a separate security boundary: roles/permissions do not "carry over" to a different tenant.

  - For creating users, look for "User Administrator" (least privilege) rather than "Global Administrator," when possible.

  Summary

  -------------------------------------------------------------------------------- Because external.contoso.onmicrosoft.com is a different tenant, User2's admin role in the original tenant does not grant rights in the new tenant; so the proposed solution does not meet the goal.

  EXAM OBJECTIVE ALIGNMENT (Hierarchy)

  -------------------------------------------------------------------------------- 1.0 Manage Azure identities and governance (20?5%) | |-1.1 Manage Microsoft Entra users and groups | | | |-1.1.1 Create users and groups

• Question 168:

  HOTSPOT

  You have an Azure subscription that contains the public load balancers shown in the following table.

  

  You plan to create six virtual machines and to load balance requests to the virtual machines. Each load balancer will load balance three virtual machines.

  You need to create the virtual machines for the planned solution.

  

  

  ---

  The virtual machines that will be load balanced by using LB1 must: be created in the same availability set or virtual machine scale set The virtual machines that will be load balanced by using LB2 must: be connected to the same virtual network

  Explanation (Why this is correct)

  - Basic Load Balancer (LB1) backend pools are limited: the backend endpoints must be VMs that are part of the same availability set or a virtual machine scale set. Therefore, the three VMs behind LB1 must be created in the same availability set (or VMSS).

  - Standard Load Balancer (LB2) backend pools support “any VMs or VMSS,” but they must be in a single virtual network. Therefore, the three VMs behind LB2 must be connected to the same VNet (they do NOT have to be in the same availability set).

  Explanation (Why the other options are not correct)

  - “be created in the same resource group” is not a Load Balancer backend-pool requirement for either SKU.

  - “run the same operating system” is not a Load Balancer requirement.

  - For LB2 (Standard), “be created in the same availability set or virtual machine scale set” is not required (it’s allowed, but not mandatory).

  Exam Tip

  - Basic LB --> backend VMs must be in ONE availability set (or ONE VMSS).

  - Standard LB --> backend VMs just need to be in ONE virtual network.

  References (APA)

  - Microsoft. (n.d.). Azure Load Balancer SKUs. Microsoft Learn. https://learn.microsoft.com/en-us/azure/load-balancer/skus

  AZ-104 Exam Objective Hierarchy 4.0 Implement and manage virtual networking (15–20%) |__4.3 Configure name resolution and load balancing |__|__4.3.2 Configure an internal or public load balancer

• Question 169:

  You have an Azure web app named webapp1.

  Users report that they often experience HTTP 500 errors when they connect to webapp1.

  You need to provide the developers of webapp1 with real-time access to the connection errors. The solution must provide all the connection error details.

  What should you do first?

  A. From webapp1, enable Web server logging
  B. From Azure Monitor, create a workbook
  C. From Azure Monitor, create a Service Health alert
  D. From webapp1, turn on Application Logging
  A. From webapp1, enable Web server logging

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  From webapp1, enable Web server logging

  ----------------------------------------------------------------------------------------------------

  Web server logging (HTTP logs) is a primary first step to capture request/response details (including 500s) for a Windows-based App Service and can be combined with Log Stream for near real-time visibility.

  Also, for "all connection error details," App Service supports enabling Detailed error messages and Failed request tracing (FREB) alongside logging-these provide deeper diagnostic artifacts for 500-class failures. Enabling web server logging first establishes the baseline HTTP telemetry path and supports real-time streaming scenarios via Log Stream.

  References:

  1. Enable Diagnostic Logging - Azure App Service (web server logging, detailed errors, failed request tracing, log streaming) https://learn.microsoft.com/en-us/azure/app-service/troubleshoot-diagnostic-logs Date Modified: 06/03/2025 Date Access: 01/24/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - For App Service HTTP 500 troubleshooting: enable App Service logs (web server + detailed errors + failed request tracing), then use Log Stream / Log Analytics as needed.

  - Watch for "first" in the question; it often points to turning on the right logging knobs before dashboards/workbooks (AZ-104).

  Summary:

  App Service diagnostics: enabling web server logging as the first step for investigating HTTP 500 errors.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10?5%) | |__ 5.1 Monitor resources in Azure | |__ 5.1.2 Configure log settings in Azure Monitor

• Question 170:

  You have an Azure subscription that contains the resources in the following table.

  

  Subnet1 is associated to VNet1. NIC1 attaches VM1 to Subnet1.

  You need to apply ASG1 to VM1.

  What should you do?

  A. Modify the properties of NSG1.
  B. Modify the properties of ASG1.
  C. Associate NIC1 to ASG1.
  C. Associate NIC1 to ASG1.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Associate NIC1 to ASG1.

  --------------------------------------------------------------------------------

  Application Security Groups (ASGs) are applied to **network interfaces** (NICs), not directly to the VM object. Since NIC1 attaches VM1 to Subnet1, associating **NIC1** to **ASG1** applies the ASG to VM1's traffic classification and allows NSG rules to reference that ASG.

  Why the other selections are incorrect:

  Modify the properties of NSG1: NSG rules can reference ASGs, but the ASG must first be associated to the NIC(s) of the VM(s).

  Modify the properties of ASG1: The ASG itself doesn't "attach" to a VM; the association is done via NIC membership.

  -------------------------------------------------------------------------------- References:

  1. Application security groups https://learn.microsoft.com/en-us/azure/virtual-network/application-security-groups Date Modified: Unable to locate exact date in this session Date Access: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - Remember: **ASG membership is on the NIC**.

  - Then NSG rules reference ASGs as source/destination application groups.

  Summary:

  Applying ASGs to VMs by associating the VM's NIC with the ASG.

  AZ-104 Exam Objective Hierarchy:

  4.0 Configure and manage virtual networking |__ 4.2 Configure secure access to virtual networks |__ 4.2.1 Create and configure network security groups (NSGs) and application security groups