Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 181:

  You have an Azure subscription.

  You plan to migrate 50 virtual machines from VMware vSphere to the subscription.

  You create a Recovery Services vault.

  What should you do next?

  A. Configure an extended network.
  B. Create a recovery plan.
  C. Deploy an Open Virtualization Application (OVA) template to vSphere.
  D. Configure a virtual network.
  D. Configure a virtual network.

  ---

  Configure a virtual network.

  For migrating VMware vSphere VMs to Azure using Azure Site Recovery (ASR), you must prepare the target Azure environment so recovered VMs can connect after failover/migration. A "virtual network" in Azure is required to map and place the replicated VMs into the correct network at recovery time. With the Recovery Services vault already created, configuring the target VNet is an appropriate next step.

  Why other selections are not correct (as the "next" action in this sequence):

  - Configure an extended network: This is an optional design choice and not the baseline prerequisite step for ASR replication setup.

  - Create a recovery plan: Typically done after replication is configured and you have protected items.

  - Deploy an OVA template to vSphere: Required for the on-premises components, but this question set's expected sequencing after vault creation is to ensure Azure-side prerequisites (including VNet) exist.

  Microsoft Exam Tips:

  - ASR scenarios often test "Azure prerequisites": vault, permissions, and "target network" planning.

  - Recovery plans generally come after items are protected.

  Summary:

  Preparing Azure networking prerequisites for VMware-to-Azure migration using Site Recovery.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources |__ 5.2 Implement backup and recovery |__ 5.2.5 Configure Azure Site Recovery for Azure resources

• Question 182:

  HOTSPOT

  You have an Azure subscription named Subscription1. Subscription1 contains the virtual networks in the following table.

  

  Subscription1 contains the virtual machines in the following table:

  

  The firewalls on all the virtual machines are configured to allow all ICMP traffic.

  You add the peerings in the following table.

  

  For each of the following statements, select Yest if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  VM1 can ping VM3: Yes VM2 can ping VM3: No VM2 can ping VM1: No

  Explanation (Why this is correct)

  - VNet peering enables private IP connectivity between peered VNets (assuming NSGs/routes allow).

  - VM1 is in the peered VNet path to VM3, so VM1↔VM3 can communicate.

  - VM2 is in a VNet that is NOT peered (per the exhibit), so it has no private route to VM1 or VM3.

  Explanation (Why the other options are not correct)

  - Without peering (or VPN/ER), private IP traffic between VNets won’t route.

  Exam Tip

  - “Peering exists” is per-VNet-pair. One peering does NOT automatically connect every VNet in the subscription.

  References (APA)

  - Microsoft. (n.d.). Virtual network peering. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

  AZ-104 Exam Objective Hierarchy 4.0 Implement and manage virtual networking (15–20%) |__4.1 Configure and manage virtual networks |__|__4.1.2 Configure virtual network peering

• Question 183:

  You have an Azure subscription named Subscription1 that contains the resources shown in the following table.

  

  You create virtual machines in Subscription1 as shown in the following table.

  

  You plan to use Vault1 for the backup of as many virtual machines as possible.

  Which virtual machines can be backed up to Vault1?

  A. VM1 only
  B. VM3 and VMC only
  C. VM1, VM2, VM3, VMA, VMB, and VMC
  D. VM1, VM3, VMA, and VMC only
  E. VM1 and VM3 only
  D. VM1, VM3, VMA, and VMC only

  ---

  Explanation

  ----------------------------------------------------------------------

  VM1, VM3, VMA, and VMC only

  ----------------------------------------------------------------------

  A Recovery Services vault is **region-scoped** for VM backups. Vault1 is in **West Europe**, so you can back up only the VMs that are also in **West Europe**:

  - West Europe: VM1 (RG1), VM3 (RG2), VMA (RG1), VMC (RG2) --> eligible

  - North Europe: VM2, VMB --> not eligible for a West Europe vault

  Why the other options are not correct:

  - VM1 only: unnecessarily excludes other West Europe VMs.

  - VM3 and VMC only: excludes VM1 and VMA which are in the same region as the vault.

  - VM1, VM2, VM3, VMA, VMB, and VMC: incorrectly includes North Europe VMs (VM2, VMB).

  - VM1 and VM3 only: excludes VMA and VMC which are also West Europe.

  ---------------------------------------------------------------------- References:

  1. Azure Backup / Recovery Services vaults (concept: vault and protected items are region-aligned). https://learn.microsoft.com/en-us/azure/backup/ Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  ----------------------------------------------------------------------

  Microsoft Exam Tips:

  - AZ-104: Always match **vault region** to **workload region** for Recovery Services vault VM backup questions.

  - Don't confuse "resource group" location with vault region requirements-vault region is the key factor.

  Summary:

  VM backup eligibility based on Recovery Services vault region.

  ---------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10?5%) |__ 5.2 Implement backup and recovery |__ 5.2.1 Create a Recovery Services vault |__ 5.2.4 Perform backup and restore operations by using Azure Backup

• Question 184:

  You have an Azure subscription that contains a user named User1.

  You need to ensure that User1 can deploy virtual machines and manage virtual networks. The solution must use the principle of least privilege.

  Which role-based access control (RBAC) role should you assign to User1?

  A. Owner
  B. Virtual Machine Contributor
  C. Contributor
  D. Virtual Machine Administrator Login
  C. Contributor

  ---

  Contributor

  User1 must be able to deploy virtual machines and manage virtual networks, and the solution must follow least privilege using the provided options. Virtual Machine Contributor is scoped to VM management but does not provide full permissions to manage virtual networks. Virtual Machine Administrator Login is for signing in to VMs, not for managing Azure resources. Owner is overly privileged because it includes role assignment permissions.

  Among the listed choices, Contributor is the smallest built-in role that can manage both compute and networking resources at the required scope, while not granting role assignment capabilities.

  Why the other options are incorrect:

  Owner: Too much privilege (includes the ability to grant access to others); not least privilege.

  Virtual Machine Contributor: Insufficient to manage virtual networks end to end.

  Virtual Machine Administrator Login: Focused on OS-level login; does not grant resource management permissions for virtual networks or VM deployment.

  Exam Tips:

  If the task spans multiple resource types (virtual machines and virtual networks) and no specialized combined role is offered, expect Contributor unless the question introduces a custom role.

  Least privilege is always relative to the answer set provided.

  Summary:

  This tests RBAC role selection under least privilege constraints for a mixed compute and networking requirement.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20–25%)

  1.2 Manage access to Azure resources

  1.2.1 Manage built-in Azure roles

• Question 185:

  HOTSPOT

  You have an Azure subscription that has offices in the East US and West US Azure regions.

  You plan to create the storage account shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  To minimize the network costs of accessing adatum2, modify the: Default routing tier After adatum2 is created, you can modify the: Encryption type

  Explanation (Why this is correct)

  - Network routing preference (default routing tier) controls whether traffic uses Microsoft global network routing vs Internet routing, which impacts cost characteristics.

  - Storage account encryption settings (including key-management choice / encryption configuration) can be changed after the account is created.

  Explanation (Why the other options are incorrect)

  - Endpoint type / performance tier are not the specific control for public internet routing preference.

  - “Enable infrastructure encryption” and other items may be constraints-specific; the prompt’s target is the encryption configuration category (“Encryption type”).

  Exam Tip If you see “routing tier / routing preference,” think **Microsoft network vs Internet routing** under Storage account Networking.

  AZ-104 Exam Objective Hierarchy 2.0 Implement and manage storage (15–20%) |__2.2 Configure and manage storage accounts |__|__2.2.1 Create and configure storage accounts |__|__2.2.4 Configure storage account encryption

  Evidence:

  Accessed: 2026-01-29

  Last updated: 2025-08-25 (routing preference configuration page footer).

  Default routing preference choices: “You can choose between the Microsoft global network and Internet routing…”

  Change after creation (portal steps shown): “Navigate to your storage account… Network routing tab…” (demonstrates it’s configurable post-create).

  Encryption type changeability (key management / CMK enablement) is supported for existing accounts (see CMK/encryption configuration evidence used in Q175 below; same storage encryption family of docs).

  References (APA; URL only)

  Microsoft. (n.d.). Configure network routing preference for Azure Storage. https://learn.microsoft.com/en-us/azure/storage/common/configure-network-routing-preference (Accessed 2026-01-29; last updated 2025-08-25).

• Question 186:

  You sign up for Azure Active Directory (Azure AD) Premium.

  You need to add a user named [email protected] as an administrator on all the computers that will be joined to the Azure AD domain.

  What should you configure in Azure AD?

  A. Device settings from the Devices blade.
  B. General settings from the Groups blade.
  C. User settings from the Users blade.
  D. Providers from the MFA Server blade.
  A. Device settings from the Devices blade.

  ---

  Device settings from the Devices blade.

  To make a specific user a local administrator on all Microsoft Entra (Azure AD) joined devices, you configure the "Additional local administrators on all Microsoft Entra joined devices" setting under Entra ID > Devices > Device settings. This is the tenant-wide configuration that assigns local admin rights on joined computers.

  Why the other options are not correct:

  - General settings from the Groups blade: Group settings don't control tenant-wide local admin assignment for Entra-joined devices.

  - User settings from the Users blade: Per-user settings don't configure device local admin assignment across all Entra-joined devices.

  - Providers from the MFA Server blade: MFA Server providers relate to MFA configuration, not device local admin rights.

  Microsoft Exam Tips:

  - AZ-104: "Local admin on all Azure AD/Entra joined devices" maps directly to Devices > Device settings > Additional local administrators.

  - Tenant-wide device settings are distinct from user/group settings.

  Summary:

  This question covered tenant-wide configuration of local administrators for Microsoft Entra joined devices.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.2 Manage user and group properties

• Question 187:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription named Subscription1 that contains the resources shown in the following table.

  

  VM1 connects to a virtual network named VNET2 by using a network interface named NIC1.

  You need to create a new network interface named NIC2 for VM1.

  Solution: You create NIC2 in RG1 and West US.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  --------------------------------------------------------------------------------

  Yes

  --------------------------------------------------------------------------------

  You must create NIC2 in a region that is compatible with attaching it to VM1. Because virtual machines and their network interfaces/virtual networks are regional resources, a NIC that will be attached to VM1 must be created in the same region as VM1 (West US). The proposed solution creates NIC2 in West US, which satisfies the regional requirement.

  The resource group selection (RG1) does not prevent creating NIC2 for VM1. A resource group's "location" is primarily where its metadata is stored and does not force resources inside the group to be in that same region. Therefore, creating NIC2 in RG1 (even though RG1 is "East US") is acceptable as long as NIC2 itself is created in West US.

  Why the alternative is not correct:

  - No: Would only be correct if NIC2 were created in a region different from VM1 (or incompatible with the VNet/subnet). Here, NIC2 is created in West US, so it meets the goal.

  References:

  [1] Microsoft. "Virtual network overview." Microsoft Learn. (VMs/VNets are regional resources and must be in same region.) Date modified: Unable to locate. Date accessed: 2026-01-25. https://learn.microsoft.com/en-us/azure/virtual-network/ virtual-networks-overview [2] Microsoft. "Create a network interface." Microsoft Learn. (NIC requires a regional location selection.) Date modified: Unable to locate. Date accessed: 2026-01-25. https://learn.microsoft.com/en-us/azure/virtual- network/create-network-interface-portal [3] Microsoft. "Resource groups." Microsoft Learn. (Resource group location/metadata vs resource location.) Date modified: Unable to locate. Date accessed: 2026-01-25. https://learn.microsoft.com/en-us/azure/azure-resource-manager/ management/manage-resource-groups-portal

  Microsoft Exam Tips:

  - AZ-104 often tests region-scoping rules: VNet/NIC/VM relationships are regional; RG location is not the same as resource location.

  Summary:

  Validated Azure regional constraints for NIC attachment to a VM; clarified resource group "location" vs resource location.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.1 Configure and manage virtual networks in Azure |__ 4.1.1 Create and configure virtual networks and subnets

• Question 188:

  HOTSPOT

  From Azure Active Directory (AD) Privileged Identify Management, you configure the Role settings for the Owner role of an Azure subscription as shown in the following exhibit.

  

  From Azure AD Privileged Identify Management, you assign the Owner role for the subscription to a user named User1, and you set the Assignment type to Active and Permanently eligible. Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  User1 can use the role for: eight hours After first activation, User1 will: need to activate the role in eight hours

  Explanation (Why this is correct)

  - PIM role activations are time-bound. If the maximum activation duration is set to 8 hours, the user has that time window, then must re-activate again afterward.

  Explanation (Why the other options are not correct)

  - Any other duration conflicts with the configured maximum activation duration.

  Exam Tip

  - PIM = “just-in-time + time-limited.” Always look for the configured activation duration.

  References (APA)

  - Microsoft. (n.d.). Configure Azure resource roles in Privileged Identity Management. https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-resource-roles-configure

  AZ-104 Exam Objective Hierarchy 1.0 Manage Azure identities and governance (20–25%) |__1.2 Manage access to Azure resources |__|__1.2.2 Assign roles at different scopes

• Question 189:

  You have the Azure virtual machines shown in the following table.

  

  A DNS service is installed on VM1.

  You configure the DNS servers settings for each virtual network as shown in the following exhibit.

  

  You need to ensure that all the virtual machines can resolve DNS names by using the DNS service on VM1.

  What should you do?

  A. Configure a conditional forwarder on VM1
  B. Add service endpoints on VNET1
  C. Add service endpoints on VNET2 and VNET3
  D. Configure peering between VNET1, VNET2, and VNET3
  D. Configure peering between VNET1, VNET2, and VNET3

  ---

  Explanation

  Item 56 of 253 Answer: Configure peering between VNET1, VNET2, and VNET3.

  ------------------------------------------------------------ Why this is correct

  - VM2 (VNET1/Subnet2), VM3 (VNET2/SubnetA), and VM4 (VNET3/SubnetB) are configured to use VM1 (10.1.0.4) as their DNS server.

  - For those VMs to query the DNS service running on VM1, they must have IP connectivity to 10.1.0.4.

  - Virtual network peering provides private, direct connectivity between resources in different VNets, enabling that DNS traffic (TCP/UDP 53) to reach VM1. :contentReference[oaicite:0]{index=0}

  ------------------------------------------------------------ Why the other options are not correct

  - Configure a conditional forwarder on VM1:

  Helps with forwarding queries, but it does not create the required network connectivity between VNets. Without connectivity, VM3/VM4 still cannot reach 10.1.0.4.

  - Add service endpoints on VNET1 / on VNET2 and VNET3:

  Service endpoints are for securing access from a VNet to specific Azure PaaS services; they do not provide VNet-to-VNet connectivity for reaching a VM-hosted DNS server.

  - Practical note (exam-realistic):

  Even with peering, ensure NSGs and the VM OS firewall allow DNS (TCP/UDP 53) to VM1 from the peered address spaces.

  ------------------------------------------------------------ Microsoft Learn references

  - Virtual network peering provides direct private connectivity and allows resources in peered VNets to communicate. :contentReference[oaicite:1]{index=1}

  - For name resolution across different VNets, you typically use customer-managed DNS servers (or Azure DNS solutions) and must ensure the networks can communicate. :contentReference[oaicite:2]{index=2}

  ------------------------------------------------------------ Exam tips

  - "Custom DNS server = you must be able to route to that DNS IP."

  - The fastest mental check: "Can VM3/VM4 reach 10.1.0.4?" If not, fix connectivity first (peering/VPN/ER), then worry about DNS forwarding rules.

  ------------------------------------------------------------ Summary Peering is the required step because it makes VM1's DNS server reachable from VM3/VM4's VNets, enabling all VMs to use VM1 for DNS resolution. :contentReference[oaicite:3]{index=3}

  ------------------------------------------------------------ Exam objective (AZ-104) 4.0 Implement and manage virtual networking 4.1 Configure and manage virtual networks 4.1.x Configure name resolution / DNS settings 4.1.x Configure virtual network peering

• Question 190:

  You have an Azure subscription that contains 100 virtual machines.

  You regularly create and delete virtual machines.

  You need to identify unattached disks that can be deleted.

  What should you do?

  A. From Azure Advisor, modify the Advisor configuration.
  B. From Azure Cost Management view Cost Analysis.
  C. From Azure Cost Management view Advisor Recommendations.
  D. From Microsoft Azure Storage Explorer, view the Account Management properties.
  C. From Azure Cost Management view Advisor Recommendations.

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  From Azure Cost Management view Advisor Recommendations.

  ----------------------------------------------------------------------------------------------------

  You want to find unattached managed disks that can be deleted. This aligns with cost optimization and "unused resources" identification.

  Why the correct selection is correct:

  - From Azure Cost Management view Advisor Recommendations.

  - Azure Advisor surfaces cost optimization recommendations, including identifying unused/underutilized resources. Unattached disks are a common "waste" item and are typically surfaced through Advisor-style recommendations that you can access from cost management perspectives.

  Why the other selections are incorrect:

  - From Azure Advisor, modify the Advisor configuration.

  - Modifying configuration is not how you "identify" unattached disks; it changes what recommendations you may receive, but does not directly list the disks as the primary action.

  - From Azure Cost Management view Cost Analysis.

  - Cost Analysis shows spend trends and breakdowns; it is not designed to enumerate specific unattached disks as actionable items.

  - From Microsoft Azure Storage Explorer, view the Account Management properties.

  - Storage Explorer is for storage accounts (blobs, files, queues, tables). Managed disks are compute resources; Storage Explorer won't list unattached managed disks.

  ---------------------------------------------------------------------------------------------------- References:

  1. Identify unused disks (concept and approaches; aligns unused disks with cost optimization/Advisor-style discovery) https://learn.microsoft.com/en-us/azure/virtual-machines/disks-find-unused?tabs=azure-cli Date Modified: Unable to locate date modified

  Date Accessed: 01/25/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - "Find unused resources" on AZ-104 commonly maps to Azure Advisor recommendations.

  - Storage Explorer is not a tool for managed disks-think "Compute blade / Disks" and optimization tooling (Advisor).

  ---------------------------------------------------------------------------------------------------- Summary:

  Cost optimization tooling selection for discovering unattached/unused managed disks.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.3 Manage Azure subscriptions and governance |__ 1.3.6 Manage costs by using alerts, budgets, and Azure Advisor recommendations