Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 191:

  HOTSPOT

  You have an Azure subscription named Subscription1 that contains a resource group named RG1.

  In RG1, you create an internal load balancer named LB1 and a public load balancer named LB2.

  You need to ensure that an administrator named Admin1 can manage LB1 and LB2. The solution must follow the principle of least privilege.

  Which role should you assign to Admin1 for each task? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  To add a backend pool to LB1: Network Contributor on RG1 To add a health probe to LB2: Network Contributor on RG1

  Explanation:

  Goal:

  - Admin1 must manage LB1 and LB2 while following least privilege.

  Why “Network Contributor on RG1” works:

  - Network Contributor provides permissions to manage network resources (including load balancers).

  - Assigning the role at RG1 scope limits Admin1’s permissions to only the resources in RG1 (not subscription-wide), while still covering both LB1 and LB2.

  Why “Contributor” / “Owner” are not correct:

  - They grant broader permissions than needed (least privilege violation).

  Why “Network Contributor on LB1/LB2” is not selected here:

  - While per-resource scope can be even narrower, the required solution here is to enable Admin1 to manage BOTH load balancers within the resource group under a least-privileged *resource group* boundary (as reflected by the expected selection in the answer area).

  References (APA):

  1. Microsoft Learn. (n.d.). Azure role-based access control (RBAC) overview. https://learn.microsoft.com/en-us/azure/role-based-access-control/overview

  - Last updated: Unable to locate on page. Date accessed: 01/27/2026.

  2. Microsoft Learn. (n.d.). Built-in roles: Networking (includes Network Contributor). https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#network-contributor

  - Last updated: Unable to locate on page. Date accessed: 01/27/2026.

  Microsoft Exam Tips:

  - Least privilege is about BOTH the role definition and the assignment scope:

  - Prefer Network Contributor over Contributor/Owner for LB tasks.

  - Prefer RG scope over subscription when all target resources are in one RG.

  Summary:

  - Selecting an Azure RBAC role and scope to manage load balancer configuration under least privilege.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20–25%) └── 1.2 Manage access to Azure resources └── 1.2.2 Assign roles at different scopes 4.0 Implement and manage virtual networking (15–20%) └── 4.3 Configure and manage load balancing └── 4.3.2 Configure an internal or public load balancer

• Question 192:

  You have a Microsoft Entra tenant named contoso.com.

  You collaborate with an external partner named fabrikam.com.

  You plan to invite users in fabrikam.com to the contoso.com tenant.

  You need to ensure that invitations can be sent only to fabrikam.com users.

  What should you do in the Microsoft Entra admin center?

  A. From Cross-tenant access settings, configure the Tenant restrictions settings.
  B. From Cross-tenant access settings, configure the Microsoft cloud settings.
  C. From External collaboration settings, configure the Guest user access restrictions settings.
  D. From External collaboration settings, configure the Collaboration restrictions settings.
  D. From External collaboration settings, configure the Collaboration restrictions settings.

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  From External collaboration settings, configure the Collaboration restrictions settings.

  ----------------------------------------------------------------------------------------------------

  To ensure invitations can be sent only to users from a specific external domain (fabrikam.com), you use **Collaboration restrictions** in External collaboration settings to configure allow/deny lists for invited domains. This enforces domain- based constraints at the time of invitation.

  Why the other choices are not correct:

  - From Cross-tenant access settings, configure the Tenant restrictions settings: Tenant restrictions are aimed at controlling access to external tenants/apps from managed devices/networks, not invitation domain allow-lists.

  - From Cross-tenant access settings, configure the Microsoft cloud settings: These settings focus on inbound/outbound trust/collaboration posture, not domain allow-listing for invitations.

  - From External collaboration settings, configure the Guest user access restrictions settings: This controls what guests can do after they exist, not which domains can be invited.

  ---------------------------------------------------------------------------------------------------- References:

  1. Collaboration restrictions / external collaboration configuration discussion (Microsoft Learn Q&A context) https://learn.microsoft.com/en-us/answers/questions/1654213/whitelisting-allowed-domains-in-external-collaborat Date Modified: 02/06/2024 (as shown on page) Date Access: 01/26/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - If the question is "who can be invited," look for *Collaboration restrictions* (domain allow/deny).

  - If the question is "what can guests do," look for *Guest user access restrictions*.

  ---------------------------------------------------------------------------------------------------- Summary:

  Restricting guest invitations by external domain.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.4 Manage external users

• Question 193:

  You have an Azure subscription named Subscription1. Subscription1 contains a virtual machine named VM1.

  You have a computer named Computer1 that runs Windows 10. Computer1 is connected to the Internet.

  You add a network interface named VM1173 to VM1 as shown in the exhibit. (Click the Exhibit tab.)

  

  From Computer1, you attempt to connect to VM1 by using Remote Desktop, but the connection fails.

  You need to establish a Remote Desktop connection to VM1.

  What should you do first?

  A. Change the priority of the RDP rule.
  B. Delete the DenyAlllnBound rule.
  C. Start VM1.
  D. Attach a network interface.
  C. Start VM1.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Start VM1.

  --------------------------------------------------------------------------------

  The exhibit shows an inbound NSG rule named **RDP** allowing TCP/3389 and a default **DenyAllInBound** rule at a much lower precedence (higher priority number). NSG processing evaluates rules from lowest priority number to highest, and stops at the first match. Therefore, the existence of DenyAllInBound does not inherently block RDP when an allow rule exists with a higher precedence (lower number). (1)

  A more fundamental reason an RDP connection fails in this scenario is that the VM is not running/available for remote access after the NIC change (adding/attaching a NIC commonly requires the VM to be deallocated). The first action to re- establish RDP connectivity is to ensure the VM is started and running so it can accept connections. (2)

  Why other selections are incorrect:

  - Change the priority of the RDP rule.: Unnecessary because the RDP allow rule already has a higher precedence than the default deny rule (lower number processes first). (1)

  - Delete the DenyAllInBound rule.: You cannot remove/modify default rules, and you do not need to because custom allow rules override them by priority. (1)

  - Attach a network interface.: The stem already states you added the NIC to VM1. The immediate remediation is to bring the VM online. (2)

  --------------------------------------------------------------------------------

  References:

  1. Azure network security groups overview https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview Date Modified: 07/15/2025 Date Accessed: 01/25/2026

  2. Cannot connect to Azure VMs because the RDP port is not enabled in the NSG (troubleshooting) https://learn.microsoft.com/en-us/troubleshoot/azure/virtual-machines/windows/troubleshoot-rdp-nsg-problem Date Modified: Unable to locate Date Accessed: 01/25/2026

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - On AZ-104, always validate "basic availability" first for connectivity: VM running, correct public IP/DNS, and NSG effective rules.

  - Remember NSG priority: lower number = evaluated first; first match wins.

  - Default deny rules are expected; you typically add explicit allows (often restricted to your client IP) rather than removing defaults.

  --------------------------------------------------------------------------------

  Summary:

  This question tests NSG rule processing and practical RDP troubleshooting sequencing-ensure the VM is running before changing NSG rule priorities.

  --------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) 4.2 Configure secure access to virtual networks 4.2.1 Create and configure network security groups (NSGs) and application security groups

• Question 194:

  HOTSPOT

  You have an Azure subscription that contains the vaults shown in the following table.

  

  You create a storage account that contains the resources shown in the following table.

  

  To which vault can you back up cont1 and share1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct answer is worth one point.

  

  

  ---

  • cont1: Backup1 only
  • share1: Recovery1 only

  Why this is correct:

  • cont1 is a Blob container. Azure Blob operational/vaulted backup is configured via Azure Backup for Blob scenarios that align with Backup vault usage.
  • share1 is an Azure file share. Azure Files share backup is performed using a Recovery Services vault.

  Evidence (Excerpts)

  • Blob backup guidance describes configuring backups for blobs in storage accounts via Azure Backup.
  • “Back up Azure file shares … create a Recovery Services vault …” (Azure Files backup workflow)

  AZ-104 Exam Objective Hierarchy
  
  5.0 Monitor and Back Up Azure Resources (10–15%)
  |__ 5.2 Implement Backup and Recovery
  || 5.2.1 Create a Recovery Services Vault
  || 5.2.2 Create an Azure Backup Vault
  || 5.2.4 Perform Backup and Restore Operations by Using Azure Backup

• Question 195:

  You have an Azure Log Analytics workspace named Workspace1 that collects Windows security logs into the SecurityEvent table.

  You need to find failed sign-in attempts in the last 60 minutes.

  Which query should you run in Workspace1?

  A. SecurityEvent | where EventID == 4625 | where TimeGenerated >= ago(60m)
  B. SecurityEvent | where EventID == 4624 | where TimeGenerated >= ago(60m)
  C. search in (SecurityEvent) "4625" | where TimeGenerated >= ago(60m)
  D. SecurityEvent | where TimeGenerated >= ago(60m) | summarize count() by Account
  A. SecurityEvent | where EventID == 4625 | where TimeGenerated >= ago(60m)

  ---

  Explanation

  --------------------------------------------------------------------------------

  SecurityEvent | where EventID == 4625 | where TimeGenerated >= ago(60m)

  --------------------------------------------------------------------------------

  Windows failed logon events are recorded as SecurityEvent with EventID 4625. Filtering by EventID and last 60 minutes returns the required set.

  Why the other choices are not correct:

  - EventID == 4624: That is typically a successful logon, not failed.

  - search in (SecurityEvent) "4625" ...: String search is less precise and can match unrelated text; EventID filtering is the correct/standard approach.

  - summarize count() by Account: Summarizes but does not necessarily return the actual failed sign-in rows as requested.

  References:

  1. Microsoft. (2024, April 25). Search operator (Kusto Query Language) ?examples of search usage patterns. Microsoft Learn (&;A reference). Retrieved January 25, 2026, from https://learn.microsoft.com/en-us/answers/questions/2132902/ search-operator-on-kusto-query-language

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: In Log Analytics, TimeGenerated + ago() is a very common exam pattern.

  - Failed logon = 4625, successful logon = 4624 (common Windows security mapping).

  Summary:

  KQL filtering in Log Analytics for security events.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10?5%) |__ 5.1 Monitor resources in Azure |__ 5.1.3 Query and analyze logs in Azure Monitor

• Question 196:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure container registry named Registry1 that contains an image named image1.

  You receive an error message when you attempt to deploy a container instance by using image1.

  You need to be able to deploy a container instance by using image1.

  Solution: You create a private endpoint connection for Registry1.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  No

  Creating a private endpoint connection for an Azure Container Registry does not automatically enable an Azure Container Instance (ACI) to deploy images from that registry. A private endpoint restricts registry access to private network paths and requires appropriate network placement and DNS resolution. If the container group is not configured to use that private network path (and still attempts public access), the deployment can still fail.

  Additionally, even with network connectivity, the container deployment must still have proper authorization to pull the image (for example, credentials/identity with pull permissions). Therefore, "create a private endpoint connection" alone does not meet the goal as stated.

  Microsoft Exam Tips:

  - Private endpoints are about "how traffic reaches the service". They do not replace "who is allowed" to pull images (AcrPull/credentials).

  Summary:

  - ACR Private Link/Private Endpoints and ACI image pull requirements.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources 3.3 Provision and manage containers in the Azure portal 3.3.1 Create and manage an Azure container registry 3.3.2 Provision a container by using Azure Container Instances

• Question 197:

  HOTSPOT

  You plan to deploy 20 Azure virtual machines by using an Azure Resource Manager template. The virtual machines will run the latest version of Windows Server 2016 Datacenter by using an Azure Marketplace image.

  You need to complete the storageProfile section of the template. How should you complete the storageProfile section? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Offer: WindowsServer Sku: 2016-Datacenter

  Explanation (Why this is correct)

  - In an ARM template, Windows Server marketplace images typically use:

  - offer = WindowsServer

  - sku = 2016-Datacenter

  - “latest” is then resolved from the chosen offer/sku combination.

  Explanation (Why the other options are incorrect)

  - Other offers/SKUs would select a different publisher image (wrong OS/version/edition).

  Exam Tip

  - Common exam imageReference triplet for Windows Server: WindowsServer / 2016-Datacenter (or 2019/2022 variants).

  References (APA)

  - Microsoft. (n.d.). ARM template reference for Microsoft.Compute/virtualMachines. Microsoft Learn. https://learn.microsoft.com/en-us/azure/templates/microsoft.compute/virtualmachines

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20–25%) |__3.1 Automate deployment of compute resources by using Azure Resource Manager templates |__|__3.1.1 Interpret an Azure Resource Manager template

• Question 198:

  You have an Azure subscription that contains a storage account named storage1. The storage1 account contains a container named container1.

  You need to configure access to container1. The solution must meet the following requirements:

  1. Only allow read access.

  2. Allow both HTTP and HTTPS protocols.

  3. Apply access permissions to all the content in the container.

  What should you use?

  A. an access policy
  B. a shared access signature (SAS)
  C. Azure Content Delivery Network (CDN)
  D. access keys
  B. a shared access signature (SAS)

  ---

  a shared access signature (SAS)

  A Shared Access Signature (SAS) can delegate scoped permissions (read-only) at the container level so it applies to all blobs in the container. SAS also supports allowing either HTTPS-only or both HTTPS and HTTP via the signed protocol setting, meeting the protocol requirement.

  Why the other options are not correct:

  - an access policy: A stored access policy is used to define constraints for a SAS, but by itself it doesn't grant access; you still need a SAS.

  - Azure Content Delivery Network (CDN): CDN is for caching and content delivery; it doesn't directly enforce "read-only + HTTP/HTTPS + container-wide delegated access" as the access mechanism.

  - access keys: Account keys grant broad permissions (not read-only) and are not least-privilege delegated access.

  Exam Tips:

  - AZ-104 frequently tests choosing SAS over account keys for least-privilege access.

  - Remember SAS supports protocol constraints (HTTPS only vs HTTPS+HTTP) and permission scoping (container/blob).

  Summary:

  - Delegating container-wide, read-only access with protocol constraints using SAS.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15–20%)
  └─ 2.1 Configure access to storage
    └─ 2.1.2 Create and use shared access signature (SAS) tokens

• Question 199:

  You have an Azure subscription that contains an Azure virtual machine named VM1. VM1 runs a financial reporting app named App1 that does not support multiple active instances.

  At the end of each month, CPU usage for VM1 peaks when App1 runs.

  You need to create a scheduled runbook to increase the processor performance of VM1 at the end of each month.

  What task should you include in the runbook?

  A. Add the Azure Performance Diagnostics agent to VM1.
  B. Modify the VM size property of VM1.
  C. Add VM1 to a scale set.
  D. Increase the vCPU quota for the subscription.
  E. Add a Desired State Configuration (DSC) extension to VM1.
  B. Modify the VM size property of VM1.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Modify the VM size property of VM1.

  --------------------------------------------------------------------------------

  The requirement is to "increase the processor performance of VM1" on a schedule (end of each month). In Azure, CPU/memory capacity is determined by the VM size (SKU). Therefore, the runbook task must resize VM1 to a larger VM size (for example, from D2s_v3 to D4s_v3) at the scheduled time.

  Operationally, resizing commonly requires stopping/deallocating the VM, resizing, and then starting it again. A runbook can automate that sequence.

  Why the other options are not correct:

  - Add the Azure Performance Diagnostics agent to VM1:

  This collects/diagnoses performance data; it does not increase CPU capacity.

  - Add VM1 to a scale set:

  Scale sets are for multiple instances and horizontal scaling; the scenario explicitly says App1 does not support multiple active instances.

  - Increase the vCPU quota for the subscription:

  Quota increases only remove limits so you *can* deploy/resize to larger SKUs; it does not itself increase VM1's CPU unless you also resize the VM.

  - Add a Desired State Configuration (DSC) extension to VM1:

  DSC enforces configuration state; it does not change VM CPU capacity.

  -------------------------------------------------------------------------------- References:

  1. Azure CLI - az vm resize https://learn.microsoft.com/en-us/cli/azure/vm?view=azure-cli-latest#az-vm-resize Date Modified: 04/06/2025 Date Access: 01/24/2026

  2. Azure Automation - Runbook types (PowerShell runbooks can run Az cmdlets/automation logic) https://learn.microsoft.com/en-us/azure/automation/automation-runbook-types Date Modified: 07/15/2025 Date Access: 01/24/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - "Increase processor performance" on a single VM almost always maps to **vertical scaling** (resize the VM SKU), not agents, DSC, or quota alone.

  - If a question mentions **scheduled** changes, think **Azure Automation runbook** (or Logic Apps) executing stop/deallocate --> resize --> start.

  - Quotas are a common distractor: quota may be required *before* resizing, but it is not the action that increases CPU by itself.

  -------------------------------------------------------------------------------- Summary:

  - Azure Automation runbooks for scheduled operations

  - Vertical scaling by resizing Azure VM SKUs

  - Distinguishing resizing from monitoring agents, DSC, and quota changes

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.2 Create and configure virtual machines |__ 3.2.4 Manage virtual machine sizes

• Question 200:

  DRAG DROP

  You are developing an Azure web app named WebApp1. WebApp1 uses an Azure App Service plan named Plan1 that uses the B1 pricing tier.

  You need to configure WebApp1 to add additional instances of the app when CPU usage exceeds 70 percent for 10 minutes.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Box 1: From the Scale up (App Service Plan) settings blade, change the pricing tier.

  Box 2: From the Scale out (App Service Plan) settings blade, enable autoscale.

  Box 3: Set the Scale mode to Scale based on a metric, add rule, and set the instance limits.

  Explanation:

  You must ensure the App Service plan supports autoscale, then enable autoscale, then define the autoscale rules (metric-based) with min/max limits.

  Why the steps are correct (and why order matters):

  Box 1: From the Scale up (App Service Plan) settings blade, change the pricing tier.

  - Autoscale capabilities depend on the plan tier/features. Scaling up ensures the plan has the required scaling features before you configure autoscale.

  Box 2: From the Scale out (App Service Plan) settings blade, enable autoscale.

  - This turns on automatic scaling for the plan/app scale-out experience.

  Box 3: Set the Scale mode to Scale based on a metric, add rule, and set the instance limits.

  - Autoscale needs rules (metric thresholds) and guardrails (instance limits) so Azure can scale out/in safely.

  Why the other actions are not correct:

  - From the Deployment Resource settings blade of WebApp1, add a slot.

  - Deployment slots are for release management; they don’t configure autoscale.

  - From the Tags settings blade of WebApp1, add a tag named Scale that has a value of Auto.

  - Tags don’t enable autoscale or define autoscale rules.

  References:

  1. Microsoft Learn. Scale Up Features and Capacities - Azure App Service.

  https://learn.microsoft.com/en-us/azure/app-service/manage-scale-up Last updated: 09/08/2025. Date Accessed: 01/26/2026.

  2. Microsoft Learn. How to Enable Automatic Scaling - Azure App Service.

  https://learn.microsoft.com/en-us/azure/app-service/manage-automatic-scaling Last updated: Unable to locate on page. Date Accessed: 01/26/2026.

  3. Microsoft Learn. Autoscale in Azure Monitor (rules/metrics concept).

  https://learn.microsoft.com/en-us/azure/azure-monitor/autoscale/autoscale-overview Last updated: 11/01/2024. Date Accessed: 01/26/2026.

  Microsoft Exam Tips:

  - App Service scaling is usually tested as: **Scale up (tier/features)** first, then **Scale out** settings (manual/autoscale), then **rules + limits**.

  - Don’t confuse “deployment slots” (release strategy) or “tags” (metadata) with scaling configuration.

  Summary:

  This question covered App Service plan scaling: upgrading the tier (scale up), enabling autoscale (scale out settings), and configuring metric-based autoscale rules with instance limits.

  AZ-104 Exam Objective Hierarchy:

  3.0 - Deploy and manage Azure compute resources (20–25%) |__ 3.4 - Create and configure Azure App Service |__ 3.4.2 - Configure scaling for an App Service plan