Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 211:

  HOTSPOT

  You need to configure Azure Backup to meet the technical requirements for cont1 and share1.

  To what should you set the backup frequency for each resource? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Correct Answer:

  cont1: Daily share1: Every 4 hours

  Explanation: The case study requires backing up cont1 (Azure Blobs) and share1 (Azure Files) as frequently as possible.

  - Azure Blobs (vaulted backups) use a daily schedule in the backup policy examples.

  - Azure Files backups support an hourly schedule; the smallest supported interval in the policy UI is typically every 4 hours.

  Therefore, the most frequent choices in the provided options are Daily for cont1 and Every 4 hours for share1.

  Proof / Reasoning:

  Azure Backup for Blobs policy examples show a daily schedule configuration.

  Azure Files backup policy supports hourly schedules (example uses every 4 hours).

  References (APA):

  Microsoft. (2025, June 17). Quickstart: Back up blobs in a storage account (Bicep). Retrieved 2026-01-31, from https://learn.microsoft.com/en-us/azure/backup/backup-blobs-storage-account-bicep Last updated: 2025-06-17 Microsoft. (2026, January 30). Manage Azure File share backups. Retrieved 2026-01-31, from https://learn.microsoft.com/en-us/azure/backup/manage-afs-backup Last updated: 2026-01-30

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10–15%) |__5.2 Implement backup and recovery |__|__5.2.1 Create a Recovery Services vault

• Question 212:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your company has an Azure Active Directory (Azure AD) tenant named weyland.com that is configured for hybrid coexistence with the on-premises Active Directory domain.

  You have a server named DirSync1 that is configured as a DirSync server.

  You create a new user account in the on-premise Active Directory. You now need to replicate the user information to Azure AD immediately.

  Solution: You restart DirSync1.

  Does the solution meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  Restarting the DirSync (Azure AD Connect sync) server does not guarantee an immediate synchronization cycle. To replicate a newly created on-premises user to Microsoft Entra ID (Azure AD) immediately, you must trigger a synchronization cycle (for example, using Start-ADSyncSyncCycle). Restarting the server is not the direct control for "sync now," so this solution does not meet the goal. [1]

  References:

  [1] Microsoft. "Microsoft Entra Connect Sync: Scheduler." Microsoft Learn. (Manual sync cycles; how to initiate.) Date modified: 2025-04-09. Date accessed: 2026-01-25. https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to- connect-sync-feature-scheduler --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - For "sync immediately" questions, look for "trigger a sync cycle now" (Start-ADSyncSyncCycle), not "restart services/servers."

  Summary:

  Manual initiation of Entra Connect synchronization vs. restarting components.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.1 Create users and groups

• Question 213:

  You have an Azure subscription that contains a storage account named storage1.

  You plan to use conditions when assigning role-based access control (RBAC) roles to storage1.

  Which storage1 services support conditions when assigning roles?

  A. containers only
  B. file shares only
  C. tables only
  D. queues only
  E. containers and queues only
  F. files shares and tables only
  E. containers and queues only

  ---

  Explanation

  --------------------------------------------------------------------------------

  containers and queues only

  --------------------------------------------------------------------------------

  Azure RBAC conditions (attribute-based access control for Azure Storage) are supported for specific data-plane authorization scenarios. For Azure Storage, conditions apply to:

  - Blob data access at container/blob scope (containers), and

  - Queue data access (queues).

  They do not apply to file shares or tables in the same way for RBAC conditions.

  Why the other options are not correct:

  - containers only: Incomplete because queues also support conditions.

  - file shares only / tables only / queues only: Incorrect or incomplete based on what Azure RBAC conditions support for Storage.

  -------------------------------------------------------------------------------- References:

  1. Azure role assignment conditions (ABAC) for Azure Storage (Blob/Queue scenarios and examples) https://learn.microsoft.com/en-us/azure/storage/common/storage-auth-abac Modified: Unable to locate date modified Date Access: 01/24/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: "RBAC conditions" (ABAC) are not universally supported across all Storage services-know where they apply (commonly Blob and Queue data actions).

  -------------------------------------------------------------------------------- Summary:

  This question tested which Azure Storage services support role assignment conditions for fine-grained authorization.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.2 Manage access to Azure resources |__ 1.2.2 Assign roles at different scopes

• Question 214:

  HOTSPOT

  You have peering configured as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Hosts on vNET6 can communicate with hosts on: vNET6 only To change the status of peering to vNET1 to Connected, you must first: delete peering1

  Explanation (Why this is correct)

  - Both peerings (to vNET1 and vNET2) show a Disconnected state, so vNET6 has no active peering path to other VNets. Only intra-vNET communication is possible.

  - For a Disconnected peering (commonly caused by the remote peering being missing/deleted), the practical remediation is to remove and recreate the peering so the peering pair can be re-established.

  Explanation (Why the other options are incorrect)

  - vNET1 / vNET2: With the peering state disconnected, traffic won’t traverse to the other VNets.

  - “No action needed”: Disconnected won’t become Connected without correcting the peering relationship.

  Exam Tip

  - Peering must exist on both VNets. If one side is missing, the other side can show Disconnected.

  References (APA)

  - Microsoft. (n.d.). Virtual network peering. Microsoft Learn. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15–20%) |__4.1 Configure virtual networks |__|__4.1.2 Configure virtual network peering

• Question 215:

  You have an Azure Active Directory (Azure AD) tenant named contoso.com that is synced to an Active Directory domain. The tenant contains the users shown in the following table.

  

  The users have the attribute shown in the following table.

  

  You need to ensure that you can enable Azure Multi-Factor Authentication (MFA) for all four users.

  Solution: You add a mobile phone number for User2 and User4.

  Does this meet the Goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  The proposed solution ("add a mobile phone number for User2 and User4") does NOT ensure that you can enable Microsoft Entra MFA for all four users:

  1) User2 and User4 are synchronized from Windows Server Active Directory.

  - Their "public profile contact information" is managed on-premises for synced users, and changes should be made in on-prem AD and then synchronized (not simply edited as a quick fix in the cloud user profile). (1)

  - More importantly for MFA specifically: Microsoft distinguishes between public contact fields and "authentication methods." Public contact fields should not be used to perform MFA; users should register authentication methods (phone method, authenticator app, etc.) in the Authentication methods area. (2)

  2) Even if you populate "mobile phone" contact fields, that alone doesn't guarantee MFA readiness.

  - MFA is satisfied by registered authentication methods (Authenticator, phone, etc.) and enforced via Conditional Access or per-user MFA. The action described is about contact data, not necessarily the registered authentication methods needed for MFA. (2)

  3) User3 is a Guest (Microsoft account).

  - Guest users typically use their own sign-in and MFA methods (often in their home identity) and are commonly enforced via Conditional Access in the resource tenant. Adding phone attributes in your tenant is not the standard mechanism that ensures guest MFA. (3)

  What would meet the goal (high-level):

  - Ensure users can register required authentication methods (or you/admin add them via Authentication methods where appropriate). (2)

  - Enforce MFA for the relevant users (including guests) using Conditional Access. (3)

  - For synced users, manage directory attributes at the authoritative source (on-prem AD) where applicable. (1)

  --------------------------------------------------------------------------------

  References:

  (1) Attributes synchronized by Microsoft Entra Connect (Microsoft Learn) Accessed: 2026-01-22 Last updated: 2025-04-09

  (2) Manage user authentication methods for Microsoft Entra multifactor authentication (Microsoft Learn) Accessed: 2026-01-22 Last updated: 2025-10-10

  (3) Tutorial: Enforce multifactor authentication for B2B guest users (Microsoft Learn) Accessed: 2026-01-22 Last updated: 2025-04-30

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - AZ-104 commonly tests that "phone number in the user profile" "MFA authentication method."

  - Public contact info is not intended to be used for MFA; MFA relies on registered authentication methods. (2)

  - In hybrid identity scenarios, know the "source of authority":

  - If a user is synced from on-prem AD, many profile attributes are managed on-prem and synchronized to Entra ID. (1)

  - Guests/external users:

  - Expect Conditional Access-based enforcement patterns for guest MFA; recognize that guests may satisfy MFA using their home tenant methods depending on configuration. (3)

  --------------------------------------------------------------------------------

  Summary:

  This question tests Microsoft Entra ID hybrid identity concepts (synced users vs cloud users), the difference between user profile contact info and MFA authentication methods, and enforcing MFA for guest/external users.

  --------------------------------------------------------------------------------

  AZ-104 Exam Objective Alignment (Hierarchy)

  1.0 Manage Azure identities and governance (20?5%) | |__ 1.1 Manage Microsoft Entra users and groups | |__ 1.1.2 Manage user and group properties

• Question 216:

  You are planning the move of App1 to Azure.

  You create a network security group (NSG).

  You need to recommend a solution to provide users with access to App1.

  What should you recommend?

  A. Create an outgoing security rule for port 443 from the Internet. Associate the NSG to all the subnets.
  B. Create an incoming security rule for port 443 from the Internet. Associate the NSG to all the subnets.
  C. Create an incoming security rule for port 443 from the Internet. Associate the NSG to the subnet that contains the web servers.
  D. Create an outgoing security rule for port 443 from the Internet. Associate the NSG to the subnet that contains the web servers.
  C. Create an incoming security rule for port 443 from the Internet. Associate the NSG to the subnet that contains the web servers.

  ---

  Explanation

  As App1 is public-facing we need an incoming security rule, related to the access of the web servers. Scenario: You have a public-facing application named App1. App1 is comprised of the following three tiers: a SQL database, a web front end, and a processing middle tier. Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.

  Incoming and the web server subnet only, as users access the web front end by using HTTPS only.

  Note Scenario: You have a public-facing application named App1. App1 is comprised of the following three tiers:

  1. A SQL database 2. A web front end 3. A processing middle tier

  Each tier is comprised of five virtual machines. Users access the web front end by using HTTPS only.

• Question 217:

  HOTSPOT

  You have an Azure Storage accounts as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  You can use [answer choice] for Azure Table Storage: storageaccount1 and storageaccount2 only
  
  You can use [answer choice] for Azure Blob storage: all the storage accounts

  Why this is correct:

  • Azure Table Storage is supported by general-purpose storage accounts (StorageV2 or GPv1). In the exhibit, storageaccount1 and storageaccount2 are “Storage account” types, while storageaccount3 is “BlobStorage” (blob-only) and does not provide Table service support.
  • Azure Blob storage is supported by all listed storage accounts in the exhibit (including BlobStorage and general-purpose storage accounts).

  Why the other options are incorrect:

  • Any option that includes storageaccount3 for Table Storage is incorrect because BlobStorage accounts are blob-only.
  • Any option that excludes a general-purpose storage account from Blob storage is incorrect because Blob service is supported there.

  Exam Tips:

  • BlobStorage account type is blob-only (no Table, Queue, or File services).
  • StorageV2 is the most common “general-purpose” storage account type.

  Summary:

  Table requires general-purpose storage accounts; Blob works on all the accounts shown.

  AZ-104 Exam Objective Hierarchy:
  
  2.0 Implement and manage storage (15–20%)
  └── 2.2 Configure and manage storage accounts
    └── 2.2.1 Create and configure storage accounts

• Question 218:

  You create the following resources in an subscription:

  1. An Azure Container Registry instance named Registry1 2. An Azure Kubernetes Service (AKS) cluster named Cluster1

  You create a container image named App 1 on your administrative workstation.

  You need to deploy App1 to cluster 1.

  What should you do first?

  A. Create a host pool on Cluster1
  B. Run the docker push command.
  C. Run the kubect1 apply command.
  D. Run the az aks create command.
  B. Run the docker push command.

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  Run the docker push command.

  ----------------------------------------------------------------------------------------------------

  AKS pulls container images from a registry (such as Azure Container Registry). Before you can deploy the application to the cluster (for example, by applying a Kubernetes Deployment/Service manifest), the image must exist in Registry1.

  Running `docker push` uploads the App1 image to the registry so that Cluster1 can pull it during pod creation. :contentReference[oaicite:0]{index=0}

  Why the other selections are not correct:

  - Create a host pool on Cluster1:

  AKS uses node pools. Even if you needed additional node capacity, the image must still be available in the registry before pods can pull it.

  - Run the kubectl apply command:

  Applying manifests before the image is available typically results in ImagePullBackOff/ErrImagePull because the image can't be retrieved from the registry.

  - Run the az aks create command:

  The AKS cluster already exists (Cluster1). Creating it again is not the required first step.

  References:

  1. Push and pull images with Azure Container Registry using Docker CLI https://learn.microsoft.com/en-us/azure/container-registry/container-registry-get-started-docker-cli Date Modified: 08/28/2025 :contentReference[oaicite:1]{index=1} Date Access: 01/24/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - For AKS deployments, ensure the image is reachable (ACR/registry) before applying Kubernetes manifests.

  - Know the order of operations: build/tag --> push --> deploy.

  Summary:

  Preparing an image in Azure Container Registry so AKS can pull it during deployment.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) | |__ 3.3 Provision and manage containers in the Azure portal | |__ 3.3.1 Create and manage an Azure container registry

• Question 219:

  You need to recommend a solution to automate the configuration for the finance department users. The solution must meet the technical requirements.

  What should you include in the recommendation?

  A. Azure AP B2C
  B. Azure AD Identity Protection
  C. an Azure logic app and the Microsoft Identity Management (MIM) client
  D. dynamic groups and conditional access policies
  D. dynamic groups and conditional access policies

  ---

  Explanation

  Scenario: Ensure Azure Multi-Factor Authentication (MFA) for the users in the finance department only.

  The recommendation is to use conditional access policies that can then be targeted to groups of users, specific applications, or other conditions.

  Technically, The finance department needs to migrate their users from AD to AAD using AADC based on the finance OU, and need to enforce MFA use. This is conditional access policy. Employees also often get promotions and/or join other departments and when that occurs, the user's OU attribute will change when the admin puts the user in a new OU, and the dynamic group conditional access exception (OU= [Department Name Value]) will move the user to the appropriate dynamic group on next AADC delta sync.

  References:

  https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-userstates https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamicmembership https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview

• Question 220:

  HOTSPOT

  You have an Azure web app named App1 that has two deployment slots named Production and Staging. Each slot has the unique settings shown in the following table.

  

  You perform a slot swap.

  What are the configurations of the Production slot after the swap? To answer, select the appropriate options in the answer area.

  NOTE: Each correction is worth one point.

  

  

  ---

  Production slot setting after swap:

  - Web sockets: On

  - Custom domain name: App1-prod.contoso.com

  Explanation (Why this is correct)

  - A slot swap swaps most app configuration settings between slots (unless marked as slot-specific).

  - Custom domain names remain associated with the slot they were configured on; the production slot keeps its production hostname after the swap.

  Explanation (Why the other options are not correct)

  - Choosing a different hostname for production after swap contradicts how custom domains are bound to slots.

  Exam Tip

  - Slot swap moves app settings/config; **custom domains don’t “trade places.”**

  References (APA)

  - Microsoft. (n.d.). Swap deployment slots. https://learn.microsoft.com/en-us/azure/app-service/deploy-staging-slots#swap-deployment-slots

  AZ-104 Exam Objective Hierarchy 3.0 Deploy and manage Azure compute resources (20–25%) |__3.1 Configure and manage virtual machines |__|__3.1.4 Configure and troubleshoot Web Apps