Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 221:

  You have an Azure Container Registry (ACR) named acrcontoso that contains an image named webapp:v1.

  You need to deploy webapp:v1 to Azure Container Instances (ACI).

  Which Azure CLI command should you run?

  A. az container create
  B. kubectl apply
  C. az acr build
  D. docker run
  A. az container create

  ---

  Explanation

  --------------------------------------------------------------------------------

  az container create

  --------------------------------------------------------------------------------

  To deploy a container image to Azure Container Instances (ACI) using Azure CLI, you use the az container create command. This command creates a container group and starts the container from the specified image (including images stored in Azure Container Registry).

  Why other selections are not correct:

  - kubectl apply: Used to deploy resources to Kubernetes (AKS), not directly to ACI.

  - az acr build: Builds an image in ACR; it does not deploy or run the container instance.

  - docker run: Runs a container on a local/host Docker engine, not in Azure Container Instances.

  -------------------------------------------------------------------------------- References:

  1. Create an Azure container instance using Azure CLI https://learn.microsoft.com/en-us/azure/container-instances/container-instances-quickstart Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  2. Azure CLI az container create https://learn.microsoft.com/en-us/cli/azure/container?view=azure-cli-latest#az-container-create Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104 commonly tests which service "owns" the deployment command:

  - ACI -> az container create

  - AKS -> kubectl apply

  - ACR build -> az acr build

  -------------------------------------------------------------------------------- Summary:

  Use az container create to deploy/run an ACR-hosted image in Azure Container Instances.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.3 Provision and manage containers in the Azure portal |__ 3.3.2 Provision a container by using Azure Container Instances

• Question 222:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named Dev.

  You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.

  Solution: On Dev, you assign the Logic App Contributor role to the Developers group.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  {template for answering question}

  --------------------------------------------------------------------------------

  Yes

  --------------------------------------------------------------------------------

  Granting the Developers group the Logic App Contributor role scoped to the Dev resource group provides permissions to manage (including create/edit) logic app resources within that resource group. Since the goal is to allow creation of Azure logic apps in that specific resource group, assigning the relevant contributor role at that scope satisfies the requirement.

  This approach also follows least privilege better than broader roles (such as subscription-wide Contributor/Owner) because the permission is limited to the Dev resource group.

  --------------------------------------------------------------------------------

  References:

  1. Secure access and data in workflows - Azure Logic Apps (role descriptions incl. Logic App Contributor) https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app Modified: Unable to locate date modified Date Access: 01/24/2026

  2. Workflow automation - Microsoft Defender for Cloud (Logic App Contributor required for creation/modification) https://learn.microsoft.com/en-us/azure/defender-for-cloud/workflow-automations Modified: 10/27/2025 Date Access: 01/24/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104 RBAC questions commonly test the correct scope (resource group vs subscription) and least privilege.

  - If the requirement is "create/manage X in resource group Y," expect a service-specific contributor role scoped to the resource group to be sufficient.

  -------------------------------------------------------------------------------- Summary:

  Using Azure RBAC role assignments (scope = resource group) to enable Logic App creation.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.2 Manage access to Azure resources |__ 1.2.2 Assign roles at different scopes

• Question 223:

  DRAG DROP

  You have an Azure subscription that contains two om-premises locations named site1 and site2.

  You need to connect site1 and site2 by using an Azure Virtual WAN.

  Which four actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: Create a Virtual WAN resource.

  Step 2: Create a virtual hub.

  Step 3: Create VPN sites.

  Step 4: Connect the VPN sites to the hub.

  Explanation:

  Goal: connect two on-premises locations (site1 and site2) by using Azure Virtual WAN. The portal workflow for Virtual WAN S2S connectivity is: create the Virtual WAN, then create a hub, define VPN sites that represent the on-prem locations, and finally connect those sites to the hub.

  Why the steps are correct (and why order matters):

  Step 1: Create a Virtual WAN resource.

  - Virtual WAN is the top-level container for your WAN architecture (hubs, sites, and connections).

  Step 2: Create a virtual hub.

  - The virtual hub is the regional routing and gateway aggregation point that provides connectivity between on-prem sites and Azure.

  Step 3: Create VPN sites.

  - VPN sites represent the on-prem locations/devices (public IP and relevant site details).

  Step 4: Connect the VPN sites to the hub.

  - The connection step links each VPN site to the hub so tunnels can be established and routing can occur.

  Why the other action is not selected:

  - Connect the virtual networks to the hub.

  - That action is for connecting Azure VNets to the hub. The question’s goal is specifically about connecting the on-premises sites (site1/site2), which is accomplished by connecting VPN sites to the hub.

  References:

  1. Microsoft Learn. Create a site-to-site connection using Azure Virtual WAN (Azure portal).

  https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-site-to-site-portal Last updated: 03/10/2025. Date Accessed: 01/26/2026.

  2. Microsoft Learn. About virtual hub settings - Azure Virtual WAN.

  https://learn.microsoft.com/en-us/azure/virtual-wan/hub-settings Last updated: Unable to locate on page. Date Accessed: 01/26/2026.

  Microsoft Exam Tips:

  - Virtual WAN S2S order to remember: Virtual WAN --> Hub --> VPN sites --> Site-to-hub connections.

  - Don’t confuse “Connect VNets to hub” (Azure-to-hub) with “Connect VPN sites to hub” (on-prem-to-hub).

  Summary:

  Built Azure Virtual WAN S2S connectivity by creating the Virtual WAN resource, deploying a virtual hub, defining VPN sites for the on-prem locations, and connecting the sites to the hub.

  AZ-104 Exam Objective Hierarchy:

  4.0 - Implement and manage virtual networking (15–20%) |__ 4.2 - Configure secure access to virtual networks

• Question 224:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You create a public IP address named IP1.

  Which two resources can you associate to IP1? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. VM1
  B. LB1
  C. NIC1
  D. VPN1
  E. VNet1
  B. LB1
  C. NIC1

  ---

  LB1

  NIC1

  A Public IP address resource can be associated with:

  - A "Load balancer" frontend configuration (LB1), to provide inbound connectivity through the load balancer.

  - A "Network interface" (NIC1), which provides the VM with a direct public IP (via its NIC).

  Why the other options are not correct:

  - VM1 (virtual machine): Public IP association is done at the NIC (or load balancer), not directly to the VM resource object.

  - VNet1 (virtual network): VNets do not attach public IPs directly.

  - VPN1 (virtual network gateway): While gateways can use public IPs, this question's "two resources" selection (and the typical AZ-104 framing) targets the standard associations shown: load balancer and NIC.

  Microsoft Exam Tips:

  - Public IP attaches to "NIC" (per-VM) or "Load Balancer" (shared), not to the VNet or VM resource directly.

  Summary:

  - Public IP association targets (NIC vs Load Balancer) in Azure networking.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking |__ 4.1 Configure and manage virtual networks in Azure |__ 4.1.3 Configure public IP addresses

• Question 225:

  You have a storage account named storage1.

  You must ensure that virtual machines in VNET1 access storage1 by using a private IP address and that public network access to storage1 is disabled.

  A. Configure a service endpoint for Microsoft.Storage on VNET1.
  B. Create a private endpoint for storage1.
  C. Create an Azure Firewall and configure a DNAT rule to storage1.
  D. Enable Azure DDoS Protection on VNET1.
  B. Create a private endpoint for storage1.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Create a private endpoint for storage1.

  --------------------------------------------------------------------------------

  A private endpoint gives the storage account a private IP address in your virtual network and allows private connectivity over the Microsoft backbone. This is the standard approach when you must ensure the service is reachable privately and you want to restrict public network access to the service.

  Why the other options are not correct:

  - Configure a service endpoint for Microsoft.Storage: Service endpoints still keep the service on a public endpoint (with VNet-based restriction), but do not provide a private IP in the VNet.

  - Create an Azure Firewall and a DNAT rule: DNAT is for inbound publishing; it does not create private PaaS connectivity.

  - Enable Azure DDoS Protection: This does not provide private access to PaaS services.

  -------------------------------------------------------------------------------- References:

  1. Private endpoints (Azure Private Link) overview and usage for Azure PaaS https://learn.microsoft.com/en-us/azure/private-link/private-endpoint-overview Modified: Unable to locate date modified Date Access: 01/24/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: "Private IP to PaaS" is a strong indicator for Private Endpoint.

  - Service endpoints private IP; private endpoints do.

  -------------------------------------------------------------------------------- Summary:

  Using Private Endpoint to ensure private connectivity to Azure Storage.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.2 Configure secure access to virtual networks |__ 4.2.5 Configure private endpoints for Azure PaaS

• Question 226:

  HOTSPOT

  You have an Azure subscription that contains a storage account named storage1. The storage1 account contains blobs in a container named container1.

  You plan to share access to storage1.

  You need to generate a shared access signature (SAS). The solution must meet the following requirements:

  1. Ensure that the SAS can only be used to enumerate and download blobs stored in container1.

  2. Use the principle of least privilege.

  Which three settings should you enable? To answer, select the appropriate settings in the answer area.

  

  

  ---

  Scenario (condensed):

  - Create a SAS for storage1 / container1.

  Requirements:

  1) SAS can only be used to enumerate and download blobs in container1 2) Use least privilege Prompt:

  - Which THREE settings should you enable?

  Answer (as shown in your screenshot/key):

  - Allowed resource types: Container

  - Allowed resource types: Object

  - Allowed permissions: Read

  Why these are correct:

  - Container + Object scope the SAS to container-level and object (blob) operations.

  - Read permits downloading blob content (least privilege for download).

  Important technical note (about the word “enumerate”):

  - Microsoft’s definitions separate “Read” and “List”. “Enumerate/list blobs” typically requires the “List” permission in addition to “Read”.

  - Your exam item limits you to THREE selections, and your screenshot highlights Container + Object + Read. If you see a variant of this question that allows a 4th/5th checkbox, add “List” to satisfy “enumerate/list”.

  Excerpt(s) supporting the permissions model (Microsoft Learn):

  - “Signed permissions … r (read) … l (list) …” (shows List is a distinct permission) URL: https://learn.microsoft.com/en-us/rest/api/storageservices/create-account-sas Last updated on: 2024-11-22 Accessed by me on: 2026-01-29

  - “The signedResourceTypes … s=service, c=container, o=object” URL: https://learn.microsoft.com/en-us/rest/api/storageservices/create-account-sas Last updated on: 2024-11-22 Accessed by me on: 2026-01-29

  References (APA; full URL; includes last-updated + accessed):

  - Microsoft. (2024, November 22). Create an account SAS. Microsoft Learn. Retrieved January 29, 2026, from https://learn.microsoft.com/en-us/rest/api/storageservices/create-account-sas (Last updated on 2024-11-22)

  AZ-104 Exam Objective Hierarchy (from your uploaded objectives):

  2.0 Implement and manage storage (15–20%) |__2.1 Configure access to storage |__|__2.1.2 Create and use shared access signatures (SAS)

• Question 227:

  You have an Azure subscription that has a Recovery Services vault named Vault1. The subscription contains the virtual machines shown in the following table.

  

  You plan to schedule backups to occur every night at 23:00.

  Which virtual machines can you back up by using Azure Backup?

  A. VM1 only
  B. VM1 and VM3 only
  C. VM1. VM2, VM3andVM4
  D. VM1 and VM2 only
  C. VM1. VM2, VM3andVM4

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  VM1, VM2, VM3, and VM4

  ----------------------------------------------------------------------------------------------------

  You can back up all four virtual machines by using Azure Backup, even though VM2 and VM4 are configured for auto-shutdown at 19:00 and the backup is scheduled for 23:00.

  Key point:

  - Azure Backup installs the VM backup extension regardless of whether the VM is running.

  - If the VM is turned off ("offline VM"), Azure Backup can still back it up; the resulting recovery point is **crash-consistent** (not application-consistent). :contentReference[oaicite:0]{index=0}

  Why the other options are not correct:

  - "VM1 only" is incorrect because Azure Backup supports protecting Windows Server and Linux Azure VMs, and VM2<pdf2txt-u>璙</pdf2txt-u>M4 are still eligible for backup. :contentReference[oaicite:1]{index=1}

  - "VM1 and VM3 only" is incorrect because VM2 and VM4 being shut down at 19:00 does not prevent Azure Backup from backing them up; they are backed up as offline VMs (crash-consistent). :contentReference[oaicite:2]{index=2}

  - "VM1 and VM2 only" is incorrect because it wrongly excludes VM3 and VM4, which are also eligible and can be backed up. :contentReference[oaicite:3]{index=3}

  ----------------------------------------------------------------------------------------------------

  References:

  1. Back up Azure VMs in a Recovery Services vault - Azure Backup | Microsoft Learn https://learn.microsoft.com/en-us/azure/backup/backup-azure-arm-vms-prepare Date Modified: 2026-01-22 Date Access: 01/23/2026

  ----------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - "VM running" vs "VM turned off" changes the **type** of recovery point you're likely to get (application-consistent vs crash-consistent), but it does not automatically make the VM ineligible for backup. :contentReference[oaicite:4]{index=4}

  - For questions that mention "auto-shutdown," check whether the task is about **eligibility** (can it be backed up?) versus **consistency requirements** (must it be application-consistent?).

  Summary:

  This question covered Azure Backup behavior for Azure VMs, including backup eligibility and recovery point consistency when a VM is offline.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10?5%) 5.2 Implement backup and recovery 5.2.4 Perform backup and restore operations by using Azure Backup

• Question 228:

  From the MFA Server blade, you open the Block/unblock users blade as shown in the exhibit.

  

  What caused AlexW to be blocked?

  A. The user account password expired.
  B. The user entered an incorrect PIN four times within 10 minutes.
  C. An administrator manually blocked the user.
  D. The user reported a fraud alert when prompted for additional authentication.
  C. An administrator manually blocked the user.

  ---

  Explanation

  --------------------------------------------------------------------------------

  An administrator manually blocked the user.

  --------------------------------------------------------------------------------

  The "Block/unblock users" blade represents an administrative control. If the user appears under "Blocked users," the user is blocked because an administrator performed that action. The "Reason" field (for example, "Lost phone") is an admin- entered rationale, not an automatic detection.

  Why the other choices are not correct:

  - The user account password expired:

  Password expiration does not place a user into an MFA "blocked users" list.

  - The user entered an incorrect PIN four times within 10 minutes:

  Lockout behavior does not equate to the admin "blocked users" list shown in the MFA management blade.

  - The user reported a fraud alert:

  Fraud alerts are reported by users and trigger investigation/response; they do not automatically map to "blocked users" unless an admin blocks the account.

  -------------------------------------------------------------------------------- References:

  1. Microsoft. (n.d.). Multifactor authentication (MFA) FAQ. https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-howitworks Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: When a portal blade is explicitly named (e.g., "Block/unblock users"), assume the action is admin-driven unless stated otherwise.

  - Don't confuse MFA "blocked users" with general account lockout or password expiration.

  -------------------------------------------------------------------------------- Summary:

  Interpretation of MFA administrative controls vs. authentication failures.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.2 Manage user and group properties

• Question 229:

  HOTSPOT

  You have an Azure subscription that contains an Azure Storage account.

  You plan to copy an on-premises virtual machine image to a container named vmimages.

  You need to create the container for the planned image.

  Which command should you run? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: azcopy command:

  • make

  Box 2: 'https://mystorageaccount.[____].core.windows.net/vmimages'

  • blob

  Why:

  • A container is a Blob Storage construct (not a file share, queue, or table).
  • AzCopy can create a container using azcopy make with a destination URL that targets the Blob endpoint.

  Example pattern:
  
  https://<storageaccount>.blob.core.windows.net/<container>

  Exam Tips:

  • “Container” → Blob endpoint.
  • When AzCopy is used to create resources, the command is commonly make.

  Summary:

  • Creating a blob container by using AzCopy
  • Recognizing the Blob endpoint URL format

  AZ-104 Exam Objective Hierarchy:
  
  2.0 Implement and manage storage (15–20%)
  └─ 2.2 Configure and manage storage accounts
    └─ 2.2.5 Manage data by using Azure Storage Explorer and AzCopy

• Question 230:

  You have an Azure policy as shown in the following exhibit:

  

  What is the effect of the policy?

  A. You can create Azure SQL servers in ContosoRG1 only.
  B. You are prevented from creating Azure SQL servers anywhere in Subscription 1.
  C. You are prevented from creating Azure SQL Servers in ContosoRG1 only.
  D. You can create Azure SQL servers in any resource group within Subscription 1.
  A. You can create Azure SQL servers in ContosoRG1 only.

  ---

  You can create Azure SQL servers in ContosoRG1 only.

  The exhibit shows an Azure Policy assignment using the built-in "Not allowed resource types" policy with the parameter set to deny the resource type Microsoft.Sql/servers (Azure SQL logical servers).

  - Because the assignment scope is Subscription1, the deny effect applies across the subscription.

  - Because ContosoRG1 is listed under Exclusions (notScopes), resources in ContosoRG1 are excluded from evaluation and enforcement.

  Therefore, creating Azure SQL servers is blocked everywhere in Subscription1 except in ContosoRG1, where the exclusion allows the deployment.

  Why the other answers are not correct:

  - "You are prevented from creating Azure SQL servers anywhere in Subscription 1." Incorrect because ContosoRG1 is excluded from the assignment.

  - "You are prevented from creating Azure SQL Servers in ContosoRG1 only." Incorrect because exclusions remove enforcement in ContosoRG1; enforcement applies outside it.

  - "You can create Azure SQL servers in any resource group within Subscription 1." Incorrect because the deny policy blocks Microsoft.Sql/servers across the subscription except the excluded scope.

  Exam Tips:

  - "Not allowed resource types" with enforcement enabled means the deployment request is denied at the assigned scope.

  - Always account for Exclusions (notScopes): excluded scopes are not evaluated/enforced.

  - For "effect of policy" questions, compute: Assignment scope minus exclusions = where the deny applies.

  Summary:

  - Azure Policy deny effect using "Not allowed resource types"

  - Assignment scope vs excluded scopes (notScopes)

  - Practical impact: Microsoft.Sql/servers blocked everywhere except excluded RG

  AZ-104 Exam Objective Alignment (Hierarchy)

  1.0 Manage Azure identities and governance (15–20%)

  └── 1.3 Manage Azure subscriptions and governance
  
    └── 1.3.1 Implement and manage Azure Policy