Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 231:

  You have an Azure subscription that contains the resources in the following table.

  

  VM1 and VM2 are deployed from the same template and host line-of-business applications.

  You configure the network security group (NSG) shown in the exhibit. (Click the Exhibit tab.)

  

  You need to prevent users of VM1 and VM2 from accessing websites on the Internet over TCP port 80.

  What should you do?

  A. Associate the NSG to Subnet1.
  B. Disassociate the NSG from a network interface.
  C. Change the DenyWebSites outbound security rule.
  D. Change the Port_80 inbound security rule.
  A. Associate the NSG to Subnet1.

  ---

  Associate the NSG to Subnet1.

  You must prevent users on VM1 and VM2 from accessing Internet websites over TCP port 80 (outbound HTTP). The NSG in the exhibit already contains an outbound rule (DenyWebSites) that denies TCP/80 to the Internet, but the NSG must be applied at a scope that affects BOTH VMs.

  Key points:

  - Network Security Groups (NSGs) only filter traffic for resources when the NSG is associated to a subnet and/or a network interface (NIC).

  - When an NSG is associated to a subnet, its rules apply to all resources (NICs/VMs) deployed in that subnet.

  - Since VM1 and VM2 are on Subnet1, associating the NSG to Subnet1 ensures the outbound deny rule (TCP 80 to Internet) is enforced for both VMs.

  Why the other options are not correct:

  - B. Disassociate the NSG from a network interface: This would weaken filtering rather than enforce blocking.

  - C. Change the DenyWebSites outbound security rule: The rule already denies TCP/80 to Internet; changing it is unnecessary for the stated requirement.

  - D. Change the Port_80 inbound security rule: The requirement is to block outbound access from the VMs to Internet websites (egress), not inbound HTTP to the VMs.

  Exam Tips:

  - If the requirement targets multiple VMs in the same subnet, prefer associating the NSG to the subnet to apply the rules consistently across all VMs.

  - Always match direction to requirement:

  - "Prevent users from accessing websites on the Internet" = outbound/egress control (NSG outbound rules), not inbound.

  - If a deny rule exists but the scenario still asks "what should you do," check whether the NSG is actually associated to the correct subnet/NIC.

  Summary:

  - NSG association scope (subnet vs NIC)

  - Enforcing outbound (egress) restrictions using NSG outbound rules

  - Applying a single policy to multiple VMs by associating NSG to the subnet

  AZ-104 Exam Objective Alignment (Hierarchy)

  4.0 Implement and manage virtual networking (15–20%)
  └── 4.2 Configure secure access to virtual networks
    └── 4.2.1 Create and configure network security groups (NSGs)

• Question 232:

  HOTSPOT

  You have an Azure subscription named Subscription1 that has a subscription ID of c276fc76-9cd4-44c9-99a7-4fd71546436e.

  You need to create a custom RBAC role named CR1 that meets the following requirements:

  1. Can be assigned only to the resource groups in Subscription1 2. Prevents the management of the access permissions for the resource groups 3. Allows the viewing, creating, modifying, and deleting of resources within the resource groups

  What should you specify in the assignable scopes and the permission elements of the definition of CR1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  

  Why this is correct:

  - assignableScopes defines where the custom role can be assigned. To allow assignment anywhere within Subscription1, you set assignableScopes to the subscription scope.

  - To prevent administrators assigned this role from managing access permissions (RBAC), you exclude authorization operations by using notActions for Microsoft.Authorization/*.

  Exam Tip

  - “Where can this role be used?” → assignableScopes.

  - “What do I explicitly block?” → notActions.

  AZ-104 Exam Objective Hierarchy 1.0 Manage Azure identities and governance (20–25%) |__1.2 Manage access to Azure resources |__|__1.2.1 Manage built-in Azure roles |__|__1.2.2 Assign roles at different scopes

• Question 233:

  Your company has an Azure subscription named Subscription1. The company also has two on-premises servers named Server1 and Server2 that run Windows Server 2016. Server1 is configured as a DNS server that has a primary DNS zone named adatum.com.

  Adatum.com contains 1,000 DNS records.

  You manage Server1 and Subscription1 from Server2. Server2 has the following tools installed:

  1. The DNS Manager console 2. Azure PowerShell 3. Azure CLI 2.0

  You need to move the adatum.com zone to Subscription1.

  The solution must minimize administrative effort.

  What should you use?

  A. Azure PowerShell
  B. Azure CLI
  C. the Azure portal
  D. the DNS Manager console
  B. Azure CLI

  ---

  Explanation

  ---------------------------------------------------------------------------------------------------------------------------------

  Azure CLI

  ---------------------------------------------------------------------------------------------------------------------------------

  You need to move the adatum.com DNS zone (1,000 records) from an on-premises Windows DNS server (Server1) into Azure (Subscription1) while minimizing administrative effort.

  Azure CLI is the best choice because Azure DNS supports importing a DNS zone file directly using the CLI command:

  - az network dns zone import

  This approach allows you to export the zone to a standard zone file format and import all records in bulk, avoiding manual creation of 1,000 records. Azure DNS zone import/export is supported via Azure CLI (and also via the Azure portal), and Microsoft's documentation explicitly notes that import/export cmdlets are not available in Azure PowerShell. (1)(2)

  Why the other options are not correct:

  - Azure PowerShell:

  Import/export cmdlets are not currently available in Azure PowerShell for DNS zone file migration, so it is not the lowest-effort path for bulk migration. (2)

  - The Azure portal:

  While the portal can support zone-file import, it typically involves more interactive steps and is less automation-friendly than a single scripted CLI import for a 1,000-record zone. The question also emphasizes tools installed on Server2, making CLI the most straightforward "from this workstation" option. (2)

  - The DNS Manager console:

  DNS Manager manages Windows DNS Server zones; it does not "move" a zone into Azure DNS. You still need an Azure DNS creation/import mechanism to populate records in Azure.

  ---------------------------------------------------------------------------------------------------------------------------------

  References:

  (1) Microsoft Learn - Import and export a DNS zone file using the Azure CLI Link: https://learn.microsoft.com/en-us/azure/dns/dns-import-export Date accessed: 2026-01-22 Last updated on: 2023-10-20

  (2) Microsoft Learn - Import and export a DNS zone file using the Azure portal Link: https://learn.microsoft.com/en-us/azure/dns/dns-import-export-portal Date accessed: 2026-01-22 Last updated on: 2025-02-05

  (3) Microsoft Learn - az network dns zone import (Azure CLI reference) Link: https://learn.microsoft.com/en-us/cli/azure/network/dns/zone?view=azure-cli-latest Date accessed: 2026-01-22 Last updated on: Not stated on the CLI reference page header in the retrieved snippet

  ---------------------------------------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - If you see "hundreds/thousands of DNS records" plus "minimize administrative effort," expect a bulk import method (zone file import) rather than manual record entry. (1)(2)

  - Watch for "tooling constraints" in the stem. When Azure CLI is available and there is an official import command, it is commonly the intended answer. (1)(3)

  - Azure PowerShell is excellent for many Azure tasks, but always confirm that the needed feature exists as a supported cmdlet-DNS zone import/export is a known exception per Microsoft documentation. (2)

  ---------------------------------------------------------------------------------------------------------------------------------

  Summary:

  - Migrating a DNS zone to Azure DNS using bulk import

  - Using Azure CLI zone file import to minimize administrative effort

  - Understanding tooling limitations (PowerShell import/export availability)

  ---------------------------------------------------------------------------------------------------------------------------------

  AZ-104 Exam Objective Alignment (Hierarchy)

  ------------------------------------------ 4.0 Implement and manage virtual networking (15?0%) | 4.3 Configure name resolution and load balancing | 4.3.1 Configure Azure DNS

• Question 234:

  HOTSPOT

  Shown in the following table.

  

  You create an Azure Resource Manager template named Template1 as shown in the following exhibit.

  

  From the Azure portal, you deploy Template1 four times by using the settings shown in the following table.

  

  What is the result of the deployment? To answer, select the appropriate options in the answer area.

  

  

  ---

  West US public IPs: 2 Total public IPs created: 4

  Explanation (Why this is correct)

  - The template uses resourceGroup().location (not the “location” parameter) to set the public IP location.

  - Two deployments target RG1 (West US) --> two IPs in West US.

  - Two deployments target RG2 (East US) --> two IPs in East US.

  - Total created = 4 across both resource groups.

  Explanation (Why the other options are incorrect)

  - Answers that treat the “location parameter” as the resource location ignore the variable assignment that forces resourceGroup().location.

  Exam Tip

  - Always check whether the template uses **parameters('location')** vs **resourceGroup().location**.

  References

  - Microsoft. (n.d.). ARM template functions: resourceGroup. https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/template-functions-resource#resourcegroup

  - Microsoft. (n.d.). Public IP address resource. https://learn.microsoft.com/en-us/azure/templates/microsoft.network/publicipaddresses

  AZ-104 Exam Objective Hierarchy 3.0 Deploy and manage Azure compute resources (20–25%) |__3.1 Automate deployment of resources by using templates |__|__3.1.1 Create and execute an Azure Resource Manager template

• Question 235:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your company's Azure subscription includes two Azure networks named VirtualNetworkA and VirtualNetworkB.

  VirtualNetworkA includes a VPN gateway that is configured to make use of static routing. Also, a site-to- site VPN connection exists between your company's on-premises network and VirtualNetworkA.

  You have configured a point-to-site VPN connection to VirtualNetworkA from a workstation running Windows 10. After configuring virtual network peering between VirtualNetworkA and VirtualNetworkB, you confirm that you are able to access VirtualNetworkB from the company's on-premises network. However, you find that you cannot establish a connection to VirtualNetworkB from the Windows 10 workstation.

  You have to make sure that a connection to VirtualNetworkB can be established from the Windows 10 workstation.

  Solution: You download and re-install the VPN client configuration package on the Windows 10 workstation.

  Does the solution meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  --------------------------------------------------------------------------------

  Yes

  --------------------------------------------------------------------------------

  Point-to-site (P2S) VPN clients commonly receive route information via the downloaded VPN client configuration package. After you change routing-related configuration (for example, adding VNet peering and enabling access to additional address spaces), re-downloading and re-installing the VPN client configuration package refreshes the client-side routes/settings so the workstation can reach newly reachable networks (such as the peered VirtualNetworkB). Therefore, this meets the goal.

  References:

  1. Microsoft Learn. "About point-to-site VPN routing." https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-point-to-site-routing. Accessed 2026-01-25.

  2. Microsoft Learn. "Virtual network peering." https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview. Accessed 2026-01-25.

  Microsoft Exam Tips:

  - For P2S questions, watch for "client route refresh" cues. If the topology changes, reinstalling/downloading the P2S client package is a common remediation.

  Summary:

  P2S VPN client routing updates after topology changes (such as peering).

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.1 Configure and manage virtual networks in Azure |__ 4.1.2 Create and configure virtual network peering |__ 4.1.5 Troubleshoot network connectivity

• Question 236:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure virtual machine named VM1 that runs Windows Server 2016.

  You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour.

  Solution: You create an Azure Log Analytics workspace and configure the Agent configuration settings. You install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  Yes

  ----------------------------------------------------------------------------------------------------

  The proposed solution builds a valid log-based alert pipeline:

  1) Send Windows System event log data to a Log Analytics workspace by installing/configuring a monitoring agent.

  2) Create an Azure Monitor alert rule based on a log query that counts error events within a 1-hour window and triggers when the count exceeds 2.

  This meets the goal because Azure Monitor log alerts can evaluate event log records in Log Analytics on a schedule and trigger when the threshold condition is met.

  ---------------------------------------------------------------------------------------------------- References:

  1. Create log alerts in Azure Monitor https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-log Date Modified: Unable to locate date modified (page access limited in tool) Date Access: 01/24/2026

  2. Collect Windows event logs in Log Analytics / Azure Monitor Logs (agent-based collection concepts) https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-windows-events Date Modified: Unable to locate date modified (page access limited in tool) Date Access: 01/24/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - "More than X events in Y time" is typically a log query + alert rule pattern.

  - Ensure the data source (event log) is being collected into the workspace before alerting.

  ---------------------------------------------------------------------------------------------------- Summary:

  Use Log Analytics to ingest System event logs and create a log alert that triggers when errors exceed a threshold.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10?5%)

  | |__ 5.1 Monitor resources in Azure | |__ 5.1.4 Set up alert rules, action groups, and alert processing rules in Azure Monitor

• Question 237:

  HOTSPOT

  You have an Azure subscription.

  You deploy a virtual machine scale set that is configured as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that answers each question based on the information presented in the graphic

  NOTE: Each correct selection is worth one point.

  

  

  ---

  9:15 AM: 3

  11:00 AM: 1

  Why these are correct:

  - Autoscale rules evaluate on the schedule/interval and then apply scale actions based on thresholds and cooldowns.

  - At 9:15 AM the rules result in scaling out to 3 running instances.

  - By 11:00 AM, the rules/cooldowns result in scaling back in to 1 running instance.

  Why the other options are incorrect:

  - Values that ignore cooldown or step adjustments typically miscount the resulting instance changes at each timestamp.

  Exam Tips:

  - For autoscale questions: write down current instance count --> rule trigger --> change (+/-) --> cooldown --> next evaluation.

  AZ-104 Exam Objective Hierarchy

  3.0 Deploy and manage Azure compute resources (20–25%)

  └── 3.2 Create and configure virtual machines
    └── 3.2.7 Create and configure VM scale sets

• Question 238:

  You have an Azure subscription. All users are enabled for multi-factor authentication (MFA).

  You need to ensure that the users can lock out their own account if they receive an unsolicited MFA request from Azure.

  Which MFA settings should you configure?

  A. Block/unblock users
  B. Providers
  C. Notifications
  D. Fraud alert
  D. Fraud alert

  ---

  Explanation

  --------------------------------------------------------------------------------

  Fraud alert

  --------------------------------------------------------------------------------

  "Fraud alert" (report suspicious activity) enables users to report unexpected MFA prompts and can block/flag the account depending on configuration. This aligns with the requirement that users can lock out their account when they receive an unsolicited MFA request.

  Why the other choices are not correct:

  - Block/unblock users: Admin control, not a user-driven "report MFA prompt" feature.

  - Providers: MFA provider configuration; not the "report suspicious activity" function.

  - Notifications: General MFA notification behavior; does not implement user fraud reporting/lockout.

  References:

  1. Microsoft. (2025, May 16). Protecting authentication methods in Microsoft Entra ID. Microsoft Learn. Retrieved January 25, 2026, from https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods-security

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: "Unsolicited MFA prompt" maps to "report suspicious activity / fraud alert" concepts.

  Summary:

  MFA safety controls for reporting suspicious activity and account protection.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.2 Manage user and group properties

• Question 239:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your company has an Azure Active Directory (Azure AD) tenant named weyland.com that is configured for hybrid coexistence with the on-premises Active Directory domain.

  You have a server named DirSync1 that is configured as a DirSync server.

  You create a new user account in the on-premise Active Directory. You now need to replicate the user information to Azure AD immediately.

  Solution: You run the Start-ADSyncSyncCycle -PolicyType Initial PowerShell cmdlet.

  Does the solution meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  --------------------------------------------------------------------------------

  Yes

  --------------------------------------------------------------------------------

  Running Start-ADSyncSyncCycle triggers a synchronization cycle on the Microsoft Entra Connect (Azure AD Connect) server. The PolicyType Initial option initiates a full synchronization cycle (a "full sync"), which will replicate directory changes (including a newly created on-premises user) to Microsoft Entra ID. While Initial can be more time-consuming than Delta, it still initiates synchronization immediately and therefore meets the stated goal ("replicate ... immediately"). [1]

  Why the alternative is not correct:

  - No: Incorrect because Start-ADSyncSyncCycle -PolicyType Initial does initiate a sync cycle; it is explicitly documented as the way to start a full sync cycle. [1]

  References:

  [1] Microsoft. "Microsoft Entra Connect Sync: Scheduler." Microsoft Learn. ("To initiate a full sync cycle, run Start-ADSyncSyncCycle -PolicyType Initial...") Date modified: 2025-04-09. Date accessed: 2026-01-25. https://learn.microsoft.com/ en-us/entra/identity/hybrid/connect/how-to-connect-sync-feature-scheduler --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - Delta is the typical "sync now" choice, but Initial still starts a sync cycle (full sync). Read the question carefully: "meets the goal" vs. "best/most efficient."

  Summary:

  Manual synchronization triggering with Entra Connect (Azure AD Connect).

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.1 Create users and groups

• Question 240:

  HOTSPOT

  You have an Azure subscription named Subscroption1.

  In Subscription1, you create an alert rule named Alert1. The Alert1 action group is configured as shown in the following exhibit.

  

  Alert1 alert criteria is triggered every minute.

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: The number of email messages that Alert1 will send in an hour is: 60

  Box 2: The number of SMS messages that Alert1 will send in an hour is: 12

  Given:

  - Alert1 triggers every minute --> 60 alert firings per hour.

  - Action group has:

  - Email receivers configured --> email can be sent for each alert firing --> 60 emails/hour.

  - SMS receivers configured --> SMS notifications are throttled by Azure Monitor notification rate limits; in this question’s options, the effective cap is 12 SMS/hour.

  Why the other options are not correct:

  - Email values less than 60 would imply email throttling at or below the firing rate (not the case in this scenario/options).

  - SMS values like 60 ignore the SMS throttling limit used by Azure Monitor action groups.

  Exam Tips:

  - Always multiply alert frequency by time window first (every minute --> 60/hour), then apply any channel throttles (SMS is commonly throttled).

  - Action group “receivers” determine which channels are used per alert.

  Summary:

  This question tested alert frequency math and action group notification throttling behavior.

  AZ-104 Exam Objective Hierarchy:

  5.0 - Monitor and maintain Azure resources (10–15%)

  └── 5.1 - Monitor resources in Azure
    └── 5.1.4 - Set up alert rules, action groups, and alert processing rules in Azure Monitor