Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 251:

  You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1.

  You need to view the error event from a table named Event.

  Which query should you run in Workspace1?

  A. Get-Event Event | where {$_.EventType == "error"}
  B. Event | search "error"
  C. select * from Event where EventType == "error"
  D. Event | where EventType is "error"
  B. Event | search "error"

  ---

  Explanation

  --------------------------------------------------------------------------------

  Event | search "error"

  --------------------------------------------------------------------------------

  In Log Analytics (KQL), you query a table by naming it, then use pipe operators to filter/search. The search operator is valid KQL syntax and can be used as:

  Event | search "error" This searches the Event table for records containing the term "error," which aligns with the requirement to view the error event.

  Why the other selections are not correct:

  - Get-Event Event | where {$_.EventType == "error"}: This is PowerShell-style, not KQL.

  - select * from Event where EventType == "error": SQL syntax, not KQL.

  - Event | where EventType is "error": "is" is not the normal KQL equality operator for string comparison (KQL typically uses ==), and the option is not the best fit versus the correct "search" syntax provided.

  References:

  [1] Microsoft. "search operator - Kusto Query Language." Microsoft Learn. Date modified: Unable to locate. Date accessed: 2026-01-25. https://learn.microsoft.com/en-us/kusto/query/search-operator

  Microsoft Exam Tips:

  - Recognize KQL patterns: TableName | where ... or TableName | search "text".

  Summary:

  Selected correct KQL syntax to search within the Event table for error-related records.

  AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10?5%) |__ 5.1 Monitor resources in Azure |__ 5.1.3 Query and analyze logs in Azure Monitor

• Question 252:

  HOTSPOT

  You need to implement the planned change for Attribute1.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Correct Answer:

  Admin1 --> No Admin2 --> No Admin3 --> No

  Explanation: Custom security attributes can be assigned to supported object types (such as users and service principals), and assignment permissions are distinct from definition permissions.

  - Admin2 is an Attribute Definition Administrator, which allows defining attributes but not assigning values.

  - Group assignment is not supported in this scenario’s attribute model, so assignments to Group1/Group2 are not valid.

  Therefore, all three statements evaluate to No.

  Proof / Reasoning:

  Case study admin role assignments (Global Administrator; Attribute Definition Administrator; Attribute Assignment Administrator).

  Attribute1 assignment targets in the statements include groups, which are not supported for this attribute assignment scenario.

  References (APA):

  Microsoft. (Last updated n.d.). Manage access to custom security attributes. Retrieved 2026-01-31 from https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/custom-security-attributes-access Microsoft. (Last updated n.d.). Custom security attributes in Microsoft Entra ID (overview). Retrieved 2026-01-31 from https://learn.microsoft.com/en-us/entra/fundamentals/custom-security-attributes-overview

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20–25%) |__1.1 Manage Microsoft Entra users and groups |__|__1.1.2 Manage user and group properties

• Question 253:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You create a route table named RT1 in the East US Azure region.

  To which resources can you associate RT1?

  A. VNet1 only
  B. Subnet1 only
  C. VNet1 and NIC1 only
  D. Subnet1 and NIC1 only
  E. VNet1, Subnet1, and NIC1
  B. Subnet1 only

  ---

  Explanation

  -----------------------------------------------------------------------

  Subnet1 only

  -----------------------------------------------------------------------

  Route tables in Azure are associated to subnets (not directly to VNets and not to NICs). Therefore, RT1 can be associated only with Subnet1.

  Why other selections are not correct:

  - VNet1 only: You don't associate a route table to a VNet; you associate it to one or more subnets.

  - Any option that includes NIC1: Route tables aren't associated to NICs.

  References:

  1. Create, change, or delete a route table https://learn.microsoft.com/en-us/azure/virtual-network/manage-route-table Date Modified: 11/12/2023 Date Accessed: 01/24/2026

  Microsoft Exam Tips:

  - Route tables (UDRs) apply at the subnet scope; always think "subnet association" first.

  Summary:

  - Route table (UDR) association scope in Azure

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.1 Configure and manage virtual networks in Azure |__ 4.1.4 Configure user-defined network routes

• Question 254:

  You have 15 Azure subscriptions.

  You have an Azure Active Directory (Azure AD) tenant that contains a security group named Group1.

  You plan to purchase additional Azure subscription.

  You need to ensure that Group1 can manage role assignments for the existing subscriptions and the planned subscriptions.

  The solution must meet the following requirements:

  1. Use the principle of least privilege.

  2. Minimize administrative effort.

  What should you do?

  A. Assign Group1 the Owner role for the root management group.
  B. Assign Group1 the User Access Administrator role for the root management group.
  C. Create a new management group and assign Group1 the User Access Administrator role for the group.
  D. Create a new management group and assign Group1 the Owner role for the group.
  B. Assign Group1 the User Access Administrator role for the root management group.

  ---

  Assign Group1 the User Access Administrator role for the root management group.

  You need Group1 to manage role assignments across:

  • the existing subscriptions (15), and
  • a planned additional subscription.

  The least-privilege, minimal-effort approach is to assign a role that grants access-management permissions (role assignment management) at a scope that covers all subscriptions, including future ones. Assigning the role at the root management group scope provides inheritance to subscriptions under it, and User Access Administrator is designed for managing access (role assignments) without granting full resource control like Owner.

  Why the other options are not correct:

  • Owner at the root management group: Typically broader than necessary (grants full management), violating least privilege.
  • Creating a new management group: Extra administrative effort if the root management group scope already satisfies the requirement (and if the subscriptions are already governed under it).
  • Assigning at a narrower scope (subscription by subscription): More effort and does not automatically cover the planned subscription.

  Exam Tips:

  • AZ-104: "User Access Administrator" is commonly the correct answer when the requirement is specifically to manage role assignments (and not to manage resources themselves).
  • Management group scope is used to apply governance and access across multiple subscriptions.

  Summary:
  
  This question tested selecting an RBAC role and scope that provides access management across current and future subscriptions with minimal effort.

  AZ-104 Exam Objective Hierarchy:
  1.0 Manage Azure Identities and Governance (20–25%)
  |__ 1.3 Manage Azure Subscriptions and Governance
  |__ 1.3.7 Configure Management Groups

• Question 255:

  HOTSPOT

  You have an Azure subscription that contains a virtual machine scale set. The scale set contains four instances that have the following configurations:

  1. Operating system: Windows Server 2016 2. Size: Standard_D1_v2

  You run the <pdf2txt-u>get-azvmss</pdf2txt-u> cmdlet as shown in the following exhibit:

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  {Dropdown 1}: 4

  {Dropdown 2}: 1

  Explanation (Why this is correct)

  - The scale set has 4 instances and uses a Rolling upgrade policy.

  - For a model change like VM size, the rolling upgrade policy can be configured to update the entire batch (100%) at once-so up to 4 instances can be updated simultaneously.

  - For automatic OS image upgrades, Azure rolls the update through instances in smaller batches to preserve availability. With 4 instances, that results in up to 1 instance being upgraded at a time.

  Explanation (Why the other options are not correct)

  - Choosing fewer than 4 for the size change would contradict a rolling policy that permits updating all instances in a single batch.

  - Choosing more than 1 for the OS image update would imply a larger batch size than the configured/expected rolling behavior for automatic OS upgrades in this exhibit.

  References (APA; full URL)

  - Microsoft Learn. (n.d.). Azure Virtual Machine Scale Sets upgrade policies. Last updated: Unable to locate on page. https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-upgrade-policy Date accessed: 2026-01-27.

  - Microsoft Learn. (n.d.). Automatic OS image upgrades for Virtual Machine Scale Sets. Last updated: Unable to locate on page. https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/virtual-machine-scale-sets-automatic-upgrade Date accessed: 2026-01-27.

  Microsoft Exam Tips

  - Separate “scale set model changes” (size, extensions) from “OS image changes.” They can be governed by different rolling/batch behaviors.

  Summary

  - Hot Area Tracking (delta): Attempted +1 | Correct +1 | Incorrect +0 | Skipped +0

  - Mismatch/Duplicate Tracking (delta): Mismatch +0 | Duplicate +0

  AZ-104 Exam Objective Hierarchy 3.0 - Deploy and manage Azure compute resources (20–25%) |__ 3.2 - Create and configure virtual machines |__ |__ 3.2.7 - Deploy and configure an Azure Virtual Machine Scale Sets

• Question 256:

  You have an Azure subscription named Subscription1 that contains the resources shown in the following table.

  

  You create virtual machines in Subscription1 as shown in the following table.

  

  You plan to use Vault1 for the backup of as many virtual machines as possible.

  Which virtual machines can be backed up to Vault1?

  A. VM1, VM3, VMA, and VMC only
  B. VM1 and VM3 only
  C. VM1, VM2, VM3, VMA, VMB, and VMC
  D. VM1 only
  E. VM3 and VMC only
  A. VM1, VM3, VMA, and VMC only

  ---

  VM1, VM3, VMA, and VMC only

  Vault1 is a Recovery Services vault located in West Europe. Azure VM backup to a Recovery Services vault is constrained by region: you cannot back up a VM to a vault in a different Azure region.

  Therefore, Vault1 can protect only the VMs that are in West Europe, regardless of which resource group they are in and regardless of whether they are Windows or supported Linux.

  From the VM list:

  West Europe VMs: VM1, VM3, VMA, VMC → eligible

  North Europe VMs: VM2, VMB → not eligible (different region from the vault)

  Hence, the maximum set backed up to Vault1 is VM1, VM3, VMA, and VMC only.

  Microsoft Exam Tips:

  Region alignment is a frequent AZ-104 trap.

  Vault region must match VM region for Azure VM backup.

  Resource group location or name does not determine eligibility here; region does.

  OS type matters only for supportability; it does not override the region restriction.

  Summary:

  This question tests Azure Backup scoping: a Recovery Services vault can protect Azure VMs only when the VMs are in the same Azure region as the vault.

  AZ-104 Exam Objective Alignment (Hierarchy)

  5.0 Monitor and maintain Azure resources (10–15%)
  
  5.2 Implement backup and recovery
  
  5.2.4 Perform backup and restore operations by using Azure Backup

• Question 257:

  You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.

  You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.

  You need to ensure that visitors are serviced by the same web server for each request.

  What should you configure?

  A. Session persistence to Client IP and protocol
  B. Protocol to UDP
  C. Session persistence to None
  D. Floating IP (direct server return) to Enabled
  A. Session persistence to Client IP and protocol

  ---

  Explanation

  --------------------------------------------------------------------------------

  Session persistence to Client IP and protocol

  --------------------------------------------------------------------------------

  To ensure a visitor is consistently serviced by the same backend web server (session affinity), you configure Azure Load Balancer "Session persistence" using the 3-tuple option: Client IP and protocol. This pins successive requests from the same client IP and protocol combination to the same backend instance.

  Why other selections are not correct:

  - Protocol to UDP: Protocol choice does not provide affinity by itself; session persistence is the setting that enforces "same backend per client."

  - Session persistence to None: Explicitly disables affinity; requests can land on different backend instances.

  - Floating IP (direct server return) to Enabled: This is for specific load balancing/DSR scenarios and does not implement client session affinity.

  -------------------------------------------------------------------------------- References:

  1. Azure Load Balancer distribution modes (Session persistence: Client IP and protocol/3-tuple) https://learn.microsoft.com/en-us/azure/load-balancer/distribution-mode-concepts Modified: Unable to locate date modified Date Access: 01/24/2026

  2. Configure Azure Load Balancer distribution mode https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-distribution-mode Modified: 01/22/2025 Date Access: 01/24/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - For "sticky sessions" on Azure Load Balancer, look for "Session persistence / source IP affinity" wording. "Client IP and protocol" is the 3-tuple affinity option.

  - Remember: Load Balancer is Layer 4; affinity is hash/tuple-based, not cookie-based.

  -------------------------------------------------------------------------------- Summary:

  Session persistence (source IP affinity) configuration on Azure Load Balancer.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.3 Configure name resolution and load balancing |__ 4.3.2 Configure an internal or public load balancer

• Question 258:

  HOTSPOT

  You have an Azure subscription named Sub1 that contains the resources shown in the following table.

  

  Sub1 contains the following alert rule:

  Name: Alert1 Scope: All resource groups in Sub1

  - Include all future resources Condition: All administrative operations Actions: Action1

  Sub1 contains the following alert processing rule:

  Name: Rule1 Scope: Sub1 Rule type: Suppress notifications Apply the rule: On a specific time

  - Start: August 10, 2022

  - End: August 13, 2022

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  If you create a resource group in Sub1 on August 11, 2022, Alert1 is listed in the Azure portal: Yes

  If you create a resource group in Sub1 on August 12, 2022, an email message is sent to [email protected]: No

  If you add a tag to RG1 on August 15, 2022, an email message is sent to [email protected]: Yes

  Why these are correct:

  The alert can still be generated and visible in the Azure portal.

  The alert processing rule suppresses notifications during the configured window, so the email is suppressed on August 12.

  After the suppression window ends (August 15), notifications resume and the action group sends the email.

  Why the other options are incorrect:

  “Yes” for the August 12 email would ignore the suppression rule.

  “No” for the August 15 email would incorrectly extend suppression beyond its configured end time.

  Exam Tips:

  Alert processing rules commonly suppress notifications, not the underlying alert evaluation itself.

  Always compare the action time to the suppression start and end window.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10–15%)
  |__ 5.3 Configure and manage alerts
  |__ 5.3.2 Configure an alert

• Question 259:

  You have an Azure Active Directory (Azure AD) tenant named contoso.com.

  You have a CSV file that contains the names and email addresses of 500 external users.

  You need to create a guest user account in contoso.com for each of the 500 external users.

  Solution: You create a Power Shell script that runs the New-AZureADUser cmdlet for each user.

  Does this meet the goal?

  A. Yes
  B. NO
  B. NO

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  The goal is to create guest accounts for external users. New-AzureADUser creates directory users (member accounts) rather than performing an external user invitation flow for B2B guest users. Therefore, creating a PowerShell script that runs New-AzureADUser for each user does not meet the goal. (1)

  Why "Yes" is not correct:

  - Guest onboarding for external identities is handled through invitation/B2B mechanisms, not standard member-user creation cmdlets.

  -------------------------------------------------------------------------------- References:

  1. Microsoft. (n.d.). Add B2B collaboration users by using PowerShell (invitation concepts). Microsoft Learn. https://learn.microsoft.com/it-it/entra/external-id/b2b-quickstart-invite-powershell Last modified: Unable to locate in tool output Date accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - External users = guest = invitation (B2B). Internal users = create user.

  - Watch cmdlet intent: "Invitation" cmdlets vs "User creation" cmdlets.

  -------------------------------------------------------------------------------- Summary:

  Covers guest user creation patterns and appropriate automation approach for external users.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) | |__ 1.1 Manage Microsoft Entra users and groups | |__ 1.1.4 Manage external users

• Question 260:

  HOTSPOT

  You have an Azure subscription.

  You plan to deploy a storage account named storage1 by using the following Azure Resource Manager (ARM) template.

  

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Change made to the data in storage1 can be rolled back after seven days: Yes Only users located in the East US Azure region can connect to storage1: No Three copies of storage1 will be maintained in the East US Azure region: Yes

  Explanation (Why this is correct):

  - Blob versioning enables you to recover/restore prior versions of blobs (rollback) as long as versions are retained; the template enables versioning, so rollback after seven days remains possible.

  - A storage account’s “location” does not restrict connectivity to only users in that region. Network access control is governed by network rules (firewalls/VNet rules/private endpoints), not by the region name alone. The shown network rules do not impose a “East US only users” constraint.

  - LRS keeps three copies of data within a single datacenter in the primary region (East US in this template), so “three copies in East US” is true for LRS (and remains true even if additional replication exists).

  Explanation (Why the other options are incorrect):

  - “Only East US users can connect” is a common trap; region is about where the service is hosted, not who can access it.

  Exam Tips:

  - Region ≠ access restriction. Use network rules/private endpoints to restrict who can connect.

  - Versioning is a recovery mechanism; redundancy is a durability mechanism-don’t mix them up.

  Summary:

  Versioning supports rollback; region does not restrict access; LRS provides three copies in the primary region.

  References (APA):

  Microsoft. (n.d.). Blob versioning. https://learn.microsoft.com/en-us/azure/storage/blobs/versioning-overview (Accessed January 28, 2026).

  Microsoft. (n.d.). Plan for an Azure Files deployment. https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-planning (Accessed January 28, 2026).

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15–20%) |__2.1 Configure access to storage |__|__2.1.1 Configure network access to storage accounts |__2.2 Configure data protection and disaster recovery |__|__2.2.1 Configure data protection |__|__2.2.2 Configure soft delete |__2.3 Configure and manage storage accounts |__|__2.3.7 Configure storage redundancy