Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 261:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  You deploy a load balancer that has the following configurations:

  1. Name: LB1 2. Type: Internal 3. SKU: Standard 4. Virtual network: VNET1

  You need to ensure that you can add VM1 and VM2 to the backend pool of LB1.

  Solution: You create a Basic SKU public IP address, associate the address to the network interface of VM1, and then start VM1.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  No

  The solution does not meet the goal because it introduces a Basic SKU public IP configuration that is not the appropriate/required fix for adding VMs to a backend pool of a Standard SKU load balancer. The core requirement is to add VM1 and VM2 NIC IP configurations to the backend pool of a Standard internal load balancer; adding a Basic public IP to VM1 does not address backend pool compatibility and is not the correct remediation.

  Why the solution is not correct:

  - Standard SKU load balancer design expects Standard SKU networking constructs where relevant; adding a Basic SKU public IP is not the correct approach.

  Microsoft Exam Tips:

  - If you see "Standard SKU load balancer," be cautious about "Basic SKU" networking components being proposed as the fix.

  - Many exam items test Basic/Standard SKU mismatches and supported combinations.

  Summary:

  Adding a Basic SKU public IP to VM1 is not the correct action to ensure you can add both VMs to the backend pool of a Standard internal load balancer.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking |__ 4.3 Configure name resolution and load balancing |__ 4.3.2 Configure an internal or public load balancer

• Question 262:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure web app named App1. App1 runs in an Azure App Service plan named Plan1. Plan1 is associated to the Free pricing tier.

  You discover that App1 stops each day after running continuously for 60 minutes.

  You need to ensure that App1 can run continuously for the entire day.

  Solution: You add a continuous WebJob to App1.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  In the Free tier (and Shared tier), App Service apps are subject to usage quotas (including CPU quotas). When an app exceeds its quota, the app is stopped until the quota resets. Adding a continuous WebJob does not remove Free-tier quota enforcement; it still runs under the same plan constraints. Therefore, the proposed solution does not ensure the app can run continuously all day. (1)(2)

  Why "Yes" is not correct:

  - Continuous WebJobs can run persistently, but only while the app and plan can run; quota enforcement can still stop the app before "the entire day" goal is met. (1)(2)

  References:

  1. Azure App Service Quotas and Metrics (quota enforcement stops the app until reset) https://learn.microsoft.com/en-us/azure/app-service/web-sites-monitor Date Modified: 03/31/2025 Date Accessed: 01/25/2026 2. App Service WebJobs Overview (WebJobs run within App Service) https://learn.microsoft.com/en-us/azure/app-service/overview-webjobs Date Modified: 12/09/2025 Date Accessed: 01/25/2026

  Microsoft Exam Tips:

  - AZ-104: If a scenario describes "Free tier stops after X minutes/quota," the fix is usually scaling up the App Service plan, not adding background components.

  - WebJobs are "inside" App Service; they do not bypass plan quotas.

  Summary:

  This question covered App Service Free-tier quota behavior and why adding a continuous WebJob does not guarantee all-day runtime.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.4 Create and configure Azure App Service |__ 3.4.1 Provision an App Service plan

• Question 263:

  DRAG DROP

  You have an Azure subscription that contains the storage accounts shown in the following table.

  

  You plan to use AzCopy to copy a blob from container1 directly to share1.

  You need to identify which authentication method to use when you use AzCopy.

  What should you identify for each account? To answer, drag the appropriate authentication methods to the correct accounts. Each method may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  Box 1 (storage1): A shared access signature (SAS) token

  Box 2 (storage2): A shared access signature (SAS) token

  Why:

  Scenario: You will use AzCopy to copy a blob from a private blob container (no public access) to an Azure Files share. You must choose an authentication method for each storage account.

  SAS tokens are a standard, time-bound, least-privilege way to authorize AzCopy to access both endpoints. You can append a SAS token to the source and/or destination URL used by AzCopy.

  Why other options are not selected:

  - Anonymous: Not valid because the blob container is “No public access.”

  - Storage account access key: Works but grants broad permissions (less aligned with least privilege than SAS).

  - OAuth: Possible in some AzCopy scenarios, but the expected key for this item uses SAS for both endpoints and SAS is commonly used for delegated access across endpoints.

  Exam Tips:

  - “No public access” immediately eliminates Anonymous.

  - If you see “least privilege” + “AzCopy,” SAS is a frequent correct choice.

  Summary:

  Selected SAS tokens to authorize AzCopy for both source blob access and destination file share access.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15–20%)

  └── 2.1 Configure access to storage
    └── 2.1.2 Create and use shared access signature (SAS) tokens

• Question 264:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals.

  Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You are the global administrator for an Azure Active Directory (Azure AD) tenant that has several subscriptions.

  You need to create a report that lists all the resources for the tenant.

  Solution: You run the New-AzureADUserAppRoleAssignment Windows PowerShell cmdlet.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  The goal is to create a report that lists all resources for the tenant (across multiple subscriptions). The cmdlet New-AzureADUserAppRoleAssignment is used to assign an application role to a user in Microsoft Entra ID (Azure AD). It does not enumerate Azure resources across subscriptions and therefore does not meet the goal.

  What would meet the goal (conceptually):

  - Use Azure Resource Graph (tenant/subscription-scoped resource inventory queries) or Azure PowerShell cmdlets that enumerate resources (for example, resource inventory per subscription and aggregation).

  Why the alternative is not correct:

  - Yes: Incorrect because app role assignment is not resource inventory/reporting.

  References:

  [1] ManageEngine. "New-AzureADUserAppRoleAssignment." (Cmdlet purpose: assign app roles.) Date modified: Unable to locate. Date accessed: 2026-01-25. https://www.manageengine.com/products/active-directory-audit/powershell/new- azureaduserapproleassignment.html [2] Microsoft. "New-AzureADServiceAppRoleAssignment." Microsoft Learn. (Role assignment concept in AzureAD module; assignment semantics.) Date modified: Unable to locate. Date accessed: 2026-01-25. https://learn.microsoft.com/en- us/powershell/module/azuread/new-azureadserviceapproleassignment

  Microsoft Exam Tips:

  - Don't confuse Entra ID app-role assignments with Azure resource inventory (Resource Graph / ARM inventory).

  Summary:

  Validated that AzureAD app-role assignment cmdlets are not used to list Azure resources across subscriptions/tenant.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.3 Manage Azure subscriptions and governance |__ 1.3.5 Manage subscriptions

• Question 265:

  You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.

  You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.

  You need to ensure that visitors are serviced by the same web server for each request.

  What should you configure?

  A. Floating IP (direct server return) to Disabled
  B. Session persistence to None
  C. Floating IP (direct server return) to Enabled
  D. Session persistence to Client IP
  D. Session persistence to Client IP

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  Session persistence to Client IP

  ----------------------------------------------------------------------------------------------------

  To ensure that visitors are serviced by the same web server (backend VM) for each request behind an Azure Load Balancer, you configure **session persistence** (also called "source IP affinity"). Setting session persistence to **Client IP** ensures that successive requests from the same client IP are routed to the same backend instance.

  Why the other options are not correct:

  - Floating IP (direct server return) settings: This controls a different load balancer behavior (DSR) and does not provide sticky sessions.

  - Session persistence to None: This explicitly disables persistence, causing load distribution without affinity.

  - Floating IP enabled/disabled: Again, unrelated to client-affinity routing.

  References (APA):

  1. Microsoft. (n.d.). Load balancer distribution mode. Microsoft Learn. Date Modified: Unable to locate date modified. Date Accessed: 01/26/2026. https://learn.microsoft.com/en-us/azure/load-balancer/distribution-mode-concepts

  Microsoft Exam Tips:

  - Sticky sessions on Azure Load Balancer = **Session persistence** (Client IP / Client IP and protocol).

  Summary:

  - Azure Load Balancer session persistence for backend affinity ("sticky sessions").

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.3 Configure name resolution and load balancing |__ 4.3.2 Configure an internal or public load balancer

• Question 266:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant named adatum.com. Adatum.com contains the groups in the following table.

  

  You create two user accounts that are configured as shown in the following table.

  

  To which groups do User1 and User2 belong? To answer. select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  User1: Group1 only
  User2: Group1 and Group2 only

  You are evaluating which groups each user is included in based on the group’s membership type and rule.

  Group1 (Security | Dynamic user)
  
  Membership rule: (user.city -startsWith "m")

  • User1 city = Montreal → starts with “m” → included in Group1.
  • User2 city = Melbourne → starts with “m” → included in Group1. (“-startsWith” is a valid operator in dynamic membership rules.)

  Group2 (Microsoft 365 | Dynamic user)
  
  Membership rule: (user.department -notIn ["HR"])

  • The rule means: include users whose department is not HR.
  • User1 department = Human Resources (HR) → excluded from Group2.
  • User2 department = Marketing → not HR → included in Group2. (“-notIn” is used to exclude specified values from membership.)

  Group3 (Microsoft 365 | Assigned)

  • “Assigned” means users are members only if explicitly added.
  • The scenario does not state that User1 or User2 were assigned to Group3 → do not include Group3.

  Why the other answer choices are incorrect:

  • Any choice including Group3 is unsupported because no explicit assignment was provided.
  • Any choice excluding Group1 is incorrect because both cities start with “m”.
  • Any choice excluding User2 from Group2 is incorrect because Marketing is not HR.

  Exam Tips:

  • Dynamic group rules are evaluated strictly against user attributes; “Assigned” groups require explicit membership.
  • Watch for distractor fields (such as licensing) that do not affect whether a user matches a dynamic membership rule.

  Summary:
  
  This question tests how to evaluate Microsoft Entra dynamic group membership using rule operators such as -startsWith and -notIn, and how “Assigned” membership differs from “Dynamic user.”

• Question 267:

  You have an Azure subscription named Subscription1 that contains an Azure virtual network named VM1. VM1 is in a resource group named RG1.

  VM1 runs services that will be used to deploy resources to RG1.

  You need to ensure that a service running on VM1 can manage the resources in RG1 by using the identity of VM1.

  What should you do first?

  A. From the Azure portal modify the Access control (IAM) settings of VM1.
  B. From the Azure portal, modify the Policies settings of RG1.
  C. From the Azure portal, modify the value of the Managed Service Identity option for VM1.
  D. From the Azure portal, modify the Access control (IAM) settings of RG1.
  C. From the Azure portal, modify the value of the Managed Service Identity option for VM1.

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  From the Azure portal, modify the value of the Managed Service Identity option for VM1.

  ----------------------------------------------------------------------------------------------------

  You need a service running on VM1 to manage resources in RG1 using VM1's identity. The "identity of the VM" in Azure for this purpose is a managed identity (system-assigned managed identity).

  Why the correct selection is correct:

  - From the Azure portal, modify the value of the Managed Service Identity option for VM1.

  - Enabling VM1's managed identity is the first step so the VM can obtain tokens as itself (without storing secrets). After enabling, you then grant that identity RBAC permissions on RG1 (e.g., Contributor) so it can manage resources.

  Why the other selections are incorrect:

  - From the Azure portal, modify the Access control (IAM) settings of VM1.

  - IAM on VM1 controls who can manage VM1; it does not enable VM1 to authenticate as an identity to manage RG1.

  - From the Azure portal, modify the Policies settings of RG1.

  - Policies enforce governance rules; they do not grant an identity to VM1 or authorize VM1 to manage RG1.

  - From the Azure portal, modify the Access control (IAM) settings of RG1.

  - RBAC on RG1 is required eventually, but it is not the first step if VM1 does not yet have a managed identity. You must first enable the managed identity on VM1, then assign roles on RG1 to that identity.

  ---------------------------------------------------------------------------------------------------- References:

  1. Enable a system-assigned managed identity on an Azure VM (portal-based configuration) https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - Sequence matters: (1) enable managed identity, then (2) assign RBAC on the target scope (resource group/subscription/resource).

  - If the question says "using the identity of VM1," that strongly implies managed identity.

  ---------------------------------------------------------------------------------------------------- Summary:

  Enabling a VM's managed identity so workloads can access Azure resources via RBAC without secrets.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.2 Manage access to Azure resources |__ 1.2.2 Assign roles at different scopes

• Question 268:

  You have a deployment template named Template1 that is used to deploy 10 Azure web apps.

  You need to identify what to deploy before you deploy Template1. The solution must minimize Azure costs.

  What should you identify?

  A. 10 App Service plans
  B. one Azure Traffic Manager
  C. five Azure Application Gateways
  D. one App Service plan
  E. one Azure Application Gateway
  D. one App Service plan

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  one App Service plan

  ----------------------------------------------------------------------------------------------------

  An App Service plan provides the underlying compute (region + pricing tier + worker resources) that can host multiple App Service apps. If you are deploying 10 web apps and need to minimize costs, the typical cost-optimized design is to place them into a single appropriately sized App Service plan (subject to capacity and isolation requirements).

  Why the correct selection is correct:

  - one App Service plan

  - Multiple web apps can share the same App Service plan. This reduces cost versus provisioning a separate plan per app, as the cost is primarily driven by the plan's workers/sku, not the number of apps.

  Why the other selections are incorrect:

  - 10 App Service plans

  - This would significantly increase cost because each plan incurs its own compute charges.

  - one Azure Traffic Manager

  - Traffic Manager is a global DNS-based load balancer; it does not provide the compute hosting required for web apps.

  - five Azure Application Gateways / one Azure Application Gateway

  - Application Gateway provides L7 load balancing/WAF, not the App Service compute plan needed to host the apps.

  ---------------------------------------------------------------------------------------------------- References:

  1. App Service plan concepts (one plan can host multiple apps; pricing is tied to the plan) https://learn.microsoft.com/en-us/answers/questions/99729/app-service-plans Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - On AZ-104, if the goal is "minimize cost" and isolation is not requested, consolidate apps into fewer App Service plans.

  - App Service plan sizing matters: many apps can share one plan, but performance is bounded by the plan's compute.

  ---------------------------------------------------------------------------------------------------- Summary:

  App Service hosting economics: consolidate multiple web apps into a single App Service plan to reduce cost.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.4 Create and configure Azure App Service |__ 3.4.1 Provision an App Service plan

• Question 269:

  HOTSPOT

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  Each virtual network has 50 connected virtual machines.

  You need to implement Azure Bastion. The solution must meet the fallowing requirements:

  1. Support host scaling.

  2. Support uploading and downloading files.

  3. Support the virtual machines on both VNet1 and VNet2.

  4. Minimize the number of addresses on the Azure Bastion subnet.

  How should you configure Azure Bastion? To answer, select the options in the answer area.

  NOTE: Each correct answer is worth one point.

  

  

  ---

  - Subnet size: /26

  - Public IP: Standard SKU with a static allocation

  Why this is correct

  - “Host scaling” is a Standard SKU capability, and Standard is also the SKU that supports file transfer (upload/download).

  - To minimize addresses in AzureBastionSubnet while meeting scaling/feature requirements, you choose the minimum supported subnet size: /26.

  - Bastion uses a Standard SKU Public IP with Static allocation for these configurations.

  AZ-104 Exam Objective Hierarchy

  4.0 Implement and manage virtual networking (20–25%) |__4.2 Configure and manage virtual networking |__|__4.2.3 Implement Azure Bastion

• Question 270:

  You create an Azure subscription that is associated to a basic Azure Active Directory (Azure AD) tenant. You need to receive an email notification when any user activates an administrative role.

  What should you do?

  A. Purchase Azure AD Premium P2 and configure Azure AD Privileged Identity Management.
  B. Purchase Enterprise Mobility + Security E3 and configure conditional access policies.
  C. Purchase Enterprise Mobility + Security E5 and create a custom alert rule in Azure Security Center.
  D. Purchase Azure AD Premium P1 and enable Azure AD Identity Protection.
  A. Purchase Azure AD Premium P2 and configure Azure AD Privileged Identity Management.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Purchase Azure AD Premium P2 and configure Azure AD Privileged Identity Management.

  --------------------------------------------------------------------------------

  To receive email notifications when users activate administrative roles, you use Microsoft Entra Privileged Identity Management (PIM). PIM capabilities (including role activation workflows and notifications) require Entra ID P2 licensing.

  Configuring PIM role settings/notifications is the correct approach for alerting on role activations. (1)

  Why the other selections are incorrect:

  - Purchase Enterprise Mobility + Security E3 and configure conditional access policies: Conditional Access controls access decisions; it does not provide "role activation" notification workflows like PIM. (1)

  - Purchase Enterprise Mobility + Security E5 and create a custom alert rule in Azure Security Center: Defender for Cloud/Security Center is not the primary control plane for Entra role activation notifications; PIM is. (1)

  - Purchase Azure AD Premium P1 and enable Azure AD Identity Protection: Identity Protection focuses on risk detection/remediation, not administrative role activation notifications. (1)

  -------------------------------------------------------------------------------- References:

  1. Email notifications in Privileged Identity Management (PIM) https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-email-notifications Date Modified: 01/07/2025 Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - P2 is the key licensing signal for PIM features in exam questions.

  - If you see "activate an administrative role" or "just-in-time role," default to PIM.

  -------------------------------------------------------------------------------- Summary:

  Role activation notifications are provided through Entra PIM (P2), not Conditional Access, Identity Protection, or Defender for Cloud.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.2 Manage access to Azure resources |__ 1.2.1 Manage built-in Azure roles