Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 271:

  You have an Azure subscription that contains the resources shown in the following table.

  

  All the resources connect to a virtual network named VNet1.

  You plan to deploy an Azure Bastion host named Bastion1 to VNet1.

  Which resources can be protected by using Bastion1?

  A. VM1 only
  B. contoso.com only
  C. App1 and contoso.com only
  D. VM1 and contoso.com only
  E. VM1, App1, and contoso.com
  A. VM1 only

  ---

  VM1 only

  Azure Bastion provides secure RDP/SSH connectivity to virtual machines in a virtual network without exposing RDP/SSH publicly. It is not a protection mechanism for an App Service web app, and it is not used to protect an Azure AD DS managed domain resource in the same way it provides VM connectivity. Therefore, only the VM resource (VM1) is applicable.

  Why the other selections are not correct:

  • contoso.com only: Bastion is for VM connectivity, not for the managed domain resource itself.
  • App1 and contoso.com only / VM1 and contoso.com only / VM1, App1, and contoso.com: Bastion does not apply to App Service as a target resource for RDP/SSH via Bastion.

  Microsoft Exam Tips:

  • Bastion is a secure jump service for RDP/SSH to VMs over TLS (port 443).
  • If the option list includes PaaS services (such as App Service), they are usually distractors in Bastion questions.

  Summary:

  Azure Bastion applicability (VM remote connectivity scope).

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15–20%)
  
  4.2 Configure secure access to virtual networks
  
  4.2.3 Implement Azure Bastion

• Question 272:

  HOTSPOT

  You have an Azure subscription named Subscription1. Subscription1 contains the resources in the following table.

  

  VNet1 is in RG1. VNet2 is in RG2. There is no connectivity between VNet1 and VNet2.

  An administrator named Admin1 creates an Azure virtual machine named VM1 in RG1. VM1 uses a disk named Disk1 and connects to VNet1. Admin1 then installs a custom application in VM1.

  You need to move the custom application to VNet2. The solution must minimize administrative effort.

  Which two actions should you perform? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  First action: Delete VM1 Second action: Create a new virtual machine

  Explanation (Why this is correct)

  - You can’t “move” an Azure VM to a different virtual network by simply re-pointing the NIC to another VNet.

  - The practical approach (minimal administrative effort in the context of this item) is to delete the VM and recreate it in the target virtual network.

  Exam Tip

  - “Change VNet” is not like “change subnet.” Subnet changes can be done; VNet changes typically require redeploy/recreate.

  References (APA)

  - Microsoft. (n.d.). Move resources to a new resource group or subscription. Microsoft Learn. https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription

  AZ-104 Exam Objective Hierarchy 3.0 Deploy and manage Azure compute resources (20–25%) |__3.2 Create and configure virtual machines |__|__3.2.3 Move virtual machines from one resource group to another 4.0 Implement and manage virtual networking (15–20%)

  |__4.1 Configure and manage virtual networks |__|__4.1.2 Create and configure virtual networks

• Question 273:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You manage a virtual network named VNet1 that is hosted in the West US Azure region.

  VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.

  You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.

  Solution: From Azure Network Watcher, you create a packet capture.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  -----------------------------------------------------------------------

  Yes

  -----------------------------------------------------------------------

  Creating a **packet capture** in Azure Network Watcher is the correct approach to inspect packet-level traffic involving VM1 (and, by filtering, traffic to/from VM2) for a defined time window such as three hours. Packet capture is explicitly intended for capturing and analyzing traffic to/from Azure VM NICs. Therefore, this solution meets the goal.

  Why the other selection is incorrect:

  - No: Incorrect because packet capture is specifically the tool designed to capture traffic and support inspection/troubleshooting.

  -----------------------------------------------------------------------

  References:

  1. Packet capture in Azure Network Watcher (overview) https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-packet-capture-overview Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -----------------------------------------------------------------------

  Microsoft Exam Tips:

  - If the question is time-bound ("for three hours"), confirm packet capture configuration supports a duration/stop time or operational workflow to run the capture for that window.

  Summary:

  Packet capture is the appropriate method for inspecting VM traffic at the packet level.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10?5%) |__ 5.1 Monitor resources in Azure |__ 5.1.6 Use Azure Network Watcher and Connection Monitor

• Question 274:

  You have an Azure web app named Appt.

  You need to monitor the availability of App1 by using a multi-step web test.

  What should you use in Azure Monitor?

  A. Azure Application Insights
  B. the Diagnostic settings
  C. metrics
  D. Azure Service Health
  A. Azure Application Insights

  ---

  Explanation

  --------------------------------------------------------------------------------

  Azure Application Insights

  --------------------------------------------------------------------------------

  A "multi-step web test" (availability test) is implemented via Application Insights availability monitoring (within Azure Monitor). Application Insights is the service used to create and run availability tests for web apps.

  Why the other choices are not correct:

  - the Diagnostic settings: Routes logs/metrics to destinations; does not create multi-step availability tests.

  - metrics: Shows numeric telemetry; does not implement scripted multi-step availability checks.

  - Azure Service Health: Reports platform/service incidents; does not test your specific application endpoints.

  References:

  1. Microsoft. (n.d.). Diagnose Azure Monitor availability test failures. Microsoft Learn. Retrieved January 25, 2026, from https://learn.microsoft.com/en-us/troubleshoot/azure/azure-monitor/availability/test-failures

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: Availability tests (URL ping / standard tests / multi-step) are an Application Insights capability under Azure Monitor.

  Summary:

  Application availability monitoring using Application Insights.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10?5%) |__ 5.1 Monitor resources in Azure |__ 5.1.5 Configure and interpret monitoring of virtual machines, storage accounts, and networks by using Azure Monitor Insights

• Question 275:

  HOTSPOT

  You have an Azure subscription that contains the storage account shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Additional stored access policies: 3

  Additional immutable blob storage policies: 1

  Why these are correct:

  - The exhibit shows 2 existing stored access policies (Policy1, Policy2). With a maximum of 5 stored access policies per container, you can add 3 more.

  - The exhibit shows 1 existing immutable policy. With the platform limit shown/assumed by the exam item, you can add 1 more immutable policy.

  Why the other options are incorrect:

  - Any value other than 3 for stored access policies does not reconcile “current count = 2” with “max = 5.”

  - Any value other than 1 for immutable policies contradicts the remaining capacity implied by the existing configuration shown.

  Exam Tips:

  - When you see “additional,” do (max - existing).

  - Stored access policies are a classic limit question; memorize the common service limits.

  Summary:

  3 additional stored access policies; 1 additional immutable policy..

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15–20%) |__2.1 Configure access to storage

• Question 276:

  You have an Azure Active Directory (Azure AD) tenant named contoso.com. You have a CSV file that contains the names and email addresses of 500 external users.

  You need to create a quest user account in contoso.com for each of the 500 external users.

  Solution: from Azure AD in the Azure portal, you use the Bulk create user operation.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Assign The Website Contributor role to the developers.

  To allow developers to deploy to an Azure App Service using their Microsoft Entra ID identities while adhering to least privilege, you assign an appropriate RBAC role at the scope of the web app. The "Website Contributor" role is intended for managing websites (App Services) and supports typical deployment and management actions without granting full Owner permissions.

  Why the other options are not correct:

  - Configure app-level credentials for FTPS: uses deployment credentials, not Entra ID-based RBAC, and does not align with the requirement to use Azure AD credentials.

  - Assign the Owner role: violates least privilege by granting full control including role assignments.

  - Configure user-level credentials for FTPS: still not Entra ID-based RBAC and is broader/less controlled than role assignment.

  Microsoft Exam Tips:

  - Least privilege on App Service often maps to a specialized built-in role rather than Contributor/Owner.

  - Distinguish "deployment credentials" (publish profile/FTPS) from "RBAC via Entra ID."

  Summary:

  Covers App Service access control for deployment using Azure RBAC and least privilege.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance

  1.2 Manage access to Azure resources

  1.2.1 Manage built-in Azure roles

• Question 277:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Active Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named Dev.

  You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.

  Solution: On Dev, you assign the Logic App Contributor role to the Developers group.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Yes

  Assigning the Logic App Contributor role to the Developers group at the Dev resource group scope meets the goal because:

  • The Logic App Contributor built-in role is intended to manage logic apps, and it explicitly does not allow changing access (RBAC), which is not required here. This role therefore provides the needed permissions to create and manage Logic Apps within the assigned scope.
  • The assignment is scoped to the Dev resource group, which is appropriate because the requirement is limited to that resource group.

  Exam Tips:

  • Pick the most specific role that meets the requirement: If the goal is only to manage a specific resource type (Logic Apps), a service-specific role such as Logic App Contributor is often a better fit than broader roles like Contributor (least privilege).
  • Watch the wording “create” vs. “run/operate”: Roles such as Logic App Operator are commonly limited to reading, enabling, or disabling, not creating or updating. When the task requires creation, you generally need a contributor-level role for that service.
  • Scope is tested heavily (AZ-104): Assign at the smallest scope that satisfies the requirement (Dev resource group), unless the scenario explicitly requires subscription-wide permissions.

  Summary:

  • Azure RBAC built-in roles
  • Logic App Contributor capabilities and limitations
  • Role assignment scope (resource group)
  • Least-privilege role selection for application or workflow resources

  AZ-104 Exam Objective Alignment (Hierarchy)
  
  1.0 Manage Azure identities and governance (20–25%)
  └── 1.2 Manage access to Azure resources
    └── 1.2.2 Assign roles at different scopes

• Question 278:

  HOTSPOT

  You have an Azure subscription that contains a virtual machine named VM1.

  To VM1, you plan to add a 1-TB data disk that meets the following requirements:

  1. Provides data resiliency in the event of a datacenter outage.

  2. Provides the lowest latency and the highest performance.

  3. Ensures that no data loss occurs if a host fails.

  You need to recommend which type of storage and host caching to configure for the new data disk.

  

  

  ---

  Verified Answer (matches the highlighted key):

  - Storage type: Premium SSD that uses zone-redundant storage (ZRS)

  - Host caching: Read-only

  Why this is correct:

  - ZRS managed disks synchronously replicate across three availability zones in the region, which directly addresses resiliency during a datacenter/zone outage.

  - Premium SSD provides higher performance characteristics than Standard disks, supporting the “maximize disk read/write performance” requirement.

  - For host caching: ReadOnly is the default/recommended setting for data disks that do reads (and mixed read/write). It improves read latency/IOPS and avoids the Write-caching crash/data-loss risk associated with ReadWrite if the application doesn’t explicitly handle persistence.

  Why the other options are not selected:

  - LRS: replicated within a single datacenter; does not meet “datacenter outage” resiliency.

  - Standard SSD/HDD: lower performance than Premium SSD, conflicting with “maximize performance.”

  - Read/Write caching: can improve performance, but requires the application to properly handle persisting cached writes; otherwise crash scenarios can cause data loss.

  - None: recommended for write-only or write-heavy disks; you lose the read-acceleration benefit.

  Exam Tip:

  - If the scenario calls out “datacenter/zone outage,” think ZRS (when supported).

  - For data disks, default guidance trends to ReadOnly unless you *know* the workload is write-heavy (None) or the app flushes cached writes safely (ReadWrite).

  Website verification (freshness):

  - Accessed: 2026-01-29

  - Microsoft Learn - Redundancy options for Azure managed disks (Last updated on 2025-07-02): https://learn.microsoft.com/en-us/azure/virtual-machines/disks-redundancy

  - Microsoft Learn - Azure premium storage: Design for high performance (Last updated on 2024-08-22): https://learn.microsoft.com/en-us/azure/virtual-machines/premium-storage-performance

  - Microsoft Learn - Virtual machine and disk performance (Last updated on 2025-04-01): https://learn.microsoft.com/en-us/azure/virtual-machines/disks-performance

  References (APA):

  - Microsoft Learn. (2025-07-02). Redundancy options for Azure managed disks. https://learn.microsoft.com/en-us/azure/virtual-machines/disks-redundancy

  - Microsoft Learn. (2024-08-22). Azure premium storage: Design for high performance. https://learn.microsoft.com/en-us/azure/virtual-machines/premium-storage-performance

  - Microsoft Learn. (2025-04-01). Virtual machine and disk performance. https://learn.microsoft.com/en-us/azure/virtual-machines/disks-performance

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources |__3.2 Manage virtual machines |__|__3.2.5 Manage virtual machine disks

• Question 279:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You deploy an Azure Kubernetes Service (AKS) cluster named AKS1.

  You need to deploy a YAML file to AKS1.

  Solution: From Azure Cloud Shell, you run az aks.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  To deploy a YAML manifest to AKS, you use Kubernetes tooling (typically kubectl) to apply the manifest to the cluster (for example, "kubectl apply -f <file.yaml>"). Running "az aks" alone does not deploy a YAML manifest; az aks is used for AKS management tasks (such as creating clusters or getting credentials), not for applying Kubernetes resource definitions.

  Why the alternative is not correct:

  - Yes: Incorrect because "az aks" by itself is not the mechanism that deploys Kubernetes YAML to a cluster.

  References:

  [1] Kubernetes. "kubectl apply." Kubernetes Documentation. (Apply configuration by file name; YAML accepted.) Date modified: Unable to locate. Date accessed: 2026-01-25. https://kubernetes.io/docs/reference/kubectl/generated/ kubectl_apply/

  Microsoft Exam Tips:

  - If the task is "deploy YAML to AKS," look for kubectl usage rather than Azure CLI management verbs.

  Summary:

  Distinguished AKS management commands (az aks) from Kubernetes deployment actions (kubectl apply).

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.3 Provision and manage containers in the Azure portal

• Question 280:

  You have five Azure virtual machines that run Windows Server 2016. The virtual machines are configured as web servers.

  You have an Azure load balancer named LB1 that provides load balancing services for the virtual machines.

  You need to ensure that visitors are serviced by the same web server for each request.

  What should you configure?

  A. Floating IP (direct server return) to Enabled
  B. Idle Time-out (minutes) to 20
  C. Protocol to UDP
  D. Session persistence to Client IP and Protocol
  D. Session persistence to Client IP and Protocol

  ---

  Session persistence to Client IP and Protocol

  To keep a client "sticky" to the same backend VM, you configure session persistence (source IP affinity).

  "Client IP and protocol" uses a 3-tuple hash (source IP, destination IP, protocol) so successive requests from the same client IP and protocol are sent to the same backend instance.

  Other settings (floating IP/DSR, idle timeout, protocol to UDP) do not provide session affinity for HTTP/HTTPS.

  Microsoft Exam Tips:

  - "Same server each request" = session persistence (stickiness) on Load Balancer.

  - Azure Load Balancer is L4; cookie-based affinity is typically an Application Gateway feature (AZ-104).

  Summary:

  Configuring Load Balancer session persistence for sticky sessions.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking  |__ 4.3 Configure name resolution and load balancing | |__ 4.3.2 Configure an internal or public load balancer