Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 291:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure virtual machine named VM1 that runs Windows Server 2016.

  You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour.

  Solution:

  1. You create an Azure Log Analytics workspace and configure the data settings.

  2. You install the Microsoft Monitoring Agent on VM1.

  3. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  --------------------------------------------------------------------------------

  Yes

  --------------------------------------------------------------------------------

  To alert when System event log errors exceed a threshold within a time window, you need to collect Windows event logs and query them. Creating a Log Analytics workspace, installing the monitoring agent, and creating an Azure Monitor alert based on Log Analytics (log search alert) is an appropriate method. Azure Monitor Logs centralizes telemetry and supports alerting on query results. (1)(2)

  Why the other selection is not correct:

  - No: Without log collection into Log Analytics and an alert rule, Azure Monitor cannot evaluate "more than two error events in one hour" from the Windows System event log in a query-based way. (1)(2)

  -------------------------------------------------------------------------------- References:

  { 1. Azure Monitor Logs overview https://learn.microsoft.com/en-us/azure/azure-monitor/logs/data-platform-logs Date Modified: Apr 1, 2025 Date Accessed: 01/25/2026

  2. Azure Monitor Metrics overview (contrast: metrics vs logs) https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/data-platform-metrics Date Modified: May 20, 2025 Date Accessed: 01/25/2026

  }

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - Event Log<pdf2txt-u>璪</pdf2txt-u>ased alerts are log alerts (Log Analytics), not metric alerts.

  - Watch for "within an hour" language; it usually implies a query + alert rule.

  Summary:

  Log Analytics ingestion + Azure Monitor log alerts for Windows event logs.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10?5%) |__ 5.1 Monitor resources in Azure |__ 5.1.3 Query and analyze logs in Azure Monitor |__ 5.1.4 Set up alert rules, action groups, and alert processing rules in Azure Monitor

• Question 292:

  HOTSPOT

  You have an Azure Kubernetes Service (AKS) cluster named AKS1 and a computer named Computer1 that runs Windows 10. Computer1 that has the Azure CLI installed.

  You need to install the kubectl client on Computer1.

  Which command should you run? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  First dropdown: az

  Second dropdown: aks

  Why this is correct:

  - The Azure CLI provides a built-in command to install the Kubernetes CLI (kubectl): `az aks install-cli`. Selecting `az` and `aks` completes the command shown in the hotspot.

  Why the other options are incorrect:

  - docker: Docker does not install kubectl for you in this context.

  - msiexec.exe: Not the Azure CLI method shown/required by the hotspot.

  - Install-Module: PowerShell module install is not the CLI approach asked here.

  Exam Tips:

  - For AKS client tools: `az aks install-cli` installs kubectl; `az aks get-credentials` pulls cluster credentials.

• Question 293:

  You are configuring Azure Active Directory (Azure AD) authentication for an Azure Storage account named storage1.

  You need to ensure that the members of a group named Group1 can upload files by using the Azure portal. The solution must use the principle of least privilege.

  Which two roles should you configure for storage1? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point

  A. Reader
  B. Storage Blob Data Contributor
  C. Storage Account Contributor
  D. Storage Blob Data Reader
  E. Contributor
  A. Reader
  B. Storage Blob Data Contributor

  ---

  Reader Storage Blob Data Contributor

  To upload blobs using the Azure portal with least privilege, users typically need:

  - A management-plane role to view the Storage account in Azure (Reader), and

  - A data-plane role that grants blob write permissions (Storage Blob Data Contributor).

  Why the other choices are not correct:

  - Storage Account Contributor / Contributor: These grant broader management permissions than required (not least privilege).

  - Storage Blob Data Reader: Read-only; does not allow uploads.

  Microsoft Exam Tips:

  - AZ-104: Distinguish management-plane RBAC (ARM) vs data-plane RBAC (Blob/Data roles). "Can upload blobs" is a data-plane permission.

  Summary:

  Azure RBAC for Storage: least privilege for portal-based uploads.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance  |__ 1.2 Manage access to Azure resources |__ 1.2.2 Assign roles at different scopes

• Question 294:

  You have two Azure virtual machines named VM1 and VM2. You have two Recovery Services vaults named RSV1 and RSV2.

  VM2 is protected by RSV1.

  You need to use RSV2 to protect VM2.

  What should you do first?

  A. From the RSV1 blade, click Backup items and stop the VM2 backup.
  B. From the RSV1 blade, click Backup Jobs and export the VM2 backup.
  C. From the RSV1 blade, click Backup. From the Backup blade, select the backup for the virtual machine, and then click Backup.
  D. From the VM2 blade, click Disaster recovery, click Replication settings, and then select RSV2 as the Recovery Services vault.
  A. From the RSV1 blade, click Backup items and stop the VM2 backup.

  ---

  Explanation

  ---------------------------------------------------------------------------------------------------------------------------------

  From the RSV1 blade, click Backup items and stop the VM2 backup.

  ---------------------------------------------------------------------------------------------------------------------------------

  A single Azure VM can be protected (backed up) by only one Recovery Services vault at a time. Since VM2 is currently protected by RSV1, you must first stop protection/backup in RSV1 before you can enable backup for VM2 in a different vault (RSV2). Stopping the VM2 backup (stop protection) removes the existing vault association so RSV2 can take over protection.

  Why the other options are not correct:

  - From the RSV1 blade, click Backup Jobs and export the VM2 backup:

  Exporting backup job data does not change protection state and does not move protection to another vault.

  - From the RSV1 blade, click Backup... and click Backup again:

  This describes initiating/enabling backup, not stopping it, and it does not address the fact that VM2 is already protected by RSV1.

  - From the VM2 blade, click Disaster recovery... select RSV2:

  "Disaster recovery" here refers to Azure Site Recovery replication, not Azure Backup protection. It is a different service and does not change the Azure Backup vault used for VM backups.

  ---------------------------------------------------------------------------------------------------------------------------------

  References:

  (1) Microsoft Learn - Back up an Azure VM (Azure Backup) (VM must be protected by a Recovery Services vault; protection managed under Backup items) https://learn.microsoft.com/en-us/azure/backup/backup-azure-vms-introduction Date accessed: 2026-01-22 Last updated: 2025-09-18

  (2) Microsoft Learn - Stop backup for an Azure VM / Disable protection (explains stopping protection before changing vault association) https://learn.microsoft.com/en-us/azure/backup/backup-azure-manage-vms Date accessed: 2026-01-22 Last updated: 2025-10-03

  (3) Microsoft Learn - About Site Recovery vs Azure Backup (disaster recovery replication is separate from backup) https://learn.microsoft.com/en-us/azure/site-recovery/site-recovery-overview Date accessed: 2026-01-22 Last updated: 2025-11-12

  ---------------------------------------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - If the stem says "VM is protected by vault X" and you need vault Y, the first step is typically "Stop backup / disable protection" in vault X.

  - Don't confuse "Backup" (Azure Backup / Recovery Services vault) with "Disaster recovery" (Azure Site Recovery replication). They are frequently mixed as distractors.

  - In exam wording, "Backup items" is the usual navigation path to manage protected instances and stop protection.

  ---------------------------------------------------------------------------------------------------------------------------------

  Summary:

  - Switching an Azure VM's backup protection from one Recovery Services vault to another

  - Correct first step: stop/disable existing VM backup in the current vault

  - Distinguishing Azure Backup from Azure Site Recovery

  ---------------------------------------------------------------------------------------------------------------------------------

  AZ-104 Exam Objective Alignment (Hierarchy)

  ------------------------------------------ 5.0 Monitor and maintain Azure resources (10?5%) | 5.2 Implement backup and recovery | 5.2.1 Create a Recovery Services vault

• Question 295:

  HOTSPOT

  You have an Azure subscription that contains the alerts shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  - For Alert1, User response: can be changed to New or Acknowledged

  - For Alert2, User response: can be changed to Acknowledged or Closed

  Why these are correct:

  - Azure Monitor alert instances support three “User response” states: New, Acknowledged, and Closed.

  - In the exhibit, Alert1 is already Closed, so the meaningful changes are to New or Acknowledged.

  - Alert2 is New, so the meaningful changes are to Acknowledged or Closed.

• Question 296:

  You develop the following Azure Resource Manager (ARM) template to create a resource group and deploy an Azure Storage account to the resource group.

  

  Which cmdtet should you run to deploy the template?

  A. New-AzResourceGroupDeployment
  B. New-AzDeployment
  C. New-AzResource
  D. New-AzTenantDeploynent
  B. New-AzDeployment

  ---

  The template creates a resource group (Microsoft.Resources/resourceGroups). Creating a resource group is a subscription-scope action, so the deployment must run at subscription scope (not resource group scope). In Az PowerShell, New- AzDeployment is used for subscription-scope deployments (for example, when deploying templates that create resource groups). Therefore, New-AzDeployment is the correct cmdlet.

  Why the other options are not correct:

  - New-AzResourceGroupDeployment: targets an existing resource group scope; it cannot be used to create the resource group as part of the same deployment scope.

  - New-AzResource: creates a single resource, not a full ARM template deployment.

  - New-AzTenantDeployment: is for tenant-scope deployments, not subscription-scope.

  Exam Tips:

  - If the template creates a resource group, you're not in RG-scope deployment.

  - Map scopes: tenant vs subscription vs management group vs resource group.

  Summary:

  Covers ARM deployment scopes and selecting the correct Az PowerShell deployment cmdlet.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources  | |__ 3.1 Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files | |__ 3.1.4 Deploy resources by using an Azure Resource Manager template or a Bicep file

• Question 297:

  You have an Azure subscription that contains a virtual machine named VM1. VM1 hosts a line-of- business application that is available 24 hours a day. VM1 has one network interface and one managed disk. VM1 uses the D4s v3 size.

  You plan to make the following changes to VM1:

  1. Change the size to D8s v3.

  2. Add a 500-GB managed disk.

  3. Add the Puppet Agent extension.

  4. Attach an additional network interface.

  Which change will cause downtime for VM1?

  A. Add a 500-GB managed disk.
  B. Attach an additional network interface.
  C. Add the Puppet Agent extension.
  D. Change the size to D8s v3.
  D. Change the size to D8s v3.

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  Change the size to D8s v3.

  ----------------------------------------------------------------------------------------------------

  The change that will cause downtime is the one that requires a VM restart (or stop/deallocate) to apply.

  Why the correct selection is correct:

  - Change the size to D8s v3.

  - Resizing a VM changes the underlying compute allocation. This typically requires a restart, and in some scenarios requires the VM to be stopped/deallocated to move to a different host cluster that supports the requested size. Either way, that introduces downtime.

  Why the other selections are incorrect:

  - Add a 500-GB managed disk.

  - Data disks can generally be added to a running VM (the OS may need to rescan the bus/initialize disk in-guest, but the Azure action does not inherently require VM downtime).

  - Attach an additional network interface.

  - Whether you can add/attach a NIC depends on VM size and NIC limits, but if the platform supports it, NIC changes are often manageable; however, the question asks which "will cause downtime" and the consistently downtime-causing action here is resizing.

  - Add the Puppet Agent extension.

  - VM extensions can typically be installed without stopping the VM; they run in-guest and may briefly impact performance but do not inherently require VM downtime.

  ---------------------------------------------------------------------------------------------------- References:

  1. Manage Azure VMs tutorial (notes that you may need to stop/deallocate before resizing in some cases) https://learn.microsoft.com/en-us/azure/virtual-machines/tutorial-manage-vm Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  2. VM resize discussion (resize operations require reboot/restart behavior) https://learn.microsoft.com/en-us/answers/questions/82048/is-it-required-to-reboot-a-vm-after-resizing-it Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - "Resize VM" is a classic downtime trigger on AZ-104. When in doubt, assume resize requires restart and may require stop/deallocate.

  - Adding disks and adding extensions are typically "online" operations.

  ---------------------------------------------------------------------------------------------------- Summary:

  Operational impact of common VM changes; resizing is the most reliably downtime-causing action.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.2 Create and configure virtual machines |__ 3.2.4 Manage virtual machine sizes

• Question 298:

  HOTSPOT

  You have an Azure AD tenant that contains a user named External User.

  External User authenticates to the tenant by using [email protected].

  You need to ensure that External User authenticates to the tenant by using [email protected].

  Which two settings should you configure from the Overview blade? To answer, select the appropriate settings in the answer area.

  NOTE: Each correct answer is worth one point.

  

  

  ---

  - Identities

  - B2B collaboration (Reset redemption status)

  Explanation To switch the email the guest uses to authenticate, you update the guest user’s sign-in identity details (Identities) and then reset the redemption status so the user redeems a new invitation tied to the new email while keeping the same object ID and assignments.

  Proof (short excerpts + citations)

  - “reset the user's redemption status and reinvite the user while keeping the user's object ID …” Microsoft. (2025-02-05). https://learn.microsoft.com/en-us/entra/external-id/reset-redemption-status

  Exam Tips:

  - Don’t delete/recreate a guest user if you need to change sign-in email-reset redemption status + reinvite preserves object-ID-based access.

  AZ-104 Exam Objective Hierarchy

  1.0 Manage Azure identities and governance (20–25%) |__1.1 Manage Microsoft Entra users and groups |__|__1.1.4 Manage external users

• Question 299:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named Dev.

  You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.

  Solution: On Dev, you assign the Contributor role to the Developers group.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Yes

  Assigning the "Contributor" role to the "Developers" group at the "Dev resource group" scope meets the goal because:

  - "Contributor" provides permissions to create, update, and delete resources within the assigned scope. Creating an "Azure Logic App" is a resource management action, so Developers can create Logic Apps in the Dev resource group.

  - The scenario does not require the Developers group to grant access to others. Contributor's key limitation is that it cannot manage access (i.e., cannot assign RBAC roles), which is not part of the stated requirement.

  - Scoping the role assignment to the "Dev resource group" is appropriate when the requirement is limited to resources in that group.

  Microsoft Exam Tips:

  - "Contributor vs Owner:" Contributor can manage resources, but "cannot assign roles". If the requirement includes "grant others access," expect "Owner" or "User Access Administrator" (or another role permitting roleAssignments/ write).

  - "Scope is a core AZ-104 concept:" Prefer "resource group scope" when the task is limited to a single resource group; avoid subscription scope unless required.

  - For "Does this meet the goal?" questions, validate both:

  1) The "role" includes the needed actions (create/manage the resource type).

  2) The "scope" matches where the resources live (resource group Dev).

  Summary:

  - Azure RBAC built-in roles

  - Contributor role capabilities and limitations

  - Role assignment scope (resource group)

  - Permissions required to create Azure Logic Apps

  AZ-104 Exam Objective Alignment (Hierarchy)

  1.0 Manage Azure identities and governance | 1.2 Manage access to Azure resources | 1.2.2 Assign roles at different scopes

• Question 300:

  You have an Azure subscription that contains multiple virtual machines in the West US Azure region.

  You need to use Traffic Analytics in Azure Network Watcher to monitor virtual machine traffic.

  Which two resources should you create? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. a Log Analytics workspace
  B. an Azure Monitor workbook
  C. a storage account
  D. a Microsoft Sentinel workspace
  E. a Data Collection Rule (DCR) in Azure Monitor
  A. a Log Analytics workspace
  C. a storage account

  ---

  a Log Analytics workspace

  a storage account

  Traffic Analytics is built on NSG flow logs:

  - NSG flow logs are written to a storage account.

  - Traffic Analytics processes flow logs and surfaces analytics in Log Analytics.

  Not selected:

  - an Azure Monitor workbook: optional visualization layer, not required.

  - a Microsoft Sentinel workspace: not required for Traffic Analytics.

  - a Data Collection Rule (DCR): DCR is for Azure Monitor Agent data collection, not NSG flow logs.

  Microsoft Exam Tips:

  - If the feature is "Traffic Analytics," anchor on "NSG flow logs + storage + Log Analytics."

  Summary:

  Traffic Analytics prerequisites: storage account for flow logs and Log Analytics for analytics.

  AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources

  5.1 Monitor resources in Azure

  5.1.6 Use Azure Network Watcher and Connection Monitor