Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 311:

  You have an Azure virtual machine named VM1 that runs Windows Server 2019.

  You save VM1 as a template named Template1 to the Azure Resource Manager library.

  You plan to deploy a virtual machine named VM2 from Template1.

  What can you configure during the deployment of VM2?

  A. virtual machine size
  B. operating system
  C. administrator username
  D. resource group
  D. resource group

  ---

  resource group

  When you deploy a saved Azure Resource Manager (ARM) template from the Azure portal (Template1 in the ARM template library), the deployment experience always requires you to choose where the resources will be created. That includes selecting the subscription and the target resource group (you can select an existing resource group or create a new one during deployment).

  The other options are not guaranteed to be configurable "during deployment" unless the template author explicitly parameterized them:

  - virtual machine size: only configurable if the template exposes VM size as a parameter.

  - operating system: typically defined by the image reference in the template; not changed unless the template is designed to allow it.

  - administrator username: only configurable if the template exposes it as a parameter.

  Because "resource group" is always selectable in the portal deployment flow, it is the correct answer.

  Microsoft Exam Tips:

  - If the question says "during deployment" (portal-based ARM template deployment), the safest always-true configurable items are deployment scope items: subscription and resource group.

  - Anything about VM size, OS, usernames, etc., is only "during deployment" if it is parameterized in the template.

  Summary:

  - ARM template deployments in the portal always involve selecting the deployment scope (resource group), while most VM settings are only changeable if exposed as template parameters.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources  |__ 3.1 Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files |__ 3.1.4 Deploy resources by using an Azure Resource Manager template or a Bicep file

• Question 312:

  DRAG DROP

  Your network is configured as shown in the following exhibit.

  

  The firewalls are configured as shown in the following table.

  

  Prod1 contains a vCenter server.

  You install an Azure Migrate Collector on Test1.

  You need to discover the virtual machines.

  Which TCP port should be allowed on each firewall? To answer, drag the appropriate ports to the correct firewalls. Each port may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  Box 1 (FW1): Outbound 443

  Box 2 (FW2): Outbound 443

  Explanation:

  Both firewalls (FW1 and FW2) must allow outbound TCP 443 so that HTTPS traffic can flow out to required endpoints (Azure control plane/management, service dependencies, and most “secure web” communications). In Azure networking, outbound connectivity for most platform interactions and many service dependencies is HTTPS over port 443.

  Why Outbound 443 is correct:

  - HTTPS is the standard port for secure outbound connections (management endpoints, APIs, and many service integrations).

  - If either firewall blocks outbound 443, outbound HTTPS traffic will fail beyond that firewall, breaking end-to-end connectivity for those secure destinations.

  Why the other port options are not correct (given the key’s intent):

  - Inbound 80 / Inbound 995: inbound-only options don’t satisfy “outbound HTTPS” requirements.

  - Outbound 3389: RDP traffic is not the common requirement for service/API access and is typically avoided for internet-facing connectivity.

  References:

  1. Microsoft Learn. How network security groups filter network traffic in Azure.

  https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works Last updated: 07/28/2025. Date Accessed: 01/26/2026.

  2. Microsoft Learn. Azure network security groups overview (inbound/outbound rules; stateful behavior).

  https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview Last updated: Unable to locate on page. Date Accessed: 01/26/2026.

  Microsoft Exam Tips:

  - If a question is really about “allow secure outbound connectivity,” default to **Outbound 443 (HTTPS)** unless the scenario explicitly calls for a different protocol/port.

  - NSGs/firewalls in Azure are commonly tested as “what port must be open for management/service access?” - it’s usually 443.

  Summary:

  This question focused on identifying the required TCP port for secure outbound connectivity (HTTPS) through multiple firewall layers.

  AZ-104 Exam Objective Hierarchy:

  4.0 - Implement and manage virtual networking (15–20%) |__ 4.2 - Configure secure access to virtual networks |__ 4.2.1 - Create and configure network security groups (NSGs) and application security groups

  

  References:

  https://docs.microsoft.com/en-us/azure/migrate/migrate-appliance

• Question 313:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:

  

  User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.

  You need to create new user accounts in external.contoso.onmicrosoft.com.

  Solution: You instruct User3 to create the user accounts.

  Does that meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  ============================== Item 53 of 253 ============================== Answer

  -------------------------------------------------------------------------------- No

  -------------------------------------------------------------------------------- User1 created a NEW Microsoft Entra ID (Azure AD) tenant: external.contoso.onmicrosoft.com.

  Even though User3 is a "User administrator" in Azure Active Directory, that role is scoped to the ORIGINAL tenant (contoso.onmicrosoft.com) shown in the scenario table, not automatically to the newly created tenant.

  Because tenants are separate security boundaries, User3 cannot create users in the NEW tenant unless User3 is first added to that tenant and assigned the required role there.

  What would be required to make it work

  --------------------------------------------------------------------------------

  - Add/invite User3 into external.contoso.onmicrosoft.com, then

  - Assign an appropriate role in THAT tenant (User Administrator is typically least-privilege for user creation), then

  - User3 can create the new user accounts.

  References (Microsoft Learn)

  --------------------------------------------------------------------------------

  - Create users in Microsoft Entra ID:

  https://learn.microsoft.com/entra/identity/users/users-create-users

  - Microsoft Entra built-in roles (User Administrator / Global Administrator):

  https://learn.microsoft.com/entra/identity/role-based-access-control/permissions-reference

  Exam Tips

  --------------------------------------------------------------------------------

  - Roles do not transfer across tenants. Always verify *which tenant* the admin role applies to.

  - Prefer "User Administrator" over "Global Administrator" for user creation (least privilege).

  Summary

  -------------------------------------------------------------------------------- User3's User Administrator role applies to the original tenant only, so instructing User3 to create users in the new tenant does not meet the goal.

  EXAM OBJECTIVE ALIGNMENT (Hierarchy)

  -------------------------------------------------------------------------------- 1.0 Manage Azure identities and governance (20?5%) | |-1.1 Manage Microsoft Entra users and groups | | | |-1.1.1 Create users and groups

• Question 314:

  You have an Azure AD tenant named adatum.com that contains the groups shown in the following table.

  

  Adatum.com contains the users shown in the following table.

  

  You assign the Azure Active Directory Premium Plan 2 license to Group1 and User4.

  Which users are assigned the Azure Active Directory Premium Plan 2 license?

  A. User4 only
  B. User1 and User4 only
  C. User1, User2, and User4 only
  D. User1, User2, User3, and User4
  B. User1 and User4 only

  ---

  User1 and User4 only

  In Microsoft Entra ID group-based licensing, licenses assigned to a group are applied to direct user members of that group. Nested group membership is not processed for licensing. Here:

  • User1 is a direct member of Group1 → receives the license from Group1.
  • User4 is directly assigned the license → receives the license.
  • User2 and User3 are members of nested groups (Group2/Group3) → do not receive the license from Group1 via nesting.

  Therefore, the users assigned the license are User1 and User4 only.

  Why other selections are not correct:

  • Any option including User2 and/or User3 assumes nested groups are evaluated for licensing, which they are not.

  Exam Tips:

  • If you see nested groups plus licensing, remember: licensing applies to direct user members.
  • Separate “group nesting works for access” from “group nesting works for licensing” (it typically does not).

  Summary:
  
  Determining effective license assignment when licenses are assigned to a group and to a user.

  AZ-104 Exam Objective Hierarchy:
  
  1.0 Manage Azure Identities and Governance (20–25%)
  
  |__ 1.1 Manage Microsoft Entra Users and Groups
  
  |__ 1.1.3 Manage Licenses in Microsoft Entra ID

• Question 315:

  HOTSPOT

  You have an Azure subscription named Subscription1 that contains a virtual network VNet1.

  You add the users in the following table.

  

  Which user can perform each configuration? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Add subnet to VNet1: User1 and User3 only Assign a user the Reader role to VNet1: User1 only

  Explanation (Why this is correct)

  - Adding a subnet requires write permissions on virtual network subnets (Microsoft.Network/virtualNetworks/subnets/write). Owner and Network Contributor can do this; Entra directory roles (like Security Administrator) don’t grant Azure resource-plane permissions by themselves.

  - Assigning the Reader role requires permission to create role assignments (Microsoft.Authorization/roleAssignments/write), which is granted to Owner (and User Access Administrator), but not to Network Contributor.

  Exam Tip

  - Network Contributor can build network resources, but can’t grant RBAC permissions.

  References (APA)

  - Microsoft. (n.d.). Azure RBAC built-in roles. Microsoft Learn. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

  - Microsoft. (n.d.). Virtual network subnets. Microsoft Learn. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-subnet

  AZ-104 Exam Objective Hierarchy 1.0 Manage Azure identities and governance (20–25%) |__1.2 Manage access to Azure resources |__|__1.2.1 Manage built-in Azure roles |__|__1.2.2 Assign roles at different scopes 4.0 Implement and manage virtual networking (15–20%) |__4.1 Configure and manage virtual networks |__|__4.1.1 Create and configure virtual networks

• Question 316:

  You are the global administrator for an Azure Active Directory (Azure AD) tenet named adatum.com. You need to enable two-step verification for Azure users.

  What should you do?

  A. Create a sign-in risk policy in Azure AD Identity Protection
  B. Enable Azure AD Privileged Identity Management.
  C. Create and configure the Identity Hub.
  D. Configure a security policy in Azure Security Center.
  A. Create a sign-in risk policy in Azure AD Identity Protection

  ---

  Explanation

  --------------------------------------------------------------------------------

  Create a sign-in risk policy in Azure AD Identity Protection

  --------------------------------------------------------------------------------

  "Two-step verification" in Microsoft Entra context generally refers to requiring an additional verification method (MFA). Among the provided options, **Azure AD (Microsoft Entra) Identity Protection sign-in risk policy** is the one that can enforce additional verification controls (such as requiring MFA) based on risk conditions.

  The other choices (PIM, Identity Hub, Security Center policy) do not directly enable two-step verification for users.

  Why other selections are incorrect:

  - Enable Azure AD Privileged Identity Management.: PIM manages just-in-time privileged role activation; it is not the control to enable two-step verification for all users.

  - Create and configure the Identity Hub.: Not an MFA enablement mechanism for Entra users.

  - Configure a security policy in Azure Security Center.: Defender for Cloud/Security Center focuses on posture management and workload protection; it does not directly enable Entra two-step verification for users.

  --------------------------------------------------------------------------------

  References:

  1. Microsoft Entra ID Protection - sign-in risk policy (require MFA based on risk) https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-risk-policies Date Modified: Unable to locate Date Accessed: 01/25/2026

  2. Multifactor authentication (MFA) in Microsoft Entra ID (conceptual "two-step verification") https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mfa-howitworks Date Modified: Unable to locate Date Accessed: 01/25/2026

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - When the answer set includes Identity Protection policies, Microsoft is often testing "risk-based MFA" rather than generic MFA setup language.

  - PIM = privileged role governance; it is not the general mechanism to "turn on two-step verification."

  --------------------------------------------------------------------------------

  Summary:

  Given the options, Identity Protection sign-in risk policy is the only choice aligned with enforcing two-step verification (MFA) behavior.

  --------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) 1.1 Manage Microsoft Entra users and groups 1.1.2 Manage user and group properties

• Question 317:

  You have an Azure subscription named Subscription1 that contains an Azure Log Analytics workspace named Workspace1.

  You need to view the error from a table named Event.

  Which query should you run in Workspace1?

  A. Event | where EventType is "error"
  B. Event | search "error"
  C. select * from Event where EventType == "error"
  D. Get-Event Event | where {$_.EventType -eq "error"}
  B. Event | search "error"

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  Event | search "error"

  ----------------------------------------------------------------------------------------------------

  You are querying a Log Analytics workspace table named Event.

  - "search" is a valid Kusto Query Language (KQL) operator used to find a term across columns/records.

  - Therefore, `Event | search "error"` is a valid query to surface records containing the term "error" from the Event table.

  Why the other selections are not correct:

  - Event | where EventType is "error" This is not a reliable/standard Event table filter as written (field naming and operator usage are questionable for KQL). The option is not the best valid KQL choice provided.

  - select * from Event where EventType == "error" This is SQL syntax, not KQL.

  - Get-Event Event | where {$_.EventType -eq "error"} This is PowerShell-style syntax, not KQL.

  ----------------------------------------------------------------------------------------------------

  References:

  1. Kusto Query Language (KQL) - search operator https://learn.microsoft.com/en-us/kusto/query/search-operator?view=microsoft-fabric Date Modified: 05/20/2025 Date Access: 01/23/2026

  ----------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - Azure Monitor Logs uses KQL, not SQL and not PowerShell. Quickly eliminate "select * ..." and "Get-* ..." answers.

  - If the question says "Which query should you run in Log Analytics," assume KQL operators like `where`, `project`, `search`, `summarize`.

  Summary:

  - Selecting the correct KQL syntax to query Azure Monitor Logs (Log Analytics workspace tables).

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10?5%) |__ 5.1 Monitor resources in Azure |__ 5.1.3 Query and analyze logs in Azure Monitor

• Question 318:

  HOTSPOT

  You need to create storage5. The solution must support the planned changes.

  Which type of storage account should you use, and which account should you configure as the destination storage account? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Account kind: StorageV2 (general purpose v2) Destination: storage2

  The planned change is to configure replication for the **Blob service** (object replication). Object replication requires specific supported storage account kinds; commonly, both source and destination are **StorageV2 (GPv2)** accounts for standard scenarios.

  In the existing environment, storage2 is StorageV2. The other accounts are GPv1 (storage1), BlobStorage (storage3), and FileStorage (storage4), which do not meet the standard prerequisites for object replication.

  Therefore, create storage5 as StorageV2 and set storage2 as the destination.

  Case study (Contoso, Ltd. 2 Case Study.pdf), “Planned changes – create storage5 and configure storage replication for the Blob service”.

  Microsoft Learn – Object replication for block blobs. URL: https://learn.microsoft.com/en-us/azure/storage/blobs/object-replication-overview. Retrieved January 31, 2026. (Last updated date not captured due to web tool limits in this run.) Microsoft Learn – Storage account overview. URL: https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview. Retrieved January 31, 2026. (Last updated 2025-10-23.)

  - Object replication questions often collapse to: ‘both accounts must be GPv2’ (and the feature is for block blobs).

  - Validate account kinds first; many distractors are BlobStorage/GPv1/FileStorage.

  2.0 Implement and manage storage (15–20%) |__2.2 Configure and manage storage accounts |__|__2.2.1 Create and configure storage accounts |__|__2.2.3 Configure object replication

• Question 319:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure virtual machine named VM1 that runs Windows Server 2016.

  You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour.

  Solution:

  1. You create an Azure Log Analytics workspace and configure the data settings.

  2. You add the Microsoft Monitoring Agent VM extension to VM1.

  3. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  ---------------------------------------------------------------------

  Yes

  ---------------------------------------------------------------------

  The proposed solution meets the goal because:

  1) A Log Analytics workspace is the destination for VM log data, and log alert rules can evaluate queries against that workspace.

  - Microsoft Learn states that log search alert rules can monitor resources that send data to a Log Analytics workspace. (1)

  2) Adding the Microsoft Monitoring Agent (MMA) **VM extension** is an accepted way to get the (legacy) Log Analytics/Monitoring agent onto the VM for log collection (instead of a manual MSI install).

  - Microsoft Learn troubleshooting guidance for the Windows agent shows the Log Analytics extension/agent installation path and includes an agent/extension install completion message for the "Microsoft Monitoring Agent VM Extension." (2)

  3) Once the VM is sending Windows event logs to the workspace (via the agent/extension) and you configure the workspace to collect the System event log, you can create a log alert that triggers when the query count of errors exceeds the threshold within the time window (1 hour).

  - Microsoft Learn tutorial guidance reinforces that log alerts are created from log queries and evaluated on a schedule. (3)

  Therefore, replacing "install the agent manually" with "add the Microsoft Monitoring Agent VM extension" does **not** break the solution-the extension is effectively performing the agent deployment needed for Log Analytics-based alerting.

  Official source excerpts (verbatim, short):

  (1) "Use log search alert rules to monitor all resources that send data to the Log Analytics workspace." (2) "Completed installing the Microsoft Monitoring Agent VM Extension." (3) "Once you verify your query, you can create the alert rule... Select New alert rule..."

  ---------------------------------------------------------------------

  References:

  (1) Microsoft Learn - Overview of Azure Monitor alerts Accessed: 2026-01-22 Last updated on: 2025-05-19 https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-overview

  (2) Microsoft Learn - Resolve Windows agent installation issues in Azure Monitor Accessed: 2026-01-22 Last updated on: 2026-01-15 https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agent-windows-troubleshoot

  (3) Microsoft Learn - Tutorial: Create a log search alert for an Azure resource Accessed: 2026-01-22 Last updated on: 2024-12-11 https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/tutorial-log-alert

  ---------------------------------------------------------------------

  Microsoft Exam Tips:

  - AZ-104 frequently tests **where the signal lives**:

  - **Metrics** --> Metric alert rules

  - **Logs (Windows Event Log / Syslog / custom logs)** --> **Log (scheduled query) alert rules** against a Log Analytics workspace.

  - Be aware of terminology shifts:

  - Legacy: Microsoft Monitoring Agent (MMA) / Log Analytics agent

  - Current direction: Azure Monitor Agent (AMA) using Data Collection Rules (DCRs) Exam items may still reference MMA/VM extensions, but Microsoft's newer guidance emphasizes AMA/DCRs.

  ---------------------------------------------------------------------

  Summary:

  This question covers Log Analytics-based monitoring for VMs, specifically collecting Windows System event log data into a Log Analytics workspace and triggering Azure Monitor log alerts.

  ---------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10?5%) 5.1 Monitor resources in Azure 5.1.3 Query and analyze logs in Azure Monitor 5.1.4 Set up alert rules, action groups, and alert processing rules in Azure Monitor

• Question 320:

  You need to implement a backup solution for App1 after the application is moved.

  What should you create first?

  A. a recovery plan
  B. an Azure Backup Server
  C. a backup policy
  D. a Recovery Services vault
  D. a Recovery Services vault

  ---

  Explanation

  A Recovery Services vault is a logical container that stores the backup data for each protected resource, such as Azure VMs. When the backup job for a protected resource runs, it creates a recovery point inside the Recovery Services vault.

  Scenario:

  There are three application tiers, each with five virtual machines.

  Move all the virtual machines for App1 to Azure.

  Ensure that all the virtual machines for App1 are protected by backups.

  https://docs.microsoft.com/en-us/azure/backup/quick-backup-vm-portal