Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 331:

  You have an Azure subscription that contains the resources in the following table.

  

  Store1 contains a file share named data. Data contains 5,000 files.

  You need to synchronize the files in the file share named data to an on-premises server named Server1.

  Which three actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Download an automation script.
  B. Create a container instance.
  C. Create a sync group.
  D. Register Server1.
  E. Install the Azure File Sync agent on Server1.
  C. Create a sync group.
  D. Register Server1.
  E. Install the Azure File Sync agent on Server1.

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  Create a sync group.

  Register Server1.

  Install the Azure File Sync agent on Server1.

  ----------------------------------------------------------------------------------------------------

  To synchronize an Azure file share (data) to an on-premises Windows Server (Server1) using Azure File Sync, you must set up the Azure File Sync "plumbing" end-to-end:

  Why the correct selections are correct:

  - Create a sync group.

  - A sync group is the logical unit that defines synchronization relationships. It contains the cloud endpoint (the Azure file share) and one or more server endpoints (paths on registered servers).

  - Register Server1.

  - Before Server1 can participate in sync, it must be registered with the Storage Sync Service. Registration establishes trust and allows the service to manage sync metadata for that server.

  - Install the Azure File Sync agent on Server1.

  - The agent is required on the Windows Server to perform the actual sync operations (download/upload changes, namespace, and optional cloud tiering).

  Why the other selections are incorrect:

  - Download an automation script.

  - No automation script is required to enable Azure File Sync. The required components are the agent + server registration + sync group/server endpoint configuration.

  - Create a container instance.

  - Azure Container Instances is unrelated. Azure File Sync synchronizes between Azure Files and Windows Servers; it does not require containers.

  ---------------------------------------------------------------------------------------------------- References:

  1. Azure File Sync ?Replace a server (includes required steps: install agent, register server, and create/attach to sync group) https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-replace-server Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  2. Az.StorageSync PowerShell module overview (covers server registration and sync group concepts) https://learn.microsoft.com/en-us/powershell/module/az.storagesync/ Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104 frequently tests "sequence" for Azure File Sync: Storage Sync Service -> Sync group -> (cloud endpoint + registered server + server endpoint).

  - Distinguish Azure Files (file shares) vs. Azure Blob containers vs. Azure File Sync (hybrid sync feature for Azure Files).

  ---------------------------------------------------------------------------------------------------- Summary:

  Azure File Sync prerequisites and core configuration steps (sync group, server registration, agent installation).

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15?0%) |__ 2.3 Configure Azure Files and Azure Blob Storage |__ 2.3.1 Create and configure a file share in Azure Storage

• Question 332:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company registers a domain name of contoso.com.

  You create an Azure DNS zone named contoso.com, and then you add an A record to the zone for a host named www that has an IP address of 131.107.1.10.

  You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address.

  You need to resolve the name resolution issue.

  Solution: You modify the SOA record in the contoso.com zone.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  Changing the SOA record inside the Azure DNS zone does not fix Internet resolution if the domain is not delegated to Azure DNS. Public resolvers must first be directed to Azure DNS via the registrar's NS delegation; SOA tuning does not substitute for delegation.

  -------------------------------------------------------------------------------- References:

  1. Tutorial: Host your domain in Azure DNS https://learn.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns Date Modified: 06/11/2024 Date Access: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: Delegation (NS at registrar) is the gating step for public DNS.

  - SOA changes are rarely the primary fix for "public hosts can't resolve" immediately after zone creation.

  -------------------------------------------------------------------------------- Summary:

  SOA edits don't resolve missing delegation to Azure DNS.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.3 Configure name resolution and load balancing |__ 4.3.1 Configure Azure DNS

• Question 333:

  DRAG DROP

  You have an Azure subscription named Subscription1.

  You create an Azure Storage account named contosostorage, and then you create a file share named data.

  Which UNC path should you include in a script that references files from the data file share? To answer, drag the appropriate values to the correct targets. Each value may be used once, more than once or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  \\contosostorage.file.core.windows.net\data

  You are accessing an Azure Files (SMB) file share named "data" in the storage account "contosostorage". Azure Files uses the file service endpoint suffix "file.core.windows.net", and the UNC path format is:

  \\<storageAccountName>.file.core.windows.net\<fileShareName>

  Substituting the given names:

  - storage account name: contosostorage

  - file share name: data

  Result:

  \\contosostorage.file.core.windows.net\data

  Why the other provided values are not used:

  - blob / blob.core.windows.net:

  - These relate to Blob Storage endpoints, not Azure Files (SMB) shares.

  - portal.azure.com:

  - This is the Azure portal URL, not a storage endpoint.

  - subscription1:

  - Subscription name is not part of the Azure Files UNC path.

  Microsoft Exam Tips:

  - For Azure Files (SMB), the endpoint is almost always:

  \\<storageAccountName>.file.core.windows.net\<shareName>

  - If you see "blob.core.windows.net", that’s Blob Storage - not the UNC path for Azure Files.

  Summary:

  This question tested how to construct the correct UNC path to access an Azure Files share using the storage account name and the Azure Files endpoint suffix.

  AZ-104 Exam Objective Hierarchy:

  2.0 - Implement and manage storage (15–20%) |__ 2.3 - Configure Azure Files and Azure Blob Storage |__ 2.3.1 - Create and configure a file share in Azure Storage

  Box 1: contosostorage The name of account

  Box 2: file.core.windows.net

  Box 3: data The name of the file share is data.

  Example:

  

  https://docs.microsoft.com/en-us/azure/storage/files/storage-how-to-use-files-windows

• Question 334:

  Your company's Azure subscription includes Azure virtual machines (VMs) that run Windows Server 2016.

  One of the VMs is backed up every day using Azure Backup Instant Restore.

  When the VM becomes infected with data encrypting ransomware, you are required to restore the VM.

  Which of the following actions should you take?

  A. You should restore the VM after deleting the infected VM.
  B. You should restore the VM to any VM within the company's subscription.
  C. You should restore the VM to a new Azure VM.
  D. You should restore the VM to an on-premise Windows device.
  C. You should restore the VM to a new Azure VM.

  ---

  Explanation

  --------------------------------------------------------------------------------

  You should restore the VM to a new Azure VM

  --------------------------------------------------------------------------------

  In a ransomware infection scenario, restoring to a new Azure VM is a best-practice approach because it avoids overwriting the infected VM, supports clean recovery, and can preserve the infected VM for forensics/containment if needed.

  Azure Backup supports restoring as a new VM, which is the appropriate action here.

  Why the other choices are not correct:

  - Restore after deleting the infected VM: unnecessary and reduces options for investigation/containment.

  - Restore to any VM within the subscription: VM restore is typically performed as a new VM or replacing an existing VM using supported restore workflows; "any VM" is not the standard restore target concept.

  - Restore to an on-prem Windows device: Azure VM backup restore is oriented to Azure VM restore workflows; cross-environment restore is not the standard action for this question.

  References:

  1. Microsoft Learn. "Restore an Azure VM from a backup." https://learn.microsoft.com/en-us/azure/backup/backup-azure-arm-restore-vms. Accessed 2026-01-25.

  2. Microsoft Learn. "Azure Backup security and ransomware considerations." https://learn.microsoft.com/en-us/azure/backup/backup-azure-security. Accessed 2026-01-25.

  Microsoft Exam Tips:

  - For "restore the VM" (not just files), the exam commonly expects "restore to a new VM" unless the stem explicitly requires "replace existing."

  Summary:

  Azure VM restore strategy after ransomware infection.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10?5%) |__ 5.2 Implement backup and recovery |__ 5.2.4 Perform backup and restore operations by using Azure Backup

• Question 335:

  You have an Azure tenant that contains two subscriptions named Subscription1 and Subscription2.

  In Subscription1, you deploy a virtual machine named Server1 that runs Windows Server 2016. Server1 uses managed disks.

  You need to move Server1 to Subscription2. The solution must minimize administration effort.

  What should you do first?

  A. In Subscription2, create a copy of the virtual disk.
  B. From Azure PowerShell, run the Move-AzureRmResource cmdlet.
  C. Create a snapshot of the virtual disk.
  D. Create a new virtual machine in Subscription2.
  B. From Azure PowerShell, run the Move-AzureRmResource cmdlet.

  ---

  Explanation

  -----------------------------------------------------------------------

  From Azure PowerShell, run the Move-AzureRmResource cmdlet.

  -----------------------------------------------------------------------

  To move a VM that uses managed disks to another subscription in the same tenant while minimizing effort, you perform a resource move. The PowerShell cmdlet Move-AzureRmResource (modern equivalent: Move-AzResource) is designed

  for moving resources (including dependent resources when included) across resource groups/subscriptions.

  Why the other selections are incorrect:

  - Create a copy of the virtual disk in Subscription2: That's a manual, higher-effort approach and does not move the VM resource state directly.

  - Create a snapshot of the virtual disk: A snapshot alone does not move the VM; it's an intermediate artifact.

  - Create a new virtual machine in Subscription2: This is more administrative effort and is not the direct "move" approach.

  ----------------------------------------------------------------------- References:

  1. Move resources to a new resource group or subscription (Microsoft Learn) https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription Date Modified: 03/06/2025 Date Accessed: 01/25/2026 2. Move-AzResource (Move-AzureRmResource legacy) (Microsoft Learn) https://learn.microsoft.com/en-us/powershell/module/az.resources/move-azresource Date Modified: Unable to locate in snippet Date Accessed: 01/25/2026

  ----------------------------------------------------------------------- Microsoft Exam Tips:

  - "Minimize admin effort" for subscription/resource group relocation --> Move resources (portal/PowerShell).

  - Expect dependency requirements: include VM + NIC + disks + public IP, etc., in the move set.

  ----------------------------------------------------------------------- Summary:

  This tests moving a managed-disk VM to another subscription using Resource Manager move operations.

  ----------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) 3.2 Create and configure virtual machines 3.2.3 Move a virtual machine to another resource group, subscription, or region

• Question 336:

  HOTSPOT

  You have an Azure subscription that contains the hierarchy shown in the following exhibit.

  

  You create an Azure Policy definition named Policy1.

  To which Azure resources can you assign Policy and which Azure resources can you specify as exclusions from Policy1? To answer, select the appropriate options in the answer NOTE Each correct selection is worth one point.

  

  

  ---

  Assign Policy1 to: Tenant Root Group, ManagementGroup1, Subscription1, RG1, and VM1 only Exclude Policy1 from: ManagementGroup1, Subscription1, RG1, and VM1 only

  Explanation (Why this is correct)

  - Azure Policy assignments can be scoped at management group, subscription, resource group, or individual resource.

  - When you assign at a higher scope (Tenant Root Group), you can exclude lower scopes/resources using exclusions (notScopes), which is why excluding the management group/subscription/resource group/resource is valid.

  Explanation (Why the other options are not correct)

  - Exclusions must be within (or below) the assignment scope; you can’t exclude something “above” the assignment.

  Exam Tip

  - Assign high, then carve out with exclusions: **scope --> notScopes**.

  References (APA)

  - Microsoft. (n.d.). Policy assignment - Create or update (REST). https://learn.microsoft.com/en-us/rest/api/policy/policy-assignments/create-or-update

  AZ-104 Exam Objective Hierarchy 1.0 Manage Azure identities and governance (20–25%) |__1.3 Manage Azure subscriptions and governance |__|__1.3.1 Implement and manage Azure Policy |__|__1.3.7 Configure management groups

  

  Box 2: ManagementGroup1, Subscription1, RG1, and VM1 You can exclude a subscope from the assignment.

  https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview

• Question 337:

  You have an Azure subscription.

  You activate Enterprise Mobility + Security E5 licenses for all users.

  You need the users to request approval before they can create virtual machines.

  What should you configure first?

  A. Azure Active Directory (Azure AD) conditional access policies
  B. Azure Active Directory (Azure AD) Authentication methods
  C. Azure Active Directory (Azure AD) Privileged Identity Management for the Azure resource roles
  D. Azure Active Directory (Azure AD) Privileged Identity Management for the Azure AD directory roles
  C. Azure Active Directory (Azure AD) Privileged Identity Management for the Azure resource roles

  ---

  Explanation

  --------------------------------------------------------------------------------

  Azure Active Directory (Azure AD) Privileged Identity Management for the Azure resource roles

  --------------------------------------------------------------------------------

  If users must **request approval** before they can perform privileged actions such as creating virtual machines, the correct control is **Azure AD Privileged Identity Management (PIM) for Azure resource roles**. PIM supports just-in-time activation, approval workflows, and time-bound elevation for Azure RBAC roles (such as Contributor/Owner or custom roles that permit VM creation).

  Why the other selections are incorrect:

  Azure AD conditional access policies: Controls authentication conditions (MFA, device state, location), not approval to gain Azure RBAC permissions.

  Azure AD Authentication methods: Governs how users authenticate (e.g., MFA methods), not Azure RBAC approvals.

  Azure AD PIM for Azure AD directory roles: Manages Entra directory roles (e.g., User Administrator), not Azure subscription/resource RBAC permissions.

  -------------------------------------------------------------------------------- References:

  1. Privileged Identity Management for Azure resources https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-resource-roles-overview Date Modified: Unable to locate exact date in this session Date Access: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - "Approval before creating resources" typically points to **PIM for Azure resources** (not Conditional Access).

  - Know the difference: **PIM (Azure resources)** vs **PIM (directory roles)**.

  Summary:

  Using PIM approval workflows to control privileged Azure RBAC actions.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance |__ 1.2 Manage access to Azure resources |__ 1.2.1 Manage built-in Azure roles

• Question 338:

  HOTSPOT

  You have an Azure subscription that contains a virtual network named VNet1. VNet1 uses an IP address space of 10.0.0.0/16 and contains the subnets in the following table:

  

  Subnet1 contains a virtual appliance named VM1 that operates as a router.

  You create a routing table named RT1.

  You need to route all inbound traffic from the VPN gateway to VNet1 through VM1.

  How should you configure RT1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Address prefix: 10.0.0.0/16

  Next hop type: Virtual appliance

  Assigned to: GatewaySubnet

  Why this is correct:

  You must force traffic originating from the VPN gateway toward the virtual network to go through VM1 (a router or NVA).

  A user-defined route that represents the virtual network address space (10.0.0.0/16) and points to a Virtual appliance makes the next hop VM1.

  To affect traffic from the VPN gateway, the route table must be associated with the GatewaySubnet (the subnet that contains the VPN gateway).

  Why the other options are not correct:

  Using a narrower prefix (such as a single /24) would not guarantee that all virtual network-bound traffic is routed through VM1.

  Selecting “Virtual network gateway” as the next hop would route traffic to the gateway, not through VM1.

  Assigning the route table to Subnet0 or Subnet1 would not control the gateway’s routing behavior.

  Microsoft Exam Tips

  If a question says “route traffic from the VPN gateway,” you almost always apply the user-defined route to GatewaySubnet.

  Summary

  Hot Area Tracking (delta): Attempted +1 | Correct +1 | Incorrect +0 | Skipped +0

  Mismatch or Duplicate Tracking (delta): Mismatch +0 | Duplicate +0

  AZ-104 Exam Objective Hierarchy

  4.0 Implement and manage virtual networking (15–20%)

  |__ 4.1 Configure and manage virtual networks in Azure

  |__ 4.1.4 Configure user-defined network routes

• Question 339:

  You download an Azure Resource Manager template based on an existing virtual machine. The template will be used to deploy 100 virtual machines.

  You need to modify the template to reference an administrative password. You must prevent the password from being stored in plain text.

  What should you create to store the password?

  A. Azure Active Directory (AD) Identity Protection and an Azure policy
  B. a Recovery Services vault and a backup policy
  C. an Azure Key Vault and an access policy
  D. an Azure Storage account and an access policy
  C. an Azure Key Vault and an access policy

  ---

  an Azure Key Vault and an access policy

  You need to deploy 100 VMs from an ARM template and reference an administrative password without storing it in plain text in the template. The standard Azure pattern is:

  - Store the secret (password) in Azure Key Vault.

  - Grant the deployment identity (user, service principal, or managed identity running the deployment) permissions to read the secret via Key Vault access control (historically "access policies," or via Azure RBAC if the vault is configured for RBAC).

  - Reference the secret in the ARM template using a Key Vault reference (secure parameter / KeyVault reference), which keeps the password out of the template content and parameter files.

  This meets the requirement to prevent the password from being stored in plain text while still enabling automated deployments at scale.

  Why the other options are not correct:

  - Azure AD Identity Protection and an Azure policy:

  Identity Protection and Azure Policy do not provide secret storage for an ARM template password.

  - A Recovery Services vault and a backup policy:

  Recovery Services vault is for backup/recovery, not secret storage.

  - An Azure Storage account and an access policy:

  Storage accounts do not provide a secure secret store equivalent to Key Vault for ARM template secret references; storing a password in a storage object is not the intended secure pattern.

  Exam Tips:

  - If the stem says "ARM template" + "password/secret" + "must not be in plain text," the intended answer is almost always "Key Vault + permission model (access policy/RBAC)."

  - Remember: securestring parameters help avoid plain text in the template, but Key Vault is the expected best practice when you must centrally store and reuse secrets across many deployments.

  - On newer vaults, you may see "Azure RBAC for Key Vault" instead of classic access policies; the exam may still use "access policy" wording.

  Summary:

  - Secure secret storage for ARM template deployments

  - Using Key Vault secrets and granting read access to the deployment identity

  - Referencing secrets from Key Vault so passwords are not stored in templates/parameter files

• Question 340:

  You have two subscriptions named Subscription1 and Subscription2. Each subscription is associated to a different Azure AD tenant.

  Subscription1 contains a virtual network named VNet1. VNet1 contains an Azure virtual machine named VM1 and has an IP address space of 10.0.0.0/16.

  Subscription2 contains a virtual network named VNet2. VNet2 contains an Azure virtual machine named VM2 and has an IP address space of 10.10.0.0/24.

  You need to connect VNet1 to VNet2.

  What should you do first?

  A. Move VNet1 to Subscription2.
  B. Modify the IP address space of VNet2.
  C. Provision virtual network gateways.
  D. Move VM1 to Subscription2.
  C. Provision virtual network gateways.

  ---

  Provision virtual network gateways.

  Why this is correct:

  - You need to "connect VNet1 to VNet2."

  - The options provided do not include VNet peering. Given the answer set, the valid Azure-native way to connect VNets is a VNet-to-VNet VPN connection, which requires provisioning virtual network gateways. The first step is to provision the gateways before you can create the VNet-to-VNet connection. (1)

  Why the other options are incorrect:

  - Move VNet1 to Subscription2.

  Moving VNets across subscriptions is not required to connect VNets, and it introduces risk/complexity. Connectivity does not require relocation.

  - Modify the IP address space of VNet2.

  IP ranges must not overlap for many connectivity options, but here they already do not overlap (10.0.0.0/16 vs 10.10.0.0/24). There is no requirement to change VNet2's address space.

  - Move VM1 to Subscription2.

  Moving a VM does not connect VNets. Connectivity is established at the network level (peering or gateways), not by relocating compute.

  Microsoft Exam Tips:

  - When "connect VNets" appears and "peering" is not an option, look for "virtual network gateways" (VNet-to-VNet VPN).

  Summary:

  - VNet-to-VNet connectivity requires virtual network gateways when peering is not available/selected.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.1 Configure and manage virtual networks in Azure |__ 4.1.5 Troubleshoot network connectivity