Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 341:

  HOTSPOT

  You have an Azure subscription that contains two storage accounts named contoso101 and contoso102.

  The subscription contains the virtual machines shown in the following table.

  

  VNet1 has service endpoints configured as shown in the Service endpoints exhibit. (Click the Service endpoints tab.)

  

  The Microsoft.Storage service endpoint has the service endpoint policy shown in the Microsoft.Storage exhibit. (Click the Microsoft.Storage tab.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  1) VM1 can access contoso102. --> No

  2) VM2 can access contoso101. --> No

  3) VM2 uses a private IP address to access Azure AD. --> Yes

  Why these are correct:

  1) Subnet1 has Microsoft.Storage service endpoint + a service endpoint policy that allow-lists contoso101. Therefore contoso102 is blocked.

  2) VM2 is in Subnet2. The exhibit shows Subnet2 has Microsoft.AzureActiveDirectory service endpoint, while Microsoft.Storage is shown on Subnet1. In this design, VM2 won’t match the Storage endpoint/policy path used to reach contoso101 --> no access (per exam pattern of “selected networks only”).

  3) With service endpoints, service traffic can switch to using the VNet’s private addressing as the source when reaching the service (as opposed to requiring public internet routing).

  Exam tips:

  - Service endpoint policy is an allow-list: if it doesn’t include the resource, access is denied (via the endpoint path).

  - “Private IP to the service” is often exam shorthand for “service endpoints keep traffic on the backbone and use VNet identity/private addressing behavior”.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15–20%) |__2.1 Configure access to storage |__|__2.1.1 Configure network access to storage accounts 4.0 Implement and manage virtual networking (20–25%) |__4.2 Implement and manage secure access to Azure resources |__|__4.2.4 Configure service endpoints

• Question 342:

  You have an Azure web app named App1. App1 has the deployment slots shown in the following table:

  

  In webapp1-test, you test several changes to App1.

  You back up App1.

  You swap webapp1-test for webapp1-prod and discover that App1 is experiencing performance issues.

  You need to revert to the previous version of App1 as quickly as possible.

  What should you do?

  A. Redeploy App1
  B. Swap the slots
  C. Clone App1
  D. Restore the backup of App1
  B. Swap the slots

  ---

  Swap the slots

  After you swapped staging into production and discovered performance issues, the fastest rollback is to swap the slots again. A slot swap is effectively reversible: the previous production version typically resides in the staging slot after the swap, so swapping again returns the last-known-good version to production quickly.

  Why the other selections are not correct:

  - Redeploy App1:

  Slower and introduces additional deployment risk compared to a quick slot swap rollback.

  - Clone App1:

  Does not provide the quickest path to restore production and adds complexity.

  - Restore the backup of App1:

  Backups are useful, but restoring is typically slower than simply swapping slots back.

  Exam Tips:

  - AZ-104 commonly tests rollback strategy: deployment slots enable rapid rollback by swapping back.

  - Know the operational tradeoff: swap (fast) vs redeploy/restore (slower).

  Summary:

  Using App Service deployment slots to rapidly revert a bad production deployment.

• Question 343:

  You have an Azure subscription that has Traffic Analytics configured.

  You deploy a new virtual machine named VM1 that has the following settings:

  1. Region: East US

  2. Virtual network: VNet1

  3. NIC network security group: NSG1

  You need to monitor VM1 traffic by using Traffic Analytics.

  Which settings should you configure?

  A. Diagnostic settings for VM1
  B. NSG flow logs for NSG1
  C. Diagnostic settings for NSG1
  D. Insights for VM1
  B. NSG flow logs for NSG1

  ---

  NSG flow logs for NSG1

  Traffic Analytics consumes NSG flow logs. Since VM1's effective traffic enforcement is via NSG1, enabling NSG flow logs on NSG1 is the required configuration to feed Traffic Analytics.

  Not selected:

  - Diagnostic settings for VM1/NSG1: not the mechanism for Traffic Analytics (it uses NSG flow logs).

  - Insights for VM1: VM Insights focuses on guest/VM performance and dependencies, not NSG traffic analytics.

  Microsoft Exam Tips:

  - "Traffic Analytics" almost always implies "NSG flow logs" as the data source.

  Summary:

  Enable NSG flow logs on the relevant NSG to use Traffic Analytics.

  AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources  | |__ 5.1 Monitor resources in Azure | |__ 5.1.6 Use Azure Network Watcher and Connection Monitor

• Question 344:

  HOTSPOT

  You have a sync group that has the endpoints shown in the following table.

  

  Cloud tiering is enabled for Endpoint3.

  You add a file named File1 to Endpoint1 and a file named File2 to Endpoint2.

  You need to identify on which endpoints File1 and File2 will be available within 24 hours of adding the files.

  What should you identify? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1 (File1): Endpoint1 only

  Box 2 (File2): Endpoint1, Endpoint2, and Endpoint3

  Explanation:

  Given:

  - Endpoint1 = Cloud endpoint

  - Endpoint2 = Server endpoint

  - Endpoint3 = Server endpoint (cloud tiering enabled)

  Key Azure File Sync behavior:

  - Changes made on a SERVER endpoint are discovered and synced promptly (upload to cloud, then to other servers).

  - Changes made directly in the CLOUD endpoint (Azure file share) require the cloud change detection job to discover them; that job runs on a schedule (once every 24 hours). Therefore, within a 24-hour window, cloud-originated changes are not guaranteed to have reached server endpoints unless change detection is manually invoked.

  File1 added to Endpoint1 (cloud):

  - Within 24 hours, the only guaranteed location is Endpoint1 itself.

  Answer: Endpoint1 only

  File2 added to Endpoint2 (server):

  - Server-originated changes are synced to the cloud endpoint and then replicated to other server endpoints.

  - Cloud tiering on Endpoint3 may tier the content, but the file is still considered “available” (at least as a stub/namespace entry) after sync.

  Answer: Endpoint1, Endpoint2, and Endpoint3

  References:

  1. Plan for an Azure File Sync deployment (cloud endpoint change detection runs only once every 24 hours).

  URL: https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-planning Last updated: 09/26/2025. Date Accessed: 01/27/2026.

  2. Troubleshoot Azure File Sync sync health and errors (change detection job initiated every 24 hours).

  FQDN: learn.microsoft.com URL: https://learn.microsoft.com/en-us/troubleshoot/azure/azure-storage/files/file-sync/file-sync-troubleshoot-sync-errors

  Last updated: 08/25/2025. Date Accessed: 01/27/2026.

  3. Invoke-AzStorageSyncChangeDetection (manual trigger for detecting changes made directly in the Azure file share).

  FQDN: learn.microsoft.com URL: https://learn.microsoft.com/en-us/powershell/module/az.storagesync/invoke-azstoragesyncchangedetection?view=azps-15.2.0 Last updated: Unable to locate on page. Date Accessed: 01/27/2026.

  Microsoft Exam Tips:

  - “File created in the cloud endpoint” --> think “change detection job” (often 24-hour cadence unless manually triggered).

  - “File created on a server endpoint” --> usually syncs to the cloud and other servers much faster.

  Summary:

  Cloud-originated changes aren’t guaranteed to replicate within 24 hours without change detection, but server-originated changes will replicate across the sync group.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15–20%) └─ 2.3 Configure Azure Files and Azure Blob Storage └─ 2.3.1 Create and configure a file share in Azure Storage

• Question 345:

  You have an Azure Kubernetes cluster in place.

  You have to deploy an application using an Azure Container registry image.

  Which of the following command can be used for this requirement?

  A. az kubernetes deploy
  B. kubectl apply
  C. New-AzKubernetes set
  D. docker run
  B. kubectl apply

  ---

  Explanation

  --------------------------------------------------------------------------------

  kubectl apply

  --------------------------------------------------------------------------------

  In AKS, workloads are deployed via Kubernetes manifests (YAML). The standard command to create/update resources from a manifest file is kubectl apply (for example, kubectl apply -f deployment.yaml). The container image source (ACR) is referenced in the manifest (image: <acr-login-server>/<repo>:<tag>).

  Why other options are not correct:

  - az kubernetes deploy: Not the standard/primary AKS deployment mechanism for manifests.

  - New-AzKubernetes set: Not a valid/common cmdlet for deploying Kubernetes resources in this context.

  - docker run: Runs a container locally/on a single host; it does not deploy to a Kubernetes cluster.

  -------------------------------------------------------------------------------- References:

  1. Kubernetes: kubectl apply https://kubernetes.io/docs/reference/kubectl/generated/kubectl_apply/ Date Modified: Unable to locate date modified (page shows relative "Published") Date Access: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: Expect basic kubectl literacy (apply/get/describe/logs) even though AKS is not a deep admin focus.

  - Image pull from ACR typically requires cluster identity permissions or imagePullSecrets.

  -------------------------------------------------------------------------------- Summary:

  Use kubectl apply to deploy/update AKS resources defined in YAML manifests.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.3 Provision and manage containers in the Azure portal |__ 3.3.1 Create and manage an Azure container registry

• Question 346:

  You have an Azure Active Directory (Azure AD) tenant named contoso.com that is synced to an Active Directory domain. The tenant contains the users shown in the following table.

  

  The users have the attributes shown in the following table.

  

  You need to ensure that you can enable Azure Multi-Factor Authentication (MFA) for all four users.

  Solution: You add an office phone number for User2.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  ---------------------------------------------------------------------------------------------------------------------------------

  No

  ---------------------------------------------------------------------------------------------------------------------------------

  The goal is to ensure you can enable Azure MFA for all four users. The proposed solution is: "Add an office phone number for User2."

  User2's source is Windows Server Active Directory (synced user). For synced identities, key user attributes (including phone-related attributes) are typically mastered on-premises and are read-only or overwritten in Microsoft Entra ID. If you "add an office phone number for User2" in the cloud tenant, the value will not reliably persist because the next directory sync can overwrite it with the on-premises values.

  Therefore, as written, the solution does not meet the goal because it does not specify updating the authoritative source (on-premises AD) and syncing, nor does it address MFA method registration in a way that guarantees User2 can complete MFA.

  What would meet the goal (high-level):

  - Update User2's phone attribute in on-premises AD (or ensure a supported MFA method can be registered), then allow sync to populate Entra ID; and/or

  - Ensure User2 registers a valid MFA method (Authenticator app, phone, etc.) via Security info.

  Why the other users are not the blocker:

  - User1 already has office and mobile.

  - User3 (Guest) can be required to perform MFA, but their method registration is governed by B2B/tenant policies; you typically don't "populate" their phone numbers like internal users.

  - User4 has an office phone, which can be sufficient depending on allowed MFA methods.

  ---------------------------------------------------------------------------------------------------------------------------------

  References:

  (1) Microsoft Learn - Directory synchronization and how certain user attributes are managed for synced users https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/ Date accessed: 2026-01-22 Last updated: Not verified in this session

  (2) Microsoft Learn - Set up and manage authentication methods (Security info / MFA registration concepts) https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods Date accessed: 2026-01-22 Last updated: Not verified in this session

  (3) Microsoft Learn - B2B collaboration and external user authentication behavior (guest users and MFA/CA enforcement concepts) https://learn.microsoft.com/en-us/entra/external-id/b2b/ Date accessed: 2026-01-22 Last updated: Not verified in this session

  ---------------------------------------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - If a user's "Source" is Windows Server AD (synced), assume many profile attributes are mastered on-premises. If the fix is "update a user attribute," the safe exam move is "update on-prem and sync," not "edit in Entra."

  - "Enable MFA" questions often hinge on whether the user can register an authentication method, not whether a profile field exists.

  - For guest users, enforcement is commonly via Conditional Access; don't assume you can administer their phone numbers the same way as members.

  ---------------------------------------------------------------------------------------------------------------------------------

  Summary:

  - Hybrid identity (synced users) attribute authority and write-back considerations

  - MFA enablement depends on valid authentication method registration

  - Distinguishing member vs guest user management patterns

  ---------------------------------------------------------------------------------------------------------------------------------

  AZ-104 Exam Objective Alignment (Hierarchy)

  ------------------------------------------ 1.0 Manage Azure identities and governance (20?5%) | 1.1 Manage Microsoft Entra users and groups | 1.1.2 Manage user and group properties

• Question 347:

  HOTSPOT

  You have an Azure subscription that contains a storage account named storage1. The subscription is linked to an Azure Active Directory (Azure AD) tenant named contoso.com that syncs to an on-premises Active Directory domain.

  The domain contains the security principals shown in the following table.

  

  In Azure AD, you create a user named User2.

  The storage1 account contains a file share named share1 and has the following configurations.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Statement 1: Yes

  Statement 2: No

  Statement 3: Yes

  Why this is correct:

  - Statement 1 (Yes): User1 is a valid security principal (synced from on-prem AD DS) and can be assigned Azure RBAC roles for the storage account.

  - Statement 2 (No): A computer account object is not typically the intended principal for subscription/resource RBAC assignment in this scenario; the expected assignable principal here is a user/group/service principal, not a domain computer object.

  - Statement 3 (Yes): You can assign Azure RBAC roles to an Azure AD user (User2). (Whether that user can successfully authenticate to the SMB endpoint is a separate identity-based access configuration issue.)

  Exam Tip:

  - RBAC assignment eligibility ≠ “will successfully authenticate over SMB.” Don’t conflate those.

  AZ-104 Exam Objective Hierarchy

  2.0 Implement and manage storage (15–20%) |__2.3 Configure Azure Files and Azure Blob Storage |__|__2.3.1 Configure Azure Files

• Question 348:

  You have an app named App1 that runs on an Azure web app named webapp1.

  The developers at your company upload an update of App1 to a Git repository named Git1.

  Webapp1 has the deployment slots shown in the following table.

  

  You need to ensure that the App1 update is tested before the update is made available to users.

  Which two actions should you perform? Each correct answer presents part of the solution.

  A. Stop webapp1 prod.
  B. Stop webapp1-test
  C. Deploy the App1 update to webapp1-test, and then test the update.
  D. Deploy the App1 update to webapp1-prod, and then test the update.
  E. Swap the slots.
  C. Deploy the App1 update to webapp1-test, and then test the update.
  E. Swap the slots.

  ---

  Deploy the App1 update to webapp1-test, and then test the update.

  Swap the slots.

  The standard App Service safe-release pattern is:

  1) Deploy and validate changes in a staging slot (webapp1-test).

  2) After validation, swap the staging slot into production to release with minimal downtime and easy rollback.

  Why the other selections are not correct:

  - Stop webapp1-prod / Stop webapp1-test:

  Stopping slots is unnecessary and increases downtime risk.

  - Deploy the App1 update to webapp1-prod, and then test the update:

  This tests in production and violates the requirement to test before exposing to users.

  Exam Tips:

  - Deployment slots are a frequent AZ-104 topic: deploy to staging, validate, then swap.

  - Swapping is also your fastest rollback mechanism (swap back).

  Summary:

  Testing releases using App Service deployment slots and swapping into production.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources  | |__ 3.4 Create and configure Azure App Service | |__ 3.4.8 Configure deployment slots for an App Service

• Question 349:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen. You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site connection uses a self-signed certificate.

  From Azure, you download and install the VPN client configuration package on a computer named Computer2.

  You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2.

  Solution: On Computer2, you set the Startup type for the IPSec Policy Agent service to Automatic.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  ---------------------------------------------------------------------------------------------------------------------------------

  No

  ---------------------------------------------------------------------------------------------------------------------------------

  The solution does NOT meet the goal.

  - The scenario states the point-to-site (P2S) connection uses a **self-signed certificate**, which means the VPN relies on **certificate authentication**.

  - For certificate-based P2S, **each client computer must have a client certificate installed locally** to authenticate. Setting the **IPsec Policy Agent** service to Automatic does not provide the required client certificate to Computer2, so it does not enable Computer2 to authenticate and connect.

  - Therefore, changing that Windows service startup type does not address the actual requirement for certificate-based P2S connectivity from Computer2.

  ---------------------------------------------------------------------------------------------------------------------------------

  References:

  (1) Microsoft Learn - Install a Point-to-Site client certificate (Azure VPN Gateway) Link: https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-how-to-vpn-client-install-azure-cert Date accessed: 2026-01-22 Last updated on: 2025-02-13

  (2) Microsoft Learn - Configure the native VPN client on Windows for P2S certificate authentication Link: https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-vpn-client-certificate-windows-native Date accessed: 2026-01-22 Last updated on: 2024-06-18

  ---------------------------------------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - When you see **"self-signed certificate"** in a P2S prompt, the fix is almost always certificate-focused (install/export/import client certs), not identity policy or Windows service tuning. (1)(2)

  - If the proposed action does not explicitly result in a **client certificate being present on the target machine**, it typically does not satisfy certificate-auth P2S requirements. (1)

  - Service-related options can be plausible distractors, but AZ-104 "meets the goal" questions usually hinge on the primary prerequisite (here: client certificate on Computer2). (1)

  ---------------------------------------------------------------------------------------------------------------------------------

  Summary:

  - Point-to-site (P2S) VPN certificate authentication prerequisites

  - Client certificate requirement per connecting device

  - Identifying distractor actions that do not satisfy authentication requirements

  ---------------------------------------------------------------------------------------------------------------------------------

  AZ-104 Exam Objective Alignment (Hierarchy)

  ------------------------------------------ 4.0 Implement and manage virtual networking (15?0%) | 4.1 Configure and manage virtual networks in Azure | 4.1.5 Troubleshoot network connectivity

• Question 350:

  HOTSPOT

  You have the web apps shown in the following table.

  

  You need to monitor the performance and usage of the apps by using Azure Application Insights. The solution must minimize modifications to the application code.

  What should you do on each app? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  App1: Install Application Insights Agent App2: Install Application Insights Agent

  Explanation (Why this is correct)

  - Both apps run on IIS on Windows Server VMs. The Application Insights Agent provides automatic/instrumentation without requiring code changes and is the appropriate installation choice for IIS-hosted applications on VMs.

  Explanation (Why the other options are incorrect)

  - App Service-specific enablement steps don’t apply because these are not App Service apps.

  - SDK-only approaches may require code changes, which the requirement prohibits.

  Exam Tip

  - “No code changes” + “IIS on VM” + “Application Insights” --> **Application Insights Agent**.

  References

  - Microsoft. (n.d.). Application Insights Agent (formerly Status Monitor). https://learn.microsoft.com/en-us/azure/azure-monitor/app/status-monitor-v2-overview

  AZ-104 Exam Objective Hierarchy 5.0 Monitor and back up Azure resources (10–15%) |__5.1 Monitor resources by using Azure Monitor |__|__5.1.5 Configure Application Insights