Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 351:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your company has an Azure Active Directory (Azure AD) subscription.

  You want to implement an Azure AD conditional access policy.

  The policy must be configured to require members of the Global Administrators group to use Multi-Factor Authentication and an Azure AD-joined device when they connect to Azure AD from untrusted locations.

  Solution: You access the Azure portal to alter the session control of the Azure AD conditional access policy.

  Does the solution meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  No

  ----------------------------------------------------------------------------------------------------

  Session controls in Conditional Access govern session behavior (for example, app enforced restrictions, sign-in frequency). The requirement here is to require MFA and an Azure AD-joined/compliant device from untrusted locations, which is implemented through grant controls (device state + MFA). Adjusting only session controls does not meet the stated goal. [1]

  References:

  1. How to configure grant controls in Microsoft Entra Conditional Access https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-grant Date modified: 2025-11-18 Date accessed: 2026-01-25

  ----------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - "Require MFA" and "require compliant/joined device" are grant controls; session controls are not substitutes.

  Summary:

  Grant controls vs. session controls in Conditional Access.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.2 Manage access to Azure resources |__ 1.2.3 Interpret access assignments

• Question 352:

  You have an Azure subscription that contains a storage account named storage1.

  You have the devices shown in the following table.

  

  From which devices can you use AzCopy to copy data to storage1?

  A. Device1 and Device2 only
  B. Device1, Device2 and Device3
  C. Device1 only
  D. Device1 and Device3 only
  B. Device1, Device2 and Device3

  ---

  Device1, Device2 and Device3

  AzCopy is available across common desktop/server operating systems, including Windows, Linux, and macOS. Therefore, all three devices (Windows 10, Linux, macOS) can use AzCopy to copy data to storage1.

  Why the other choices are not correct:

  - Device1 and Device2 only / Device1 only / Device1 and Device3 only: These incorrectly exclude a supported platform.

  Microsoft Exam Tips:

  - AZ-104: Expect "tooling" questions (AzCopy/Storage Explorer). Know what runs where and which tool is for which job.

  Summary:

  AzCopy platform support and Azure Storage data movement tooling.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage |__ 2.2 Configure and manage storage accounts |__ 2.2.5 Manage data by using Azure Storage Explorer and AzCopy

• Question 353:

  DRAG DROP

  You are configuring serverless computing in Azure.

  You need to receive an email message whenever a resource is created in or deleted from a resource group.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: Create an Azure Logic App

  Step 2: Create an Azure Event Grid trigger

  Step 3: Create conditions and actions

  Explanation:

  You want to send an email message whenever a resource is created or deleted in a resource group. The most direct approach is a Logic App that starts with an Event Grid trigger, then uses conditional logic and an email action.

  Why the steps are correct (and why order matters):

  Step 1: Create an Azure Logic App

  - The Logic App is the workflow container where you define the trigger and subsequent actions.

  Step 2: Create an Azure Event Grid trigger

  - Event Grid is the eventing system for Azure resource events (including Resource Group/Resource Manager events). The trigger is what starts the workflow when the event occurs.

  Step 3: Create conditions and actions

  - After the trigger fires, you add conditions (for example, filter for create vs delete operations) and actions (send an email).

  Why the other actions are not correct:

  - Create an Azure Service Bus namespace

  - Service Bus is messaging (queues/topics). It isn’t required to trigger on Azure resource lifecycle events for this scenario.

  - Create an event subscription

  - In practice, Event Grid involves subscriptions, but this exam item is specifically focused on the Logic App build flow the portal guides you through (Logic App --> Event Grid trigger --> conditions/actions).

  References:

  1. Microsoft Learn. Azure Logic Apps triggers and actions overview.

  https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-overview Last updated: Unable to locate on page. Date Accessed: 01/26/2026.

  2. Microsoft Learn. Event Grid event handlers (including Azure Logic Apps).

  https://learn.microsoft.com/en-us/azure/event-grid/event-handlers Last updated: Unable to locate on page. Date Accessed: 01/26/2026.

  3. Microsoft Learn. Azure resource notifications with Event Grid (resource events).

  https://learn.microsoft.com/en-us/azure/event-grid/overview Last updated: Unable to locate on page. Date Accessed: 01/26/2026.

  Microsoft Exam Tips:

  - If the requirement is “react to Azure resource create/delete,” think **Event Grid**.

  - If the requirement is “send an email / workflow automation,” think **Logic Apps**.

  - Don’t get distracted by Service Bus unless the scenario explicitly needs durable messaging between apps.

  Summary:

  This question covered building an event-driven workflow using Azure Logic Apps triggered by Event Grid resource events, then using conditions/actions to send email notifications.

  AZ-104 Exam Objective Hierarchy:

  3.0 - Deploy and manage Azure compute resources (20–25%) |__ 3.4 - Create and configure Azure App Service |__ 3.4.3 - Create an App Service

• Question 354:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains 10 virtual networks. The virtual networks are hosted in separate resource groups.

  Another administrator plans to create several network security groups (NSGs) in the subscription.

  You need to ensure that when an NSG is created, it automatically blocks TCP port 8080 between the virtual networks.

  Solution: You configure a custom policy definition, and then you assign the Azure policy to the subscription.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Yes

  Configuring a custom Azure Policy definition and assigning it at the subscription scope is an appropriate way to enforce network/security standards automatically when resources are created. With the correct policy logic and effect (for example, deny to block noncompliant NSGs, or deployIfNotExists to deploy required configuration via a template), you can ensure that NSGs meet a required baseline such as blocking TCP 8080 between VNets. (1)(2)

  Why the other selection is not correct:

  - No:

  Azure Policy is designed specifically to enforce organizational standards and assess compliance at scale, including at subscription scope.

  Microsoft Exam Tips:

  - AZ-104: If the requirement is "auto-enforce at creation," choose an Azure Policy approach (deny / deployIfNotExists / modify), then scope it correctly (MG/subscription/RG).

  - "Deny" prevents creation of noncompliant resources; "deployIfNotExists" can auto-remediate by deploying required config.

  Summary:

  Using Azure Policy (custom definition + subscription assignment) to automatically enforce NSG/security requirements.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance |__ 1.3 Manage Azure subscriptions and governance |__ 1.3.1 Implement and manage Azure Policy

• Question 355:

  You have an Azure subscription that contains a custom application named Application1.

  Application1 was developed by an external company named Fabrikam, Ltd. Developers at Fabrikam were assigned role-based access control (RBAC) permissions to the Application1 components.

  All users are licensed for the Microsoft 365 E5 plan.

  You need to recommend a solution to verify whether the Fabrikam developers still require permissions to Application1.

  The solution must meet the following requirements:

  1. To the manager of the developers, send a monthly email message that lists the access permissions to Application1.

  2. If the manager does not verify an access permission, automatically revoke that permission.

  3. Minimize development effort.

  What should you recommend?

  A. In Azure Active Directory (Azure AD), create an access review of Application1.
  B. Create an Azure Automation runbook that runs the Get-AzRoleAssignment cmdlet.
  C. In Azure Active Directory (Azure AD) Privileged Identity Management, create a custom role assignment for the Application1 resources.
  D. Create an Azure Automation runbook that runs the Get-AzureADUserAppRoleAssignment cmdlet.
  A. In Azure Active Directory (Azure AD), create an access review of Application1.

  ---

  Explanation

  --------------------------------------------------------------------------------

  In Azure Active Directory (Azure AD), create an access review of Application1.

  --------------------------------------------------------------------------------

  Access Reviews (Identity Governance) are designed for periodic attestation of access. You can schedule recurring reviews (e.g., monthly) and configure what happens when reviewers do not respond (for example, remove access automatically), satisfying:

  1) Monthly email to the manager with access list, 2) Automatic revocation when not approved, 3) Minimal development effort.

  Why the other choices are not correct:

  - Create an Azure Automation runbook that runs Get-AzRoleAssignment:

  This is custom engineering and does not inherently provide manager attestation workflows or automatic removal based on "no response."

  - Use PIM to create a custom role assignment:

  PIM is for privileged role lifecycle and just-in-time access-not for a recurring manager attestation of application access.

  - Automation runbook that runs Get-AzureADUserAppRoleAssignment:

  Still custom engineering; does not provide built-in review/attestation workflow and "auto-remove if not verified" with minimal effort.

  -------------------------------------------------------------------------------- References:

  1. Microsoft. (n.d.). Access reviews in Microsoft Entra ID (Identity Governance). https://learn.microsoft.com/en-us/entra/id-governance/access-reviews-overview Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104/AZ-305: "Review access monthly" + "remove if not approved" is a signature pattern for Entra Access Reviews.

  - Prefer built-in governance features over Automation runbooks when "minimize development effort" is stated.

  -------------------------------------------------------------------------------- Summary:

  Identity Governance access reviews for periodic attestation and automatic removal.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.2 Manage access to Azure resources |__ 1.2.3 Interpret access assignments

• Question 356:

  HOTSPOT

  You have a network security group (NSG) named NSG1 that has the rules defined in the exhibit. (Click the Exhibit tab.)

  

  NSG1 is associated to a subnet named Subnet1. Subnet1 contains the virtual machines shown in the following table.

  

  You need to add a rule to NSG1 to ensure that VM1 can ping VM2. The solution must use the principle of least privilege.

  How should you configure the rule? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Direction: Outbound Source: 10.1.0.10 Destination: 10.1.0.11 Priority: 110

  Explanation (Why this is correct)

  - NSG rules process in priority order (lowest number first). The existing “Deny ping” is priority 111, so you must create an “Allow ping” rule with a lower priority number (110) to override it.

  - Because VM1 initiates the ICMP traffic to VM2, the rule must be outbound from VM1 (source VM1 IP to destination VM2 IP).

  Explanation (Why the other options are incorrect)

  - Using priority 112+ would not override the existing deny at 111.

  - Using inbound would not match the traffic direction for VM1-initiated ping.

  Exam Tip

  - If you must “override” an NSG deny, create a more specific allow rule with a *lower* priority number.

  References

  - Microsoft. (n.d.). Network security groups. https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

  - Microsoft. (n.d.). Security rules in NSGs. https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works

  AZ-104 Exam Objective Hierarchy 4.0 Implement and manage virtual networking (20–25%) |__4.2 Configure secure access to virtual networks |__|__4.2.1 Configure network security groups

• Question 357:

  You have an Azure subscription that contains a virtual network named VNet1.

  VNet1 uses two ExpressRoute circuits that connect to two separate on-premises datacenters.

  You need to create a dashboard to display detailed metrics and a visual representation of the network topology.

  What should you use?

  A. Azure Monitor Network Insights
  B. a Data Collection Rule (DCR)
  C. Azure Virtual Network Watcher
  D. Log Analytics
  A. Azure Monitor Network Insights

  ---

  Azure Monitor Network Insights

  To display detailed metrics and a visual network topology for ExpressRoute-connected network resources, Azure Monitor Network Insights provides health dashboards, metrics, and topology maps for ExpressRoute without requiring additional setup.

  Why the other selections are not correct:

  • A Data Collection Rule (DCR): Controls data collection routing and agent behavior; it is not the topology and dashboard solution.
  • Azure Virtual Network Watcher: Provides diagnostic tools, but the integrated dashboards and topology visualization requirement aligns with Network Insights.
  • Log Analytics: Stores and queries logs; it does not inherently provide the topology dashboards described without additional configuration and visualization layers.

  Exam Tips:

  • If the question explicitly asks for “metrics plus topology visualization,” Network Insights is often the correct answer.
  • Network Watcher tools are useful for point-in-time diagnostics; Network Insights is for consolidated dashboards and topology views.

  Summary:

  Use Azure Monitor Network Insights to visualize topology and monitor ExpressRoute metrics.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10–15%)
  └── 5.1 Monitor resources in Azure
    └── 5.1.5 Configure and interpret monitoring of virtual machines, storage accounts, and networks by using Azure Monitor Insights

• Question 358:

  You create an Azure Storage account named contosostorage.

  You plan to create a file share named data.

  Users need to map a drive to the data file share from home computers that run Windows 10.

  Which outbound port should be open between the home computers and the data file share?

  A. 80
  B. 443
  C. 445
  D. 3389
  C. 445

  ---

  Mapping a drive to an Azure file share from Windows uses SMB. SMB over the Internet requires outbound TCP port 445 to be open between the client and Azure Files.

  Why the other options are not correct:

  - 80/443: HTTP/HTTPS, not SMB.

  - 3389: RDP, not SMB.

  Microsoft Exam Tips:

  - Azure Files + Windows drive mapping = SMB = TCP 445.

  - Many home/ISP networks block 445; VPN/ExpressRoute/private endpoints can be used when required.

  Summary:

  Azure Files drive mapping requires SMB over TCP port 445.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage  | |__ 2.3 Configure Azure Files and Azure Blob Storage | |__ 2.3.1 Create and configure a file share in Azure Storage

• Question 359:

  HOTSPOT

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  VM1 and VM2 use public IP addresses. From Windows Server 2019 on VM1 and VM2, you allow inbound Remote Desktop connections.

  Subnet1 and Subnet2 are in a virtual network named VNET1.

  The subscription contains two network security groups (NSGs) named NSG1 and NSG2. NSG1 uses only the default rules.

  NSG2 uses the default rules and the following custom incoming rule:

  1. Priority: 100 2. Name: Rule1 3. Port: 3389 4. Protocol: TCP 5. Source: Any 6. Destination: Any 7. Action: Allow

  NSG1 connects to Subnet1. NSG2 connects to the network interface of VM2. For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: From the internet, you can connect to VM1 by using Remote Desktop. = No

  Box 2: From the internet, you can connect to VM2 by using Remote Desktop. = Yes

  Box 3: From VM1, you can connect to VM2 by using Remote Desktop. = Yes

  Given:

  - VM1 is in Subnet1. NSG1 is associated to Subnet1 and has ONLY default rules.

  - VM2 is in Subnet2. NSG2 is associated to the NIC of VM2 and includes a custom inbound rule:

  - Priority 100, Allow TCP 3389 from Any to Any.

  Key NSG behavior:

  - Default inbound rules end with DenyAllInbound, which blocks inbound traffic unless a custom allow rule permits it.

  - Inbound NSG evaluation is applied for the subnet (if present) and the NIC (if present). If traffic is denied at one point, it won’t proceed.

  Box 1 (Internet -> VM1 via RDP):

  - VM1 is protected by NSG1 at Subnet1 with default rules only.

  - There is no custom allow for TCP 3389 inbound.

  - Therefore the default DenyAllInbound blocks RDP from the internet. Result = No.

  Box 2 (Internet -> VM2 via RDP):

  - VM2 has NSG2 applied at the NIC with an explicit allow rule for TCP 3389 (RDP) from Any.

  - Subnet2 has no NSG mentioned, so the NIC NSG rule is the controlling inbound filter.

  - Therefore RDP from the internet is allowed. Result = Yes.

  Box 3 (VM1 -> VM2 via RDP):

  - VM1 outbound to VM2 is allowed by NSG1 default outbound rule AllowVNetOutBound.

  - VM2 inbound on TCP 3389 is allowed by NSG2’s custom rule (source Any includes VM1’s private IP).

  - Therefore VM1 can RDP to VM2. Result = Yes.

  Exam Tips:

  - “Default NSG rules only” almost always means “inbound from Internet is blocked” (because of DenyAllInbound).

  - If you see a custom rule allowing TCP 3389 at a NIC NSG, assume Internet RDP is allowed unless a subnet NSG blocks it earlier.

  - Remember: 3389 = RDP.

  Summary:

  Evaluated effective inbound/outbound connectivity using NSG association points (subnet vs NIC), default deny behavior, and an explicit allow for TCP 3389 on VM2’s NIC.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15–20%)
  └─ 4.2 Configure secure access to virtual networks
    └─ 4.2.2 Evaluate effective security rules in NSGs

• Question 360:

  You have an Azure Active Directory (Azure AD) tenant named Contoso.com that is synced to an Active Directory domain.

  The tenant contains the users shown in the following table.

  

  The user have the attributes shown in the following table.

  

  You need to ensure that you can enable Azure Multi-Factor Authentication (MFA) for all four users.

  Solution: You create a new user account in Azure AD for User3.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  --------------------------------------------------------------------------------

  Yes

  --------------------------------------------------------------------------------

  User3 is currently a Guest user with a Microsoft account source. Creating a new (member) user account in Azure AD for User3 places User3 under the same tenant-managed identity model as the other member users, which allows you to apply tenant MFA requirements to that new account consistently.

  Why this meets the stated goal:

  - The goal is to "enable Azure Multi-Factor Authentication (MFA) for all four users." Creating the Azure AD user for User3 ensures User3 is a tenant user account for which MFA can be enforced under your tenant controls (in alignment with how you manage member users).

  Why "No" is not correct:

  - "No" would imply that creating the Azure AD user does not allow MFA enforcement for User3; however, making User3 a tenant user account enables applying MFA requirements to that identity.

  References:

  1. Quickstart: Add a guest user and send an invitation (context on guest user model in Entra tenants) https://learn.microsoft.com/en-us/entra/external-id/b2b-quickstart-add-guest-users-portal Date Modified: 12/05/2025 Date Accessed: 01/25/2026

  Microsoft Exam Tips:

  - AZ-104: Watch "Member vs Guest" and "Source" (cloud-only vs synced vs external). These often drive which identity controls are available.

  - If the exam pushes you toward "convert/replace external identity with tenant-managed user," expect "Yes" outcomes for enforceability questions.

  Summary:

  This question covered tenant identity types (Member vs Guest) and ensuring MFA enforceability across users.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.4 Manage external users