Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 361:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  You deploy a load balancer that has the following configurations:

  1. Name: LB1

  2. Type: Internal

  3. SKU: Standard

  4. Virtual network: VNET1

  You need to ensure that you can add VM1 and VM2 to the backend pool of LB1.

  Solution: You create two Standard SKU public IP addresses and associate a Standard SKU public IP address to the network interface of each virtual machine.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Yes

  This solution meets the goal.

  You are using a Standard (SKU) internal Load Balancer and must be able to add both VM1 and VM2 to the backend pool. A common blocker in these scenarios is an SKU compatibility mismatch caused by attaching a Basic SKU public IP to a VM’s NIC while working with Standard load-balancing components. Converting or standardizing the NIC-attached public IP resources to Standard SKU removes that incompatibility and allows both NICs (VM1 and VM2) to be used with the Standard Load Balancer backend pool.

  Why the other option is not correct:

  No: Incorrect because assigning Standard SKU public IPs to both NICs does not prevent backend pool membership; it helps align SKUs and removes a typical compatibility blocker.

  Exam Tips:

  For Load Balancer SKUs, remember “Standard prefers Standard”: Standard Load Balancer scenarios frequently require Standard-aligned dependent resources.

  Backend pool membership ultimately depends on NIC IP configurations in the same virtual network and compatibility constraints.

  Summary:

  Standard Load Balancer backend pool membership requires SKU alignment and compatibility considerations.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15–20%)
  |__ 4.3 Configure name resolution and load balancing
  |__ 4.3.2 Configure an internal or public load balancer

• Question 362:

  HOTSPOT

  You have an Azure subscription.

  You plan to use an Azure Resource Manager template to deploy a virtual network named VNET1 that will use Azure Bastion.

  How should you complete the template? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Subnet name: AzureBastionSubnet Subnet address prefix: 10.10.10.0/27

  Explanation (Why this is correct)

  - Azure Bastion requires a dedicated subnet named exactly AzureBastionSubnet.

  - The Bastion subnet must be at least /27 (or larger).

  Exam Tip

  - If the subnet name is anything other than AzureBastionSubnet, it’s wrong-no partial credit.

  References (APA)

  - Microsoft. (n.d.). Create an Azure Bastion host. Microsoft Learn. https://learn.microsoft.com/en-us/azure/bastion/tutorial-create-host-portal

  AZ-104 Exam Objective Hierarchy 4.0 Implement and manage virtual networking (15–20%) |__4.2 Configure secure access to virtual networks |__|__4.2.3 Configure Azure Bastion

• Question 363:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to configure a proximity placement group for VMSS1.

  Which proximity placement groups should you use?

  A. Proximity2 only
  B. Proximity 1, Proximity2, and Proximity3
  C. Proximity 1 and Proximity3 only
  D. Proximity1 only
  D. Proximity1 only

  ---

  Proximity1 only

  A proximity placement group (PPG) must be in the same Azure region as the compute resources that will use it. VMSS1 is in West US. From the table, only Proximity1 is in West US; Proximity2 and Proximity3 are in Central US, so they cannot be used for VMSS1.

  Why the other selections are not correct:

  - Proximity2 only:

  Wrong region (Central US).

  - Proximity1, Proximity2, and Proximity3:

  Includes PPGs in the wrong region.

  - Proximity1 and Proximity3 only:

  Proximity3 is in the wrong region (Central US).

  Microsoft Exam Tips:

  - PPG questions usually test region alignment first. If regions don't match, the option is invalid.

  Summary:

  Selecting a proximity placement group in the correct region for a VM Scale Set.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources  | |__ 3.2 Create and configure virtual machines | |__ 3.2.7 Deploy and configure an Azure Virtual Machine Scale Sets

• Question 364:

  HOTSPOT

  You need to ensure that User1 can create initiative definitions, and User4 can assign initiatives to RG2. The solution must meet the technical requirements.

  Which role should you assign to each user? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  User1: Resource Policy Contributor for Sub1 User4: Resource Policy Contributor for RG2

  Creating initiative (policy set) definitions and assigning initiatives require permissions under the Microsoft.Authorization provider.

  The built-in **Resource Policy Contributor** role includes permissions to create and manage policy definitions/initiatives and to create policy assignments at the assigned scope.

  Because User1 needs to create initiative definitions (at subscription scope) and User4 needs to assign initiatives to RG2, assigning Resource Policy Contributor at Sub1 for User1 and at RG2 scope for User4 satisfies the least-privilege requirement.

  Case study (Contoso, Ltd. 2 Case Study.pdf), “Existing environment – users and roles / subscriptions / resource groups”.

  Microsoft Learn – Built-in roles (Resource Policy Contributor). URL: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles. Retrieved January 31, 2026. (Last updated 2025-04-28.)

  - Resource Policy Contributor is the go-to least-privilege role for creating and assigning Azure Policy definitions/initiatives.

  - Scope matters: definition creation often needs subscription scope, while assignment can be at RG or subscription scope.

  1.0 Manage Azure identities and governance (20–25%) |__1.3 Manage Azure subscriptions and governance |__|__1.3.1 Implement and manage Azure Policy

• Question 365:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company registers a domain name of contoso.com.

  You create an Azure DNS zone named contoso.com, and then you add an A record to the zone for a host named www that has an IP address of 131.107.1.10.

  You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address.

  You need to resolve the name resolution issue.

  Solution: You modify the name servers at the domain registrar.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  --------------------------------------------------------------------------------

  Yes

  --------------------------------------------------------------------------------

  If Internet hosts cannot resolve www.contoso.com after creating the Azure DNS zone and adding the A record, the most common cause is that the public domain is not delegated to Azure DNS. Updating the domain registrar name server (NS) settings to the Azure DNS name servers correctly delegates the zone, allowing public resolution.

  Why this meets the goal:

  - Delegation at the registrar makes the public DNS hierarchy point contoso.com to the Azure DNS authoritative name servers.

  -------------------------------------------------------------------------------- References:

  1. Tutorial: Host your domain in Azure DNS https://learn.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns Date Modified: 06/11/2024 Date Access: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: Creating a zone + records is not enough; public resolution requires delegation at the registrar.

  - Always confirm NS delegation first when "Internet can't resolve" is the symptom.

  -------------------------------------------------------------------------------- Summary:

  Fix by delegating the domain to Azure DNS through registrar NS updates.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.3 Configure name resolution and load balancing |__ 4.3.1 Configure Azure DNS

• Question 366:

  You have an app named App1 that runs on two Azure virtual machines named VM1 and VM2.

  You plan to implement an Azure Availability Set for App1. The solution must ensure that App1 is available during planned maintenance of the hardware hosting VM1 and VM2.

  What should you include in the Availability Set?

  A. one update domain
  B. two fault domains
  C. one fault domain
  D. two update domains
  D. two update domains

  ---

  two update domains

  Planned maintenance (platform updates) is sequenced by "update domains" so that Azure doesn't restart all VMs in the availability set at the same time. With "two" VMs (VM1 and VM2), configuring "two update domains" ensures the VMs are placed into different update domains so only one VM is restarted at a time during planned maintenance.

  Why the other choices are not correct:

  - one update domain: both VMs could be restarted together during planned maintenance (no rolling restart protection).

  - two fault domains / one fault domain: fault domains protect primarily against "unplanned" hardware/network/power failures (rack-level issues), not the sequencing of planned maintenance reboots.

  Microsoft Exam Tips:

  - If the question says "planned maintenance/platform updates/rolling reboot", think "Update Domains".

  - If the question says "hardware failure/rack/power/network switch", think "Fault Domains".

  - With "two VMs" and a requirement to stay up during planned maintenance, you typically need "at least two update domains".

  Summary:

  Availability Sets, update domains vs fault domains, and how Azure sequences planned maintenance reboots.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources |__ 3.2 Create and configure virtual machines |__ 3.2.6 Deploy virtual machines to availability zones and availability sets

• Question 367:

  HOTSPOT

  You have an Azure subscription named Subscription1 that contains the resources shown in the following table.

  

  You plan to configure Azure Backup reports for Vault1. You are configuring the Diagnostics settings for the AzureBackupReports log.

  Which storage accounts and which Log Analytics workspaces can you use for the Azure Backup reports of Vault1?

  To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Area numbering rule:

  - Number boxes left-to-right, then top-to-bottom (based on the Answer Area layout).

  Storage accounts:

  - storage3 only

  Log Analytics workspaces:

  - Analytics1, Analytics2, and Analytics3

  You are configuring **Diagnostic settings** for the Recovery Services vault’s **AzureBackupReports** log.

  Storage account destination:

  - When you send diagnostic logs to a **storage account**, the storage account must be in the **same region** as the resource emitting the logs.

  - Vault1 is in **West Europe**.

  - storage3 is in **West Europe**; storage1 (East US) and storage2 (West US) are not.

  Therefore, only **storage3** is valid.

  Log Analytics destination:

  - For Azure Backup Reports, the Log Analytics workspace can be in a **different region** than the vault (as long as it’s valid/accessible for the configuration).

  - Therefore, **Analytics1**, **Analytics2**, and **Analytics3** are all valid.

  References (APA):

  1. Microsoft Learn. (2026, January 20). Diagnostic settings in Azure Monitor. https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings

  - Last updated: 2026-01-20. Date accessed: 01/27/2026.

  2. Microsoft Learn. (2025, November 19). Tutorial: Configure and view reports in Resiliency in Azure. https://learn.microsoft.com/en-us/azure/reliability/tutorial-configure-backup-reports

  - Last updated: 2025-11-19. Date accessed: 01/27/2026.

  Microsoft Exam Tips:

  - Diagnostic settings --> **Storage account = same region requirement** is a frequent constraint.

  - Log Analytics workspaces are often more flexible than storage for cross-region logging (always confirm per feature/service).

  Summary:

  This question tested Azure Monitor diagnostic settings constraints for Recovery Services vault reporting, especially regional constraints for storage vs Log Analytics.

  AZ-104 Exam Objective Hierarchy:

  5.0 - Monitor and maintain Azure resources (10–15%) |__ 5.2 - Implement backup and recovery |__ 5.2.7 - Configure and interpret reports and alerts for backups

• Question 368:

  You have an Azure subscription that contains a virtual network named VNet1. VNet 1 has two subnets named Subnet1 and Subnet2. VNet1 is in the West Europe Azure region. The subscription contains the virtual machines in the following table.

  

  You need to deploy an application gateway named AppGW1 to VNet1.

  What should you do first?

  A. Add a service endpoint.
  B. Add a virtual network.
  C. Move VM3 to Subnet1.
  D. Stop VM1 and VM2.
  D. Stop VM1 and VM2.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Stop VM1 and VM2.

  --------------------------------------------------------------------------------

  Application Gateway requires a dedicated subnet (the subnet must not host other resources). Given Subnet1 and Subnet2 currently host VMs, you must free a subnet for the gateway. Changing a VM's subnet/NIC configuration requires the VM to be stopped/deallocated first. Therefore, the first step (before moving those VMs out of the subnet you intend to dedicate to the Application Gateway) is to stop the affected VMs.

  Why other options are not correct:

  - Adding a service endpoint is unrelated to Application Gateway subnet requirements.

  - Adding a virtual network is unnecessary because VNet1 already exists.

  - Moving VM3 may be part of a valid plan, but the question asks what you should do first in the workflow implied by the choices; stopping the VMs is the prerequisite action.

  -------------------------------------------------------------------------------- References:

  1. Application Gateway FAQ (subnet/dedicated subnet requirements) https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-faq Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  2. Move virtual machine to another subnet requires stop/deallocate (Q&A guidance) https://learn.microsoft.com/en-us/answers/questions/165451/move-azure-vm-to-different-subnet Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - Application Gateway subnet must be dedicated; the name appGatewaySubnet is a common convention.

  - To move VMs between subnets, expect a stop/deallocate step.

  -------------------------------------------------------------------------------- Summary:

  Preparing a VNet for Application Gateway by ensuring a dedicated subnet and taking required VM lifecycle steps.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.1 Configure and manage virtual networks in Azure |__ 4.1.1 Create and configure virtual networks and subnets

• Question 369:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while

  others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has 100 users located in an office in Paris.

  The on-premises network contains the servers shown in the following table.

  

  You create a new subscription. You need to move all the servers to Azure.

  Solution: You use the Data Migration Assistant tool.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  The Data Migration Assistant (DMA) is used to assess and help migrate database workloads (for example, SQL Server databases) to Azure data platforms. It does not migrate an entire on-premises environment of mixed server roles (Exchange, domain controller, file server OS, etc.) into Azure as running servers/VMs. Therefore, using DMA does not meet the goal of moving all servers to Azure. (1)

  Why the other selection is incorrect:

  - Yes: This is incorrect because DMA targets database migrations and does not perform a full server lift-and-shift of all listed machines/roles. (1)

  -------------------------------------------------------------------------------- References:

  1. Migration overview: SQL Server to Azure SQL Database (tooling overview including migration tooling) https://learn.microsoft.com/en-us/data-migration/sql-server/database/overview Date Modified: 06/16/2025 Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - "Assistant" tools (DMA/SSMA) generally indicate database migration, not VM/server migration.

  - For "move servers to Azure," think Azure Migrate (Server Assessment + Server Migration).

  -------------------------------------------------------------------------------- Summary:

  DMA supports database migration scenarios, not moving all servers (mixed roles/OS) to Azure compute.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.2 Create and configure virtual machines |__ 3.2.1 Create a virtual machine

• Question 370:

  HOTSPOT

  You have an Azure App Service app named WebApp1 that contains two folders named Folder1 and Folder2.

  You need to configure a daily backup of WebApp1. The solution must ensure that Folder2 is excluded from the backup.

  What should you create first, and what should you use to exclude Folder2? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  First create: An Azure Storage account

  To exclude Folder2, use: A backup.filter file

  Azure App Service backups are written to Azure Storage using a SAS URL to a blob container, so you must have a Storage account available first.

  App Service supports excluding files/folders from backup by placing a _backup.filter file in the app content, listing paths to exclude (principle of least backup content).

  AZ-104 Exam Objective Hierarchy

  3.0 Implement and manage compute resources |__3.4 Configure and manage Azure App Service |__|__3.4.6 Configure Azure App Service backups