Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 401:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json.

  You receive a notification that VM1 will be affected by maintenance.

  You need to move VM1 to a different host immediately.

  Solution: From the Update management blade, you click Enable.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  No

  Enabling Update Management (or similar update features) does not migrate a VM to a different host. Update Management is for patching and update orchestration/visibility, not host relocation. To move a VM to a different host immediately, you use Redeploy. Therefore, clicking Enable in Update Management does not meet the goal.

  Why the other option is incorrect:

  - Yes: This is incorrect because Update Management does not perform a host migration.

  Exam Tips:

  - Update/patching tools are governance/operations features; they do not change the VM host placement.

  - "Maintenance impact + move host now" remains a Redeploy pattern.

  Summary:

  Update Management is unrelated to host relocation; Redeploy is required to move the VM to a new host.

  AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (15–20%)

  └── 5.1 Monitor resources in Azure

    └── 5.1.2 Configure log settings in Azure Monitor

• Question 402:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant.

  You want to implement Multi-Factor Authentication by making use of a conditional access policy. The conditional access policy must be applied to all users when they access the Azure portal.

  Which three settings should you configure? To answer, select the appropriate settings to the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Assignments:

  - Users and groups

  - Cloud apps

  Access controls:

  - Grant

  Explanation (Why this is correct)

  - To enforce MFA for Azure portal access via a Conditional Access policy, you must define **who** the policy applies to (Assignments --> Users and groups) and **what resource/app** the policy targets (Assignments --> Cloud apps / Target resources).

  - You must also define **how access is enforced** (Access controls --> Grant) and set the grant requirement to require MFA (or an authentication strength that satisfies MFA), which is the mechanism Conditional Access uses to force MFA during sign-in.

  - “Conditions” and “Session” are optional controls used for narrowing scope (device/platform/location, etc.) or controlling session behavior after access is granted, but they aren’t required for the core “apply to all users for Azure portal and require MFA” requirement.

  Microsoft Exam Tips

  - Conditional Access always needs, at minimum: **Assignments (Users + Target resources)** + **Access controls (Grant/Block)**.

  - Start with the smallest set of policy components that meets the requirement, then add Conditions/Session only when the requirement explicitly calls for them.

  Summary

  - Click **Users and groups**, **Cloud apps**, and **Grant**.

  References (APA)

  - Microsoft. (2025-08-07). Building Conditional Access policies in Microsoft Entra. Microsoft Learn. https://learn.microsoft.com/en-us/entra/identity/conditional-access/concept-conditional-access-policies

  - Microsoft. (2025-07-24). Require MFA for all users with Conditional Access - Microsoft Entra ID. Microsoft Learn. https://learn.microsoft.com/en-us/entra/identity/conditional-access/policy-all-users-mfa-strength

  AZ-104 Exam Objective Hierarchy 1.0 Manage Azure identities and governance (20–25%) |__1.1 Manage Microsoft Entra users and groups

• Question 403:

  You have an Azure subscription.

  You have an on-premises virtual machine named VM1. The settings for VM1 are shown in the exhibit. (Click the Exhibit tab.)

  

  You need to ensure that you can use the disks attached to VM1 as a template for Azure virtual machines.

  What should you modify on VM1?

  A. Integration Services
  B. the network adapters
  C. the memory
  D. the hard drive
  E. the processor
  D. the hard drive

  ---

  Explanation

  --------------------------------------------------------------------------------

  the hard drive

  --------------------------------------------------------------------------------

  To use an on-premises VM's disks as a template/source for Azure virtual machines, the disk format and characteristics must meet Azure requirements (for example, a supported VHD format and a fixed-size disk for many image workflows).

  Those requirements are addressed by modifying/converting the VM's virtual hard disk configuration (the hard drive), not by changing CPU, memory, NICs, or Hyper-V integration services. (1)

  Why the other selections are not correct:

  - Integration Services:

  Useful for guest/host features in Hyper-V, but it does not convert the disk into an Azure-ready VHD image.

  - the network adapters:

  Not relevant to whether the disk can be used as an Azure VM template.

  - the memory:

  Not relevant to disk templating requirements.

  - the processor:

  Not relevant to disk templating requirements.

  --------------------------------------------------------------------------------

  References:

  1. Prepare a Windows VHD or VHDX to upload to Azure (Azure image requirements, VHD format and fixed-size disk guidance) https://learn.microsoft.com/en-us/azure/virtual-machines/windows/prepare-for-upload-vhd-image Date Modified: 08/22/2024 Date Access: 01/24/2026

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - AZ-104 often focuses on VM image prerequisites: supported disk format, sizing constraints, and preparation steps.

  - Keep "disk prep" separate from "VM sizing" (CPU/RAM) and "network configuration."

  Summary:

  Preparing an on-prem VM disk (VHD) to meet Azure image/template requirements.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  (Note: Only a partial hierarchy is available in this chat. Mapping below is best-fit.) 3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.2 Create and configure virtual machines |__ 3.2.x Manage virtual machine disks (VM image/VHD preparation)

• Question 404:

  You are the global administrator for an Azure Active Directory (Azure AD) tenant named adatum.com.

  You need to enable two-step verification for Azure users.

  What should you do?

  A. Configure a playbook in Azure AD conditional access policy.
  B. Create an Azure AD conditional access policy.
  C. Create and configure the Identify Hub.
  D. Install and configure Azure AD Connect.
  B. Create an Azure AD conditional access policy.

  ---

  Explanation

  -----------------------------------------------------------------------

  Create an Azure AD conditional access policy.

  -----------------------------------------------------------------------

  To enable "two-step verification" (MFA) for Azure AD (Microsoft Entra ID) users, the standard control is to enforce MFA using **Conditional Access** by requiring multifactor authentication for targeted users/apps. Creating an Azure AD Conditional Access policy is the direct and correct method.

  Why the other selections are incorrect:

  - Configure a playbook in Azure AD conditional access policy: Playbooks are not how Conditional Access enforces MFA; policies themselves enforce grant controls (like Require MFA).

  - Create and configure the Identity Hub: Not required for enabling/enforcing MFA.

  - Install and configure Azure AD Connect: Azure AD Connect is for synchronizing identities between on-premises AD DS and Entra ID; it does not enable MFA by itself.

  -----------------------------------------------------------------------

  References:

  1. Conditional Access overview (Microsoft Entra ID) https://learn.microsoft.com/en-us/entra/identity/conditional-access/overview Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  2. Require multifactor authentication using Conditional Access (conceptual guidance) https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-getstarted Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -----------------------------------------------------------------------

  Microsoft Exam Tips:

  - For "enable/require MFA" at scale, prefer **Conditional Access** (policy-based enforcement) over per-user legacy MFA settings unless the question explicitly references legacy MFA.

  Summary:

  Enforce two-step verification (MFA) by creating a Conditional Access policy that requires multifactor authentication.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.2 Manage user and group properties

• Question 405:

  HOTSPOT

  You have three Azure subscriptions named Sub1, Sub2, and Sub3 that are linked to an Azure AD tenant.

  The tenant contains a user named User1, a security group named Group1, and a management group named MG1. User is a member of Group1.

  Sub1 and Sub2 are members of MG1. Sub1 contains a resource group named RG1. RG1 contains five Azure functions.

  You create the following role assignments for MG1:

  1. Group1: Reader

  2. User1: User Access Administrator

  You assign User the Virtual Machine Contributor role for Sub1 and Sub2.

  

  

  ---

  1) The Group1 members can view the configurations of the Azure functions. -> Yes

  2) User1 can assign the Owner role for RG1. -> Yes

  3) User1 can create a new resource group and deploy a virtual machine to the new group. -> No

  Why these answers are correct:

  - Group1 has Reader on MG1, and MG1 contains RG1; Reader permits viewing resource configurations (including Function App configuration).

  - User1 has User Access Administrator on MG1; that role can manage access (role assignments), including assigning Owner at scopes under MG1.

  - User Access Administrator does not grant permissions to create resource groups or deploy VMs (those are resource management actions requiring roles like Contributor/Owner).

  Why the other options are incorrect:

  - Answering “No” for statement 1 would contradict what Reader allows (read access).

  - Answering “No” for statement 2 would contradict what User Access Administrator is designed to do (manage access / role assignments).

  - Answering “Yes” for statement 3 incorrectly treats access-management rights as resource-creation rights.

  Exam Tips:

  User Access Administrator = can assign RBAC roles (access control), not create or modify resources by itself.

  AZ-104 Exam Objective Hierarchy
  
  1.0 Manage Azure identities and governance (20–25%)
  └── 1.2 Manage access to Azure resources
    └── 1.2.1 Manage built-in Azure roles
    └── 1.2.2 Assign roles at different scopes
    └── 1.2.3 Interpret access assignments

• Question 406:

  You have an Azure subscription that contains a user account named User1. You need to ensure that User1 can assign a policy to the tenant root management group.

  What should you do?

  A. Create a new management group and delegate User1 as the owner of the new management group.
  B. Assign the Owner role for the Azure subscription to User1, and then instruct User1 to configure access management for Azure resources.
  C. Assign the Owner role for the Azure subscription to User1, and then modify the default conditional access policies.
  D. Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources.
  D. Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources.

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  Assign the Global administrator role to User1, and then instruct User1 to configure access management for Azure resources.

  ----------------------------------------------------------------------------------------------------

  To assign an Azure Policy at the tenant root management group scope, User1 must have permissions at (or be able to elevate to) the root management group scope. The "Access management for Azure resources" setting (in Microsoft Entra ID) allows a Global Administrator to elevate access so they can manage Azure role assignments across all subscriptions and management groups, including the tenant root management group. Once that access path is enabled, User1 can obtain the necessary RBAC permissions to assign policy at the tenant root scope.

  Why the other selections are not correct:

  - Create a new management group and delegate User1 as the owner of the new management group:

  This does not grant permissions at the tenant root management group; it only applies to the newly created management group.

  - Assign the Owner role for the Azure subscription to User1, and then instruct User1 to configure access management for Azure resources:

  Subscription Owner does not automatically grant access at the tenant root management group scope.

  - Assign the Owner role for the Azure subscription to User1, and then modify the default conditional access policies:

  Conditional Access is not the control plane for Azure RBAC at the tenant root management group.

  References:

  1. Elevate access to manage all Azure subscriptions and management groups https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin Date Modified: Unable to locate date modified Date Access: 01/24/2026 2. What is Azure Policy? (scope includes management groups) https://learn.microsoft.com/en-us/azure/governance/policy/overview Date Modified: Unable to locate date modified Date Access: 01/24/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - Tenant root management group tasks usually require tenant-level elevation/permissions, not just subscription-level roles.

  - If you see "tenant root management group," think "management groups + RBAC elevation" (AZ-104).

  Summary:

  Enabling the correct tenant-level permissions so a user can assign policy at the tenant root management group scope.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) | |__ 1.3 Manage Azure subscriptions and governance | |__ 1.3.7 Configure management groups

• Question 407:

  You have an Active Directory domain named contoso.com that contains the objects shown in the following table.

  

  The groups have the memberships shown in the following table.

  

  OU1 and OU2 are synced to Azure Active Directory (Azure AD).

  You modify the synchronization settings and remove OU1 from synchronization. You sync Active Directory and Azure AD.

  Which objects are in Azure AD?

  OU1 and OU2 are synced to Azure Active Directory (Azure AD). You modify the synchronization settings and remove OU1 from synchronization. You sync Active Directory and Azure AD.

  Which objects are in Azure AD?

  A. User4 and Group2 only
  B. User2, Group1, User4, and Group2 only
  C. User1, User2, Group1, User4, and Group2 only
  D. User1, User2, User3, User4, Group1, and Group2
  A. User4 and Group2 only

  ---

  Explanation

  --------------------------------------------------------------------------------

  User4 and Group2 only

  --------------------------------------------------------------------------------

  You removed OU1 from synchronization scope and then ran a sync. With Microsoft Entra Connect, when an object is filtered out of scope (for example, by domain/OU filtering) and you apply the change correctly, Entra Connect will remove (delete) the previously synchronized objects that are now out of scope in Microsoft Entra ID (1).

  Given the table:

  - OU1 contains: User1, User2, User3, Group1

  - OU2 contains: User4, Group2

  After OU1 is excluded and synchronization runs, only the objects that remain in scope (OU2) will remain in Microsoft Entra ID:

  - User4 (OU2) remains.

  - Group2 (OU2) remains.

  Group membership does not "preserve" out-of-scope objects:

  Even though Group2 previously contained members from OU1 (User2 and Group1), those OU1 objects are out of scope and are removed from Microsoft Entra ID during the cleanup. Group2 can still exist, but the out-of-scope members will not remain in the directory.

  Why the other selections are not correct:

  - Any answer that still includes User1, User2, User3, or Group1 is incorrect because those objects are in OU1, which was removed from synchronization scope, and filtered objects are deleted in Microsoft Entra ID when the change is applied (1).

  --------------------------------------------------------------------------------

  References:

  1. Microsoft Entra Connect Sync: Configure filtering https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/how-to-connect-sync-configure-filtering

  Date Modified: 2025-04-09 Date Access: 01/23/2026

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - AZ-104 frequently tests how "scope" changes in Microsoft Entra Connect affect object lifecycle in Microsoft Entra ID. When you change domain/OU filtering, expect "Full Import" requirements and potential mass-deletion safeguards (prevent accidental deletes).

  - Remember: group nesting does not override sync scope. If the source objects fall out of scope, they will be removed from Microsoft Entra ID after the sync applies the change.

  -------------------------------------------------------------------------------- Summary:

  This question tested Microsoft Entra Connect domain/OU filtering behavior and the impact on which on-premises AD objects remain synchronized into Microsoft Entra ID after scope changes.

  --------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.2 Manage user and group properties

• Question 408:

  HOTSPOT

  You have an Azure subscription that contains a storage account named storage1.

  You need to configure a shared access signature (SAS) to ensure that users can only download blobs securely by name.

  Which two settings should you configure? To answer, select the appropriate settings in the answer area.

  NOTE: Each correct answer is worth one point.

  

  

  ---

  Verified Answer (matches the highlighted key):

  - Allowed resource types: Object

  - Allowed permissions: Read

  Why this is correct:

  - The requirement is “only download blobs securely by name.” That maps to:

  - Object-level access (blobs are object-level in SAS resource types)

  - Read permission only (download/read)

  - Not selecting Container/Service resource types prevents listing containers/blobs or performing service-level operations via the SAS.

  - Not selecting additional permissions (Write/Delete/List/etc.) enforces least privilege.

  Why the other checkboxes are not selected:

  - Container or Service resource types: enable broader capabilities (list/create/delete containers, service properties, etc.) beyond “download by name.”

  - Any permission beyond Read: exceeds requirement (Write/Delete/Add/Create/List).

  Exam Tip:

  - “Download a blob by name” --> Object + Read. “List blobs” --> Container + List. “Service operations” --> Service.

• Question 409:

  You have an Azure subscription.

  You are creating a new Azure container instance that will have the following settings:

  1. Container name: cont1 2. SKU: Standard 3. OS type: Windows 4. Networking type: Public 5. Memory (GiB): 2.5 6. Number of CPU cores: 2

  You discover that the Private setting for Networking type is unavailable.

  You need to ensure that cont1 can be configured to use private networking.

  Which setting should you change?

  A. Memory (GiB)
  B. Networking type
  C. Number of CPU cores
  D. OS type
  E. SKU
  B. Networking type

  ---

  Explanation

  ----------------------------------------------------------------------

  OS type

  ----------------------------------------------------------------------

  In Azure Container Instances (ACI), **private networking (VNet deployment)** is only available for supported deployment combinations. When the **Private** option is unavailable for Networking type, the most common blocking configuration in exam scenarios is the **OS type = Windows**. Changing the OS type to a supported option (typically Linux in ACI VNet/private networking scenarios) makes private networking selectable.

  Why the other options are not correct:

  - Memory (GiB) / Number of CPU cores: sizing does not determine whether private networking is supported.

  - Networking type: that is the setting you *want* to select (Private), but it is currently unavailable; the question asks what you must change so Private becomes available.

  - SKU: Standard is generally not the typical limiter called out in these scenarios compared to OS support.

  ---------------------------------------------------------------------- References:

  1. (General ACI constraint concept) Azure Container Instances documentation. https://learn.microsoft.com/en-us/azure/container-instances/ Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  ----------------------------------------------------------------------

  Microsoft Exam Tips:

  - AZ-104 often tests "feature unavailable" troubleshooting: identify the property that makes the feature supported (region, SKU, OS, etc.).

  - For containers: keep straight which features apply to ACI vs. AKS vs. App Service.

  Summary:

  Enabling ACI private networking by changing an incompatible OS-type configuration.

  ---------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.3 Provision and manage containers in the Azure portal |__ 3.3.2 Provision a container by using Azure Container Instances

• Question 410:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json.

  You receive a notification that VM1 will be affected by maintenance.

  You need to move VM1 to a different host immediately.

  Solution: From the Redeploy blade, you click Redeploy.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Yes

  Redeploying a VM ("Redeploy + reapply" in the portal) migrates the VM to a new Azure host node. This is a standard mitigation step when the underlying host has issues or when you need the VM placed onto different infrastructure.

  Therefore, clicking Redeploy meets the goal of moving VM1 to a different host immediately (with a restart as part of the operation).

  Why the other selection is incorrect:

  - No: This is incorrect because Redeploy explicitly migrates the VM to a new Azure host, which satisfies the "different host" requirement.

  Microsoft Exam Tips:

  - "Move VM to a different host" (not region) is a strong signal for Redeploy.

  - Redeploy is not the same as moving to another subscription/resource group; it is a host-level relocation.

  Summary:

  Redeploy moves the VM to a new Azure host, meeting the requirement.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources |__ 3.2 Create and configure virtual machines |__ 3.2.1 Create a virtual machine