Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 421:

  You have an Azure Storage account that contains a blob container named reports.

  You must grant a vendor read-only access to the blobs in reports for 7 days without sharing account keys.

  You must also be able to revoke access immediately (before the 7 days end) without regenerating storage account keys.

  A. An account SAS with a 7-day expiry
  B. A service SAS with a 7-day expiry (no stored access policy)
  C. A service SAS associated to a stored access policy
  D. Azure Storage account access keys
  C. A service SAS associated to a stored access policy

  ---

  Explanation

  --------------------------------------------------------------------------------

  A service SAS associated to a stored access policy

  --------------------------------------------------------------------------------

  A stored access policy lets you centrally control (and revoke) SAS permissions without rotating storage account keys. You define the stored access policy on the container, then generate a service SAS that references that policy. If you need to revoke access immediately, you modify/delete the stored access policy, which invalidates all SAS tokens tied to it.

  Why other options are not correct:

  - An account SAS with a 7-day expiry: You cannot centrally revoke it without rotating keys; you typically must wait for expiry or regenerate keys.

  - A service SAS with a 7-day expiry (no stored access policy): Same issue-revocation is not centralized unless you rotate keys.

  - Azure Storage account access keys: Violates the requirement to not share account keys and is overly permissive.

  -------------------------------------------------------------------------------- References:

  1. Grant limited access to data with shared access signatures (SAS) https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview Date Modified: 11/21/2024 Date Access: 01/25/2026 2. Define a stored access policy - Azure Storage (REST) https://learn.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy Date Modified: 07/11/2023 Date Access: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: If you must be able to revoke SAS access without rotating keys, use a stored access policy (container/blob) and generate a SAS that references it.

  - Prefer least-privilege (read-only) and short-lived tokens; use stored access policies when you need centralized control.

  -------------------------------------------------------------------------------- Summary:

  Used a service SAS + stored access policy to enable immediate revocation without regenerating account keys.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15?0%) |__ 2.1 Configure access to storage |__ 2.1.2 Create and use shared access signature (SAS) tokens |__ 2.1.3 Configure stored access policies

  https://docs.microsoft.com/en-us/azure/storage/common/redundancy- migration?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&tabs=portal

• Question 422:

  HOTSPOT

  You need to create container1 and share1.

  Which storage accounts should you use for each resource? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  container1: storage2 and storage3 only share1: storage2 only

  container1 is an Azure Blob container. Both **StorageV2** (GPv2) and **BlobStorage** accounts support Blob service access tiers, including **Cool** (subject to feature specifics). In the case study, storage2 is StorageV2 and storage3 is BlobStorage, so either can host container1.

  share1 is an Azure file share. The requirement includes using the **Cool** tier. Azure Files cool tier is supported on standard file shares in **StorageV2** accounts; premium FileStorage accounts don’t use the same access tier model. In the case study, storage2 is the only StorageV2 account that supports creating a standard file share with the required tier.

  Case study (Contoso, Ltd. 2 Case Study.pdf), “Planned changes – create container1 and share1, use Cool tier”.

  Microsoft Learn – Storage Blob access tiers. URL: https://learn.microsoft.com/en-us/azure/storage/blobs/storage-blob-storage-tiers. Retrieved January 31, 2026. (Last updated date not captured due to web tool limits in this run.) Microsoft Learn – Storage account overview (account kinds and supported services). URL: https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview. Retrieved January 31, 2026. (Last updated 2025-10-23.)

  - Blob containers can live in BlobStorage or GPv2; file shares have stricter account-kind requirements when tiers are involved.

  - Premium FileStorage is for premium Azure Files; tiering questions usually imply standard Azure Files on GPv2.

  2.0 Implement and manage storage (15–20%) |__2.3 Configure Azure Files and Azure Blob Storage |__|__2.3.1 Create and configure a file share in Azure Storage |__|__2.3.2 Create and configure a container in Blob Storage

• Question 423:

  You have an Azure subscription that contains two peered virtual networks named VNet1 and VNet2.

  VNet1 has a VPN gateway that uses static routing.

  The on-premises network has a VPN connection that uses the VPN gateway of VNet1.

  You need to configure access for users on the on-premises network to connect to a virtual machine on VNet2. The solution must minimize costs.

  Which type of connectivity should you use?

  A. Azure Firewall with a private IP address
  B. service chaining and user-defined routes (UDRs)
  C. Azure Application Gateway
  D. ExpressRoute circuits to VNet2
  B. service chaining and user-defined routes (UDRs)

  ---

  service chaining and user-defined routes (UDRs)

  You already have a VPN gateway in VNet1 used by on-premises. To let on-prem users reach a VM in VNet2 at minimal cost, you typically:

  1) Use VNet peering features (gateway transit / use remote gateway) so VNet2 can leverage VNet1's VPN gateway rather than deploying another gateway, and

  2) Use UDRs (service chaining) as needed to ensure the correct return path and to steer traffic appropriately between the peered VNets and the VPN.

  This avoids the additional cost of separate connectivity services.

  Why the other choices are not correct:

  - Azure Firewall with a private IP address: Adds cost and is not required just to enable on-prem to VNet2 connectivity in this scenario.

  - Azure Application Gateway: L7 HTTP(S) load balancer/WAF; not used to provide private on-prem-to-VM connectivity across VNets.

  - ExpressRoute circuits to VNet2: Works, but is not the cost-minimizing option given an existing VPN gateway.

  Microsoft Exam Tips:

  - AZ-104 cost-minimization cues often imply "reuse existing gateway" via peering capabilities rather than deploying new gateways/services.

  - When you see "service chaining," think "UDR-based steering."

  Summary:

  Hybrid connectivity extension to a second peered VNet using gateway reuse patterns and UDR/service chaining.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking  |__ 4.1 Configure and manage virtual networks in Azure |__ 4.1.4 Configure user-defined network routes

• Question 424:

  You plan to move services from your on-premises network to Azure. You identify several virtual machines that you believe can be hosted in Azure. The virtual machines are shown in the following table.

  

  Which two virtual machines can you access by using Azure migrate? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Sea-CA0l
  B. Hou-NW01
  C. NYC-FS01
  D. Sea-DC01
  E. BOS-DB01
  C. NYC-FS01
  E. BOS-DB01

  ---

  Explanation

  -----------------------------------------------------------------------

  NYC-FS01 BOS-DB01

  -----------------------------------------------------------------------

  Azure Migrate can discover and assess (and, depending on tooling, migrate) servers from VMware environments. In the provided list, NYC-FS01 and BOS-DB01 are the VMs hosted on VMware vCenter Server, which are the two items that match the expected Azure Migrate source environment in this question.

  Why the other selections are incorrect:

  - Sea-CA01 and Sea-DC01: These are shown as running on Hyper-V. In many exam scenarios, Hyper-V migrations are positioned under Azure Site Recovery tooling rather than selecting these as the Azure Migrate-accessible pair.

  - Hou-NW01: While it is on VMware, the question requires exactly two selections; the answer key indicates the VMware file server and SQL server VMs as the correct pair.

  ----------------------------------------------------------------------- References:

  1. Azure Migrate: Supported sources/requirements (Microsoft Learn) https://learn.microsoft.com/en-us/azure/migrate/migrate-support-matrix Date Modified: 10/29/2024 Date Accessed: 01/25/2026

  ----------------------------------------------------------------------- Microsoft Exam Tips:

  - Pay attention to the "source platform" in the table (VMware vs Hyper-V) when asked what you can access/migrate with a given tool.

  - If the question says "Which two" and mixes environments, select the pair that matches the tool's intended source in the scenario.

  ----------------------------------------------------------------------- Summary:

  This focuses on identifying which VMs match Azure Migrate's expected on-prem source environment.

  ----------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) 3.2 Create and configure virtual machines 3.2.1 Create a virtual machine

• Question 425:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  You plan to use an Azure key vault to provide a secret to app1.

  What should you create for app1 to access the key vault, and from which key vault can the secret be used? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Create a: Managed identity
  
  Use the secret from: Vault1, Vault2, or Vault3

  Azure Container Apps can authenticate to Azure services without storing credentials by using a managed identity. For Key Vault integration, you grant the container app’s managed identity permission to read the secret.

  Key Vault access is based on the vault’s endpoint and authorization (RBAC or access policies), not the resource group or region of the vault. Therefore, app1 can use a secret from Vault1, Vault2, or Vault3 as long as the managed identity is granted secret read permissions on the selected vault.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20–25%)
  
  |__ 1.2 Manage access to Azure resources
  
  |__ 1.2.2 Assign roles at different scopes

  3.0 Deploy and manage Azure compute resources (20–25%)
  
  |__ 3.3 Provision and manage containers in the Azure portal
  
  |__ 3.3.3 Provision a container by using Azure Container Apps

• Question 426:

  You have an Azure virtual network named VNet1 that contains the following settings:

  1. IPv4 address space: 172.16.10.0/24

  2. Subnet name: Subnet1

  3. Subnet address range: 172.16.10.0/25

  What is the maximum number of virtual machines that can connect to Subnet1?

  A. 24
  B. 25
  C. 123
  D. 128
  E. 251
  C. 123

  ---

  A /25 subnet has 128 total IPv4 addresses. Azure reserves 5 addresses in every subnet (the first 4 and the last 1).

  128 - 5 = 123 usable IP addresses (and thus up to 123 VM NIC private IP addresses, assuming one IP per VM NIC).

  Why the other selections are not correct:

  • 128: Ignores Azure reserved addresses.
  • 251 / 25 / 24: Do not match /25 capacity after reservations.

  Exam Tips:

  • Always subtract Azure’s 5 reserved IP addresses when asked for the maximum number of hosts in a subnet.

  Summary:

  • Subnet sizing and Azure reserved IP addresses

  AZ-104 Exam Objective Hierarchy:
  
  4.0 Implement and manage virtual networking (15–20%)
  
  └── 4.1 Configure and manage virtual networks in Azure
  
    └── 4.1.1 Create and configure virtual networks and subnets

• Question 427:

  You issued a service SAS URL to a vendor for a blob container.

  The vendor's access must be revoked immediately.

  You must be able to revoke access without regenerating the storage account keys.

  A. Regenerate the storage account access keys
  B. Assign an Azure RBAC role to the vendor for the storage account
  C. Configure a SAS expiration policy on the storage account
  D. Configure a stored access policy and generate the SAS using the policy identifier
  D. Configure a stored access policy and generate the SAS using the policy identifier

  ---

  Explanation

  --------------------------------------------------------------------------------

  Configure a stored access policy and generate the SAS using the policy identifier

  --------------------------------------------------------------------------------

  A stored access policy (defined on the container/file share/queue/table) is the Azure Storage mechanism that lets you revoke or modify permissions for a **service SAS** after it has already been issued-without regenerating the storage account keys. You generate the SAS so it references the stored access policy (signed identifier). If you later need to revoke access, you update/delete the stored access policy, and all SAS tokens bound to that policy are immediately affected.

  Why other selections are not correct:

  - Regenerate the storage account access keys: This revokes SAS tokens signed with the old key, but it is a broad, high-impact action that affects all clients using that key; the requirement is to revoke without rotating keys.

  - Assign Azure RBAC role to the vendor: RBAC is used for identity-based access (Entra ID). A vendor using an existing SAS URL is not affected by RBAC changes to the storage account unless they are accessing via identity-based auth.

  - Configure a SAS expiration policy on the storage account: This constrains future SAS creation/validity intervals, but it does not provide immediate targeted revocation of an already-issued SAS in the same way a stored access policy does.

  -------------------------------------------------------------------------------- References:

  1. Grant limited access to data with shared access signatures (SAS) https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview Modified: 11/21/2024 Date Access: 01/24/2026

  2. Define a stored access policy - Azure Storage (REST) https://learn.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy Modified: 07/11/2023 Date Access: 01/24/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - If the requirement is "revoke a SAS without rotating keys," the expected answer is **stored access policy**.

  - Map concepts: "service SAS" (key-signed) + "stored access policy" (server-side control + revocation capability).

  -------------------------------------------------------------------------------- Summary:

  Revoking a service SAS using stored access policies (server-side control) without rotating storage account keys.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15?0%) |__ 2.1 Configure access to storage |__ 2.1.3 Configure stored access policies

• Question 428:

  HOTSPOT

  You have an Azure Storage account named storage1.

  You have an Azure Service app named App1 and an app named App2 that runs in an Azure container instance. Each app uses a managed identity.

  You need to ensure that App1 and App2 can read blobs from storage1. The solution must meet the following requirements:

  1. Minimize the number of secrets used.

  2. Ensure that App2 can only read from storage1 for the next 30 days.

  What should you configure in storage1 for each app? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  App1: Access control (IAM)

  App2: Shared access signatures

  Why this is correct:

  - App1 uses a managed identity, so the best practice is to grant it Azure RBAC permissions on the storage account (Access control (IAM))-no secrets required.

  - App2 must be restricted to 30 days. A SAS can be issued with an expiration time, making it an appropriate mechanism for time-bounded access.

  Exam Tip

  - “No secrets / managed identity” --> RBAC (IAM).

  - “Time-limited access” --> SAS with expiry.

  AZ-104 Exam Objective Hierarchy

  1.0 Manage Azure identities and governance (20–25%) |__1.2 Manage access to Azure resources |__|__1.2.2 Assign roles at different scopes 2.0 Implement and manage storage (15–20%) |__2.1 Configure access to storage |__|__2.1.2 Create and use shared access signatures (SAS)

• Question 429:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription.

  Solution: You assign the Reader role at the subscription level to Admin1.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  No

  ----------------------------------------------------------------------------------------------------

  Reader is a read-only role and does not provide the write permissions needed to enable or configure Network Watcher capabilities such as Traffic Analytics. Network Watcher capabilities require roles like Owner, Contributor, or Network Contributor (or a custom role with required actions). :contentReference[oaicite:17]{index=17}

  Why the other selection is not correct:

  - Yes:

  Reader does not grant the necessary permissions to configure/enable Traffic Analytics.

  References:

  1. Azure RBAC permissions required for Network Watcher (Owner, Contributor, or Network contributor) https://learn.microsoft.com/en-us/azure/network-watcher/required-rbac-permissions Date Modified: 06/24/2025 :contentReference[oaicite:18]{index=18} Date Access: 01/24/2026 2. Azure built-in roles (Reader is read-only) https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles Date Modified: 01/02/2026 :contentReference[oaicite:19]{index=19} Date Access: 01/24/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - Reader cannot "enable" anything-assume "No" when configuration changes are required.

  - For networking features, Network Contributor is frequently the least-privileged "yes" answer.

  Summary:

  Reader does not provide sufficient permissions to enable Traffic Analytics.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) | |__ 1.2 Manage access to Azure resources | |__ 1.2.2 Assign roles at different scopes

• Question 430:

  You have a Microsoft Entra tenant configured as shown in the following exhibit.

  

  The tenant contains the identities shown in the following table.

  

  You purchase a Microsoft Fabric license.

  To which identities can you assign the license?

  A. User1 only
  B. User1 and Group1 only
  C. User1 and Group2 only
  D. User1, Group1, and Group2
  A. User1 only

  ---

  Explanation

  --------------------------------------------------------------------------------

  User1 only

  --------------------------------------------------------------------------------

  Microsoft Entra ID (Azure AD) group-based licensing (assigning product licenses to groups) is not available with only a Microsoft Entra ID Free tenant. Group-based licensing requires Microsoft Entra ID P1 (or higher) or certain Microsoft 365 plans that include the necessary licensing entitlement. Therefore, you can assign the Microsoft Fabric license directly to a user (User1), but you cannot assign it to Group1 (security group) or Group2 (Microsoft 365 group) in a Free-only tenant.

  Why the other selections are not correct:

  - "User1 and Group1 only" is incorrect because assigning licenses to groups requires group-based licensing entitlements not present in Entra ID Free.

  - "User1 and Group2 only" is incorrect for the same reason: group assignment requires group-based licensing entitlements.

  - "User1, Group1, and Group2" is incorrect because both group assignments are blocked without the required licensing.

  --------------------------------------------------------------------------------

  References:

  1. Microsoft. (2025-01-31). What is group-based licensing in Microsoft Entra ID? Microsoft Learn.

  https://learn.microsoft.com/en-us/entra/fundamentals/concept-group-based-licensing Date Accessed: 01/26/2026

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - AZ-104: Treat "assign a license to a group" as "group-based licensing," and immediately validate whether the tenant has Entra ID P1/P2 (or eligible Microsoft 365 plans). If not, default to per-user assignment.

  - Watch for distractors that mention "security group" vs "Microsoft 365 group"-both still require group-based licensing entitlement to assign product licenses via groups.

  --------------------------------------------------------------------------------

  Summary:

  This question tested Microsoft Entra licensing capabilities-specifically whether a tenant with Microsoft Entra ID Free supports group-based (group-scoped) license assignment.

  --------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.3 Manage licenses in Microsoft Entra ID