Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 431:

  HOTSPOT

  You are evaluating the name resolution for the virtual machines after the planned implementation of the Azure networking infrastructure.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  

  

• Question 432:

  You plan to create the Azure web apps shown in the following table.

  

  What is the minimum number of App Service plans you should create for the web apps?

  A. 1
  B. 2
  C. 3
  D. 4
  B. 2

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  ----------------------------------------------------------------------------------------------------

  App Service plans are OS-specific (Windows vs. Linux). You can run multiple apps with different runtime stacks in the same plan only if they are compatible with the plan's OS and region.

  Given the table:

  - WebApp2 (ASP.NET v4.8) requires Windows App Service.

  - WebApp4 (Ruby 2.6) is typically a Linux App Service runtime.

  - WebApp1 (.NET Core 3.1 LTS) can run on Windows or Linux.

  - WebApp3 (PHP 7.3) can run on Windows or Linux.

  To minimize plans:

  - Put the Windows-required app(s) (ASP.NET v4.8, and optionally .NET Core + PHP) in one Windows plan.

  - Put the Ruby app in one Linux plan.

  => Minimum is 2 plans.

  Why the other selections are incorrect:

  - You cannot host both Windows and Linux apps in the same App Service plan.

  - 3 or 4

  - Not required; you can consolidate all Windows-compatible apps into one Windows plan, and the Linux-only app into one Linux plan.

  ---------------------------------------------------------------------------------------------------- References:

  1. App Service plan OS constraint discussion (plans are OS-specific; Windows vs. Linux separation) https://learn.microsoft.com/en-us/answers/questions/1692568/how-many-app-service-plans-would-i-need-to-use-for Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - When you see mixed runtimes, immediately check for OS constraints (ASP.NET Framework => Windows; many Ruby stacks => Linux).

  - The exam often expects "fewest plans" by consolidating where OS/region/pricing tier allow.

  ---------------------------------------------------------------------------------------------------- Summary:

  Determining minimum App Service plans based on runtime and OS compatibility.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.4 Create and configure Azure App Service |__ 3.4.1 Provision an App Service plan

• Question 433:

  You have a Recovery Services vault named RSV1. RSV1 has a backup policy that retains instant snapshots for five days and daily backup for 14 days.

  RSV1 performs daily backups of VM1. VM1 hosts a static website that was updated eight days ago.

  You need to recover VM1 to a point eight days ago. The solution must minimize downtime.

  What should you do first?

  A. Deallocate VM1.
  B. Restore VM1 by using the Replace existing restore configuration option.
  C. Delete VM1.
  D. Restore VM1 by using the Create new restore configuration option.
  B. Restore VM1 by using the Replace existing restore configuration option.

  ---

  Restore VM1 by using the Replace existing restore configuration option.

  To recover VM1 to a point eight days ago, you restore from an available recovery point in the Recovery Services vault. Using Replace existing restores the backed-up VM disks back onto the existing VM (in-place restore), returning the VM to the selected point in time.

  Why other selections are not correct:

  - Deallocate/Delete VM1: Not required to initiate restore and increases disruption.

  - Restore using Create new: Restores to a new VM; useful in some scenarios, but the stated answer focuses on in-place recovery of the existing VM as the first action in this question set.

  Microsoft Exam Tips:

  - Know the two portal restore patterns: Replace existing (in-place) vs Create new (new VM).

  - Read the stem carefully for whether they want "restore existing VM" vs "restore alongside."

  Summary:

  Restoring an Azure VM to a point-in-time recovery point using in-place restore.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources  |__ 5.2 Implement backup and recovery |__ 5.2.4 Perform backup and restore operations by using Azure Backup

• Question 434:

  HOTSPOT

  You have an Azure virtual machine that runs Windows Server 2019 and has the following configurations:

  1. Name: VM1 2. Location: West US 3. Connected to: VNET1 4. Private IP address: 10.1.0.4 5. Public IP address: 52.186.85.63 6. DNS suffix in Windows Server: Adatum.com

  You create the Azure DNS zones shown in the following table.

  

  You need to identify which DNS zones you can link to VNET1 and the DNS zones to which VM1 can automatically register.

  Which zones should you identify? To answer, select the appropriate options in the answer area.

  

  

  ---

  Box 1: DNS zones that you can link to VNET1: The private zones only

  Box 2: DNS zones to which VM1 can automatically register: The private zones only

  - Box 1: You can link a **virtual network** only to **Azure Private DNS zones**. Public DNS zones are internet-facing and do not support VNet links.

  - Box 2: Automatic DNS record registration for Azure resources (when enabled) is a **Private DNS zone** capability via a VNet link configured for auto-registration.

  Why the other options are not correct:

  - “Adatum.com only” or “The public zones only” is incorrect because **public DNS zones can’t be linked to VNets** for private name resolution.

  - “Adatum.pri and adatum.com only” is incorrect because it includes a **public** zone.

  References:

  Microsoft. (n.d.). Azure Private DNS overview. Last updated: Unable to locate on page. Date accessed: 2026-01-27. https://learn.microsoft.com/en-us/azure/dns/private-dns-overview Microsoft. (n.d.). Virtual network links for Azure Private DNS. Last updated: Unable to locate on page. Date accessed: 2026-01-27. https://learn.microsoft.com/en-us/azure/dns/private-dns-virtual-network-links

  Microsoft Exam Tips:

  - “Link to a VNet” is your cue for **Private DNS**, not public DNS.

  - “Auto registration” is only for **private** DNS zones (and only when enabled on the VNet link).

  Summary:

  This question tested the difference between public vs private DNS zones, and which features require Private DNS (VNet linking and auto-registration).

  AZ-104 Exam Objective Hierarchy:

  4.0 - Implement and manage virtual networking (15–20%) |__ 4.3 - Configure name resolution and load balancing |__ |__ 4.3.1 - Configure Azure DNS

• Question 435:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You deploy an Azure Kubernetes Service (AKS) cluster named AKS1.

  You need to deploy a YAML file to AKS1.

  Solution: From Azure CLI, you run azcopy.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  AzCopy is a command-line utility for transferring data to/from Azure Storage (blobs/files). It is not used for deploying Kubernetes YAML manifests to an AKS cluster. Therefore, running azcopy does not meet the goal of deploying a YAML file to AKS.

  Why the alternative is not correct:

  - Yes: Incorrect because azcopy does not interact with the Kubernetes API to create/update Kubernetes resources.

  References:

  [1] Microsoft. "Copy or move data to Azure Storage by using AzCopy v10." Microsoft Learn. Date modified: 2026-01-08. Date accessed: 2026-01-25. https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10

  Microsoft Exam Tips:

  - Map tools to domains: azcopy = storage data transfer; kubectl = Kubernetes resource deployment.

  Summary:

  Validated that AzCopy is for Azure Storage transfers, not Kubernetes manifest deployment.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15?0%) |__ 2.2 Configure and manage storage accounts |__ 2.2.5 Manage data by using Azure Storage Explorer and AzCopy

• Question 436:

  You plan to deploy route-based Site-to-Site VPN connections between several on-premises locations and an Azure virtual network.

  Which tunneling protocol should you use?

  A. L2TP
  B. |KEv2
  C. PPTP
  D. IKEv1
  B. |KEv2

  ---

  Explanation

  --------------------------------------------------------------------------------

  IKEv2

  --------------------------------------------------------------------------------

  Azure VPN Gateway site-to-site connections use IPsec/IKE. For route-based VPNs (dynamic routing scenarios), IKEv2 is supported and is the preferred/modern IKE version for interoperability and security.

  Why the other choices are not correct:

  - L2TP: Typically used for client VPN scenarios (often with IPsec), not standard route-based S2S with Azure VPN Gateway.

  - PPTP: Insecure and not recommended; not used for Azure S2S VPN.

  - IKEv1: Older; may be supported in some cases, but IKEv2 is the correct selection here and is broadly recommended.

  References:

  1. Microsoft. (2025, July 31). About VPN devices and IPsec/IKE parameters for Site-to-Site VPN Gateway connections. Microsoft Learn. Retrieved January 25, 2026, from https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway- about-vpn-devices

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: For S2S VPN, think "IPsec/IKE" (not PPTP). When choosing between IKEv1 and IKEv2, prefer IKEv2 unless a device constraint forces IKEv1.

  Summary:

  Azure VPN Gateway tunneling protocols and S2S VPN fundamentals.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.2 Configure secure access to virtual networks |__ 4.2.5 Configure private endpoints for Azure PaaS

• Question 437:

  HOTSPOT

  You have an Azure subscription that contains a virtual network named VNET1 in the East US 2 region. A network interface named VM1-NI is connected to VNET1.

  You successfully deploy the following Azure Resource Manager template.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE:Eachcorrectselectionisworthonepoint.

  

  

  ---

  Statement 1: Yes Statement 2: Yes Statement 3: No

  Explanation (Why this is correct)

  - VMs connected to the same virtual network can communicate (subject to NSG/UDR constraints), so Statement 1 is Yes.

  - Availability Zones provide datacenter-level resiliency within a region, so loss of a single datacenter (zone) can still allow availability --> Yes.

  - Region-wide outage is broader than a zone outage; Availability Zones do not guarantee regional failover by themselves --> No.

  Explanation (Why the other options are incorrect)

  - Confusing “zone resiliency” with “region resiliency” is the common trap.

  Exam Tip

  - **Availability Zones ≠ cross-region DR**. For regional resiliency, use paired regions and replication/failover patterns.

  References

  - Microsoft. (n.d.). Regions and availability zones. https://learn.microsoft.com/en-us/azure/reliability/availability-zones-overview

  AZ-104 Exam Objective Hierarchy 3.0 Deploy and manage Azure compute resources (20–25%) |__3.2 Create and configure virtual machines |__|__3.2.6 Configure availability zones and sets

• Question 438:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to assign User1 the Storage File Data SMB Share Contributor role for share1.

  What should you do first?

  A. Modify the security profile for the file shares in storage1.
  B. Configure Access control (IAM) for share1.
  C. Select Default to Azure Active Directory authorization in the Azure portal for storage1.
  D. Enable identity-based data access for the file shares in storage1.
  B. Configure Access control (IAM) for share1.

  ---

  Configure Access Control (IAM) for share1.

  To assign the Storage File Data SMB Share Contributor role to a specific file share, scope the RBAC role assignment at the file share level. In the Azure portal, open the file share and use Access control (IAM) to add a role assignment for User1. That is the required first action to grant share-level permissions.

  Why the other options are not correct:

  Modify the security profile for the file shares in storage1: This is not the mechanism for assigning Azure RBAC share-level permissions.

  Select Default to Azure Active Directory authorization in the Azure portal for storage1: This is not the first step for share-level RBAC assignment and does not, by itself, grant the role.

  Enable identity-based data access for the file shares in storage1: Identity-based access may be a prerequisite in some authentication models, but the question specifically asks about assigning an Azure RBAC role to the share; the immediate first step for the role assignment is IAM at the share scope.

  Exam Tips:

  AZ-104: Data-plane roles for Azure Files (Storage File Data SMB Share ...) are assigned via RBAC at the storage account or file share scope.

  Always confirm the scope: storage account vs. file share vs. directory/file (NTFS ACLs).

  Summary:

  Assign Azure Files share-level permissions using RBAC at the file share scope.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and Manage Storage (15–20%)

  |__ 2.1 Configure Access to Storage

  |__ 2.1.5 Configure Identity-Based Access for Azure Files

• Question 439:

  DRAG DROP

  You create an Azure Migrate project named TestMig in a resource group named test-migration. You need to discover which on-premises virtual machines to assess for migration.

  Which three actions should you perform in sequence? To answer, select the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: Download the OVA file for the collector appliance

  Step 2: Create a migration group in the project

  Step 3: Create an assessment in the project

  Explanation:

  You’re using Azure Migrate to discover on-premises VMs and assess them for migration. The answer key’s sequence focuses on (1) obtaining the collector/appliance package used for discovery, then (2) organizing discovered servers for assessment, then (3) creating the assessment artifact.

  Why the steps are correct (and why order matters):

  Step 1: Download the OVA file for the collector appliance

  - The Azure Migrate appliance/collector is what enables discovery by collecting configuration/performance metadata from your on-prem environment and sending it to the Azure Migrate project. Downloading the OVA is the prerequisite to deploying that appliance.

  Step 2: Create a migration group in the project

  - Groups are used to organize discovered servers (for example, by app/workload) so you can assess them together.

  Step 3: Create an assessment in the project

  - An assessment evaluates readiness, sizing, and cost (depending on settings) for the servers in scope (often a group).

  Why the other actions are not selected (per this exam item’s expected workflow):

  - Configure the collector and start discovery

  - This is required in real life, but it is not selected by the answer key in this question’s “three actions” constraint.

  - Create a migration group in the project (selected)

  - Create a collector virtual machine

  - The OVA deployment results in the appliance VM, but the key specifically calls out downloading the OVA rather than “create a collector VM.”

  References:

  1. Microsoft Learn. Azure Migrate appliance.

  https://learn.microsoft.com/en-us/azure/migrate/migrate-appliance?view=migrate Last updated: 07/16/2025. Date Accessed: 01/26/2026.

  2. Microsoft Learn. Discover servers running in a VMware environment with Azure Migrate (appliance/OVA option + discovery workflow).

  https://learn.microsoft.com/en-us/azure/migrate/tutorial-discover-vmware?view=migrate Last updated: 07/07/2025. Date Accessed: 01/26/2026.

  3. Microsoft Learn. Group servers for assessment with Azure Migrate.

  https://learn.microsoft.com/en-us/azure/migrate/how-to-create-a-group?view=migrate Last updated: 03/21/2025. Date Accessed: 01/26/2026.

  4. Microsoft Learn. Create an Azure VM assessment.

  https://learn.microsoft.com/en-us/azure/migrate/how-to-create-assessment?view=migrate Last updated: 09/30/2025. Date Accessed: 01/26/2026.

  Microsoft Exam Tips:

  - Azure Migrate commonly tests the “discover --> group --> assess” pattern.

  - If you see “collector/appliance,” assume you must deploy it on-prem (OVA/template/script) before Azure Migrate can discover servers.

  - Groups are the typical scope boundary for assessments (especially in exam scenarios).

  Summary:

  This question covered Azure Migrate discovery/assessment workflow components: obtaining the appliance (OVA), grouping discovered servers, and creating an assessment.

  AZ-104 Exam Objective Hierarchy:

  3.0 - Deploy and manage Azure compute resources (20–25%) |__ 3.2 - Create and configure virtual machines |__ 3.2.3 - Move a virtual machine to another resource group, subscription, or region

• Question 440:

  Your company has an Azure Active Directory (Azure AD) tenant that is configured for hybrid coexistence with the on-premises Active Directory domain.

  You plan to deploy several new virtual machines (VMs) in Azure. The VMs will have the same operating system and custom software requirements.

  You configure a reference VM in the on-premise virtual environment. You then generalize the VM to create an image.

  You need to upload the image to Azure to ensure that it is available for selection when you create the new Azure VMs.

  Which PowerShell cmdlets should you use?

  A. Add-AzVM
  B. Add-AzVhd
  C. Add-AzImage
  D. Add-AzImageDataDisk
  B. Add-AzVhd

  ---

  Explanation

  --------------------------------------------------------------------------------

  Add-AzVhd

  --------------------------------------------------------------------------------

  To use a generalized on-prem VHD as the basis for Azure VM creation, you must first upload the VHD to Azure Storage. Add-AzVhd is the Azure PowerShell cmdlet used to upload a VHD to a storage account, which is a prerequisite step before you can reference it to create an image/VM in Azure.

  Why the other choices are not correct:

  - Add-AzVM: used to create a VM, not upload a VHD.

  - Add-AzImage / Add-AzImageDataDisk: not the standard cmdlet for uploading the VHD itself; you must upload the VHD first, then create an image referencing it.

  References:

  1. Add-AzVhd - Microsoft Learn (Az.Compute) https://learn.microsoft.com/en-us/powershell/module/az.compute/add-azvhd Date Modified: As shown on page (Microsoft Learn) Date Accessed: 01/25/2026

  Microsoft Exam Tips:

  - Image workflows are commonly "upload VHD" --> "create image" --> "deploy VM(s)".

  Summary:

  - Uploading generalized VHDs to Azure via Azure PowerShell.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.2 Create and configure virtual machines |__ 3.2.1 Create a virtual machine