Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 461:

  You deploy an Azure Application Gateway.

  You need to ensure that all the traffic requesting https://adatum.com/internal resources is directed to an internal server pool and all the traffic requesting https://adatum.com/external resources is directed to an external server pool.

  What should you configure on the Application Gateway?

  A. URL path-based routing
  B. multi-site listeners
  C. basic routing
  D. SSL termination
  A. URL path-based routing

  ---

  Explanation

  --------------------------------------------------------------------------------

  URL path-based routing

  --------------------------------------------------------------------------------

  You need to route requests to different backend pools based on the URL path:

  - /internal --> internal backend pool

  - /external --> external backend pool

  In Application Gateway, this is exactly what URL path-based routing rules accomplish: they inspect the request path and forward to the mapped backend pool.

  Why other options are not correct:

  - Multi-site listeners route by host header (different DNS names), not by path.

  - Basic routing is not path-aware.

  - SSL termination controls TLS handling, not backend selection by URL path.

  -------------------------------------------------------------------------------- References:

  1. URL path-based routing overview (Application Gateway) https://learn.microsoft.com/en-us/azure/application-gateway/url-route-overview Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - Host-based routing (multi-site) = different hostnames.

  - Path-based routing = same hostname, different URL paths.

  -------------------------------------------------------------------------------- Summary:

  Configuring Application Gateway to route traffic to different backends based on URL paths.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.3 Configure name resolution and load balancing |__ 4.3.3 Troubleshoot load balancing

  

  https://docs.microsoft.com/en-us/azure/application-gateway/url-route-overview

• Question 462:

  Your company has two on-premises servers named SRV01 and SRV02. Developers have created an application that runs on SRV01. The application calls a service on SRV02 by IP address.

  You plan to migrate the application on Azure virtual machines (VMs). You have configured two VMs on a single subnet in an Azure virtual network.

  You need to configure the two VMs with static internal IP addresses.

  What should you do?

  A. Run the New-AzureRMVMConfig PowerShell cmdlet.
  B. Run the Set-AzureSubnet PowerShell cmdlet.
  C. Modify the VM properties in the Azure Management Portal.
  D. Modify the IP properties in Windows Network and Sharing Center.
  E. Run the Set-AzureStaticVNetIP PowerShell cmdlet.
  E. Run the Set-AzureStaticVNetIP PowerShell cmdlet.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Run the Set-AzureStaticVNetIP PowerShell cmdlet.

  --------------------------------------------------------------------------------

  The answer choices here are from the classic (Azure Service Management) era. In that model, Set-AzureStaticVNetIP is the cmdlet specifically used to assign a static internal IP address for a VM within a virtual network. Therefore, this is the correct action per the provided options.

  Why the other choices are not correct:

  - New-AzureRMVMConfig: ARM-era VM configuration; not the specific operation described in the classic cmdlet set presented here.

  - Set-AzureSubnet: subnet selection/configuration, not assigning a VM's static internal IP.

  - Modify VM properties in the Azure Management Portal / Windows Network and Sharing Center: the question is testing the Azure-side VNet IP assignment via the provided PowerShell options.

  References:

  1. Microsoft documentation (archived/legacy). "Set-AzureStaticVNetIP." https://learn.microsoft.com/en-us/powershell/module/azure/set-azurestaticvnetip. Accessed 2026-01-25.

  2. Microsoft Learn. "IP addressing for Azure virtual networks (concepts)." https://learn.microsoft.com/en-us/azure/virtual-network/ip-services/virtual-network-ip-addresses-overview. Accessed 2026-01-25.

  Microsoft Exam Tips:

  - If you see "Set-Azure*" (not "Az.*"), you're usually in classic/legacy cmdlet territory; answer within that world.

  Summary:

  Static internal IP assignment in Azure using the cmdlets provided by the question set.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.1 Configure and manage virtual networks in Azure |__ 4.1.1 Create and configure virtual networks and subnets

• Question 463:

  HOTSPOT

  You implement the planned changes for cont2.

  What is the maximum number of additional access policies you can create for cont2? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Correct Answer:

  Stored access policies: 2 Immutable blob storage policies: 1

  Explanation: Azure Storage supports up to five stored access policies per container. The planned changes already require three stored access policies, so you can create two additional stored access policies.

  For immutability, the container can have a single time-based retention policy (in addition to legal holds), so you can create one immutable blob storage policy.

  Proof / Reasoning:

  Stored access policies limit per container is five.

  Immutability uses one time-based retention policy per container; legal holds are separate tags.

  References (APA):

  Microsoft. (n.d.). Create and use a stored access policy. Retrieved 2026-01-31, from https://learn.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy Microsoft. (n.d.). Immutable storage for Azure Blob Storage. Retrieved 2026-01-31, from https://learn.microsoft.com/en-us/azure/storage/blobs/immutable-storage-overview

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15–20%) |__2.2 Configure and manage storage accounts |__|__2.2.1 Create and configure storage accounts

• Question 464:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your company has a Microsoft SQL Server Always On availability group configured on their Azure virtual machines (VMs).

  You need to configure an Azure internal load balancer as a listener for the availability group.

  Solution: You set Session persistence to Client IP.

  Does the solution meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  Setting session persistence to "Client IP" is not the key requirement for SQL Server Always On availability group listeners behind an internal load balancer. The canonical requirements focus on the load balancer rule behavior (notably enabling Floating IP/direct server return for certain configurations) and the proper health probe configuration. Therefore, this solution does not meet the goal.

  References:

  1. Microsoft Learn. "Configure a load balancer for SQL Server Always On availability groups on Azure VMs." https://learn.microsoft.com/en-us/azure/azure-sql/virtual-machines/windows/availability-group-load-balancer-portal-configure.

  Accessed 2026-01-25.

  2. Microsoft Learn. "Load Balancer distribution modes." https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-distribution-mode. Accessed 2026-01-25.

  Microsoft Exam Tips:

  - Don't confuse "sticky sessions" needs of some web apps with Always On listener requirements. The Always On pattern is about correct LB rule/probe behavior.

  Summary:

  SQL AG listener requirements vs. non-essential LB settings (session persistence).

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.3 Configure name resolution and load balancing |__ 4.3.2 Configure an internal or public load balancer

• Question 465:

  DRAG DROP

  You have an on-premises network that includes a Microsoft SQL Server instance named SQL1.

  You create an Azure Logic App named App1.

  You need to ensure that App1 can query a database on SQL1.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: From an on-premises computer, install an on-premises data gateway.

  Step 2: From the Azure portal, create an on-premises data gateway.

  Step 3: From the Logic Apps Designer in the Azure portal, add a connector.

  Explanation:

  You need a Logic App to connect to an on-premises SQL Server. The standard approach is to use an on-premises data gateway as the bridge between Azure and the on-prem data source.

  Why the steps are correct (and why order matters):

  Step 1: From an on-premises computer, install an on-premises data gateway.

  - The gateway must be installed on a machine in (or with network reachability to) the on-premises environment so it can reach SQL Server.

  Step 2: From the Azure portal, create an on-premises data gateway.

  - After installation/registration, you create the gateway resource in Azure so Logic Apps can reference and use that gateway.

  Step 3: From the Logic Apps Designer in the Azure portal, add a connector.

  - You then add the SQL Server connector (or applicable on-prem connector) and select the gateway to authenticate and route traffic through it.

  Why the other actions are not correct:

  - Create an Azure virtual machine that runs Windows Server 2016.

  - Not required. The gateway should be installed where it can reach the on-prem SQL server; creating an Azure VM doesn’t solve on-prem reachability by itself.

  - From an Azure virtual machine, install an on-premises data gateway.

  - The prompt’s expected workflow uses an on-premises computer. Installing the gateway on an Azure VM is not the typical or required step for “on-prem SQL access” unless that VM has private connectivity back to on-prem (which isn’t stated).

  References:

  1. Microsoft Learn. Install on-premises data gateway for logic app workflows.

  https://learn.microsoft.com/en-us/azure/logic-apps/install-on-premises-data-gateway-workflows Last updated: 03/05/2025. Date Accessed: 01/26/2026.

  2. Microsoft Learn. Connect to on-premises data sources - Azure Logic Apps.

  https://learn.microsoft.com/en-us/azure/logic-apps/connect-on-premises-data-sources Last updated: 04/22/2025. Date Accessed: 01/26/2026.

  Microsoft Exam Tips:

  - “On-premises data gateway” questions are usually ordered: Install gateway locally --> create/select gateway resource in Azure --> configure the connector in the workflow.

  - Don’t get baited into building extra infrastructure (like an Azure VM) unless the scenario explicitly requires it.

  Summary:

  This question covered enabling Azure Logic Apps to reach an on-prem SQL Server using the on-premises data gateway, then configuring the connector in Logic Apps Designer.

  AZ-104 Exam Objective Hierarchy:

  3.0 - Deploy and manage Azure compute resources (20–25%) |__ 3.4 - Create and configure Azure App Service |__ 3.4.7 - Configure networking settings for an App Service

• Question 466:

  Your on-premises network contains an Active Directory domain named adatum.com that is synced to Azure Active Directory (Azure AD). Password writeback is disabled. In adatum.com, you create the users shown in the following table.

  

  Which users must sign in from a computer joined to adatum.com?

  A. User2 only
  B. User1 and User3 only
  C. User1, User2, and User3
  D. User2 and User3 only
  E. User1 only
  E. User1 only

  ---

  Explanation

  Item 55 of 253 Answer User1 only

  Explanation (why this is correct) User1 is flagged as "must change password at next logon." That condition is enforced by the on-premises AD DS account state (password must be changed at next logon). Because password writeback is disabled, the "authoritative" password change for that account must occur in AD DS (i.e., a domain sign-in / domain password change path). Therefore, User1 must use a computer joined to adatum.com to complete the forced password change process.

  Why the other users are NOT required to sign in from a domain-joined computer User2 (reversible encryption)

  - This setting affects how AD DS can store/handle the password for certain auth scenarios, but it does not force an interactive domain sign-in.

  User3 (smart card required for interactive logon)

  - This setting affects interactive logon methods (smart card vs. password) for domain logons, but it does not inherently create a "must sign in from a domain-joined computer" requirement for the scenario the question is testing (forced password change + no writeback).

  Microsoft Learn proof (official excerpts) 1) "Must change password at next logon" is tied to pwdLastSet = 0 in AD DS, which indicates the password must be changed at next logon:

  - "pwdLastSet ... If this value is zero, ... the password at next logon." :contentReference[oaicite:0]{index=0}

  2) Password writeback is an AD DS-side update operation (the writeback flow exists to update the on-prem password):

  - "...password writeback ... on the target user object that has to update the password." :contentReference[oaicite:1]{index=1}

  (Combined meaning for this question: if AD DS requires a change-at-next-logon state, and writeback is not available to update AD DS from the cloud, the user must satisfy the requirement through the domain sign-in/password change path.)

  Exam tip When you see "must change password at next logon" in a hybrid (AD DS synced) scenario, immediately check:

  - Where the "must change" state is enforced (AD DS attribute/state), and

  - Whether password writeback is enabled.

  If writeback is disabled, assume the user must complete the password-change requirement via AD DS (domain-joined sign-in / domain password change workflow).

  Summary User1 is the only account forced to change its password at next logon. With password writeback disabled, that requirement must be satisfied via AD DS, so User1 must sign in from an adatum.com-joined computer.

  AZ-104 exam objective mapping (hierarchy) 1.0 Manage Azure identities and governance 1.1 Manage Microsoft Entra users and groups 1.1.2 Manage user and group properties 1.1.5 Configure self-service password reset (SSPR)

• Question 467:

  You have an Azure Standard Load Balancer that distributes TCP traffic to five backend VMs.

  Users access the application through a corporate proxy, and you notice traffic is unevenly distributed because many users share the same apparent client IP address.

  You need to improve distribution across all backend VMs.

  A. Session persistence to None (hash-based)
  B. Session persistence to Client IP (2-tuple)
  C. Session persistence to Client IP and protocol (3-tuple)
  D. Floating IP (direct server return) to Enabled
  A. Session persistence to None (hash-based)

  ---

  Explanation

  {template for answering question}

  --------------------------------------------------------------------------------

  Session persistence to None (hash-based)

  --------------------------------------------------------------------------------

  The goal of the replacement question is to improve distribution fairness when many clients appear to come from the same public IP (for example, behind a proxy/NAT). In that situation, enabling Source IP affinity (session persistence) can cause uneven distribution because the load balancer hashes on client attributes that may be identical for many users. Setting **Session persistence to None (hash-based)** allows Azure Load Balancer to distribute connections using the default hashing behavior (five-tuple), which generally improves distribution across backend instances compared to sticky affinity when many clients share the same source IP.

  Why other selections are not correct:

  - Session persistence to Client IP (2-tuple): Can concentrate traffic to a subset of backend instances when many users share the same apparent source IP.

  - Session persistence to Client IP and protocol (3-tuple): Still affinity-based and can exhibit the same "many clients look the same" problem, leading to uneven distribution.

  - Floating IP (direct server return) to Enabled: This is for specific DSR scenarios and does not address load distribution fairness for proxied/NAT'd clients.

  --------------------------------------------------------------------------------

  References:

  1. Azure Load Balancer distribution modes https://learn.microsoft.com/en-us/azure/load-balancer/distribution-mode-concepts Modified: 2026-01-07 Date Access: 01/24/2026

  2. Configure the distribution mode for Azure Load Balancer https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-distribution-mode Modified: 2025-01-22 Date Access: 01/24/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - "Uneven distribution behind proxies/NAT" is a common hint that **source IP affinity (session persistence)** may be causing concentration.

  - Remember the three portal options for Session persistence: **None**, **Client IP**, **Client IP and protocol**.

  -------------------------------------------------------------------------------- Summary:

  Load Balancer distribution modes and when to disable session persistence to improve traffic spread.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.3 Configure name resolution and load balancing |__ 4.3.2 Configure an internal or public load balancer

• Question 468:

  HOTSPOT

  You have several Azure virtual machines on a virtual network named VNet1.

  You configure an Azure Storage account as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point

  

  

  ---

  The virtual machines on the 10.2.9.0/24 subnet will have network connectivity to the file shares in the storage account: **Never** Azure Backup will be able to back up the unmanaged hard disks of the virtual machines in the storage account: **Never**

  The storage account is configured to allow access from **Selected networks** (firewall/network rules). Only the specific subnets added as virtual network rules can access Azure Storage data endpoints (including Azure Files). The 10.2.9.0/24 subnet is not listed in the allowed virtual network rules, so connectivity to the file shares is blocked.

  Azure Backup is a **trusted Azure service** that can access storage accounts with network rules only when the storage account is configured to allow trusted Microsoft services. In the exhibit, that exception is not enabled, so Azure Backup cannot access the storage account to back up the VHDs (unmanaged disks).

  Storage network security (firewalls & virtual networks). (2025-07-16). Microsoft Learn. https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security (Accessed 2026-01-30).

  Excerpt: "When you configure network rules, only applications from allowed networks can access a storage account." Trusted Azure services and storage network security. (Unknown (could not capture via tool in this run)). Microsoft Learn. https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security-trusted-azure-services (Accessed 2026-01-30).

  Excerpt: "Azure Backup can run backups and restores of unmanaged disks in IaaS virtual machines."

  2.0 Implement and manage storage (15–20%) |__2.1 Configure access to storage |__|__2.1.1 Configure Azure Storage firewalls and virtual networks 5.0 Monitor and maintain Azure resources (10–15%) |__5.2 Implement backup and recovery |__|__5.2.1 Create a Recovery Services vault |__|__5.2.3 Create and configure a backup policy

  |__|__5.2.4 Perform backup and restore operations by using Azure Backup

• Question 469:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to deploy Application1 to Cluster1. Which command should you run?

  A. az acr build
  B. az ales create
  C. kubect1 apply
  D. docker build
  A. az acr build

  ---

  Explanation

  --------------------------------------------------------------------------------

  az acr build

  --------------------------------------------------------------------------------

  The scenario includes an Azure Container Registry (Registry1), an AKS cluster (Cluster1), and a container image (Application1). Before an application can be deployed to AKS, the container image must exist in a registry that AKS can pull from. The command **`az acr build`** builds the image in Azure Container Registry (ACR Tasks) and stores it in Registry1, making it available for subsequent deployment to Cluster1. (1)

  Why other selections are incorrect:

  - az aks create: Creates a new AKS cluster; Cluster1 already exists. (2)

  - kubectl apply: Applies Kubernetes manifests, but it presumes the image is already available in a registry and you have the deployment YAML ready; the scenario/answer set is targeting the image build step into ACR first. (1)

  - docker build: Builds a local image only; it does not place the image into ACR for AKS to pull unless you also tag/push afterward. (3)

  --------------------------------------------------------------------------------

  References:

  1. Tutorial - Quick Docker image build with ACR Tasks (az acr build) https://learn.microsoft.com/en-us/azure/container-registry/container-registry-tutorial-quick-task Date Modified: Unable to locate Date Accessed: 01/25/2026

  2. Quickstart: Deploy an Azure Kubernetes Service (AKS) cluster (az aks create context) https://learn.microsoft.com/en-us/azure/aks/learn/quick-kubernetes-deploy-cli Date Modified: Unable to locate Date Accessed: 01/25/2026

  3. Push and pull an image using the Docker CLI with Azure Container Registry (docker build vs push distinction) https://learn.microsoft.com/en-us/azure/container-registry/container-registry-get-started-docker-cli Date Modified: Unable to locate Date Accessed: 01/25/2026

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - If the choices include **az acr build**, Microsoft is often testing ACR Tasks as a "build directly into the registry" workflow.

  - Separate steps mentally: build image (ACR/Docker) --> push/store in registry --> deploy to AKS (kubectl/manifest). The question/choices decide which step they're targeting.

  --------------------------------------------------------------------------------

  Summary:

  This tests recognizing ACR Tasks as the appropriate command to build an image directly into Azure Container Registry so AKS can later pull it.

  --------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure

• Question 470:

  You are troubleshooting a performance issue for an Azure Application Gateway. You need to compare the total requests to the failed requests during the past six hours.

  What should you use?

  A. Metrics in Application Gateway
  B. Diagnostics logs in Application Gateway
  C. NSG flow logs in Azure Network Watcher
  D. Connection monitor in Azure Network Watcher
  A. Metrics in Application Gateway

  ---

  Explanation

  --------------------------------------------------------------------------------

  Metrics in Application Gateway

  --------------------------------------------------------------------------------

  To compare total requests vs failed requests over a time window (past six hours), you should use Azure Monitor metrics exposed by Application Gateway (for example, TotalRequests and FailedRequests). Metrics are designed for aggregation, charting, and quick comparative analysis over time.

  Why other options are not correct:

  - Diagnostics logs: Useful for deep troubleshooting/events, but not the quickest for direct time-series comparison.

  - NSG flow logs: Network-layer visibility; does not provide Application Gateway request success/failure counts.

  - Connection monitor: Connectivity monitoring, not HTTP request/response health counts.

  -------------------------------------------------------------------------------- References:

  1. Application Gateway metrics (Azure Monitor) https://learn.microsoft.com/en-us/azure/azure-monitor/reference/supported-metrics/microsoft-network-applicationgateways-metrics Date Modified: 11/04/2025 Date Access: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: If the prompt says "compare over the last X hours," start with Metrics, not Logs.

  - Logs are for detail; metrics are for trends, baselines, and rapid comparisons.

  -------------------------------------------------------------------------------- Summary:

  Use Application Gateway metrics (TotalRequests vs FailedRequests) for time-window comparison.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10?5%) |__ 5.1 Monitor resources in Azure |__ 5.1.1 Interpret metrics in Azure Monitor