Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 471:

  HOTSPOT

  You have two Azure subscriptions named Sub1 and Sub2. Sub1 is in a management group named MG1. Sub2 is in a management group named MG2.

  You have the resource groups shown in the following table.

  

  You have the virtual machines shown in the following table.

  

  You assign roles to users as shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  User1 can sign in to VM1: No

  User2 can manage disks and disk snapshots of VM1: No

  User2 can manage disks and disk snapshots of VM3: No

  Why this is correct:

  - “Sign in” requires a login role assignment (for example, Virtual Machine User Login) at the VM/subscription/resource group scope that contains the VM. User1’s login role is at Sub2, but VM1 is in Sub1.

  - User2 has Virtual Machine User Login at Sub1 (login only) and Virtual Machine Contributor at MG2 (covers Sub2, not Sub1). So User2 can’t manage VM1 disks/snapshots in Sub1.

  - For VM3 in Sub2: Virtual Machine Contributor does not grant disk snapshot management. Snapshot operations are typically covered by roles like Disk Snapshot Contributor (or broader roles like Contributor/Owner).

  Why the other options are incorrect:

  - “Virtual Machine User Login” is not a management role for compute resources-it's for interactive access.

  - “Virtual Machine Contributor” is not the same as disk/snapshot contributor permissions.

  Exam Tips:

  - Separate "login" permissions from "manage" permissions.

  - Disk/snapshot actions are not guaranteed under “VM Contributor” (watch for the exact built-in role required).

  Summary:

  No login for User1 to VM1, and User2 lacks the correct scope/role permissions to manage disks/snapshots for VM1 or VM3.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20–25%) |__1.2 Manage access to Azure resources |__|__1.2.3 Interpret access assignments

• Question 472:

  You have an Azure subscription.

  In the Azure portal, you plan to create a storage account named storage1 that will have the following settings:

  1. Performance: Standard 2. Replication: Zone-redundant storage (ZRS) 3. Access tier (default): Cool 4. Hierarchical namespace: Disabled

  You need to ensure that you can set Account kind for storage1 to BlockBlobStorage.

  Which setting should you modify first?

  A. Performance
  B. Replication
  C. Access tier (default)
  D. Hierarchical namespace
  A. Performance

  ---

  Explanation

  --------------------------------------------------------------------------------

  Performance

  --------------------------------------------------------------------------------

  To set Account kind to BlockBlobStorage, you must select a storage account configuration that supports that account kind. BlockBlobStorage is a premium block blob-oriented account kind; in the portal, the availability of BlockBlobStorage is driven by choosing the appropriate performance tier (Premium) first. Therefore, you should modify the Performance setting first.

  Why the other selections are not correct:

  - Replication: Replication affects redundancy options; it does not unlock BlockBlobStorage if the performance tier is incompatible.

  - Access tier (default): Access tiers (Hot/Cool) apply to GPv2 blobs and do not determine whether BlockBlobStorage is available.

  - Hierarchical namespace: HNS toggles Data Lake Gen2 capabilities; it is not the gating factor for BlockBlobStorage selection.

  References:

  [1] Microsoft. "Storage account overview." Microsoft Learn. (Account kinds and supported configurations, including premium options.) Date modified: Unable to locate. Date accessed: 2026-01-25. https://learn.microsoft.com/en-us/azure/ storage/common/storage-account-overview

  Microsoft Exam Tips:

  - If an account kind is "premium-only," check Performance tier first; many portal options are hidden until the correct tier is selected.

  Summary:

  Identified the portal gating setting (Performance tier) required before BlockBlobStorage can be selected.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15?0%) |__ 2.2 Configure and manage storage accounts |__ 2.2.1 Create and configure storage accounts

• Question 473:

  Your company has an Azure subscription that includes a Recovery Services vault.

  You want to use Azure Backup to schedule a backup of your company's virtual machines (VMs) to the Recovery Services vault.

  Which of the following VMs can you back up? Choose all that apply.

  A. VMs that run Windows 10.
  B. VMs that run Windows Server 2012 or higher.
  C. VMs that have NOT been shut down.
  D. VMs that run Debian 8.2+.
  E. VMs that have been shut down.
  F. VMs that run MacOS
  A. VMs that run Windows 10.
  B. VMs that run Windows Server 2012 or higher.
  C. VMs that have NOT been shut down.
  D. VMs that run Debian 8.2+.
  E. VMs that have been shut down.

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  VMs that run Windows 10 VMs that run Windows Server 2012 or higher VMs that have NOT been shut down VMs that run Debian 8.2+ VMs that have been shut down

  ----------------------------------------------------------------------------------------------------

  Azure VM Backup (to a Recovery Services vault) supports Windows workloads including Windows client (Windows 10) and Windows Server versions, and Linux workloads (including Azure-endorsed distributions). In addition, Azure Backup supports VM backups even when the VM is shut down/offline, but those backups are crash-consistent (agentless) and OS-agnostic. Therefore, Windows 10, Windows Server 2012+, Debian 8.2+ (as a Linux VM), and both "shut down" and "not shut down" states are eligible for backup scenarios described. macOS is not applicable here because Azure VM Backup support is documented for Windows and Linux; the support matrix does not include macOS in supported OS lists. [1]

  References:

  1. Azure VM backup support matrix https://learn.microsoft.com/en-us/azure/backup/backup-support-matrix-iaas Date modified: 2025-10-27 Date accessed: 2026-01-25

  ----------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - For Azure VM Backup, remember "shut down/offline" is still supported, but typically as crash-consistent backups.

  - Look for "supported OS" and "supported VM states" language in the support matrix.

  Summary:

  Azure Backup eligibility (supported OS and VM power state) for Azure VM backups.

  AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10?5%) |__ 5.2 Implement backup and recovery |__ 5.2.4 Perform backup and restore operations by using Azure Backup

• Question 474:

  HOTSPOT

  You plan to create a new Azure Active Directory (Azure AD) role. You need to ensure that the new role can view all the resources in the Azure subscription and issue support requests to Microsoft. The solution must use the principle of least privilege. How should you complete the JSON definition? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Actions entry 1: */read Actions entry 2: Microsoft.Support/*

  Explanation (Why this is correct)

  - `*/read` grants read-only access across Azure resource providers.

  - Creating support requests requires permissions under the Microsoft.Support resource provider.

  Explanation (Why the other options are incorrect)

  - If you omit `Microsoft.Support/*`, the user might be able to view resources but not create support requests.

  - Broader write permissions would exceed least privilege.

  Exam Tip

  - “Read everything + support tickets” often maps to `*/read` + `Microsoft.Support/*`.

  References (APA)

  - Microsoft. (n.d.). Azure RBAC custom roles. Microsoft Learn. https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles

  - Microsoft. (n.d.). Microsoft.Support resource provider operations. Microsoft Learn. https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftsupport

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20–25%) |__3.4 Implement and manage Azure App Service |__|__3.4.7 Configure networking settings |__|__3.4.8 Configure deployment slots

• Question 475:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your company has an Azure subscription with two storage accounts. Each of these storage accounts includes a queue service, a table service, and a blob service.

  You have created two apps that must be configured to store various types of data to all the storage services on the two storage accounts.

  You need to configure the required amount of endpoints for the apps.

  Solution: You configure three endpoints per app.

  Does the solution meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  The requirement is to configure the required number of endpoints for two apps to access two storage accounts (each account hosting blob, queue, and table services). In an app configuration model where one endpoint/connection string is used per storage account, you need two endpoints per app (one per account). Configuring three endpoints per app is not the required amount in this scenario, so it does not meet the goal as stated. [1]

  References:

  [1] Microsoft. "Configure a connection string." Microsoft Learn. Date modified: 2024-05-10. Date accessed: 2026-01-25. https://learn.microsoft.com/en-us/azure/storage/common/storage-configure-connection-string

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - When a question asks for the "required amount," avoid adding unnecessary endpoints-pick the minimum that satisfies access requirements.

  Summary:

  Determining required per-app endpoint count for multiple storage accounts.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15?0%) |__ 2.2 Configure and manage storage accounts |__ 2.2.1 Create and configure storage accounts

• Question 476:

  You have an Azure subscription.

  You are deploying an Azure Kubernetes Service (AKS) cluster that will contain multiple pods. The pods will use kubernet networking.

  You need to restrict network traffic between the pods.

  What should you configure on the AKS cluster?

  A. the Azure network policy
  B. the Calico network policy
  C. pod security policies
  D. an application security group
  B. the Calico network policy

  ---

  Explanation

  --------------------------------------------------------------------------------

  the Calico network policy

  --------------------------------------------------------------------------------

  To restrict pod-to-pod traffic in AKS using **kubenet** networking, you enable and use **Calico network policies**. Network policies are the Kubernetes-native mechanism for defining allowed/denied pod traffic flows.

  Why other selections are not correct:

  - the Azure network policy: This option is not the expected choice for the kubenet-based restriction scenario in this question set.

  - pod security policies: These govern pod security admission controls (and are deprecated), not pod network traffic filtering.

  - an application security group: ASGs apply to Azure NICs/VMs, not Kubernetes pod-level traffic controls.

  -------------------------------------------------------------------------------- References:

  1. Secure traffic between pods with network policies in Azure Kubernetes Service (AKS) https://learn.microsoft.com/en-us/azure/aks/use-network-policies Modified: 01/07/2026 Date Access: 01/24/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - If the requirement is "restrict traffic between pods," the keyword is **NetworkPolicy** (enforced by a network policy provider such as Calico).

  - Separate "pod security" (admission/identity) from "pod network policy" (traffic filtering).

  -------------------------------------------------------------------------------- Summary:

  Using Kubernetes network policies (Calico) in AKS to restrict pod-to-pod traffic.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.2 Configure secure access to virtual networks |__ 4.2.1 Create and configure network security groups (NSGs) and application security groups

• Question 477:

  HOTSPOT

  You have an Azure subscription named Subscription1 that contains the resources shown in the following table.

  

  In storage1, you create a blob container named blob1 and a file share named share1. Which resources can be backed up to Vault1 and Vault2? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1 (Can use Vault1 for backups): VM1 only

  Box 2 (Can use Vault2 for backups): share1 only

  Key rule: For Azure Backup using a Recovery Services vault, the vault must be in the SAME REGION as the protected data source.

  Given resources/regions:

  - Vault1 = Central US

  - Vault2 = West US

  - VM1 = Central US

  - storage1 (hosts blob1 + share1) = West US

  - SQL1 = East US

  Therefore:

  - Vault1 (Central US) can back up:

  - VM1 (Central US) x

  - share1 (West US) x (wrong region)

  - blob1 x (blob container backups are not done via Recovery Services vault in this context)

  - SQL1 (East US) x (wrong region and Azure SQL DB uses its own automated backups)

  - Vault2 (West US) can back up:

  - share1 (West US) x (Azure Files share backup requires the vault be in the same region as the storage account)

  - VM1 (Central US) x (wrong region)

  - blob1 x (not protected via Recovery Services vault here)

  - SQL1 (East US) x (wrong region)

  References:

  1. Back up Azure VMs in a Recovery Services vault (VMs must be in same region as the vault).

  FQDN: learn.microsoft.com URL: https://learn.microsoft.com/en-us/azure/backup/backup-azure-arm-vms-prepare Last updated: Unable to locate on page. Date Accessed: 01/27/2026.

  2. Back up Azure Files in the Azure portal (vault must be in same region as the storage account hosting the file share).

  FQDN: learn.microsoft.com URL: https://learn.microsoft.com/en-us/azure/backup/backup-azure-files Last updated: 07/09/2025. Date Accessed: 01/27/2026.

  3. Create and configure a Recovery Services vault (vault must be in same region as the data source).

  FQDN: learn.microsoft.com URL: https://learn.microsoft.com/en-us/azure/backup/backup-create-recovery-services-vault Last updated: Unable to locate on page. Date Accessed: 01/27/2026.

  Microsoft Exam Tips:

  - If the question shows multiple regions, expect “only items in the same region as the vault” to be the constraint.

  - Azure Files share backup aligns to the Storage Account region; VM backup aligns to the VM region.

  Summary:

  Chose VM1 for Vault1 (Central US match) and share1 for Vault2 (West US match) based on same-region Recovery Services vault requirements.

  AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10–15%) └─ 5.2 Implement backup and recovery └─ 5.2.1 Create a Recovery Services vault

• Question 478:

  Which blade should you instruct the finance department auditors to use?

  A. invoices
  B. partner information
  C. cost analysis
  D. External services
  C. cost analysis

  ---

  Explanation

  Cost analysis: Correct Option

  In cost analysis blade of Azure, you can see all the detail for custom time span. You can use this to determine expenditure of last few day, weeks, and month. Below options are available in Cost analysis blade for filtering information by time span: last 7 days , last 30 days, and custom date range. Choosing the first option (last 7 days) auditors can view the costs by time span.

  Cost analysis shows data for the current month by default. Use the date selector to switch to common date ranges quickly. Examples include the last seven days, the last month, the current year, or a custom date range. Pay-as-you-go subscriptions also include date ranges based on your billing period, which isn't bound to the calendar month, like the current billing period or last invoice. Use the <PREVIOUS and NEXT> links at the top of the menu to jump to the previous or next period, respectively. For example,

  

  Invoice: Incorrect Option

  Invoices can only be used for past billing periods not for current billing period, i.e. if your requirement is to know the last week's cost then that also not filled by invoices because Azure generates invoice at the end of the month. Even though Invoices have custom timespan, but when you put in dates for a week, the pane would be empty.

  

  Resource Provider: Incorrect Option

  When deploying resources, you frequently need to retrieve information about the resource providers and types. For example, if you want to store keys and secrets, you work with the Microsoft.KeyVault resource provider. This resource provider offers a resource type called vaults for creating the key vault. This is not useful for reviewing all Azure costs from the past week which is required for audit.

  Payment method: Incorrect Option

  Payment methods is not useful for reviewing all Azure costs from the past week which is required for audit.

  https://docs.microsoft.com/en-us/azure/cost-management-billing/costs/quick-acm-cost-analysis https://docs.microsoft.com/en-us/azure/cost-management-billing/manage/download-azure-invoice-daily-usage-date

• Question 479:

  Your on-premises network contains a VPN gateway.

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to ensure that all the traffic from VM1 to storage1 travels across the Microsoft backbone network.

  What should you configure?

  A. Azure AD Application Proxy
  B. service endpoints
  C. a network security group (NSG)
  D. Azure Firewall
  B. service endpoints

  ---

  service endpoints

  Service endpoints keep Azure PaaS service traffic (such as to Azure Storage) on the Microsoft Azure backbone network and prevent service traffic from being forced through on-premises paths during forced tunneling. This directly meets the requirement that VM1-to-storage1 traffic travels across the Microsoft backbone.

  Why the other answers are incorrect:

  - Azure AD Application Proxy: unrelated to storage traffic routing.

  - an NSG: controls allow/deny; does not guarantee backbone routing.

  - Azure Firewall: can enforce/inspect traffic but does not inherently provide the "PaaS stays on backbone despite forced tunneling" behavior targeted here.

  Exam Tips:

  - "Forced tunneling + Storage over backbone" is a classic service endpoint signal on AZ-104.

  Summary:

  Using service endpoints to keep Azure Storage traffic on the Microsoft backbone under forced tunneling.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15–20%)
  └── 4.2 Configure secure access to virtual networks
    └── 4.2.4 Configure service endpoints for Azure platform as a service (PaaS)

• Question 480:

  HOTSPOT

  You have Azure virtual machines that run Windows Server 2019 and are configured as shown in the following table.

  

  You create a private Azure DNS zone named adatum.com. You configure the adatum.com zone to allow auto registration from VNET1.

  Which A records will be added to the adatum.com zone for each virtual machine? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: A records for VM1: Private IP address only
  Box 2: A records for VM2: Private IP address only

  You configured a private Azure DNS zone (adatum.com) and enabled auto-registration from VNET1.

  • In a Private DNS zone, auto-registration creates A records that point to the VM’s private IP address.
  • Public IP addresses are not used for private zone auto-registered A records (Private DNS is for internal name resolution inside VNets).

  Why the other options are not correct:

  • “Public IP address only” is incorrect: Private DNS auto-registration does not publish public IP addresses.
  • “Private IP address and public IP address” is incorrect for the same reason.
  • “None” would be correct only if auto-registration were not enabled or the VM was not in the linked registration VNet.

  Exam Tips:

  • Auto-registration in Private DNS = A record → private IP address.
  • Private DNS is for inside-VNet name resolution; public IP addresses belong to public DNS scenarios.

  Summary:
  
  This question tests what gets auto-registered in a Private DNS zone: VM hostnames mapped to private IP addresses.

  AZ-104 Exam Objective Hierarchy:
  
  4.0 - Implement and manage virtual networking (15–20%)
  └── 4.3 - Configure name resolution and load balancing
    └── 4.3.1 - Configure Azure DNS