Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 481:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might

  have more than one correct solution, while others might not have a correct solution. After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the following resources:

  1. A virtual network that has a subnet named Subnet1 2. Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1 3. A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop connections 4. NSG-Subnet1 has the default inbound security rules only.

  NSG-VM1 has the default inbound security rules and the following custom inbound security rule:

  1. Priority: 100 2. Source: Any 3. Source port range: * 4. Destination: * 5. Destination port range: 3389 6. Protocol: UDP 7. Action: Allow

  VM1 connects to Subnet1. NSG1-VM1 is associated to the network interface of VM1. NSG-Subnet1 is associated to Subnet1.

  You need to be able to establish Remote Desktop connections from the internet to VM1.

  Solution: You modify the custom rule for NSG-VM1 to use the internet as a source and TCP as a protocol.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  The proposed change (editing the NSG rule on NSG-VM1 to use Internet as the source and TCP as the protocol) is necessary, but it is not sufficient.

  Because there are TWO NSGs in the path:

  - NSG-Subnet1 is associated to Subnet1 and has only default inbound rules.

  - NSG-VM1 is associated to VM1's NIC and has the custom rule.

  Microsoft states that for inbound traffic Azure evaluates:

  "...the rules in a network security group associated with a subnet... [then] ...the network interface..." (1)

  Since NSG-Subnet1 has only default inbound rules, inbound RDP traffic from the Internet will be blocked by the default inbound deny rule (DenyAllInbound) before it can be successfully permitted end-to-end. Therefore, changing only NSG- VM1 does NOT meet the goal.

  To meet the goal, you would need to also allow TCP 3389 inbound on the subnet NSG (NSG-Subnet1), or redesign so that the effective rules allow RDP at the appropriate scope.

  -------------------------------------------------------------------------------- References:

  (1) Microsoft Learn - "How network security groups filter network traffic" Relevant excerpt: "For inbound traffic, Azure first processes the rules... associated with a subnet... then... associated with the network interface..." URL: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works Accessed: 2026-01-22

  (2) Microsoft Learn - "Azure network security groups overview" (Default security rules) Relevant excerpt: Default inbound includes "DenyAllInbound" with Access = Deny.

  URL: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview Accessed: 2026-01-22

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - Always account for BOTH NSG scopes when they're both applied (subnet + NIC). Inbound traffic must not be denied at either scope to succeed.

  - Use "Effective security rules" on the NIC in the portal to see the combined outcome of subnet and NIC NSGs.

  - Microsoft guidance: avoid attaching NSGs to both a subnet and its NICs unless you have a clear design reason, because overlaps can cause unexpected filtering. (1)

  -------------------------------------------------------------------------------- Summary:

  This question tests NSG inbound evaluation behavior when an NSG is applied at both the subnet and NIC levels, and how default inbound deny rules can block traffic even if another NSG allows it.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Alignment (Hierarchy) 4.0 Implement and manage virtual networking (15?0%) 4.2 Configure secure access to virtual networks 4.2.2 Evaluate effective security rules in NSGs

• Question 482:

  You have an Azure Active Directory (Azure AD) tenant named contosocloud.onmicrosoft.com.

  Your company has a public DNS zone for contoso.com.

  You add contoso.com as a custom domain name to Azure AD. You need to ensure that Azure can verify the domain name.

  Which type of DNS record should you create?

  A. NSEC
  B. PTR
  C. DNSKEY
  D. TXT
  D. TXT

  ---

  Explanation

  --------------------------------------------------------------------------------

  TXT

  --------------------------------------------------------------------------------

  When adding a custom domain (contoso.com) to Microsoft Entra ID (Azure AD) and verifying ownership, you typically create a **DNS TXT record** (or in some cases an MX record) in the public DNS zone. The question asks which record type you should create to allow Azure/Entra to verify the domain-**TXT** is the standard answer in this context. (1)

  Why other selections are incorrect:

  - NSEC: Used with DNSSEC for authenticated denial of existence; not domain ownership verification for Entra custom domains. (1)

  - PTR: Reverse DNS; not used for custom domain verification. (1)

  - DNSKEY: DNSSEC key material; not used for Entra custom domain verification. (1)

  --------------------------------------------------------------------------------

  References:

  1. Add your custom domain - Microsoft Entra (verification uses TXT or MX record) https://learn.microsoft.com/en-us/entra/fundamentals/add-custom-domain Date Modified: 08/28/2025 Date Accessed: 01/25/2026

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - For identity-domain verification questions, default to **TXT** unless the stem explicitly calls out MX.

  - Do not confuse DNSSEC record types (DNSKEY/NSEC) with identity verification records.

  --------------------------------------------------------------------------------

  Summary:

  This tests knowing the DNS record type required for Microsoft Entra custom domain ownership verification.

  --------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) 4.3 Configure name resolution and load balancing 4.3.1 Configure Azure DNS

  TXT : Correct Choice You need to go to your hosting domain registrar and add in a TXT record.

  

  NSEC3 : Incorrect Choice This is Part of DNSSEC. This is used for explicit denial-of-existence of a DNS record. It is used to prove a name does not exist.

  RRSIG : Incorrect Choice This contains a cryptographic signature.

  DNSKEY : Incorrect Choice This will verify that the records are originating from an authorized sender.

  https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-custom-domain https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/add-custom-domain#verify-your-custom-domain-name https://www.cloudflare.com/dns/dnssec/how-dnssec-works/#:~:text=DNSKEY%20%2D%20Contains%20a%20public%20signing,s)%20in%20the%20parent %20zone.

• Question 483:

  HOTSPOT

  You have an Azure Storage account named storage1 that uses Azure Blob storage and Azure File storage.

  You need to use AzCopy to copy data to the blob storage and file storage in storage1.

  Which authentication method should you use for each type of storage? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Scenario

  - You have an Azure virtual machine named VM1.

  - You must collect guest performance counters from VM1 and send them to a Log Analytics workspace named LAW1.

  - You must minimize administrative effort and use the current recommended approach.

  Answer Area (select the correct options) 1) On VM1, enable:

  - Azure Monitor Agent

  2) To define what data is collected and sent to LAW1, configure:

  - A data collection rule (DCR)

  Why this is correct

  - **Azure Monitor Agent (AMA)** is the modern agent used for collecting guest OS telemetry (including performance counters) from Azure VMs.

  - With AMA, **data collection rules (DCRs)** are the control-plane objects that define:

  - *what* to collect (ex: performance counters), and

  - *where* to send it (ex: Log Analytics workspace LAW1).

  Why the other options are not correct

  - **Log Analytics Agent**: legacy agent approach (not the current recommended model for new deployments).

  - **Dependency Agent**: used for dependency mapping/service map scenarios, not for defining perf counter collection to LAW.

  - **Network Watcher Agent**: focuses on network diagnostics/packet capture/connection monitoring scenarios, not perf counters to LAW.

  - **A diagnostic setting**: used to route *resource/platform logs* (control-plane), not to define guest perf counter collection from a VM agent.

  - **An alert rule / a workbook**: used for alerting/visualization, not to define data collection and routing.

  Proof (short excerpts)

  - “Data collection from Azure Monitor Agent is defined by one or more data collection rules (DCRs) …”

  - “DCRs define data such as events and performance counters to collect and specify the Log Analytics workspaces where data should be sent.”

  References (APA; full URLs)

  - Microsoft Learn. (n.d.). *Data collection rules (DCRs) in Azure Monitor*. https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-rule-overview

  - Microsoft Learn. (n.d.). *Collect data from a virtual machine with Azure Monitor Agent*. https://learn.microsoft.com/en-us/azure/azure-monitor/vm/data-collection

  Exam tips

  - If you see **“current recommended approach”** + **VM performance counters** + **Log Analytics workspace** --> think **AMA + DCR**.

  - “Where does the configuration live?” --> **DCR** (not diagnostic settings, not workbooks).

  AZ-104 Exam Objective Hierarchy 5.0 Monitor and maintain Azure resources (10–15%) |__5.1 Monitor resources in Azure |__|__5.1.2 Configure log settings in Azure Monitor |__|__5.1.5 Configure and interpret monitoring of virtual machines in Azure Monitor

• Question 484:

  You have an Azure subscription that contains two peered virtual networks named VNet1 and VNet2. VNet1 has a VPN gateway that uses static routing.

  The on-premises network has a VPN connection that uses the VPN gateway of VNet1.

  You need to configure access for users on the on-premises network to connect to a virtual machine on VNet2. The solution must minimize costs.

  Which type of connectivity should you use?

  A. Azure Firewall with a private IP address
  B. service chaining and user-defined routes (UDRs)
  C. Azure Application Gateway
  D. ExpressRoute circuits to VNet2
  B. service chaining and user-defined routes (UDRs)

  ---

  Explanation

  -----------------------------------------------------------------------

  service chaining and user-defined routes (UDRs)

  -----------------------------------------------------------------------

  To extend on-premises connectivity (terminating on the VPN gateway in VNet1) to workloads in a peered VNet (VNet2) while minimizing cost, you use hub-and-spoke style transit so the spoke can leverage the hub's connectivity. In exam phrasing, "service chaining + UDRs" aligns to routing/transit through the hub rather than deploying additional cost-bearing components (like new ExpressRoute circuits).

  Why other selections are not correct:

  - Azure Firewall with a private IP address: adds cost and is not required just to extend reachability.

  - Azure Application Gateway: is for HTTP(S) L7 load balancing, not network transit from on-prem to a peered VNet.

  - ExpressRoute circuits to VNet2: adds significant cost; not the "minimize costs" approach.

  References:

  1. Configure VPN gateway transit for virtual network peering (gateway transit lets one VNet use the VPN gateway in a peered VNet)

  https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-peering-gateway-transit Date Modified: 06/19/2024 Date Accessed: 01/24/2026

  Microsoft Exam Tips:

  - For "minimize cost" with hub/spoke + on-prem, look for "use remote gateways / allow gateway transit" concepts (even if the option wording is indirect).

  Summary:

  - Hub/spoke transit for on-prem to peered VNets

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.1 Configure and manage virtual networks in Azure |__ 4.1.2 Create and configure virtual network peering

• Question 485:

  You create an App Service plan named App1 and an Azure web app named webapp1.

  You discover that the option to create a staging slot is unavailable.

  You need to create a staging slot for App1.

  What should you do first?

  A. From webapp1, modify the Application settings.
  B. From webapp1, add a custom domain.
  C. From App1, scale up the App Service plan.
  D. From App1, scale out the App Service plan.
  C. From App1, scale up the App Service plan.

  ---

  From App1, scale up the App Service plan.

  Deployment slots are not available on the Free or Shared tiers (and are limited/feature-dependent by tier). If the option to create a staging slot is unavailable, the App Service plan is typically on a tier that does not support deployment slots.

  "Scale up" changes the pricing tier (SKU) of the App Service plan (for example, to Standard, Premium, etc.), which enables deployment slots. After scaling up to a tier that supports slots, you can create the staging slot.

  Why the other options are not correct:

  - Modify the Application settings:

  App settings do not enable the deployment slots feature; slot availability depends on the App Service plan tier.

  - Add a custom domain:

  Custom domains are unrelated to deployment slot capability.

  - Scale out the App Service plan:

  Scale out adds instances within the same tier. It does not change the SKU feature set, so it will not enable deployment slots if the current tier does not support them.

  Microsoft Exam Tips:

  - If a portal option is "greyed out/unavailable," first suspect a tier/SKU limitation.

  - Remember: "Scale up" = change tier/features; "Scale out" = add instances/capacity.

  - Deployment slots are a Standard/Premium feature-Free/Shared plans are common exam distractors.

  Summary:

  - Enabling deployment slots by scaling up an App Service plan

  - Distinguishing scale up (SKU/features) vs scale out (instance count)

  - Eliminating unrelated configuration changes (app settings, custom domain)

  AZ-104 Exam Objective Alignment (Hierarchy)

  3.0 Deploy and manage Azure compute resources | 3.4 Create and configure Azure App Service | 3.4.1 Provision an App Service plan | 3.4.8 Configure deployment slots for an App Service

• Question 486:

  DRAG DROP

  You have an Azure subscription. The subscription includes a virtual network named VNet1. Currently, VNet1 does not contain any subnets.

  You plan to create subnets on VNet1 and to use application security groups to restrict the traffic between the subnets. You need to create the application security groups and to assign them to the subnets.

  Which four cmdlets should you run in sequence? To answer, move the appropriate cmdlets from the list of cmdlets to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Box 1: New-AzureRmNetworkSecurityRuleConfig

  Box 2: New-AzureRmNetworkSecurityGroup

  Box 3: Add-AzureRmVirtualNetworkSubnetConfig

  Box 4: New-AzureRmVirtualNetwork

  Explanation:

  You’re building the network security components and virtual network configuration via PowerShell.

  - New-AzureRmNetworkSecurityRuleConfig:

  Create the NSG rule definition first (the rule object). This is also where Application Security Groups (ASGs) can be referenced in rules (source/destination ASG), aligning with “create and configure application security groups” usage patterns.

  - New-AzureRmNetworkSecurityGroup:

  Create the NSG using the previously-defined rule configuration(s).

  - Add-AzureRmVirtualNetworkSubnetConfig:

  Define (or add) the subnet configuration and associate it to the NSG so the subnet is protected by the intended rules.

  - New-AzureRmVirtualNetwork:

  Create the VNet using the prepared configuration (including the subnet definition(s)).

  Note: The AzureRm module is legacy; in modern environments you typically use the Az.* equivalents (Az.Network), but the exam item is explicitly written with AzureRm cmdlets.

  References:

  1. Implement Virtual Networks (Microsoft Press Store) https://www.microsoftpressstore.com/articles/article.aspx?p=2873369 Date Accessed: 01/26/2026 Last Updated/Published: 04/10/2018

  2. Create, change, or delete a network security group (Microsoft Learn) https://learn.microsoft.com/en-us/azure/virtual-network/manage-network-security-group Date Accessed: 01/26/2026 Last Updated: 07/26/2025

  3. Application security groups (Microsoft Learn) https://learn.microsoft.com/en-us/azure/virtual-network/application-security-groups Date Accessed: 01/26/2026 Last Updated: 07/25/2025

  Microsoft Exam Tips:

  - Expect NSG/ASG questions to test “where enforcement happens” (subnet vs NIC) and “how rules are authored” (rule objects -> NSG -> association).

  - Watch for AzureRm vs Az cmdlet naming on older exam content; translate mentally, but answer with what the question provides.

  Summary:

  PowerShell-based build sequence for NSG rules, NSG creation, subnet association, and VNet creation (including ASG-aware rule capability).

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15–20%) └─ 4.2 Configure secure access to virtual networks └─ 4.2.1 Create and configure network security groups (NSGs) and application security groups

• Question 487:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Directory (Azure AD) tenant named Adatum and an Azure Subscription named Subscription1. Adatum contains a group named Developers. Subscription1 contains a resource group named Dev.

  You need to provide the Developers group with the ability to create Azure logic apps in the Dev resource group.

  Solution: On Subscription1, you assign the Logic App Operator role to the Developers group.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  No

  Logic App Operator is explicitly limited: it allows reading and enabling/disabling logic apps, but not editing/updating-and it does not grant creation permissions.

  To create Logic Apps in a resource group, you need a role that includes write permissions for Logic Apps resources (commonly Contributor at the resource group, or a role such as Logic App Contributor).

  Additionally, the requirement is scoped to the Dev resource group; assigning a role at the subscription scope is broader than necessary, and still the selected role is insufficient for creation.

  Exam Tips:

  - Always match permissions to verbs: "create" usually implies write permissions (Contributor/role with write actions).

  - Also match scope: if the task is in one RG, prefer RG scope unless the question forces broader scope (AZ-104).

  Summary:

  RBAC role selection and scope for creating Logic Apps.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (15–20%)
  └── 1.2 Manage access to Azure resources
    └── 1.2.1 Manage built-in Azure roles

• Question 488:

  You have an Azure Storage account named storage1.

  You plan to use AzCopy to copy data to storage1.

  You need to identify the storage services in storage1 to which you can copy the data.

  What should you identify?

  A. blob, file, table, and queue
  B. blob and file only
  C. file and table only
  D. file only
  E. blob, table, and queue only
  B. blob and file only

  ---

  blob and file only

  AzCopy v10 is designed for data transfer to and from Azure Storage services that expose Blob and File endpoints. In Microsoft Learn, the “Get started with AzCopy” article explicitly describes copying data to and from:

  a Blob Storage account, or
  
  a File Storage account (Azure Files)

  Official excerpt (Microsoft Learn):
  
  “…copy data to and from… a Blob Storage account…” and “…a File Storage account…”

  Therefore, the storage services in a storage account that you can copy data to by using AzCopy are:

  Blob
  
  File (Azure Files)

  Why the other selections are not correct:

  blob, file, table, and queue: Includes Table and Queue. AzCopy is not positioned in Microsoft Learn as the tool for Table or Queue data movement; the AzCopy “Get started” scope focuses on Blob and Files.

  file and table only: Table is outside AzCopy’s described scope; this option also omits Blob, which AzCopy explicitly supports.

  file only: Too narrow; AzCopy explicitly supports Blob as well.

  blob, table, and queue only: Omits Azure Files, which AzCopy supports, and includes Table and Queue, which are not in AzCopy’s described scope.

  Exam Tips:

  AzCopy (v10) is the exam data mover for Blob and Azure Files. If you see Table or Queue, think not AzCopy (use other tooling or services).

  Memorize endpoint cues:

  Blob: *.blob.core.windows.net
  
  Files: *.file.core.windows.net

  If the question says “copy a folder recursively,” look for AzCopy copy with --recursive.

  Summary:

  This question tests which Azure Storage services are supported targets for AzCopy-based data transfer. AzCopy supports copying to Blob storage and Azure Files (file shares), not Table or Queue in the scope described by Microsoft Learn.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15–20%)
  |__ 2.2 Configure and manage storage accounts
  |__ 2.2.5 Manage data by using Azure Storage Explorer and AzCopy

• Question 489:

  HOTSPOT

  You have an Azure subscription that contains an Azure Availability Set named WEBPROD-AS-USE2 as shown in the following exhibit.

  

  You add 14 virtual machines to WEBPROD-AS-USE2.

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  1. When Microsoft performs planned maintenance in East US 2, the maximum number of unavailable virtual machines will be: 2
  2. If the server rack in the Azure datacenter that hosts WEBPROD-AS-USE2 experiences a power failure, the maximum number of unavailable virtual machines will be: 7

  You added 14 VMs to an Availability Set that has:

  • platformUpdateDomainCount = 10 (update domains)
  • platformFaultDomainCount = 2 (fault domains)

  (1) Planned maintenance (Update Domains)
  
  Azure performs planned maintenance by updating or rebooting VMs one update domain at a time, so the maximum outage equals the number of VMs in the largest update domain.

  • With 14 VMs spread across 10 update domains, the largest update domain will have: ceil(14 / 10) = 2 VMs. Therefore, the maximum unavailable VMs during planned maintenance is 2.

  (2) Rack or power failure (Fault Domains)
  
  A rack-level failure impacts a fault domain, so the maximum outage equals the number of VMs in the largest fault domain.

  • With 14 VMs spread across 2 fault domains, the largest fault domain will have: ceil(14 / 2) = 7 VMs. Therefore, the maximum unavailable VMs during a rack or power failure is 7.

  Exam Tips:

  • Planned maintenance → think Update Domains → one update domain at a time → maximum impact equals the largest update domain.
  • Rack, power, or network failure → think Fault Domains → maximum impact equals the largest fault domain.
  • When VMs do not divide evenly across domains, use ceiling() to find the worst-case domain size.

  Summary:
  
  This question tests Availability Set behavior for update domains (planned maintenance) and fault domains (rack or power failure).

  AZ-104 Exam Objective Hierarchy:

  3.0 - Deploy and manage Azure compute resources (20–25%)
  └── 3.2 - Create and configure virtual machines
    └── 3.2.6 - Deploy virtual machines to availability zones and availability sets

• Question 490:

  You have an Azure Service Bus.

  You need to implement a Service Bus queue that guarantees first in first-out (FIFO) delivery of messages.

  What should you do?

  A. Set the Lock Duration setting to 10 seconds.
  B. Enable duplicate detection.
  C. Set the Max Size setting of the queue to 5 GB.
  D. Enable partitioning.
  E. Enable sessions.
  E. Enable sessions.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Enable sessions.

  --------------------------------------------------------------------------------

  In Azure Service Bus, **Sessions** provide ordered, FIFO-style processing (within a session) and enable message sequencing patterns. If the requirement is specifically to guarantee **first-in, first-out (FIFO)** delivery/processing, the key feature to enable/configure is **Sessions**.

  Why the other selections are incorrect:

  Set the Lock Duration setting to 10 seconds: Lock duration affects message lock handling, not FIFO ordering.

  Enable duplicate detection: Helps prevent processing duplicates, not FIFO ordering.

  Set the Max Size setting of the queue to 5 GB: Capacity setting, unrelated to FIFO.

  Enable partitioning: Improves scale/availability characteristics, but does not guarantee FIFO.

  -------------------------------------------------------------------------------- References:

  1. Service Bus sessions (FIFO sequencing patterns) https://learn.microsoft.com/en-us/azure/service-bus-messaging/message-sessions Date Modified: Unable to locate exact date in this session Date Access: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - **FIFO on Service Bus** is commonly tested as **"enable sessions."**

  - Partitioned entities can change ordering expectations-treat "FIFO guarantee" as a sessions clue.

  Summary:

  Service Bus queue configuration for ordered (FIFO) processing.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources |__ 3.3 Configure and manage container/queue-based solutions (best fit)