Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 491:

  HOTSPOT

  You have an Azure subscription that is linked to an Azure AD tenant. The tenant contains two users named User1 and User2. The subscription contains the resources shown in the following table.

  

  The subscription contains the alert rules shown in the following table.

  

  The users perform the following actions:

  1. User1 creates a new virtual disk and attaches the disk to VM1.

  2. User2 creates a new resource tag and assigns the tag to RG1 and VM1.

  Which alert rules are triggered by each user? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one pint.

  

  

  ---

  User1: Alert1 and Alert2 are triggered
  
  User2: Alert1 and Alert2 are triggered

  Why this is correct:

  Activity log alerts evaluate Administrative operations within the configured scope(s).

  Alert1 scope = RG1: Any administrative operation on RG1 or on resources within RG1 matches this scope.

  Alert2 scope = VM1: Any administrative operation on VM1 matches this scope.

  User1 action:

  Creating a disk (a new resource in RG1) triggers Alert1 (RG1 scope).

  Attaching the disk updates VM1 (an administrative write on VM1), which triggers Alert2 and also Alert1 (because VM1 is in RG1).

  Result: Alert1 and Alert2

  User2 action:

  Tagging RG1 triggers Alert1.

  Tagging VM1 triggers Alert2 and also Alert1 (because VM1 is in RG1).

  Result: Alert1 and Alert2

  Exam Tips:

  If you have an activity log alert scoped to a resource group, it can match operations on resources inside that resource group (the scope behaves like a prefix).

  When an action affects both the parent resource group and a child resource (such as VM1), multiple alerts can be triggered.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and back up Azure resources (10–15%)
  
  |__ 5.1 Monitor resources by using Azure Monitor
  
  |__ 5.1.4 Configure alert rules

• Question 492:

  You have two Azure virtual machines named VM1 and VM2 that run Windows Server. The virtual machines are in a subnet named Subnet1. Subnet1 is in a virtual network named VNet1.

  You need to prevent VM1 from accessing VM2 on port 3389.

  What should you do?

  A. Create a network security group (NSG) that has an outbound security rule to deny destination port 3389 and apply the NSG to the network interface of VM1.
  B. Configure Azure Bastion in VNet1.
  C. Create a network security group (NSG) that has an outbound security rule to deny source port 3389 and apply the NSG to Subnet1.
  D. Create a network security group (NSG) that has an inbound security rule to deny source port 3389 and apply the NSG to Subnet1.
  A. Create a network security group (NSG) that has an outbound security rule to deny destination port 3389 and apply the NSG to the network interface of VM1.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Create a network security group (NSG) that has an outbound security rule to deny destination port 3389 and apply the NSG to the network interface of VM1.

  --------------------------------------------------------------------------------

  To prevent **VM1 initiating** RDP connections to **VM2** on TCP **3389**, you block the **outbound** traffic from VM1 where the **destination port** is 3389. Applying the NSG at the **NIC of VM1** scopes the restriction precisely to VM1, matching least impact.

  Why other selections are not correct:

  - Configure Azure Bastion: Provides secure management access; it does not block VM1-to-VM2 RDP.

  - Deny source port 3389: Client source ports are ephemeral; you block by **destination port** for RDP.

  - Inbound deny source port 3389: Incorrect direction/port usage; to stop VM1 initiating, you need an outbound rule on VM1 (or an inbound deny on VM2 for destination port 3389).

  -------------------------------------------------------------------------------- References:

  1. Network security groups (NSGs) and security rules https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview Modified: Unable to locate date modified Date Access: 01/24/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - RDP is TCP destination port **3389**; block by **destination port**, not source port.

  - Apply NSG at NIC scope for the most targeted control when the requirement is "from VM1 only."

  -------------------------------------------------------------------------------- Summary:

  Blocking VM-to-VM traffic using NSG outbound rules.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.2 Configure secure access to virtual networks |__ 4.2.1 Create and configure network security groups (NSGs) and application security groups

• Question 493:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Storage account named storage1.

  You need to enable a user named User1 to list and regenerate storage account keys for storage1.

  Solution: You assign the Storage Account Key Operator Service Role to User1.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Yes

  The Storage Account Key Operator Service Role is designed to allow key operations such as listing and regenerating storage account keys (without granting full contributor/owner permissions). Therefore, assigning this role to User1 satisfies the requirement.

  Why the other option is not correct:

  - No: Would only be correct if this role lacked key management permissions, which is not the case in the intent of the role.

  Exam Tips:

  - Use the least-privilege built-in role that directly maps to the action (here: key operations).

  - For "list/regenerate keys," the correct objective mapping is "Manage access keys."

  Summary:

  Least-privilege RBAC role for managing storage account access keys.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage  |__ 2.1 Configure access to storage |__ 2.1.4 Manage access keys

• Question 494:

  HOTSPOT

  You have an Azure subscription that contains an Azure Storage account named storageaccount1.

  You export storageaccount1 as an Azure Resource Manager template. The template contains the following sections.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point

  

  

  ---

  Statement 1: Yes
  Statement 2: Yes
  Statement 3: No

  Why this is correct:

  • With the default network action set to Allow and no restrictive firewall rules configured, a server with a public IP address can access the storage account (subject to proper authentication).
  • The Archive tier can be set at the blob level (individual blobs) and managed through lifecycle management policies.
  • Azure Files access by using Azure AD credentials is not automatically granted to Global Administrators; Azure Files identity-based authentication requires proper configuration and separate authorization through RBAC or share-level ACLs.

  Why the other options are incorrect:

  • Global Administrator is a directory role; it does not automatically grant data-plane access to Azure Files shares.

  Exam Tip:

  • Separate management plane roles (Microsoft Entra ID directory roles) from data plane access (Storage RBAC, share ACLs, and identity-based authentication configuration).

  AZ-104 Exam Objective Hierarchy
  
  2.0 Implement and manage storage (15–20%)
  └── 2.1 Configure storage accounts
    └── 2.1.2 Configure network access to storage accounts
  
  └── 2.3 Configure storage management
    └── 2.3.3 Configure storage tiers

• Question 495:

  You need to implement the planned changes for DCR1. Which type of query should you?

  A. WQL
  B. T-SQL
  C. XPath
  D. KQL
  D. KQL

  ---

  Explanation

  Correct Answer:

  XPath

  DCR1 changes relate to Windows event collection and filtering. In Azure Monitor data collection rules, Windows Event Logs data sources use XPath queries (xPathQueries) to select/filter event records at collection time. While KQL can be used for transformations (transformKql), the query type used for Windows Event Logs selection is XPath.

  Proof / Reasoning:

  DCR samples and ARM reference show WindowsEventLogs data sources use the xPathQueries property (XPath).

  References (APA):

  Microsoft. (n.d.). Data collection rule samples. Retrieved 2026-01-31, from https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-rule-samples Microsoft. (n.d.). Create a data collection rule using an ARM template. Retrieved 2026-01-31, from https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/data-collection-rule-azure-resource-manager

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10–15%) |__5.1 Monitor resources in Azure |__|__5.1.2 Configure log settings in Azure Monitor

• Question 496:

  You have an Azure subscription that contains a resource group named TestRG.

  You use TestRG to validate an Azure deployment.

  TestRG contains the following resources:

  

  You need to delete TestRG.

  What should you do first?

  A. Modify the backup configurations of VM1 and modify the resource lock type of VNET1.
  B. Turn off VM1 and delete all data in Vault1.
  C. Remove the resource lock from VNET1 and delete all data in Vault1.
  D. Turn off VM1 and remove the resource lock from VNET1.
  C. Remove the resource lock from VNET1 and delete all data in Vault1.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Remove the resource lock from VNET1 and delete all data in Vault1.

  --------------------------------------------------------------------------------

  To delete the resource group (TestRG), Azure Resource Manager must be able to delete *all* resources inside it.

  - A **Delete/CanNotDelete lock** on VNET1 will block deletion of that resource, which in turn blocks deletion of the resource group. Therefore, the lock must be removed. (1)(2)

  - A **Recovery Services vault** that contains protected items/backup data (including soft-deleted backup data) cannot be deleted until you **stop protection** and **delete backup data** (and clear any remaining dependencies). Since the vault is inside TestRG, those backup items must be removed so the vault (and then the resource group) can be deleted. (3)

  Why the other options are not correct:

  - Turning off VM1 is not required to delete a VM/resource group; the blockers here are the **resource lock** and the **vault backup data/dependencies**. (1)(2)(3)

  - Changing backup "configurations" without **stopping protection and deleting backup data** will still leave vault dependencies that prevent deletion. (3)

  -------------------------------------------------------------------------------- References:

  (1) Microsoft Learn - "Azure Resource Manager resource group and resource deletion (Delete resource groups and resources)" Accessed: 2026-01-22 Last updated: 2025-02-09

  (2) Microsoft Learn - "Lock your Azure resources to protect your infrastructure (lock-resources)" Accessed: 2026-01-22 Last updated: 2025-02-06

  (3) Microsoft Learn - "Delete an Azure Backup Recovery Services vault" Accessed: 2026-01-22 Last updated: 2026-01-13

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - **Resource locks** are a common "gotcha": if a resource (or RG) has a CanNotDelete/Delete lock, deletion operations will fail until the lock is removed. (2)

  - For **Recovery Services vaults**, remember the sequence: **Stop backup/disable protection --> delete backup data (including soft-delete considerations) --> remove remaining dependencies --> delete vault**. (3)

  - On AZ-104, when asked "do first," pick the step that removes the *hard blocker* (locks/dependencies) preventing the intended operation. (1)

  -------------------------------------------------------------------------------- Summary:

  Deleting a resource group when it contains (a) a resource protected by a **Delete lock** and (b) a **Recovery Services vault** containing protected/backup data.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Alignment (Hierarchy):

  1.0 Manage Azure identities and governance (20?5%) 1.3 Manage Azure subscriptions and governance 1.3.2 Configure resource locks 1.3.4 Manage resource groups 5.0 Monitor and maintain Azure resources (10?5%) 5.2 Implement backup and recovery 5.2.1 Create a Recovery Services vault

• Question 497:

  HOTSPOT

  You are creating an Azure load balancer.

  You need to add an IPv6 load balancing rule to the load balancer.

  How should you complete the Azure PowerShell script? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Command: New-AzureRmLoadBalancerRuleConfig Parameter: -LoadBalancingRule

  Explanation (Why this is correct)

  - You create a load balancer rule configuration with New-AzureRmLoadBalancerRuleConfig.

  - You then pass the rule into the load balancer creation/update cmdlet via the -LoadBalancingRule parameter.

  Explanation (Why the other options are not correct)

  - Other parameters (for probes/frontends/backends) don’t represent the LB rule collection itself.

  Exam Tip

  - Think “*RuleConfig* cmdlet creates the object; *-LoadBalancingRule* attaches it to the LB.”

  References (APA)

  - Microsoft. (n.d.). New-AzureRmLoadBalancerRuleConfig. https://learn.microsoft.com/en-us/powershell/module/azurerm.network/new-azurermloadbalancerruleconfig

  AZ-104 Exam Objective Hierarchy 4.0 Implement and manage virtual networking (15–20%) |__4.3 Configure name resolution and load balancing |__|__4.3.2 Configure load balancing

• Question 498:

  You have two Azure virtual networks named VNet1 and VNet2. VNet1 contains an Azure virtual machine named VM1. VNet2 contains an Azure virtual machine named VM2.

  VM1 hosts a frontend application that connects to VM2 to retrieve data.

  Users report that the frontend application is slower than usual.

  You need to view the average round-trip time (RTT) of the packets from VM1 to VM2.

  Which Azure Network Watcher feature should you use?

  A. NSG flow logs
  B. Connection troubleshoot
  C. IP flow verify
  D. Connection monitor
  D. Connection monitor

  ---

  Connection monitor

  Connection monitor (Azure Network Watcher) is designed for proactive connectivity monitoring between endpoints and explicitly includes round-trip time (RTT) metrics and failed-check percentages.

  - NSG flow logs show rule hits/flows, not RTT.

  - IP flow verify checks whether traffic is allowed/denied, not latency.

  - Connection troubleshoot is more for diagnostic checks; the question asks for average RTT monitoring, which aligns to Connection monitor.

  Exam Tips:

  - RTT/latency + ongoing monitoring between endpoints = Connection monitor.

  - Allowed/denied decision path = IP flow verify; flow records = NSG flow logs (AZ-104).

  Summary:

  Selecting the correct Network Watcher tool for latency/RTT monitoring.

• Question 499:

  You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.

  Subscription1 has a user named User1. User1 has the following roles:

  1. Reader

  2. Security Admin

  3. Security Reader

  You need to ensure that User1 can assign the Reader role for VNet1 to other users.

  What should you do?

  A. Assign User1 the Network Contributor role for VNet1.
  B. Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.
  C. Assign User1 the Owner role for VNet1.
  D. Assign User1 the Network Contributor role for RG1.
  C. Assign User1 the Owner role for VNet1.

  ---

  Assign User1 the Owner role for VNet1.

  Assigning Azure RBAC roles requires permission to create role assignments at the target scope (Microsoft.Authorization/roleAssignments/write). The Owner role includes full management permissions for resources at the assigned scope, including the ability to assign roles. Therefore, giving User1 the Owner role on the VNet1 resource enables User1 to assign the Reader role for VNet1 to other users.

  The other existing roles listed (Reader, Security Admin, Security Reader) do not grant permission to assign Azure RBAC roles for Azure resources.

  In practice, you could assign User Access Administrator at the VNet1 scope to allow role assignment with fewer permissions than Owner.

  Exam Tips:

  • AZ-104 frequently tests which roles can grant access: Owner and User Access Administrator are the key built-in roles for creating role assignments.
  • If the task is “let a user assign roles,” think Owner or User Access Administrator at the appropriate scope.

  Summary:

  Azure RBAC requirements for delegating role assignment capability at the resource scope.

  AZ-104 Exam Objective Hierarchy:
  
  1.0 Manage Azure identities and governance (20–25%)
  └── 1.2 Manage access to Azure resources
    └── 1.2.2 Assign roles at different scopes

• Question 500:

  HOTSPOT

  You have two Azure virtual machines as shown in the following table.

  

  You create the Azure DNS zones shown in the following table.

  

  You perform the following actions:

  1. To fabrikam.com, you add a virtual network link to vnet1 and enable auto registration.

  2. For contoso.com, you assign vm1 and vm2 the Owner role.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worm one point.

  

  

  ---

  Why:

  - Public DNS zones (like contoso.com) do not automatically create A records for Azure VMs.

  - Private DNS zones (like fabrikam.com) linked to a VNet with auto-registration can create/register VM host records using the VM’s private IP.

  - Therefore vm1/vm2 records appear in fabrikam.com (private DNS) with private IPs, not in the public zone with a public IP.

  Why the other options are incorrect:

  - Expecting an automatic A record in a public DNS zone for a VM is incorrect unless you explicitly create it.

  Exam Tip

  - If you see “auto-registration” + “linked to VNet” --> that’s **Private DNS zone behavior**, not public DNS.

  AZ-104 Exam Objective Hierarchy

  4.0 Implement and manage virtual networking (20–25%) |__4.3 Configure name resolution |__|__4.3.1 Configure Azure DNS