Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 511:

  You have an Azure virtual machine named VM1 that you use for testing. VM1 is protected by Azure Backup.

  You delete VM1.

  You need to remove the backup data stored for VM1.

  What should you do first?

  A. Modify the backup policy.
  B. Delete the Recovery Services vault.
  C. Stop the backup.
  D. Delete the storage account.
  C. Stop the backup.

  ---

  Explanation

  -----------------------------------------------------------------------

  Stop the backup.

  -----------------------------------------------------------------------

  Deleting the VM does not automatically remove its recovery points from the vault. To remove backup data, you must stop protection (stop the backup) and choose the option that deletes backup data. Therefore, the first step is to stop the backup.

  Why the other selections are incorrect:

  - Modify the backup policy: Policy changes do not remove existing backup data for a deleted VM.

  - Delete the Recovery Services vault: You typically cannot delete a vault while it contains protected items/backup data.

  - Delete the storage account: Backup data is managed by the Recovery Services vault; deleting a storage account is not the correct first step.

  ----------------------------------------------------------------------- References:

  1. Stop backup and delete backup data (Azure Backup) (Microsoft Learn) https://learn.microsoft.com/en-us/azure/backup/backup-azure-delete-vault Date Modified: Unable to locate in snippet Date Accessed: 01/25/2026

  ----------------------------------------------------------------------- Microsoft Exam Tips:

  - "Remove backup data" usually means: Stop protection + Delete backup data (not just delete the VM).

  - Vault deletion is often blocked until all protected items and data are removed.

  ----------------------------------------------------------------------- Summary:

  This tests the correct operational step to remove retained Azure Backup data for a deleted VM.

  ----------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10?5%) 5.2 Implement backup and recovery 5.2.4 Perform backup and restore operations by using Azure Backup

• Question 512:

  HOTSPOT

  You have an Azure subscription.

  You plan to use Azure Resource Manager templates to deploy 50 Azure virtual machines that will be part of the same availability set.

  You need to ensure that as many virtual machines as possible are available if the fabric fails or during servicing.

  How should you configure the template? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  platformFaultDomainCount: "3 (max value)"

  platformUpdateDomainCount: "20 (max value)"

  For an availability set, the maximum number of "fault domains" is 3 and the maximum number of "update domains" is 20. Therefore, to maximize resiliency, set the counts to their maximum values.

  Note: Regions may support fewer fault domains, but the template dropdown asks for the "max value".

  Excerpt: "You can configure up to 3 fault domains and up to 20 update domains."

  3.0 Deploy and manage Azure compute resources (20–25%) |__3.1 Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files |__|__3.1.1 Interpret an Azure Resource Manager template or a Bicep file |__|__3.1.4 Deploy resources by using an Azure Resource Manager template or a Bicep file |__3.2 Create and configure virtual machines |__|__3.2.6 Deploy virtual machines to availability zones and availability sets

• Question 513:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You manage a virtual network named VNet1 that is hosted in the West US Azure region.

  VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.

  You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.

  Solution: From Azure Monitor, you create a metric on Network In and Network Out.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  No

  Network In/Network Out metrics provide aggregate byte/packet throughput indicators; they do not "inspect all network traffic" between two specific VMs with packet-level/detail visibility.

  To inspect traffic between VM1 and VM2 for a defined period, you would use tooling designed for traffic capture/logging, such as:

  - Network Watcher packet capture (captures packets/flows for analysis), or

  - NSG flow logs (records flows through NSGs, if applicable).

  Therefore, the proposed "create a metric" solution does not meet the goal.

  Microsoft Exam Tips:

  - "Inspect traffic" implies packet capture/flow logs, not just performance counters.

  - Metrics answer "how much," not "what traffic."

  Summary:

  Throughput metrics are insufficient for traffic inspection; packet capture/flow logs are appropriate.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources |__ 5.1 Monitor resources in Azure | |__ 5.1.6 Use Azure Network Watcher and Connection Monitor /

• Question 514:

  You have an Azure subscription.

  You have 100 Azure virtual machines.

  You need to quickly identify underutilized virtual machines that can have their service tier changed to a less expensive offering.

  Which blade should you use?

  A. Metrics
  B. Customer insights
  C. Monitor
  D. Advisor
  D. Advisor

  ---

  Advisor

  To quickly identify underutilized virtual machines and find candidates for downsizing to a less expensive tier, you should use Azure Advisor. Advisor provides cost recommendations, including VM right-sizing guidance based on utilization patterns, enabling quick identification of optimization opportunities.

  Why the other options are incorrect:

  • Metrics: Raw performance data; you would need to manually interpret and correlate it across 100 VMs.
  • Customer insights: Not a standard blade for VM cost right-sizing recommendations.
  • Monitor: A central monitoring platform; it does not provide the same prescriptive cost right-sizing recommendations as Advisor.

  Exam Tips:

  • If the question mentions “less expensive offering” or “optimize cost,” look for Advisor or Cost Management, depending on the answer set.
  • Advisor is the exam’s go-to service for quick recommendations versus manual metrics analysis.

  Summary:
  
  Azure Advisor provides prescriptive cost optimization recommendations, including identifying underutilized VMs for resizing.

  AZ-104 Exam Objective Hierarchy:
  
  1.0 Manage Azure identities and governance (20–25%)
  └── 1.3 Manage Azure subscriptions and governance
    └── 1.3.6 Manage costs by using alerts, budgets, and Azure Advisor recommendations

• Question 515:

  HOTSPOT

  You have an Azure subscription named Subscription1 that contains the resources in the following table.

  

  You install the Web Server server role (IIS) on WM1 and VM2, and then add VM1 and VM2 to LB1. LB1 is configured as shown in the LB1 exhibit. (Click the Exhibit button.)

  

  Rule1 is configured as shown in the Rule1 exhibit. (Click the Exhibit button.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes
  Box 2: Yes
  Box 3: No

  Why:

  • Box 1 (Yes): Because VM1 and VM2 were successfully added to the backend pool of LB1, they must be eligible backend members for that load balancer SKU. For a Basic load balancer, backend pool VMs must be in the same availability set (or in a VM scale set). Therefore, VM1 is in the same availability set as VM2.
  • Box 2 (Yes): LB1’s health probe targets Probe1.htm. If that file exists on both VM1 and VM2 (and IIS is running), both instances become “healthy,” so the load balancer will distribute TCP/80 traffic across both healthy backends.
  • Box 3 (No): Deleting Rule1 removes the specific load-balancing rule that maps the frontend to the backend (including the port/protocol mapping). The load balancer will not automatically balance all requests for all ports without explicit load-balancing rules.

  Why the other options are not correct:

  • “No” for Box 1 would contradict the Basic load balancer backend pool requirement (same availability set or VMSS).
  • “No” for Box 2 would be correct only if the probe failed on one or both VMs (missing Probe1.htm, IIS stopped, or incorrect probe configuration).
  • “Yes” for Box 3 would require a design where all ports are explicitly covered, which is not how Azure Load Balancer works.

  Exam Tips:

  • Basic vs. Standard Load Balancer matters: Basic has stricter backend constraints (same availability set or VMSS).
  • Health probes determine eligible backends. If a probe fails, that VM is removed from load distribution.
  • Load Balancer does nothing by default for ports; rules define exactly what is balanced.

  Summary:
  
  This question tests Basic Load Balancer backend eligibility, probe-based health evaluation, and the effect of deleting a load-balancing rule.

  AZ-104 Exam Objective Hierarchy:
  
  4.0 - Implement and manage virtual networking (15–20%)
  
  └── 4.3 - Configure name resolution and load balancing
  
    └── 4.3.2 - Configure an internal or public load balancer

  
  

  

  
  

  https://docs.microsoft.com/en-us/azure/load-balancer/skus

• Question 516:

  You have an Azure subscription.

  You create the following Azure Resource Manager (ARM) template named Template.json.

  

  You need to deploy Template.json.

  Which PowerShell cmdlet should you run from Azure Cloud Shell?

  A. New-AzSubscriptionDeployment
  B. New-AzManagementGroupDeployment
  C. New-AzResourceGroupDeployment
  D. New-AzTenantDeployment
  A. New-AzSubscriptionDeployment

  ---

  New-AzSubscriptionDeployment

  The template creates a resource group resource (`Microsoft.Resources/resourceGroups`). Creating a resource group is a subscription-scope deployment, so you deploy the template at subscription scope using New- AzSubscriptionDeployment.

  Not selected:

  - New-AzResourceGroupDeployment: requires an existing target resource group and is used for resource-group-scope deployments.

  - New-AzManagementGroupDeployment / New-AzTenantDeployment: wrong scope for this template.

  Microsoft Exam Tips:

  - If the template "creates" the resource group, the deployment scope must be subscription (or higher), not resource group.

  Summary:

  Use subscription-scope PowerShell deployment when the template creates a resource group.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources  |__ 3.1 Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files | |__ 3.1.4 Deploy resources by using an Azure Resource Manager template or a Bicep file

• Question 517:

  HOTSPOT

  You have an Azure subscription that contains a storage account named storage1. The storage1 account contains a container named container1.

  You need to create a lifecycle management rule for storage1 that will automatically move the blobs in container1 to the lowest-cost tier after 90 days.

  How should you complete the rule? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  - tierToArchive

  - prefixMatch

  Explanation Archive is the lowest-cost tier for blob data. To apply the rule only to blobs in container1, you scope it using a prefix filter (prefixMatch) for that container path.

  Proof (short excerpts + citations)

  - From the exam exhibit: the action dropdown includes “tierToArchive” and the filter field includes “prefixMatch”.

  Microsoft. (n.d.). https://learn.microsoft.com/en-us/azure/storage/blobs/lifecycle-management-policy-configure

  Exam Tips

  - Lifecycle rules use filters (prefixMatch) to scope to containers/folders.

  - Archive is cheapest but requires rehydration to read.

  AZ-104 Exam Objective Hierarchy 2.0 Implement and manage storage (15–20%) |__2.3 Configure Azure Files and Azure Blob Storage |__|__2.3.6 Configure blob lifecycle management |__|__2.3.3 Configure storage tiers

• Question 518:

  You have an Azure subscription that contains a storage account named storageacct1234 and two users named User1 and User2.

  You assign User1 the roles shown in the following exhibit.

  

  Which two actions can User1 perform? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Modify the firewall of storageacct1234.
  B. View blob data in storageacct1234.
  C. View file shares in storageacct1234.
  D. Upload blob data to storageacct1234.
  E. Assign roles to User2 for storageacct1234.
  B. View blob data in storageacct1234.
  D. Upload blob data to storageacct1234.

  ---

  View blob data in storageacct1234.

  Upload blob data to storageacct1234.

  User1 has:

  Reader (management plane) at the resource group scope (inherited), which allows viewing resource metadata but not changing configuration.

  Storage Blob Data Contributor at the storage account scope (“This resource”), which grants read and write access to blob data (data plane), including listing or reading blobs and uploading or writing blobs. Therefore, User1 can view blob data and upload blob data.

  Why the other options are not correct:

  Modify the firewall of storageacct1234: requires configuration write permissions (Contributor or Storage Account Contributor), not Reader.

  View file shares in storageacct1234: Azure Files is a different data plane; Blob Data Contributor does not grant Azure Files share access.

  Assign roles to User2 for storageacct1234: requires role assignment permissions (Owner or User Access Administrator).

  Microsoft Exam Tips:

  Know the split: management plane RBAC (Reader or Contributor) vs. data plane roles (Storage Blob Data Contributor).

  “Blob data” permissions come from data roles, not storage account keys.

  Summary:

  Covers Azure RBAC role scopes and Storage Blob data-plane permissions.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20–25%)

  |__ 1.2 Manage access to Azure resources

  |__ 1.2.1 Manage built-in Azure roles

• Question 519:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a computer named Computer1 that has a point-to-site VPN connection to an Azure virtual network named VNet1. The point-to-site connection uses a self-signed certificate.

  From Azure, you download and install the VPN client configuration package on a computer named Computer2.

  You need to ensure that you can establish a point-to-site VPN connection to VNet1 from Computer2.

  Solution: You modify the Azure Active Directory (Azure AD) authentication policies.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  ---------------------------------------------------------------------------------------------------------------------------------

  No

  ---------------------------------------------------------------------------------------------------------------------------------

  The solution does NOT meet the goal.

  - The point-to-site (P2S) VPN connection uses a **self-signed certificate**, which indicates **certificate authentication**, not Microsoft Entra ID (Azure AD) authentication.

  - For certificate-based P2S, each client computer that connects must have the appropriate **client certificate installed locally** (and, depending on how the cert chain is deployed, the root certificate as well). Installing only the VPN client configuration package on Computer2 does not replace the need for the client certificate.

  - Modifying Microsoft Entra ID (Azure AD) authentication policies is relevant when the VPN gateway is configured for **Entra ID authentication**. In this scenario, authentication is certificate-based, so Entra ID authentication policies do not enable Computer2 to connect.

  What you would do instead (conceptually):

  - Ensure Computer2 has the required **client certificate (with private key)** installed, and that the VPN client profile is configured to use it.

  --------------------------------------------------------------------------------------------------------------------------------- References:

  (1) Microsoft Learn - Install a Point-to-Site client certificate (Azure VPN Gateway) Link: https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-how-to-vpn-client-install-azure-cert Date accessed: 2026-01-22 Last updated on: 2025-02-13

  (2) Microsoft Learn - About Azure Point-to-Site VPN connections Link: https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about Date accessed: 2026-01-22 Last updated on: 2025-07-09

  ---------------------------------------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - **Authentication type drives the fix:** If the prompt explicitly says "self-signed certificate," expect the remedy to involve installing/exporting/importing certificates (not Conditional Access or Entra ID auth policy changes). (1)

  - **Profile package vs. certificates:** The VPN client profile/config package provides configuration, but **certificate authentication still requires a client certificate on each endpoint**. (1)

  - "Does this meet the goal?" questions often test whether you picked the control plane correctly: identity policy changes help only when the gateway is configured for that identity-based auth method. (2)

  ---------------------------------------------------------------------------------------------------------------------------------

  Summary:

  - Point-to-site VPN (P2S) authentication methods

  - Certificate-based P2S requirements (client certificate on each connecting device)

  - Distinguishing Entra ID authentication configuration from certificate authentication steps

  ---------------------------------------------------------------------------------------------------------------------------------

  AZ-104 Exam Objective Alignment (Hierarchy)

  ------------------------------------------ 4.0 Implement and manage virtual networking (15?0%) | 4.1 Configure and manage virtual networks in Azure | 4.1.5 Troubleshoot network connectivity

• Question 520:

  HOTSPOT

  You have an Azure subscription that has diagnostic logging enabled and is configured to send logs to a Log Analytics workspace.

  You are investigating a service outage.

  You need to view the event time, the event name, and the affected resources.

  How should you complete the query? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  - Table: AzureActivity

  - Operator: project

  Why this is correct

  - AzureActivity contains activity log records in Log Analytics; you can filter to the relevant severity and then use `project` to return only:

  - event time (TimeGenerated),

  - event name (OperationNameValue),

  - affected resource (_ResourceId).

  Evidence sources (web)

  - Accessed: 2026-01-29

  - Microsoft Learn - “AzureActivity in Azure Monitor (sample queries)”

  - Last updated: 2025-03-31

  - https://learn.microsoft.com/en-us/azure/azure-monitor/reference/queries/azureactivity

  AZ-104 Exam Objective Hierarchy 5.0 Monitor and maintain Azure resources (10–15%) |__5.1 Monitor resources by using Azure Monitor |__|__5.1.3 Query and analyze logs