Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 521:

  You have an Azure subscription that contains an Azure Active Directory (Azure AD) tenant named contoso.com and an Azure Kubernetes Service (AKS) cluster named AKS1.

  An administrator reports that she is unable to grant access to AKS1 to the users in contoso.com.

  You need to ensure that access to AKS1 can be granted to the contoso.com users.

  What should you do first?

  A. From contoso.com, modify the Organization relationships settings.
  B. From contoso.com, create an OAuth 2.0 authorization endpoint.
  C. Recreate AKS1.
  D. From AKS1, create a namespace.
  C. Recreate AKS1.

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  Recreate AKS1

  ----------------------------------------------------------------------------------------------------

  To grant AKS access to Microsoft Entra ID users, the AKS cluster must be configured for Microsoft Entra ID integration (managed Entra integration / Azure AD integration) so that authentication/authorization can be performed for directory users.

  - You do not "create an OAuth 2.0 authorization endpoint" in Microsoft Entra ID; Entra ID already provides OAuth 2.0/OpenID Connect endpoints as part of the platform.

  - The missing capability is cluster-side identity integration. In real operations, you would typically enable Entra integration (for example, by updating the cluster). Since "enable Entra integration" is not an answer choice here, "Recreate AKS1" is the only option that represents fixing the AKS identity integration configuration.

  Why the other choices are incorrect:

  - Modify the Organizational relationships settings:

  Organizational relationships are for cross-tenant/external collaboration scenarios, not enabling AKS identity integration for same-tenant users.

  - From contoso.com, create an OAuth 2.0 authorization endpoint:

  OAuth 2.0 authorization endpoints are provided by Entra ID; they are not something you manually "create" for AKS access.

  - From AKS1, create a namespace:

  Namespaces are Kubernetes resource organization constructs; they do not solve directory-based access grant issues.

  ---------------------------------------------------------------------------------------------------- References:

  1. Managed Microsoft Entra ID integration in AKS (AKS uses OpenID Connect built on OAuth 2.0; integration must be enabled on the cluster) https://learn.microsoft.com/azure/aks/managed-aad Date Modified: Unable to locate date modified Date Access: 01/23/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - For AKS user access questions, first check whether Microsoft Entra ID integration is enabled on the cluster (authentication plane). Namespaces/RBAC objects come after identity integration.

  - If an option describes "creating OAuth endpoints," treat it as suspicious-Entra endpoints are platform-provided.

  ---------------------------------------------------------------------------------------------------- Summary:

  This question tested the prerequisite of enabling Microsoft Entra ID integration for AKS so access can be granted to tenant users.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.2 Manage access to Azure resources |__ 1.2.2 Assign roles at different scopes

  With Azure AD-integrated AKS clusters, you can grant users or groups access to Kubernetes resources within a namespace or across the cluster. To obtain a kubectl configuration context, a user can run t he az aks get-credentials command. When a user then interacts with the AKS cluster with kubectl, they're prompted to sign in with their Azure AD credentials. This approach provides a single source for user account management and password credentials. The user can only access the resources as defined by the cluster administrator. Azure AD authentication is provided to AKS clusters with OpenID Connect. OpenID Connect is an identity layer built on top of the OAuth 2.0 protocol. For more information on OpenID Connect, see the Open ID connect documentation. From inside of the Kubernetes cluster, Webhook Token Authentication is used to verify authentication tokens. Webhook token authentication is configured and managed as part of the AKS cluster.

  

  https://kubernetes.io/docs/reference/access-authn-authz/authentication/ https://docs.microsoft.com/en-us/azure/aks/concepts-identity

• Question 522:

  You have two Azure subscriptions named Sub1 and Sub2.

  Sub1 contains a virtual machine named VM1 and a storage account named storage1.

  VM1 is associated to the resources shown in the following table.

  

  You need to move VM1 to Sub2.

  Which resources should you move to Sub2?

  A. VM1, Disk1, and NetInt1 only
  B. VM1, Disk1, and VNet1 only
  C. VM1, Disk1, and storage1 only
  D. VM1, Disk1, NetInt1, and VNet1
  D. VM1, Disk1, NetInt1, and VNet1

  ---

  Explanation

  -----------------------------------------------------------------------------------------------

  - VM1, Disk1, NetInt1, and VNet1

  ----------------------------------------------------------------------------------------------------

  When moving a VM across subscriptions, you must move the VM and its dependent resources that it requires to function in the target subscription-at minimum the VM resource, its managed disks, and its NIC(s). If you need the VM to remain connected to the same virtual network configuration in the target subscription, you also move the VNet (or recreate/connect to an appropriate VNet in the target subscription). Based on the answer choices provided, the only complete dependency set is VM1 + Disk1 + NetInt1 + VNet1.

  Why the other choices are not correct:

  - Any option that omits the NIC or disk is incomplete for a functional VM move.

  - Including storage1 is irrelevant here because the OS disk is shown as Disk1 (managed disk), not as a VHD-backed dependency in storage1.

  References:

  1. Move resources to a new resource group or subscription (move dependencies; VM-related resources) https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-resource-group-and-subscription Date Modified: Unable to locate date modified Date Access: 01/24/2026

  ----------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - "Move a VM" questions usually require you to include NIC(s) + disk(s); look for those in the resource list/table.

  ----------------------------------------------------------------------------------------------------

  Summary:

  - Resource move operations across subscriptions and VM dependency sets.

  ----------------------------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.2 Create and configure virtual machines |__ |__ 3.2.3 Move a virtual machine to another resource group, subscription, or region

• Question 523:

  HOTSPOT

  You have an Azure App Service plan named ASP1.

  CPU usage for ASP1 is shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  The average CPU percentage is calculated: four times ASP1 must be: scaled up

  Why this is correct:

  - The chart’s CPU “Average” is being displayed at a time grain that results in four aggregated points per day (6-hour grain --> 24/6 = 4).

  - Because the problem is high CPU on the App Service plan, optimizing CPU in-place typically requires adding CPU/RAM per instance (vertical scaling), which is Scale up.

  Why the other options are incorrect:

  - once / six times / 24 times: Do not match the implied time-grain aggregation represented in the exhibit.

  - scaled down: Would reduce compute and worsen CPU pressure.

  - scaled out: Adds instances, but the question’s “optimize CPU usage” phrasing aligns to increasing resources per instance (scale up) rather than horizontal scale.

  Exam Tips:

  - “Scale up” = bigger SKU (more CPU/RAM per instance). “Scale out” = more instances.

  - Portal metric charts depend on “Time grain”; fewer points/day implies a larger time grain (e.g., 6h).

  AZ-104 Exam Objective Hierarchy:

  3.0 Implement and manage compute resources (20–25%) |__3.4 Create and configure Azure App Service |__|__3.4.2 Configure scaling for an App Service plan

• Question 524:

  Note: The question is included in a number of questions that depicts the identical set-up. However, every question has a distinctive result. Establish if the solution satisfies the requirements.

  Your company has an Azure subscription with two storage accounts. Each of these storage accounts includes a queue service, a table service, and a blob service.

  You have created two apps that must be configured to store various types of data to all the storage services on the two storage accounts.

  You need to configure the required amount of endpoints for the apps.

  Solution: You configure two endpoints per app.

  Does the solution meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  --------------------------------------------------------------------------------

  Yes

  --------------------------------------------------------------------------------

  Each storage account can be accessed by an application using a single connection string (or equivalent endpoint configuration), and that connection string can be used to access the storage services within that account (blob, queue, and table) as needed. Since there are two storage accounts, configuring two endpoints per app (one per storage account) meets the requirement to store data across all storage services on both accounts. [1]

  References:

  [1] Microsoft. "Configure a connection string." Microsoft Learn. (Connection string structure for storage accounts.) Date modified: 2024-05-10. Date accessed: 2026-01-25. https://learn.microsoft.com/en-us/azure/storage/common/storage- configure-connection-string

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - Distinguish "one per account" configuration (connection string/account endpoint) from "one per service" endpoints-exam questions often test that nuance.

  Summary:

  Storage account access configuration using connection strings/endpoints per account.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15?0%) |__ 2.2 Configure and manage storage accounts |__ 2.2.1 Create and configure storage accounts

• Question 525:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You manage a virtual network named VNet1 that is hosted in the West US Azure region.

  VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.

  You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.

  Solution: From Azure Network Watcher, you create a connection monitor.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  No

  Network Watcher “Connection Monitor“ is used to monitor connectivity (reachability, latency, path changes) between endpoints over time. It does not capture or expose “all packet traffic“ from VM1 to VM2. Because the goal is to inspect all network traffic (packet-level), Connection Monitor is insufficient. Therefore, this solution does not meet the goal.

  Why the other selection is incorrect:

  - Yes: Incorrect because Connection Monitor is for connectivity monitoring, not packet capture/packet inspection.

  Microsoft Exam Tips:

  - "Monitor connectivity" --> Connection Monitor.

  - "Inspect/capture traffic/packets" --> Packet capture.

  Summary:

  Connection Monitor measures connectivity/latency; it does not inspect all packets between VM1 and VM2.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources |__ 5.1 Monitor resources in Azure |__ 5.1.6 Use Azure Network Watcher and Connection Monitor

• Question 526:

  DRAG DROP

  You have an Azure subscription that contains two virtual networks named VNet1 and VNet2.

  Virtual machines connect to the virtual networks.

  The virtual networks have the address spaces and the subnets configured as shown in the following table.

  

  You need to add the address space of 10.33.0.0/16 to VNet1. The solution must ensure that the hosts on VNet1 and VNet2 can communicate.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: Remove peering between VNet1 and VNet2.

  Step 2: Add the 10.33.0.0/16 address space to VNet1.

  Step 3: Recreate peering between VNet1 and VNet2.

  Explanation:

  This scenario is about updating a peered VNet’s address space and ensuring the peering reflects the new prefixes.

  Why the steps are correct (and why order matters):

  Step 1: Remove peering between VNet1 and VNet2.

  - The peering relationship includes learned/known address prefixes. Removing the peering guarantees you can safely change the address space without stale peering state/route propagation issues (this is also the classic workaround approach).

  Step 2: Add the 10.33.0.0/16 address space to VNet1.

  - You must update VNet1’s address space to include the new prefix before VNet2 can learn routes to it.

  Step 3: Recreate peering between VNet1 and VNet2.

  - Recreating the peering forces the peering relationship to re-establish with the updated address space so the new prefix is recognized and routing works end-to-end.

  Azure lesson (practical nuance):

  - In modern Azure, you can often update the address space and then **sync** the peering so peers learn the new prefixes (no need to delete/recreate). Microsoft documents that after resizing/updating a peered VNet’s address space, peers must sync with the new address space changes. However, deleting/recreating peering remains a valid “works-every-time” method and is what this answer key expects. :contentReference[oaicite:0]{index=0}

  References:

  1. Microsoft Learn. Update the address space for a peered virtual network.

  https://learn.microsoft.com/en-us/azure/virtual-network/update-virtual-network-peering-address-space Last updated: 09/10/2025. Date Accessed: 01/26/2026. :contentReference[oaicite:1]{index=1}

  2. Microsoft Learn. Azure virtual network peering overview (Resize the address space of peered VNets; peers must sync).

  https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview Last updated: 07/17/2025. Date Accessed: 01/26/2026. :contentReference[oaicite:2]{index=2}

  3. Microsoft Learn. Create, change, or delete Azure virtual network peering.

  https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering Last updated: 07/29/2025. Date Accessed: 01/26/2026. :contentReference[oaicite:3]{index=3}

  Microsoft Exam Tips:

  - For peered VNets, any address space change must be reflected on the peering relationship (either by syncing the peering or, on some exams/older patterns, by removing and recreating peering).

  - The exam loves “routing/propagation gotchas”: if connectivity breaks after adding a new prefix, think “peering sync / recreate peering.”

  Summary:

  This question covered changing a virtual network address space in a peered topology and ensuring peering recognizes the updated prefixes so routing works.

  AZ-104 Exam Objective Hierarchy:

  4.0 - Implement and manage virtual networking (15–20%) |__ 4.1 - Configure and manage virtual networks in Azure |__ 4.1.1 - Create and configure virtual networks and subnets |__ 4.1.2 - Create and configure virtual network peering

• Question 527:

  You have an Azure DNS zone named adatum.com. You need to delegate a subdomain named research.adatum.com to a different DNS server in Azure. What should you do?

  A. Create an PTR record named research in the adatum.com zone.
  B. Create an NS record named research in the adatum.com zone.
  C. Modify the SOA record of adatum.com.
  D. Create an A record named ".research in the adatum.com zone.
  B. Create an NS record named research in the adatum.com zone.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Create an NS record named research in the adatum.com zone.

  --------------------------------------------------------------------------------

  To delegate a subdomain (research.adatum.com) to a different DNS server/zone in Azure, you create the child zone (research.adatum.com) and then add an **NS record set** in the **parent zone (adatum.com)** named **research** that contains the child zone's name servers. This NS record is the delegation. (1)

  Why other selections are incorrect:

  - Create an PTR record named research in the adatum.com zone.: PTR is for reverse DNS (IP-to-name), not subdomain delegation. (1)

  - Modify the SOA record of adatum.com.: SOA defines zone authority metadata; it does not delegate a child zone. (1)

  - Create an A record named "*.research in the adatum.com zone.": A records map names to IPs; they do not delegate DNS authority for a subdomain. (1)

  --------------------------------------------------------------------------------

  References:

  1. Delegate a subdomain - Azure DNS https://learn.microsoft.com/en-us/azure/dns/delegate-subdomain Date Modified: 06/10/2024 Date Accessed: 01/25/2026

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - Delegation = NS records in the parent zone pointing to the child zone name servers.

  - PTR is only for reverse lookup zones; do not confuse forward-zone delegation with reverse DNS.

  --------------------------------------------------------------------------------

  Summary:

  This tests DNS delegation mechanics: create an NS record set in the parent zone for the subdomain.

  --------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) 4.3 Configure name resolution and load balancing 4.3.1 Configure Azure DNS

• Question 528:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has 100 users located in an office in Paris.

  The on-premises network contains the servers shown in the following table.

  

  You create a new subscription. You need to move all the servers to Azure.

  Solution: You use Azure Site Recovery.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  --------------------------------------------------------------------------------

  Yes

  --------------------------------------------------------------------------------

  Using Azure Site Recovery (ASR) can meet the goal of moving the servers to Azure because ASR can replicate supported on-premises machines and then perform a failover (or migration-style cutover) so the workloads run in Azure. In practice, Microsoft positions ASR primarily for disaster recovery, and for migrations you would typically prefer Azure Migrate; however, the proposed solution (use ASR) can still achieve the stated outcome of moving the servers to Azure by replicating and failing over the machines. (1)

  Why the other selection is incorrect:

  - No: This is incorrect because ASR replication + failover can result in the workloads running in Azure, which satisfies the stated "move all the servers to Azure" goal. (1)

  -------------------------------------------------------------------------------- References:

  1. Migrate on-premises machines to Azure (Azure Site Recovery / Azure Migrate guidance) https://learn.microsoft.com/en-us/azure/site-recovery/migrate-tutorial-on-premises-azure Date Modified: 10/31/2025 Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - Expect AZ-104 to test "which tool does what": ASR is DR-first, Azure Migrate is migration-first. If the question is framed as "does this meet the goal," focus on whether the tool can technically achieve the outcome.

  - When you see "move servers to Azure," think: Azure Migrate (assessment + migration), and sometimes ASR for lift-and-shift style cutovers.

  -------------------------------------------------------------------------------- Summary:

  ASR replication and failover can be used to run on-premises servers in Azure, so the proposal can meet the "move servers" goal (even though Azure Migrate is typically preferred for migrations).

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.2 Create and configure virtual machines |__ 3.2.1 Create a virtual machine

• Question 529:

  HOTSPOT

  You have an Azure subscription.

  You plan to use Azure Resource Manager templates to deploy 50 Azure virtual machines that will be part of the same availability set.

  You need to ensure that as many virtual machines as possible are available if the fabric fails or during servicing.

  How should you configure the template?

  To answer, select the appropriate options in the answer area. NOTE: Each correct selection is worth one point.

  

  

  ---

  - platformFaultDomainCount: 3

  - platformUpdateDomainCount: 20

  Explanation (Why this is correct)

  - To maximize resiliency against **hardware/fabric failures**, you use the maximum supported **fault domains** for an availability set (3). This spreads VMs across separate racks/power/network where possible.

  - To minimize the number of VMs impacted during **planned maintenance**, you use the maximum supported **update domains** (20). More update domains means fewer VMs per update domain, reducing maintenance blast radius.

  Explanation (Why the other options are incorrect)

  - Lower platformFaultDomainCount values provide less protection from a single fault-domain failure.

  - Lower platformUpdateDomainCount values place more VMs into each update domain, increasing the number potentially rebooted/serviced together.

  References (APA)

  - Microsoft. (n.d.). Availability sets overview. Retrieved January 27, 2026, from https://learn.microsoft.com/en-us/azure/virtual-machines/availability-set-overview

  Exam Tip

  - Remember: Availability Sets max out at **3 fault domains** and **20 update domains**.

  AZ-104 Exam Objective Hierarchy 3.0 Implement and manage compute (20–25%) |__3.2 Create and configure virtual machines |__|__3.2.6 Deploy virtual machines to availability zones and availability sets

• Question 530:

  You have an Azure virtual machine named VM1.

  You use Azure Backup to create a backup of VM1 named Backup1. After creating Backup1, you perform the following changes to VM1:

  1. Modify the size of VM1.

  2. Copy a file named Budget.xls to a folder named Data.

  3. Reset the password for the built-in administrator account.

  4. Add a data disk to VM1.

  An administrator uses the Replace existing option to restore VM1 from Backup1. You need to ensure that all the changes to VM1 are restored.

  Which change should you perform again?

  A. Modify the size of VM1.
  B. Add a data disk.
  C. Reset the password for the built-in administrator account.
  D. Copy Budget.xls to Data.
  D. Copy Budget.xls to Data.

  ---

  Copy Budget.xls to the Data folder.

  Using Azure Backup with the Replace existing restore option replaces the VM's disks with the selected recovery point. That means in-guest file changes made after Backup1 (such as copying Budget.xls into a folder) are rolled back and will not be present after the restore completes. To ensure all changes are present, you must perform the file copy again after the restore.

  Why the other changes are not the best answer for this question's focus:

  - Modify VM size: VM size is a VM configuration setting and is not the primary "disk content rollback" item the question is testing.

  - Reset built-in administrator password: password state depends on what was captured in the backed-up disk at the recovery point; however, the question's clear, deterministic "redo" item is the post-backup file copy.

  - Add a data disk: restore behavior for data disks can vary depending on the restore point disk configuration, but again the most direct change that is definitely undone by disk replacement is the file copy on disk.

  Microsoft Exam Tips:

  - "Replace existing" = disk rollback to the recovery point. Assume OS/data disk contents revert to that time.

  - File/folder operations performed after the recovery point typically must be redone after a replace-existing restore.

  - Separate VM configuration changes (SKU/size) from disk contents (files, OS state, application data).

  Summary:

  This question tests Azure Backup restore behavior: replacing existing VM disks restores disk contents from the recovery point, so post-backup file copies must be performed again.

  AZ-104 Exam Objective Alignment (Hierarchy)

  5.0 Monitor and maintain Azure resources | 5.2 Implement backup and recovery | 5.2.4 Perform backup and restore operations by using Azure Backup