Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 531:

  You have an Azure subscription.

  You plan to create a storage account named storage1.

  You need to configure a deny assignment for storage1.

  What should you use?

  A. an Azure Resource Manager (ARM) template
  B. Azure Policy
  C. a landing zone
  D. a deployment stack
  D. a deployment stack

  ---

  a deployment stack

  A "deny assignment" is an RBAC artifact that you typically don't create directly as a one-off configuration item. Azure creates deny assignments through specific managed mechanisms. Deployment stacks support "deny settings" that can create deny assignments to prevent changes to stack-managed resources. Therefore, to configure a deny assignment for storage1 using the provided options, a deployment stack best fits.

  Why other options are not correct:

  - Azure Policy: a "Deny" effect blocks non-compliant operations but does not equate to configuring an RBAC deny assignment object.

  - ARM template: you can deploy many resources via ARM, but deny assignments are not generally created as a standard user-deployed configuration.

  - landing zone: an architectural pattern, not a direct control to create deny assignments.

  Exam Tips:

  - If the stem explicitly says "deny assignment," think RBAC/managed deny assignments (Blueprints/managed apps/deployment stacks), not Azure Policy.

  Summary:

  - RBAC deny assignments vs Azure Policy deny effect; deployment stacks deny settings

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance |__ 1.3 Manage Azure subscriptions and governance |__ 1.3.1 Implement and manage Azure Policy

• Question 532:

  HOTSPOT

  You have an Azure subscription named Subscription1. Subscription1 contains two Azure virtual machines VM1 and VM2. VM1 and VM2 run Windows Server 2016.

  VM1 is backed up daily by Azure Backup without using the Azure Backup agent.

  VM1 is affected by ransomware that encrypts data.

  You need to restore the latest backup of VM1.

  To which location can you restore the backup? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: You can perform a file recovery of VM1 to: Any Windows computer that has Internet connectivity
  
  Box 2: You can restore VM1 to: VM1 or a new Azure virtual machine only

  This is an Azure Backup (Recovery Services vault) scenario.

  • Box 1: File recovery for an Azure VM backup uses a downloadable script that mounts the recovery point on a Windows machine (commonly via iSCSI). That machine must be running Windows and have Internet connectivity to reach Azure and mount or download the data.
  • Box 2: Restoring the VM (VM-level restore) supports restoring to the original VM (by replacing disks) or creating a new VM from the restore point. It is not a “restore VM1 onto VM2” operation.

  Why the other options are not correct:

  • File recovery is not restricted to VM1 or to an Azure VM; it can be performed from another Windows machine.
  • Restoring to VM2 is not a supported target model for Azure VM restore.

  Exam Tips:

  • “File recovery” is not the same as “VM restore.” File recovery mounts the recovery point to a Windows machine.
  • VM restore targets are typically: restore to the existing VM or create a new VM.

  Summary:
  
  This question tests Azure Backup restore capabilities: file-level recovery versus VM-level restore targets.

  AZ-104 Exam Objective Hierarchy:
  
  5.0 - Monitor and maintain Azure resources (10–15%)
  └── 5.2 - Implement backup and recovery
    └── 5.2.4 - Perform backup and restore operations by using Azure Backup

• Question 533:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the following resources:

  1. A virtual network that has a subnet named Subnet1 2. Two network security groups (NSGs) named NSG-VM1 and NSG-Subnet1 3. A virtual machine named VM1 that has the required Windows Server configurations to allow Remote Desktop connections

  NSG-Subnet1 has the default inbound security rules only.

  NSG-VM1 has the default inbound security rules and the following custom inbound security rule:

  1. Priority: 100 2. Source: Any 3. Source port range: * 4. Destination: * 5. Destination port range: 3389 6. Protocol: UDP 7. Action: Allow

  VM1 has a public IP address and is connected to Subnet1. NSG-VM1 is associated to the network interface of VM1. NSG-Subnet1 is associated to Subnet1.

  You need to be able to establish Remote Desktop connections from the internet to VM1.

  Solution: You add an inbound security rule to NSG-Subnet1 that allows connections from the Any source to the *destination for port range 3389 and uses the TCP protocol. You remove NSG-VM1 from the network interface of VM1.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  --------------------------------------------------------------------------------

  Yes

  --------------------------------------------------------------------------------

  Yes, this meets the goal.

  Why:

  - Remote Desktop Protocol (RDP) to a Windows VM uses TCP port 3389. Microsoft's guidance for connecting to a Windows VM states you connect using RDP over TCP 3389.

  Excerpt (official): "connect ... using Remote Desktop Protocol (RDP) over TCP port 3389."

  - For inbound traffic, Azure evaluates NSG rules in this order:

  1) Subnet NSG (if present) 2) NIC NSG (if present) Excerpt (official): "Azure first processes the rules ... associated with a subnet... [then] ... associated with the network interface..." }

  - Current state (per scenario):

  - NSG-Subnet1 has only default inbound rules --> by default, unsolicited inbound from the Internet is blocked unless you add an explicit allow rule.

  - NSG-VM1's custom rule allows UDP 3389 (not TCP), so it would not enable RDP.

  - Proposed solution:

  - Add an inbound allow rule on NSG-Subnet1 for TCP 3389 from Internet/Any to the VM/subnet.

  - Remove NSG-VM1 from the VM1 NIC.

  With NSG-VM1 removed, inbound evaluation is effectively at the subnet level only; the added TCP 3389 allow rule on the subnet NSG enables RDP to VM1 (and any VM in that subnet, unless further constrained).

  Additional note (Microsoft tip):

  - Microsoft recommends avoiding attaching NSGs at both subnet and NIC simultaneously due to potential conflicts/troubleshooting complexity.

  -------------------------------------------------------------------------------- References (Microsoft Learn):

  1) How network security groups filter network traffic

  - Accessed: 2026-01-22

  - Last updated: 2025-07-29

  2) Connect to a Windows virtual machine using RDP

  - Accessed: 2026-01-22

  - Last updated: 2025-07-10

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - For inbound flows, remember NSG evaluation order: subnet first, then NIC. If traffic is denied at the subnet, the NIC NSG never gets a chance to allow it.

  - RDP is TCP 3389 (not UDP). If a rule allows UDP 3389, it will not satisfy RDP requirements.

  - Be cautious applying NSGs at both subnet and NIC; it can create "it should work but doesn't" scenarios on exams and in production.

  - AZ-104 commonly tests where to place the rule (subnet vs NIC) and protocol accuracy (TCP/UDP).

  -------------------------------------------------------------------------------- Summary:

  This question covered NSG inbound rule evaluation order (subnet vs NIC), default-deny behavior for unsolicited inbound traffic, and protocol/port correctness for RDP (TCP 3389).

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) | 4.2 Configure secure access to virtual networks | 4.2.1 Create and configure network security groups (NSGs) and application security groups

• Question 534:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals.

  Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Active Directory (Azure AD) tenant named contoso.com.

  You have a CSV file that contains the names and email addresses of 500 external users.

  You need to create a guest user account in contoso.com for each of the 500 external users.

  Solution: You create a PowerShell script that runs the New-MgUser cmdlet for each external user.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  To create guest accounts for external users (B2B), the typical and reliable method is to send invitations so the external users redeem the invite and are linked to their external identity. The "invitation" flow (Graph invitation) is designed for this.

  Using New-MgUser to create users for each external email address does not, by itself, perform the B2B invitation/redemption process. That means it does not reliably meet the goal of creating usable guest accounts for those external users with minimal friction.

  Why the other option is not correct:

  - Yes: Would be correct only if the proposed action actually performs B2B guest invitation/onboarding. Setting up a script with New-MgUser alone does not guarantee that.

  -------------------------------------------------------------------------------- References:

  1. Microsoft Graph PowerShell: New-MgInvitation (B2B invitations) https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.identity.signins/new-mginvitation Modified: Unable to locate date modified Date Access: 01/24/2026

  2. Microsoft Graph PowerShell: New-MgUser (creates user objects) https://learn.microsoft.com/en-us/powershell/module/microsoft.graph.users/new-mguser Modified: Unable to locate date modified Date Access: 01/24/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: "Guest user" creation for external users usually implies B2B invitation, not just creating a directory object.

  - If the requirement includes external users authenticating with their own identity, prefer invitation-based onboarding.

  -------------------------------------------------------------------------------- Summary:

  This question tested the difference between creating a user object and inviting an external (B2B) guest user.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.4 Manage external users

• Question 535:

  HOTSPOT

  You have an Azure subscription named Sub1 that contains the blob containers shown in the following table.

  

  Sub1 contains two users named User1 and User2. Both users are assigned the Reader role at the Sub1 scope.

  You have a condition named Condition1 as shown in the following exhibit.

  

  You have a condition named Condition2 as shown in the following exhibit.

  

  You assign roles to User1 and User2 as shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  - User1 can read blob2: No

  - User1 can read blob3: No

  - User2 can read blob1: Yes

  Explanation (Why this is correct)

  - User1:

  User1 has Storage Blob Data Reader at the subscription scope BUT with Condition1.

  Condition1 allows the blob “read” action only when the target container name equals cont1.

  Therefore, User1 can read blob1 (in cont1) but cannot read blob2 (cont2) or blob3 (cont3).

  - User2:

  User2 has Storage Blob Data Owner scoped to storage1 with Condition2 that constrains “write” operations to certain blob paths.

  Read is not a write operation, so the condition does not block read. Therefore, User2 can read blob1.

  Evidence (Excerpts)

  - Azure RBAC conditions evaluate action + resource attributes (for example, ActionMatches and resource fields) to allow/deny the request.

  - Example condition patterns use ActionMatches and resource attributes like container name/path.

  AZ-104 Exam Objective Hierarchy 1.0 Manage Azure identities and governance (20–25%) |__1.2 Manage access to Azure resources |__|__1.2.2 Assign roles at different scopes |__|__1.2.3 Interpret access assignments

  References (APA; full URL only) Microsoft. (n.d.). Add or edit Azure role assignment conditions using Azure CLI. Last updated 2024-01-02. Accessed 2026-01-29. https://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-role-assignments-azure-cli Microsoft. (n.d.). Add or edit Azure role assignment conditions using Azure PowerShell. Last updated 2024-04-16. Accessed 2026-01-29. https://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-role-assignments- powershell

• Question 536:

  You are planning to deploy an Ubuntu Server virtual machine to your company's Azure subscription.

  You are required to implement a custom deployment that includes adding a particular trusted root certification authority (CA).

  Which of the following should you use to create the virtual machine?

  A. The New-AzureRmVm cmdlet.
  B. The New-AzVM cmdlet.
  C. The Create-AzVM cmdlet.
  D. The az vm create command.
  D. The az vm create command.

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  The az vm create command.

  ----------------------------------------------------------------------------------------------------

  The requirement is to deploy an Ubuntu Server VM using a custom deployment that includes adding a trusted root certificate authority (CA). The Azure CLI supports this type of automated/custom provisioning during VM creation using parameters such as custom data (cloud-init) or extensions, and az vm create is the canonical Azure CLI command for creating VMs. Therefore, using az vm create is an appropriate choice to meet a "custom deployment" requirement in an automated, repeatable way. [1]

  Why the other selections are not correct:

  - The New-AzureRmVm cmdlet:

  This is part of the legacy AzureRM PowerShell module, which has been deprecated and replaced by the Az module. Exam items typically treat AzureRM cmdlets as incorrect in favor of Az cmdlets/CLI. [2]

  - The New-AzVM cmdlet:

  This is a valid Az PowerShell cmdlet for creating VMs; however, the question's expected answer indicates the scenario is steering toward Azure CLI-based deployment ("custom deployment" for Ubuntu) and the specific choice az vm create.

  In the context of this item's answer key, New-AzVM is treated as not the best fit compared to az vm create for the required custom deployment workflow. [1][3]

  - The Create-AzVM cmdlet:

  This is not the standard Az PowerShell VM creation cmdlet name (the commonly documented cmdlet is New-AzVM). Because it is not recognized as the correct/typical Az cmdlet for VM creation, it is not the best selection. [3]

  ----------------------------------------------------------------------------------------------------------

  References:

  1. az vm create (Azure CLI) https://learn.microsoft.com/en-us/cli/azure/vm?view=azure-cli-latest#az-vm-create Date modified: Unable to locate date modified Date accessed: 2026-01-25

  2. AzureRM to Az migration (Azure PowerShell) https://learn.microsoft.com/en-us/powershell/azure/migrate-azureps?view=azps-latest Date modified: Unable to locate date modified Date accessed: 2026-01-25

  3. New-AzVM (Az.Compute) https://learn.microsoft.com/en-us/powershell/module/az.compute/new-azvm?view=azps-latest Date modified: Unable to locate date modified Date accessed: 2026-01-25

  ----------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - If you see AzureRM cmdlets (e.g., *New-AzureRm**), assume they are deprecated and prefer Az module cmdlets or Azure CLI.

  - For Linux "custom deployment" language, look for cloud-init/custom data or extension-based automation patterns supported by Azure CLI and Az PowerShell.

  Summary:

  Selecting the appropriate tooling (Azure CLI vs. PowerShell) to create a Linux VM with custom provisioning requirements.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.2 Create and configure virtual machines |__ 3.2.1 Create a virtual machine

• Question 537:

  You have an Azure subscription that contains a storage account named account1.

  You plan to upload the disk files of a virtual machine to account1 from your on-premises network. The on-premises network uses a public IP address space of 131.107.1.0/24.

  You plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be attached to a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24.

  You need to configure account1 to meet the following requirements:

  1. Ensure that you can upload the disk files to account1.

  2. Ensure that you can attach the disks to VM1.

  3. Prevent all other access to account1.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. From the Firewalls and virtual networks blade of account1, add the 131.107.1.0/24 IP address range.
  B. From the Firewalls and virtual networks blade of account1, select Selected networks.
  C. From the Firewalls and virtual networks blade of acount1, add VNet1.
  D. From the Firewalls and virtual networks blade of account1, select Allow trusted Microsoft services to access this storage account.
  E. From the Service endpoints blade of VNet1, add a service endpoint.
  A. From the Firewalls and virtual networks blade of account1, add the 131.107.1.0/24 IP address range.
  B. From the Firewalls and virtual networks blade of account1, select Selected networks.

  ---

  - From the Firewalls and virtual networks blade of account1, add the 131.107.1.0/24 IP address range.

  - From the Firewalls and virtual networks blade of account1, select Selected networks.

  You must restrict access to the storage account so that:

  You can upload disk files from your on-premises network (131.107.1.0/24), 2) VM1 can attach and use the disks, and 3) All other access is blocked.

  How the selected actions meet the requirements:

  - Select Selected networks:

  This switches the storage account to a "deny by default" posture for its public endpoint, so only explicitly allowed networks/IP ranges can access the data plane. This satisfies the "prevent all other access" requirement when combined with an allow-list entry.

  - Add the 131.107.1.0/24 IP address range:

  This allow-lists your on-premises public IP range so you can upload the disk files from on-premises while all other public traffic remains blocked.

  - VM1 can attach the disks:

  Storage network rules do not block VM disk traffic (mount/unmount and disk I/O). Therefore, enabling Selected networks and allowing only the on-prem range will not prevent VM disk attachment/usage.

  Why the other options are not correct:

  - Add VNet1 from the Firewalls and virtual networks blade:

  Not required to meet the stated requirements, because the goal is not "VM1 must access storage account data over the network," but rather "VM1 can attach the disks."

  - Select Allow trusted Microsoft services to access this storage account:

  This broadens access beyond the stated allow-list intent and is not required for the stated disk attach requirement.

  - From the Service endpoints blade of VNet1, add a service endpoint:

  This is used to enable VNet-based access to the storage account data plane (when you intend workloads in the VNet to access storage data). It is not required to satisfy the disk attach requirement.

  Exam Tips:

  - Interpret storage "Networking / Firewalls and virtual networks" as data-plane protection. Control-plane actions are not governed by these rules, and some platform behaviors (like VM disk traffic) are explicitly exempted.

  - For "lock down storage but allow on-prem upload," the common pattern is:

  enable Selected networks + add the on-prem public IP (CIDR) as an allowed IP range.

  - Service endpoints are typically selected only when the requirement explicitly says that resources in a VNet must access storage over the data plane (for example, apps reading blobs).

  Summary:

  - Configuring Azure Storage firewall to allow only specific public IP ranges

  - Enabling "deny by default" via Selected networks

  - Understanding what storage network rules do and do not block (data plane vs VM disk traffic)

  AZ-104 Exam Objective Alignment (Hierarchy)

  2.0 Implement and manage storage | 2.1 Configure access to storage | 2.1.1 Configure Azure Storage firewalls and virtual networks

• Question 538:

  HOTSPOT

  You have an Azure App Service web app named app1.

  You configure autoscaling as shown in following exhibit.

  

  You configure the autoscale rule criteria as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that answers each question based on the information presented in the graphic. NOTE Each correct selection is worth one point.

  

  

  ---

  After CPU usage has reached 80 percent for 15 minutes, [answer choice] will be running: 3 instances Once the first scale-out instance is created, the minimum time before an additional instance is created will be: 5 minutes

  Why this is correct:

  - The autoscale profile shows a default instance count of 2 and a scale-out rule that adds 1 instance when CPU > 80% for 15 minutes. So it becomes 3 instances.

  - The rule cooldown is 5 minutes, which is the minimum wait time before another scale action can occur.

  Why the other options are incorrect:

  - 2 instances: ignores the scale-out action.

  - 4–5 instances: would require additional scale-out actions beyond the first trigger.

  - 1/10/15 minutes cooldown: does not match the configured cooldown shown.

  Exam Tips:

  - “Default” in autoscale = starting instance count.

  - “Cooldown” = how long autoscale waits before it can trigger another scale action.

  Summary:

  Scale from 2 to 3 instances after the rule fires, and cooldown is 5 minutes.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20–25%) |__3.4 Configure and manage Azure App Service |__|__3.4.2 Configure scaling for an App Service plan

• Question 539:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure web app named Appl. App1 runs in an Azure App Service plan named Plan1. Plan1 is associated to the Free pricing tier.

  You discover that App1 stops each day after running continuously for 60 minutes.

  You need to ensure that App1 can run continuously for the entire day.

  Solution: You change the pricing tier of Plan1 to Basic.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  --------------------------------------------------------------------------------

  Yes

  --------------------------------------------------------------------------------

  The Free (F1) App Service plan runs in shared infrastructure and is subject to daily CPU quotas (commonly 60 CPU minutes/day). That aligns with the symptom of the app stopping after ~60 minutes of continuous runtime. Moving the plan to a dedicated tier such as Basic provides dedicated compute and removes the Free-tier CPU quota constraint, enabling the app to run continuously for the day.

  -------------------------------------------------------------------------------- References:

  1. Azure App Service on Windows pricing (Free plan CPU minutes/day) https://azure.microsoft.com/en-us/pricing/details/app-service/windows/ Date Modified: Unable to locate date modified Date Access: 01/25/2026 2. Azure App Service Plans (shared vs dedicated compute tiers) https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans Date Modified: 11/18/2025 Date Access: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: If the plan is Free/Shared and you see runtime/CPU quota symptoms, the fix is usually to scale up to Basic+.

  - Free/Shared tiers are for dev/test and learning; production continuity requires dedicated tiers.

  -------------------------------------------------------------------------------- Summary:

  Scaling from Free to Basic removes Free-tier CPU/runtime constraints so the app can run all day.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.4 Create and configure Azure App Service |__ 3.4.2 Configure scaling for an App Service plan

• Question 540:

  You have an Azure subscription that contains the resources shown in the following table.

  

  VM1 and VM2 run a website that is configured as shown in the following table.

  

  LB1 is configured to balance requests to VM1 and VM2.

  You configure a health probe as shown in the exhibit. (Click the Exhibit tab.)

  

  You need to ensure that the health probe functions correctly.

  What should you do?

  A. On LB1, change the Unhealthy threshold to 65536.
  B. On LB1, change the port to 8080.
  C. On VM1 and VM2, create a file named Probe1.htm in the C:\intepub\wwwroot\Temp folder.
  D. On VM1 and VM2, create a file named Probe1.htm in the C:\intepub\wwwroot\SiteA\Temp folder.
  C. On VM1 and VM2, create a file named Probe1.htm in the C:\intepub\wwwroot\Temp folder.

  ---

  Explanation

  Item 48 of 253 - Correctness Check Does this meet the goal?

  No

  Correct action Create a file named Probe1.htm on BOTH VM1 and VM2 in:

  C:\inetpub\wwwroot\Temp

  Why

  - The health probe path shown is: /Temp/Probe1.htm

  - In the website configuration table, "Temp" is an alias (virtual directory) that maps to:

  Physical path: C:\inetpub\wwwroot\Temp

  - Therefore, when the probe requests /Temp/Probe1.htm, IIS will resolve it to:

  C:\inetpub\wwwroot\Temp\Probe1.htm

  - Creating the file under C:\inetpub\wwwroot\SiteA\Temp would NOT satisfy the probe because that is a different physical path than the alias mapping.

  Microsoft Learn references

  - Add-AzLoadBalancerProbeConfig (RequestPath = path in the load-balanced service to probe):

  https://learn.microsoft.com/powershell/module/az.network/add-azloadbalancerprobeconfig Exam Objective (Hierarchy) 4.0 Implement and manage virtual networking (15?0%) | |__ 4.3 Configure name resolution and load balancing | |__ 4.3.2 Configure an internal or public load balancer