Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 541:

  HOTSPOT

  You have an Azure subscription named Subscription1.

  Subscription1 contains the virtual machines in the following table.

  

  Subscription1 contains the virtual machines in the following table.

  

  VM3 has multiple network, including a network adapter named NIC3, IP forwarding is enabled on NIC3. Routing is enabled on VM3.

  You create a route table named RT1 that contains the routes in the following table.

  

  You apply RT1 to subnet1 and Sybnet2.

  For each of the following statements, select Yes if the statements is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  VM3 can establish a network connection to VM1: Yes If VM3 is turned off, VM2 can establish a network connection to VM1: No VM1 can establish a network connection to VM2: Yes

  Explanation (Why this is correct)

  - VM3 is acting as the network virtual appliance (NVA). With IP forwarding enabled and routes pointing traffic through VM3, VM1 and VM2 can communicate via VM3.

  - If VM3 is turned off, the NVA path is gone, so the routed connectivity that depended on VM3 fails.

  - VM1 can still establish a connection to VM2 while VM3 is available to forward traffic.

  Explanation (Why the other options are incorrect)

  - Any option implying VM2↔VM1 works when VM3 is down contradicts the dependency on the NVA forwarding path.

  Exam Tip

  - For “NVA routing” questions: you usually need (1) a route table/UDR with next hop = Virtual appliance and (2) IP forwarding enabled on the NVA NIC.

  References (APA)

  - Microsoft. (n.d.). Route network traffic through a network virtual appliance. Microsoft Learn. https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-create-route-table-portal

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15–20%) |__4.1 Configure virtual networks |__|__4.1.4 Configure user-defined network routes

• Question 542:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You manage a virtual network named VNet1 that is hosted in the West US Azure region.

  VNet1 hosts two virtual machines named VM1 and VM2 that run Windows Server.

  You need to inspect all the network traffic from VM1 to VM2 for a period of three hours.

  Solution: From Azure Network Watcher, you create a packet capture.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  -----------------------------------------------------------------------

  Yes

  -----------------------------------------------------------------------

  Azure Network Watcher **packet capture** captures packet data to/from a target VM's network interface, optionally with filters and time bounds. Creating a packet capture in Network Watcher is the appropriate first step to inspect the network traffic between VM1 and VM2 over a defined window (e.g., three hours), assuming capture limits (size/time) are configured appropriately. Therefore, this solution meets the goal.

  Why the other selection is incorrect:

  - No: Incorrect because packet capture is specifically designed for packet-level inspection and can be run over a specified duration.

  -----------------------------------------------------------------------

  References:

  1. Packet capture in Azure Network Watcher (overview) https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-packet-capture-overview Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -----------------------------------------------------------------------

  Microsoft Exam Tips:

  - For packet-level troubleshooting between Azure VMs, choose **Network Watcher packet capture**. Metrics (Network In/Out) show volume, not packet contents.

  Summary:

  Network Watcher packet capture is the correct tool to inspect packet-level traffic between two VMs over a defined period.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10?5%) |__ 5.1 Monitor resources in Azure |__ 5.1.6 Use Azure Network Watcher and Connection Monitor

• Question 543:

  HOTSPOT

  Peering for VNET2 is configured as shown in the following exhibit.

  

  Peering for VNET3 is configured as shown in the following exhibit.

  

  How can packets be routed between the virtual networks? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Packets from VNET1 can be routed to: VNET2 and VNET3 Packets from VNET2 can be routed to: VNET1 only

  Explanation (Why this is correct)

  - VNet peering connectivity is non-transitive by default:

  - VNET1 can communicate with VNET2 (direct peering) and with VNET3 (direct peering).

  - VNET2 cannot route to VNET3 through VNET1 unless you implement a routing/NVA design (peering alone doesn’t provide transitive routing).

  Exam Tip

  - “Peering is not transitive” is a classic exam trap.

  References (APA)

  - Microsoft. (n.d.). Virtual network peering. Microsoft Learn. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

  AZ-104 Exam Objective Hierarchy 4.0 Implement and manage virtual networking (15–20%) |__4.1 Configure and manage virtual networks |__|__4.1.2 Configure virtual network peering

• Question 544:

  You have two storage accounts named saSource and saDest.

  You need to configure object replication to replicate block blobs from saSource to saDest.

  Which configuration prerequisites are required?

  A. Enable blob versioning on saSource only.
  B. Enable blob versioning on both saSource and saDest and enable change feed on saSource.
  C. Enable change feed on saDest only.
  D. Enable soft delete on both saSource and saDest.
  B. Enable blob versioning on both saSource and saDest and enable change feed on saSource.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Enable blob versioning on both the source and destination accounts and enable change feed on the source account.

  --------------------------------------------------------------------------------

  Azure Storage object replication for block blobs requires:

  - Blob versioning enabled on both the source and destination accounts, and

  - Blob change feed enabled on the source account.

  These prerequisites allow replication to track writes/deletes and replicate versions consistently.

  Why the other options are not correct:

  - Enabling versioning only on the source (or only on the destination) is insufficient; it must be enabled on both.

  - Change feed is required on the source; enabling it only on the destination does not satisfy the prerequisite.

  - Soft delete, lifecycle policies, or encryption settings do not replace the object replication prerequisites.

  -------------------------------------------------------------------------------- References:

  1. Configure object replication (prerequisites: versioning on both accounts; change feed on source) https://learn.microsoft.com/en-us/azure/storage/blobs/object-replication-configure Modified: Unable to locate date modified Date Access: 01/24/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: If you see "object replication," immediately think "versioning (both) + change feed (source)."

  - Watch for "source vs destination" wording-requirements are asymmetric for change feed.

  -------------------------------------------------------------------------------- Summary:

  Azure Blob Storage object replication prerequisites.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15?0%) |__ 2.2 Configure and manage storage accounts |__ 2.2.3 Configure object replication

• Question 545:

  You have an on-premises server that contains a folder named D:\Folder1.

  You need to copy the contents of D:\Folder1 to the public container in an Azure Storage account named contosodata.

  Which command should you run?

  A. az storage blob copy start D:\Folder1 https://contosodata.blob.core.windows.net/public
  B. azcopy sync D:\folder1 https://contosodata.blob.core.windows.net/public--snapshot
  C. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public--recursive
  D. az storage blob copy start-batch D:\Folder1 https://contosodata.blob.core.windows.net/public
  C. azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public--recursive

  ---

  azcopy copy D:\folder1 https://contosodata.blob.core.windows.net/public --recursive

  You are copying the contents of a local folder (D:\Folder1) to a blob container (public) in an Azure Storage account.

  AzCopy is the supported tool for copying data from an on-premises/local path directly to Azure Blob Storage.

  Why this answer is correct:

  - `azcopy copy` supports uploading from a local directory to a blob container.

  - The `--recursive` flag is required to copy all files and subfolders under D:\Folder1 (not just the folder object itself).

  Why the other choices are not correct:

  - az storage blob copy start D:\Folder1 https://.../public This is for blob-to-blob copy operations (server-side copy of blobs), not uploading from a local Windows path.

  - azcopy sync D:\folder1 https://.../public --snapshot `sync` is for synchronization scenarios and the `--snapshot` parameter is not a valid way to target a "public container upload" for this requirement.

  - az storage blob copy start-batch D:\Folder1 https://.../public `start-batch` is for copying multiple blobs (storage-to-storage), not uploading a local folder from a drive letter path.

  Note (real-world execution):

  Even if the destination container is public for read access, uploading still requires authorization (for example, AzCopy login or a SAS token).

  Microsoft Exam Tips:

  - For "copy data from on-prem/local to Azure Storage," default to AzCopy (or Storage Explorer). Azure CLI `az storage blob copy` is primarily for storage-side blob copy operations.

  - Watch for keywords: "contents of D:\Folder1" strongly implies a local filesystem source --> AzCopy copy + `--recursive`.

  Summary:

  This question tested selecting the correct tool/command to upload a local directory to an Azure Blob container using AzCopy, including the need for recursive copy.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage 2.2 Configure and manage storage accounts 2.2.5 Manage data by using Azure Storage Explorer and AzCopy

• Question 546:

  DRAG DROP

  You have an Azure subscription that contains the storage accounts shown in in the following table.

  

  You plan to use AzCopy to copy a blob from container 1 directly to share1.

  You need to identity which authentication method to use when you use AzCopy.

  What should you identify for each account? To answer, drag the appropriate authentication methods to the correct accounts Each method may be used once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  Box 1 (Storage 1):

  A shared access signature(SAS) token

  Box 2 (Storage 2):

  A shared access signature(SAS) token

  Explanation:

  You’re using AzCopy to copy data between two storage accounts:

  - Storage1 contains a private blob container (no public access), so AzCopy must be authorized to read the blob.

  - Storage2 contains an Azure Files share, so AzCopy must also be authorized to write to the file share.

  A SAS token is a common, least-privilege way to grant AzCopy time-bound permissions to both the source and destination. With AzCopy, you can authorize requests by appending a SAS token to the source and/or destination URL used in the copy command.

  Why other options are not selected:

  - OAuth: AzCopy can use Microsoft Entra ID (OAuth) in some scenarios, but the question’s expected key for this item is SAS for both endpoints, and SAS is universally accepted for delegated access in AzCopy copy operations.

  - Anonymous: Not possible because the blob container is explicitly “No public access.”

  - Storage account access key: Works, but it grants broad access and is not least-privilege compared to SAS.

  References:

  1. Copy or move data to Azure Storage by using AzCopy v10 (Authorize with a SAS token).

  https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10 Last Updated: 01/08/2026 Date Accessed: 01/26/2026

  2. Copy blobs between Azure storage accounts with AzCopy v10 (SAS examples).

  https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-blobs-copy Last Updated: 10/31/2025 Date Accessed: 01/26/2026

  3. azcopy_copy reference (supported authorization forms, incl. SAS for Azure Files/Blob).

  https://learn.microsoft.com/en-us/azure/storage/common/storage-ref-azcopy-copy Last Updated: Unable to determine from page excerpt Date Accessed: 01/26/2026

  Microsoft Exam Tips:

  - AZ-104 frequently tests SAS vs account keys vs Entra ID authorization. Prefer SAS for delegated, time-bound, least-privilege access.

  - Know that “No public access” means Anonymous access is invalid for Blob.

  Summary:

  AzCopy authorization for copying between Blob Storage and Azure Files; using SAS tokens for both source and destination.

  AZ-104 Exam Objective Hierarchy 2.0 Implement and manage storage (15–20%) └─ 2.1 Configure access to storage └─ 2.1.2 Create and use shared access signature (SAS) tokens

• Question 547:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  You deploy a load balancer that has the following configurations:

  1. Name: LB1 2. Type: Internal 3. SKU: Standard 4. Virtual network: VNET1

  You need to ensure that you can add VM1 and VM2 to the backend pool of LB1.

  Solution: You disassociate the public IP address from the network interface of VM2.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  --------------------------------------------------------------------------------

  Yes

  --------------------------------------------------------------------------------

  If the issue is caused by a SKU mismatch involving a Basic SKU public IP resource (VM2) in a Standard SKU load balancer design, then removing/disassociating the Basic public IP from VM2 eliminates that mismatch. After the public IP is removed, the NIC can be added to the backend pool without the Basic public IP association being a blocker.

  Why other outcomes are less aligned:

  - Keeping Basic public IP resources in a scenario where Standard SKU load balancing compatibility is being tested is a common reason the "solution" fails in these exam patterns.

  -------------------------------------------------------------------------------- References:

  1. Azure Load Balancer SKUs (Basic vs Standard concepts) https://learn.microsoft.com/en-us/azure/load-balancer/skus Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - These "Does it meet the goal?" series questions often test recognizing SKU incompatibilities.

  - A common correction is removing or replacing Basic SKU public IP usage when Standard SKU behavior is expected.

  -------------------------------------------------------------------------------- Summary:

  Disassociating the Basic public IP from VM2 resolves the likely Basic/Standard mismatch and allows adding the NICs to the Standard LB backend pool.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.3 Configure name resolution and load balancing |__ 4.3.2 Configure an internal or public load balancer

• Question 548:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates.

  You need to view the date and time when the resources were created in RG1.

  Solution: From the Subscriptions blade, you select the subscription, and then click Resource providers.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  Selecting **Resource providers** from the subscription blade shows registered providers (e.g., Microsoft.Compute, Microsoft.Storage) and registration state. It does **not** display the **date and time resources were created** in a specific resource group.

  To view when resources were created (especially those deployed by templates), you would typically use:

  - The **resource group's Deployments** history (ARM/Bicep deployments), and/or

  - The **Activity log** filtered to "Create" operations in that resource group.

  Therefore, the proposed solution does not meet the stated goal.

  Why other selections are incorrect:

  - Yes: Resource providers is the wrong area for creation timestamps; it's provider registration management, not deployment history or activity auditing.

  --------------------------------------------------------------------------------

  References:

  1. View deployment history (resource group deployments) https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deployment-history Date Modified: Unable to locate Date Accessed: 01/25/2026

  2. Azure Activity log (track create/update/delete operations) https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/activity-log Date Modified: Unable to locate Date Accessed: 01/25/2026

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - "When was it created?" usually points to **Activity log** or **Deployments**-not Resource providers.

  - Resource providers questions usually test registration (register/unregister), not auditing.

  --------------------------------------------------------------------------------

  Summary:

  Resource provider registration does not show resource creation timestamps; use deployment history or the activity log instead.

  --------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10?5%) 5.1 Monitor resources in Azure 5.1.3 Query and analyze logs in Azure Monitor

  Through activity logs, you can determine:

  1. what operations were taken on the resources in your subscription 2. who started the operation 3. when the operation occurred 4. the status of the operation 5. the values of other properties that might help you research the operation

  1. On the Azure portal menu, select Monitor, or search for and select Monitor from any page

  

  2. Select Activity Log.

  

  3. You see a summary of recent operations. A default set of filters is applied to the operations. Notice the information on the summary includes who started the action and when it happened.

  

  https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/view-activity-logs

• Question 549:

  HOTSPOT

  You have an Azure subscription named Subscription1.

  In Subscription1, you create an Azure file share named share1.

  You create a shared access signature (SAS) named SAS1 as shown in the following exhibit:

  

  To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Storage Explorer from IP 193.77.134.1 to the storage account using SAS1: will have no access

  net use from IP 193.77.134.50 to connect to share1 using SAS1 as the password: will have no access

  Why this is correct：

  Storage Explorer attempt from 193.77.134.1 fails because the SAS allows only IPs in 193.77.134.10–193.77.134.50; .1 is out of range → no access.

  The net use or SMB mount attempt fails because SAS tokens are not supported for mounting Azure file shares over SMB → no access, even though 193.77.134.50 is within the IP range.

  Why the other options are not correct：

  Any “prompted for credentials” or “read/write” outcome for the SMB mount is incorrect because SMB mounting requires supported authentication methods (account key or identity-based options), not SAS.

  Any “read/write” outcome for Storage Explorer from 193.77.134.1 is incorrect because it violates the SAS IP restriction.

  Microsoft Exam Tips

  Separate REST-based access (where SAS is common) from SMB mounting (where SAS is not supported).

  Summary

  Hot Area Tracking (delta): Attempted +1 | Correct +1 | Incorrect +0 | Skipped +0

  Mismatch/Duplicate Tracking (delta): Mismatch +0 | Duplicate +0

  AZ-104 Exam Objective Hierarchy

  2.0 Implement and manage storage (15–20%)
  
  -- 2.3 Configure Azure Files and Azure Blob Storage
  
  --2.3.1 Create and configure file shares

• Question 550:

  Your company deploys several virtual machines on-premises and to Azure. ExpressRoute is deployed and configured for on-premises to Azure connectivity.

  Several virtual machines exhibit network connectivity issues.

  You need to analyze the network traffic to identify whether packets are being allowed or denied to the virtual machines.

  Solution: Use Azure Advisor to analyze the network traffic.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  Azure Advisor provides best-practice recommendations (cost, reliability, security, operational excellence, performance). It is not a packet/flow troubleshooting tool and does not analyze network traffic to determine whether packets are allowed or denied to VMs. Therefore, it does not meet the goal. (1)

  Why "Yes" is not correct:

  - Advisor does not inspect/verify NSG rule evaluation or packet flow status.

  -------------------------------------------------------------------------------- References:

  1. Microsoft. (n.d.). Azure Advisor overview. Microsoft Learn. https://learn.microsoft.com/en-us/azure/advisor/advisor-overview Last modified: Unable to locate in tool output Date accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - Advisor = recommendations. Network Watcher = network diagnostics. Don't swap them.

  -------------------------------------------------------------------------------- Summary:

  Covers tool selection: Advisor vs Network Watcher for traffic allow/deny troubleshooting.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10?5%) | |__ 5.1 Monitor resources in Azure | |__ 5.1.6 Use Azure Network Watcher and Connection Monitor