Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 561:

  HOTSPOT

  You have an Azure virtual machine mat runs Windows Server 2019 and has the following configurations:

  * Name:VM1

  * Location: Welt US

  * Connected to: VNfT1

  * Private IP address: 10.1.0.4

  * Public IP address: 52 18685.63

  * DNS suffix m Windows Server.Adatum.com

  You create the Azure DNS zones shown in the following table.

  

  

  

  ---

  Answer Area:

  {Dropdown 1} (DNS zones that you can link to VNET1): The private zones only

  {Dropdown 2} (DNS zones to which VM1 can automatically register): Adatum.pri only

  Explanation (Why this is correct)

  - **VNet links** apply to **Private DNS zones** (not Public DNS zones), so only the private zones are linkable.

  - **Auto-registration** can be enabled such that VM records are automatically registered in a private DNS zone, but a **VNet can be linked with auto-registration enabled to only one private DNS zone**.

  - Therefore:

  - Linkable zones = the private zones.

  - Auto-register = only one private zone (Adatum.pri, per the prompt’s intended selection).

  Explanation (Why the other options are not correct)

  - Any option including public zones is incorrect because public DNS zones do not use VNet linking.

  - Any option listing both private zones for auto-registration is incorrect due to the one-auto-registration-zone-per-VNet limitation.

  References (APA; full URL)

  - Microsoft Learn. (n.d.). Azure Private DNS auto-registration. Last updated: Unable to locate on page. https://learn.microsoft.com/en-us/azure/dns/private-dns-autoregistration Date accessed: 2026-01-27.

  - Microsoft Learn. (n.d.). Virtual network links for Azure Private DNS. Last updated: Unable to locate on page. https://learn.microsoft.com/en-us/azure/dns/private-dns-virtual-network-links Date accessed: 2026-01-27.

  Microsoft Exam Tips

  - Don’t mix up **Public DNS** (internet) with **Private DNS** (VNet-linked). Only Private DNS supports VNet linking + auto-registration.

  Summary

  - Hot Area Tracking (delta): Attempted +1 | Correct +1 | Incorrect +0 | Skipped +0

  - Mismatch/Duplicate Tracking (delta): Mismatch +0 | Duplicate +0

  AZ-104 Exam Objective Hierarchy 4.0 Implement and manage virtual networking (20–25%) └─ 4.3 Configure name resolution └─ 4.3.1 Configure Azure DNS

• Question 562:

  You have an Azure subscription that contains a storage account named storage1.

  You need to allow access to storage1 from selected networks and your home office. The solution must minimize administrative effort.

  What should you do first for storage1?

  A. Add a private endpoint.
  B. Modify the Public network access settings.
  C. Select Internet routing.
  D. Modify the Access Control (IAM) settings.
  B. Modify the Public network access settings.

  ---

  Modify the Public network access settings.

  To allow access only from selected networks and a home office (specific public IP ranges) with minimal effort, you start by setting the storage account's Public network access to allow access from selected virtual networks and IP addresses, then add the specific VNets/subnets and the home office IP(s). That directly implements "selected networks" filtering.

  Why other selections are not correct:

  - Add a private endpoint: is valid for private-only access, but it's more involved and doesn't directly address "home office" unless the home office is also connected via VPN/ExpressRoute and DNS is configured.

  - Select Internet routing: not the control used to restrict storage access.

  - Modify IAM settings: authorization is separate from network-level allow/deny controls.

  Microsoft Exam Tips:

  - Storage access is enforced by BOTH: (1) network rules and (2) identity/authorization. Read questions carefully to see which layer is being asked.

  Summary:

  - Storage account network access controls (firewall/VNet rules)

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage |__ 2.1 Configure access to storage |__ 2.1.1 Configure Azure Storage firewalls and virtual networks

• Question 563:

  You have an Azure subscription that contains the resources shown in the following table.

  

  The Not allowed resource types Azure policy is assigned to RG1 and uses the following parameters:

  1. Microsoft.Network/virtualNetworks 2. Microsoft.Compute/virtualMachines

  In RG1, you need to create a new virtual machine named VM2, and then connect VM2 to VNET1.

  What should you do first?

  A. Remove Microsoft.Network/virtualNetworks from the policy.
  B. Create an Azure Resource Manager template.
  C. Remove Microsoft.Compute/virtualMachines from the policy.
  D. Add a subnet to VNET1.
  C. Remove Microsoft.Compute/virtualMachines from the policy.

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  Remove Microsoft.Compute/virtualMachines from the policy.

  ----------------------------------------------------------------------------------------------------

  The policy blocks creation of both virtual networks and virtual machines in RG1. You already have VNET1, and you need to create VM2 and connect it to VNET1. Therefore, the first step is to allow VM creation by removing Microsoft.Compute/ virtualMachines from the "not allowed resource types" policy assignment/parameters. You do not need to allow new VNets.

  Why the other selections are not correct:

  - Remove Microsoft.Network/virtualNetworks from the policy:

  This would allow creating new VNets, but your immediate blocker is VM creation (VM2).

  - Create an Azure Resource Manager template:

  A template deployment would still be denied by the policy.

  - Add a subnet to VNET1:

  A subnet does not resolve the policy restriction that prevents VM creation.

  References:

  1. Azure Policy overview https://learn.microsoft.com/en-us/azure/governance/policy/overview Date Modified: Unable to locate date modified Date Access: 01/24/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - If a policy denies a resource type, any deployment method (portal, CLI, PowerShell, ARM/Bicep) is still denied.

  - Read the "resource type" carefully (AZ-104).

  Summary:

  Resolving an Azure Policy restriction that blocks VM creation.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) | |__ 1.3 Manage Azure subscriptions and governance | |__ 1.3.1 Implement and manage Azure Policy

• Question 564:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant.

  You need to create a conditional access policy that requires all users to use multi-factor authentication when they access the Azure portal.

  Which three settings should you configure? To answer, select the appropriate settings in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  - Users and groups

  - Cloud apps

  - Grant

  Explanation (Why this is correct)

  - To require MFA for Azure portal access, you must:

  - Scope who it applies to (**Users and groups**),

  - Scope what app it applies to (**Cloud apps** --> Microsoft Azure Management / Azure portal),

  - Enforce MFA via **Access controls --> Grant** (Require multi-factor authentication).

  Explanation (Why the other options are incorrect)

  - Conditions are optional constraints (device/platform/location) and are not required to enforce MFA broadly.

  - Session controls are not required to mandate MFA.

  References (APA)

  - Microsoft. (n.d.). Plan a Conditional Access deployment. Retrieved January 27, 2026, from https://learn.microsoft.com/en-us/entra/identity/conditional-access/plan-conditional-access

  Exam Tip

  - Conditional Access always boils down to: **Assignments (who/what)** + **Access controls (grant)**.

  AZ-104 Exam Objective Hierarchy 1.0 Manage Azure identities and governance (20–25%)

• Question 565:

  You have an Azure Active Directory (Azure AD) tenant named adatum.com that contains the users shown in the following table.

  

  Adatum.com has the following configurations:

  1. Users may join devices to Azure AD is set to User1.

  2. Additional local administrators on Azure AD joined devices is set to None.

  You deploy Windows 10 to a computer named Computer1. User1 joins Computer1 to adatum.com.

  You need to identify the local Administrator group membership on Computer1.

  Which users are members of the local Administrators group?

  A. User1 only
  B. User1, User2, and User3 only
  C. User1 and User2 only
  D. User1, User2, User3, and User4
  E. User2 only
  C. User1 and User2 only

  ---

  Explanation

  --------------------------------------------------------------------------------

  User1 and User2 only

  --------------------------------------------------------------------------------

  On a Microsoft Entra (Azure AD) joined Windows device, Microsoft Entra ID updates the local Administrators group during the join operation.

  In this scenario:

  - "Users may join devices to Azure AD" is set to User1, so User1 is allowed to perform the join.

  - "Additional local administrators on Azure AD joined devices" is set to None, meaning you are not granting any *extra* users local admin rights via that setting.

  - During the join operation, two relevant principals are added to the local Administrators group:

  1) The user performing the join (User1).

  2) The Global Administrator role (User2, because User2 is a Global administrator).

  Other directory roles shown (Cloud device administrator, Intune administrator) are not automatically added to the device's local Administrators group by default solely because of those roles.

  Therefore, the local Administrators group membership (from the listed users) is:

  - User1 (performed the join)

  - User2 (Global administrator)

  --------------------------------------------------------------------------------

  References (Microsoft Learn):

  1) How to manage the local administrators group on Microsoft Entra joined devices

  - Link: https://learn.microsoft.com/en-us/entra/identity/devices/assign-local-admin

  - Date accessed: 2026-01-22

  - Page last updated: 2025-06-27

  2) Manage devices in Microsoft Entra ID using the Microsoft Entra admin center (device settings context)

  - Link: https://learn.microsoft.com/en-us/entra/identity/devices/manage-device-identities

  - Date accessed: 2026-01-22

  - Page last updated: 2025-06-27

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - Distinguish between:

  - "User performing the Entra join" (typically becomes local admin by default at join time), and

  - "Additional local administrators..." (a tenant setting to grant device-local admin rights more broadly).

  - Principle of least privilege:

  - Avoid relying on Global Administrator for routine device administration.

  - Prefer the "Microsoft Entra Joined Device Local Administrator" role (or scoped methods like Intune/Account Protection policies) where appropriate.

  - Watch for wording: questions often test what happens "during join" vs "after join" (changes later may require different mechanisms).

  --------------------------------------------------------------------------------

  Summary:

  This question tests Microsoft Entra join behavior and default local Administrators group membership on an Entra-joined Windows device, including the impact of the Global Administrator role and the "Additional local administrators" device setting.

  --------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) 1.1 Manage Microsoft Entra users and groups 1.1.2 Manage user and group properties

• Question 566:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the resources shown in the following table.

  

  VM1 connects to VNET1.

  You need to connect VM1 to VNET2.

  Solution: You turn off VM1, and then you add a new network interface to VM1.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  No

  ----------------------------------------------------------------------------------------------------

  A VM's network interfaces must be in the same location (region) as the VM, and NICs attached to a VM must be connected to the same virtual network. You cannot attach a NIC that connects the VM directly into a different VNet in another region. To enable communication between VNets, you would use options such as (global) VNet peering, VPN gateway, or other inter-VNet connectivity-not by adding a NIC to a second VNet. :contentReference[oaicite:24]{index=24}

  Why the other selection is not correct:

  - Yes:

  Adding a NIC does not allow connecting a VM to a different-region VNet as described; Azure enforces region/VNet constraints on NIC attachment.

  References:

  1. Virtual network overview (NIC location constraints) https://learn.microsoft.com/en-us/azure/virtual-network/network-overview Date Modified: 04/15/2025 :contentReference[oaicite:25]{index=25} Date Access: 01/24/2026 2. Add network interfaces to or remove from Azure VMs (NICs must be connected to the same virtual network) https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-network-interface-vm Date Modified: 10/08/2025 :contentReference[oaicite:26]{index=26} Date Access: 01/24/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - A VM can have multiple NICs, but Azure enforces constraints (same region; typically same VNet).

  - "Connect VM to another VNet/region" usually points to VNet peering or gateways, not extra NICs.

  Summary:

  The proposed solution violates Azure NIC/VNet constraints and does not connect the VM to the second VNet.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) | |__ 4.1 Configure and manage virtual networks in Azure | |__ 4.1.2 Create and configure virtual network peering

• Question 567:

  HOTSPOT

  You have an Azure subscription. The subscription contains a storage account named storage1 that has the lifecycle management rules shown in the following table.

  

  On June 1, you store two blobs in storage1 as shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Scenario: Evaluate Blob lifecycle rules and determine which statements are true on specific dates (June 6, June 7, June 16).

  Selected value On June 6, File1 will be stored in the Cool access tier. No

  On June 7, File2 will be stored in the Cool access tier. Yes

  On June 16, File2 will be stored in the Archive access tier. No

  Lifecycle conditions use “daysAfter…GreaterThan” semantics (i.e., ‘more than N days’), so a 5-day rule does not trigger exactly on day 5 but after it has been exceeded.

  Rule2 (all blobs, >5 days since last modification) is the earliest applicable action for File2, so File2 can transition to Cool around June 7.

  Archive at >15 days for container2 requires exceeding 15 days; June 16 is not beyond 15 full days from June 1, so the Archive transition is not yet guaranteed on June 16.

  Watch for “greater than” vs “greater than or equal to” wording in lifecycle conditions; Azure uses ‘greater than’.

  If multiple rules apply, the earliest threshold action typically happens first; later thresholds won’t apply until their conditions are met.

  |__2.0 Implement and manage storage (15–20%) |__2.3 Configure Azure Files and Azure Blob Storage |__|__2.3.6 Configure blob lifecycle management

• Question 568:

  You have an Azure subscription named Subscription1 that contains two Azure virtual networks named VNet1 and VNet2. VNet1 contains a VPN gateway named VPNGW1 that uses static routing. There is a site-to-site VPN connection between your on-premises network and VNet1.

  On a computer named Client1 that runs Windows 10, you configure a point-to-site VPN connection to VNet1.

  You configure virtual network peering between VNet1 and VNet2. You verify that you can connect to VNet2 from the on-premises network. Client1 is unable to connect to VNet2.

  You need to ensure that you can connect Client1 to VNet2.

  What should you do?

  A. Select Use the remote virtual network's gateway or Route Server on VNet1 to VNet2 peering.
  B. Select Use the remote virtual network s gateway or Route Server on VNet2 to VNet1 peering.
  C. Download and re-install the VPN client configuration package on Client1.
  D. Enable BGP on VPNGW1.
  C. Download and re-install the VPN client configuration package on Client1.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Download and re-install the VPN client configuration package on Client1.

  --------------------------------------------------------------------------------

  Client1 uses a **point-to-site (P2S)** VPN into **VNet1**, and VNet1 is peered with VNet2. After peering changes (and/or enabling gateway-related peering settings), P2S clients may not automatically receive updated route information to additional address spaces (such as the peered VNet). A common remediation is to **download and reinstall the updated VPN client configuration package**, which refreshes routes and configuration so Client1 can reach VNet2 through the established connectivity.

  Why other selections are incorrect:

  - Select Use the remote virtual network's gateway or Route Server on VNet1 to VNet2 peering.: This is not the correct direction; VNet1 hosts the gateway and typically "allows gateway transit," while the other VNet uses the remote gateway.

  - Select Use the remote virtual network's gateway or Route Server on VNet2 to VNet1 peering.: This setting can be relevant in some gateway-transit designs, but the question states on-premises connectivity to VNet2 already works (indicating peering/gateway transit is effectively working). The remaining issue is the P2S client configuration/routing.

  - Enable BGP on VPNGW1.: The VPN gateway uses static routing per the stem; enabling BGP is not the primary fix for a P2S client that needs updated routes.

  --------------------------------------------------------------------------------

  References:

  1. About point-to-site VPN (P2S) - client configuration and downloading VPN client package https://learn.microsoft.com/en-us/azure/vpn-gateway/point-to-site-about Date Modified: Unable to locate Date Accessed: 01/25/2026

  2. Virtual network peering - gateway transit concepts https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview Date Modified: Unable to locate Date Accessed: 01/25/2026

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - When a P2S client cannot reach newly connected address spaces, "re-download/reinstall the VPN client package" is a common exam-safe fix.

  - For gateway transit, remember the typical pattern: gateway VNet "allows gateway transit," and the peered VNet "uses remote gateways."

  --------------------------------------------------------------------------------

  Summary:

  P2S client connectivity often requires refreshing the client configuration package after routing/peering changes so the client receives the correct routes.

  --------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) 4.1 Configure and manage virtual networks in Azure 4.1.2 Create and configure virtual network peering

• Question 569:

  DRAG DROP

  You have an Azure subscription that contains a storage account.

  You have an on-premises server named Server1 that runs Windows Server 2016. Server1 has 2 TB of data.

  You need to transfer the data to the storage account by using the Azure Import/Export service.

  In which order should you perform the actions? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.

  NOTE: More than one order of answer choices is correct. You will receive credit for any of the correct orders you select.

  Select and Place:

  

  

  ---

  Step 1: Attach an external disk to Server1 and then run waimportexport.exe

  Step 2: From the Azure portal, create an import job.

  Step 3: Detach the external disks from Server1 and ship the disks to an Azure data center.

  Step 4: From the Azure portal, update the import job.

  Explanation:

  This is the Azure Import/Export workflow for importing large amounts of data into an Azure Storage account by shipping physical disks.

  Why the steps are correct (and why order matters):

  Step 1: Attach an external disk to Server1 and then run waimportexport.exe

  - You must prep the drive before shipping. The Import/Export tool (waimportexport.exe) is used to generate the required drive metadata/journal (and typically encrypt the drive) so Azure can ingest the data correctly once it arrives.

  Step 2: From the Azure portal, create an import job.

  - The import job is created in the portal using the information produced by the tool (e.g., the journal/drive details). This job tells Azure what storage account to import into and establishes the job tracking.

  Step 3: Detach the external disks from Server1 and ship the disks to an Azure data center.

  - After the drives are prepared and the job exists, you physically ship the disks to the designated Azure datacenter address provided for the job.

  Step 4: From the Azure portal, update the import job.

  - After shipment, you update the import job (commonly to add/confirm shipping/tracking details and finalize logistics), enabling Azure to receive and process the drives under the correct job.

  Why the other ordering would be incorrect:

  - Creating an import job before preparing the disks/journal can block you from supplying the correct job inputs.

  - Shipping disks before the job exists or before the disks are prepared risks delays or a failed import due to missing job metadata.

  References:

  1. Microsoft Learn. Use the Azure Import/Export service to import data to Azure Blob storage.

  https://learn.microsoft.com/en-us/azure/import-export/storage-import-export-service Last updated: Unable to locate on page. Date Accessed: 01/26/2026.

  2. Microsoft Learn. Prepare drives for an import job (Azure Import/Export) using WAImportExport.

  https://learn.microsoft.com/en-us/azure/import-export/storage-import-export-tool Last updated: Unable to locate on page. Date Accessed: 01/26/2026.

  Microsoft Exam Tips:

  - If you see “Import/Export” + “ship disks,” memorize the flow: run WAImportExport --> create import job --> ship disks --> update job (tracking/details).

  - Import/Export is used when network transfer is too slow or impractical for large datasets.

  Summary:

  This question covered the correct sequence for using Azure Import/Export to move large on-premises datasets into an Azure Storage account by preparing external disks, creating an import job, shipping the disks, and updating the job details.

  AZ-104 Exam Objective Hierarchy:

  2.0 - Implement and manage storage (15–20%) |__ 2.2 - Configure and manage storage accounts |__ 2.2.5 - Manage data by using Azure Storage Explorer and AzCopy

• Question 570:

  You have an Azure Active Directory (Azure AD) tenant named contoso.com.

  You have a CSV file that contains the names and email addresses of 500 external users.

  You need to create a guest user account in contoso.com for each of the 500 external users.

  Solution: You create a PowerShell script that runs the New-AzureADMSInvitation cmdlet for each external user.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Yes

  New-AzureADMSInvitation is used to invite external users as guest accounts into an Azure AD (Microsoft Entra ID) tenant.

  Running a PowerShell script that executes New-AzureADMSInvitation for each user in the CSV file will create a guest user account in contoso.com for all 500 external users.

  This meets the goal because:

  The cmdlet creates B2B guest users.
  
  It supports bulk automation through scripting.
  
  A CSV-driven loop is a standard approach for large user onboarding scenarios.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20–25%)
  |__ 1.1 Manage Microsoft Entra users and groups
  |__ 1.1.4 Manage external users