Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 571:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an app named App1 that is installed on two Azure virtual machines named VM1 and VM2. Connections to App1 are managed by using an Azure Load Balancer.

  The effective network security configurations for VM2 are shown in the following exhibit.

  

  You discover that connections to App1 from 131.107.100.50 over TCP port 443 fail.

  You verify that the Load Balancer rules are configured correctly.

  You need to ensure that connections to App1 can be established successfully from 131.107.100.50 over TCP port 443.

  Solution: You delete the BlockAllOther443 inbound security rule.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  Yes

  ----------------------------------------------------------------------------------------------------

  The goal is to allow **131.107.100.50 --> TCP/443**.

  The effective rules show a broad deny rule (**BlockAllOther443**) that can interfere with intended access patterns. Removing that deny rule removes an unnecessary layer of restriction and allows the environment to rely on the specific allow rule(s) intended to permit the required traffic (and/or the Load Balancer path), which satisfies the goal.

  Why "No" is incorrect:

  - Removing the broad deny rule is consistent with restoring expected access to TCP/443 when the allow rules/Load Balancer configuration is correct.

  ---------------------------------------------------------------------------------------------------- References:

  1. Network security group (NSG) overview (rule processing and effective security rules) https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - "BlockAllOther443"-style rules are common culprits; removing or narrowing them can restore access.

  - Prefer **least privilege** in real deployments; in exam scenarios, focus on whether the proposed change meets the stated goal.

  ---------------------------------------------------------------------------------------------------- Summary:

  Removing an overly broad deny rule can restore the required inbound 443 connectivity.

  ----------------------------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) | |__ 4.2 Configure secure access to virtual networks | |__ 4.2.2 Evaluate effective security rules in NSGs

• Question 572:

  HOTSPOT

  You have an Azure virtual machine named VM1 and a Recovery Services vault named Vault1.

  You create a backup policy named Policy1 as shown in the exhibit. (Click the Exhibit tab.)

  

  You configure the backup of VM1 to use Policy1 on Thursday, January 1.

  You need to identify the number of available recovery points for VM1.

  How many recovery points are available on January 8 and January 15? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Policy1 configuration (from the exhibit):

  - Backup schedule: "Daily at 2:00 AM (UTC)"

  - Daily retention: "5 days"

  - Weekly retention: "Sunday at 2:00 AM for 20 weeks"

  - Backup was enabled on "Thursday, January 1".

  Key idea:

  - Daily backups generate one recovery point per scheduled run.

  - Weekly retention “keeps” (tags) the recovery point that occurs at the weekly schedule (Sunday 2:00 AM) for longer.

  - Recovery point cleanup/pruning is performed by the service cleanup cycle, so counts are evaluated at the given timestamps.

  Recovery points available on January 8 at 14:00 = 6

  - Daily recovery points visible from "Jan 3 through Jan 8" (2:00 AM each day) = 6 recovery points.

  - The weekly (Sunday) recovery point on Jan 4 is already included in those daily points (it’s the same point, just also retained as weekly), so it does not increase the count beyond the daily points visible at that time.

  Recovery points available on January 15 at 14:00 = 8

  - Daily recovery points visible from "Jan 10 through Jan 15" = 6 recovery points.

  - Weekly recovery points retained:

  - "Jan 4 (Sunday)" weekly point is still retained (20 weeks).

  - "Jan 11 (Sunday)" weekly point is also retained.

  - Total = 6 daily + 2 weekly (Jan 4, Jan 11) = "8".

  Exam Tips:

  - For “how many recovery points,” always map:

  - "Schedule frequency" (daily time)

  - "Daily retention window"

  - "Weekly/monthly retention markers" (e.g., Sunday points kept longer)

  - Weekly/monthly retention typically “promotes” specific scheduled points for longer retention.

  Summary:

  This question tests how "Azure Backup retention" (daily + weekly) impacts the number of available recovery points on specific dates.

  AZ-104 Exam Objective Hierarchy:

  3.0 - Deploy and manage Azure compute resources (20–25%) |__ 3.4 - Backup and recovery

• Question 573:

  You have an Azure subscription that contains a virtual machine named VM1.

  You have an on-premises datacenter that contains a domain controller named DC1. ExpressRoute is used to connect the on-premises datacenter to Azure.

  You need to use Connection Monitor to identify network latency between VM1 and DC1.

  What should you install on DC1?

  A. the Azure Connected Machine agent for Azure Arc-enabled servers
  B. the Azure Network Watcher Agent virtual machine extension
  C. the Log Analytics agent
  D. an Azure Monitor agent extension
  D. an Azure Monitor agent extension

  ---

  Explanation

  {------------------------------------------------------------------------------------}

  an Azure Monitor agent extension

  {------------------------------------------------------------------------------------}

  Connection Monitor relies on agent-based telemetry from monitored machines. For non-Azure machines, the supported pattern is to onboard the server (for example via Azure Arc) and install the Azure Monitor Agent so Connection Monitor can measure connectivity/latency.

  Not selected:

  - Azure Network Watcher Agent VM extension: applies to Azure VMs, not an on-prem domain controller.

  - Log Analytics agent: legacy approach; Azure Monitor Agent is the current agent for Azure Monitor-based collection scenarios.

  - Azure Connected Machine agent (Arc): onboarding prerequisite, but the monitoring collection for Connection Monitor is provided by Azure Monitor Agent.

  References:

  1. Connection Monitor (Network Watcher) with Azure Monitor Agent guidance (Arc-enabled servers) https://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor Date Modified: Unable to locate date modified Date Accessed: 01/24/2026

  Microsoft Exam Tips:

  - If the endpoint is on-prem, think "Arc + AMA" (modern), not "Network Watcher VM extension" (Azure VM only).

  Summary:

  Install Azure Monitor Agent (via supported onboarding) on on-prem DC1 to participate in Connection Monitor.

  AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10?5%) | |__ 5.1 Monitor resources in Azure | |__ 5.1.6 Use Azure Network Watcher and Connection Monitor

• Question 574:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Active Directory (Azure AD) tenant named contoso.com.

  You have a CSV file that contains the names and email addresses of 500 external users.

  You need to create a guest user account in contoso.com for each of the 500 external users.

  Solution: From Azure AD in the Azure portal, you use the Bulk invite users operation.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  --------------------------------------------------------------------------------------------

  Yes

  --------------------------------------------------------------------------------------------

  The stated goal is to create a guest user account in the Microsoft Entra tenant (contoso.com) for each of the 500 external users listed in a CSV file. The "Bulk invite users" operation in the Microsoft Entra admin center (Entra ID > Users > Bulk operations > Bulk invite) is specifically designed to send invitations to multiple external users from a CSV and add them as guest users in the directory as part of the bulk operation. After the bulk invite completes, you can verify the users exist in the directory and are of UserType "Guest" (often with a #EXT# UPN format). This directly satisfies the requirement to create guest user accounts for the external users. (1)

  Why an alternative "No" interpretation sometimes occurs: "Bulk create user" creates internal member accounts, not B2B guest invitations. However, this question's solution explicitly uses "Bulk invite users," which is the correct bulk method for creating B2B guest users from a CSV in the portal. (1)

  --------------------------------------------------------------------------------------------

  References:

  1. Microsoft. (2025, November 17). Tutorial: Bulk invite B2B collaboration users in Microsoft Entra External ID. Microsoft Learn. https://learn.microsoft.com/entra/external-id/tutorial-bulk-invite Date Accessed: 01/26/2026

  --------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - AZ-104: When the requirement is "external users" or "guest accounts," default to Microsoft Entra External Identities (B2B) patterns: invitation, redemption, and guest user lifecycle.

  - Watch the verbs: "invite" (B2B guest) vs. "create user" (member/internal). Portal bulk operations mirror this distinction.

  --------------------------------------------------------------------------------------------

  Summary:

  This question tested Microsoft Entra B2B collaboration bulk invitations (CSV-based) to create guest users at scale.

  --------------------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) | |__ 1.1 Manage Microsoft Entra users and groups | |__ 1.1.4 Manage external users

• Question 575:

  HOTSPOT

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  You have the peering options shown in the following exhibit.

  

  You need to design a communication strategy for the resources on the virtual networks.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Peering 1-2 is a possible configuration - No
  Peering 1-3 is a possible configuration - No
  Peering 3-2 is a possible configuration - No

  Virtual network peering is supported only within the same Azure cloud environment. Azure Government and Azure China are sovereign clouds that are isolated from the public Azure cloud. Because VNet1 is in Azure Government, VNet2 is in the public cloud, and VNet3 is in Azure China, none of the peering combinations shown are supported. Therefore, each proposed peering (1-2, 1-3, and 3-2) is not possible.

  Proof points:

  • Azure Government and Azure China are separate cloud environments from public Azure (isolation and segmentation).
  • Virtual network peering guidance applies to VNets within the same Azure cloud environment; cross-cloud peering is not supported.

• Question 576:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure virtual machine named VM1 that runs Windows Server 2016.

  You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour.

  Solution:

  1. You create an Azure Log Analytics workspace and configure the data settings.

  2. You install the Microsoft Monitoring Agent on VM1.

  3. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  --------------------------------------------------------------------------------

  Yes

  --------------------------------------------------------------------------------

  The requirement is to generate an alert when more than two *error* events are written to the **System** event log on VM1 within one hour.

  The proposed solution is valid because it implements the standard Azure Monitor log-alert pattern:

  1) Create a Log Analytics workspace and configure Windows Event Log collection

  - This enables collection of the Windows "System" event log into the workspace.

  2) Install the monitoring agent on VM1 (as stated in the question)

  - The agent forwards the configured Windows event logs from VM1 to the Log Analytics workspace.

  3) Create an Azure Monitor *log query* alert targeting the Log Analytics workspace

  - You can write a query that counts System log events where Level = Error over the last 60 minutes and trigger when count > 2.

  This meets the stated goal.

  --------------------------------------------------------------------------------

  References (Microsoft Learn):

  (1) Collect Windows event log data sources with Azure Monitor Logs / Log Analytics https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-sources-windows-events Date accessed: 2026-01-22 Page last updated: (see Microsoft Learn page header)

  (2) Create, view, and manage log alerts in Azure Monitor (Scheduled query rules) https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-create-log-alert-rule Date accessed: 2026-01-22 Page last updated: (see Microsoft Learn page header)

  (3) Azure Monitor agents overview (agent considerations; Microsoft Monitoring Agent vs Azure Monitor Agent) https://learn.microsoft.com/en-us/azure/azure-monitor/agents/agents-overview Date accessed: 2026-01-22 Page last updated: (see Microsoft Learn page header)

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - If the question is about "events in the Windows event log" and "alert on a count within a time window," think:

  Log Analytics + event log collection + Azure Monitor log alert (scheduled query).

  - Metric alerts and activity log alerts won't satisfy "Windows System event log" requirements; you need log-based alerting.

  - Newer implementations use Azure Monitor Agent (AMA), but many exam items still reference the legacy MMA agent. Follow the question's terminology.

  --------------------------------------------------------------------------------

  Summary:

  This question tests Azure Monitor log-based alerting for Windows event logs: collecting System events into Log Analytics and creating a scheduled query alert with a threshold over a time window.

  --------------------------------------------------------------------------------

  AZ-104 Exam Objective Alignment (Hierarchy)

  ------------------------------------------ 5.0 Monitor and maintain Azure resources (10?5%) | 5.1 Monitor resources in Azure | 5.1.4 Set up alert rules, action groups, and alert processing rules in Azure Monitor

• Question 577:

  You need to configure WebApp1 to meet the technical requirements.

  Which certificate can you use from Vault1?

  A. Cert1 only
  B. Cert1 or Cert2 only
  C. Cert1 or Cert3 only
  D. Cert3 or Cert4 only
  E. Cert1, Cert2 Cert3, or Cert4
  B. Cert1 or Cert2 only

  ---

  Explanation

  Correct Answer:

  Cert1 or Cert2 only

  The case study lists certificates in Vault1 and the technical requirements for WebApp1. Cert1 and Cert2 meet the required criteria for use with the app, while the remaining certificates do not satisfy the specified constraints.

  Proof / Reasoning:

  Case study Vault1 certificate inventory (Cert1–Cert4) and the WebApp1 technical requirements.

  Official Microsoft Learn / Azure references

  - About Azure Key Vault certificates. (n.d.). Retrieved 2026-01-31 from https://learn.microsoft.com/en-us/azure/key-vault/certificates/about-certificates

  - Use a certificate from Azure Key Vault in App Service. (n.d.). Retrieved 2026-01-31 from https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate?tabs=portal#use-a-certificate-in-azure-key-vault

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20–25%) |__3.4 Create and configure Azure App Service |__|__3.4.4 Configure certificates and Transport Layer Security (TLS) for an App Service

• Question 578:

  HOTSPOT

  You have an Azure container registry named contoso2023 as shown in the following exhibit.

  

  You need to enable contoso2023 to use a dedicated data endpoint.

  Which two settings should you configure for contoso2023? To answer, select the appropriate settings in the answer area.

  NOTE: Each correct answer is worth one point.

  

  

  ---

  Configure: Networking

  Configure: Connected registries (Preview)

  Dedicated data endpoints and related ACR networking features are configured under the registry's Networking settings. Connected registries are configured from the Connected registries blade when you need to use connected registry features that can rely on dedicated endpoints for data plane traffic patterns.

  AZ-104 Exam Objective Hierarchy (map for this question):

  3.0 Deploy and manage Azure compute resources
  └─ 3.3 Configure container workloads
    └─ 3.3.1 Configure Azure Container Registry

• Question 579:

  You have an Azure Subscription that contains the virtual networks Shown in the following table.

  

  All the virtual networks are peered. Each virtual network contains nine virtual machines.

  You need to configure secure RDP corrections to the virtual machines by using Azure Boston.

  Whit is the minimum number of Bastion nests required?

  A. 1
  B. 3
  C. 9
  D. 10
  A. 1

  ---

  Azure Bastion can be used to connect to virtual machines in peered virtual networks (including global VNet peering scenarios) when configured appropriately. Therefore, you can deploy a single Bastion host (in one VNet) and use peering to reach the VMs across the peered VNets, minimizing the number of Bastion hosts required.

  Why the other options are not correct:

  - 3 / 9 / 10: These assume Bastion must be deployed per VNet or per group of VNets, which is not required when you can leverage peering for connectivity.

  Exam Tips:

  - AZ-104: "Minimum number" often implies a hub-and-spoke approach; Bastion in a hub VNet + peering is a common pattern.

  - Always distinguish "must deploy in each VNet" vs "can reach via peering."

  Summary:

  Azure Bastion connectivity using VNet peering to minimize Bastion deployments.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking |__ 4.2 Configure secure access to virtual networks |__ 4.2.3 Implement Azure Bastion

• Question 580:

  You need to delegate to a user the ability to create Azure RBAC role assignments at the resource group scope.

  The user must not be able to create or modify resources in that resource group.

  A. Owner
  B. User Access Administrator
  C. Contributor
  D. Reader
  B. User Access Administrator

  ---

  Explanation

  --------------------------------------------------------------------------------

  User Access Administrator

  --------------------------------------------------------------------------------

  This replacement question tests delegating Azure RBAC role assignment capability with least privilege. The **User Access Administrator** role is designed to manage access to Azure resources, including creating and removing role assignments at the assigned scope. It enables role assignment management without granting broad resource management permissions.

  Why other selections are not correct:

  - Owner: Can assign roles, but is broader than required because it also grants full management rights over resources.

  - Contributor: Can manage resources, but does not provide the intended "manage access" capability as its primary purpose; role assignment management is not the least-privilege fit.

  - Reader: View-only; cannot create role assignments.

  -------------------------------------------------------------------------------- References:

  1. Azure built-in roles - User Access Administrator https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles#user-access-administrator Modified: Unable to locate date modified Date Access: 01/24/2026

  2. Assign Azure roles using the Azure portal (roleAssignments permissions context) https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal Modified: Unable to locate date modified Date Access: 01/24/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - For "grant ability to assign roles," the common built-ins are **Owner** and **User Access Administrator**; least privilege is often **User Access Administrator**.

  - Distinguish "manage resources" (Contributor) from "manage access" (User Access Administrator).

  -------------------------------------------------------------------------------- Summary:

  Delegating RBAC role assignment capability with least privilege.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.2 Manage access to Azure resources |__ 1.2.1 Manage built-in Azure roles