Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 581:

  HOTSPOT

  You are evaluating the connectivity between the virtual machines after the planned implementation of the Azure networking infrastructure.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  

  

  ---

  Answer (Yes/No) The virtual machines on Subnet1 will be able to connect to the virtual machines on Subnet3.

  Yes

  The virtual machines on ClientSubnet will be able to connect to the Internet.

  Yes

  The virtual machines on Subnet3 and Subnet4 will be able to connect to the Internet.

  Yes

  Explanation / Proof:

  Virtual network peering enables private connectivity between VNets over the Microsoft backbone. Subnet/VM internet access depends on the presence of an egress path (for example, NAT Gateway/Azure Firewall/route configuration) in the design; when such egress is configured, subnets can reach the Internet while maintaining internal connectivity.

  References (APA; last updated + accessed):

  Azure Virtual Network Peering. (Last updated 2025-07-17). Retrieved 2026-01-31 from https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

  AZ-104 Exam Objective Hierarchy (branch path):

  4.0 Implement and manage virtual networking |__4.1 Configure virtual networks |__|__4.1.3 Configure virtual network peering |__4.2 Configure secure access to virtual networks |__|__4.2.4 Configure Network Address Translation (NAT)

• Question 582:

  You have an Azure subscription that contains 10 virtual machines on a virtual network.

  You need to create a graph visualization to display the traffic flow between the virtual machines.

  What should you do from Azure Monitor?

  A. From Activity log, use quick insights.
  B. From Metrics, create a chart.
  C. From Logs, create a new query.
  D. From Workbooks, create a workbook.
  C. From Logs, create a new query.

  ---

  Explanation

  --------------------------------------------------------------------------------

  From Logs, create a new query.

  --------------------------------------------------------------------------------

  Azure Monitor Logs (Log Analytics) is the appropriate place to query and shape telemetry data (for example, flow logs/connection telemetry) and then visualize it. Creating a query from Logs is the "data retrieval and shaping" step that enables charting/graph visualization of traffic patterns.

  Why the other choices are not correct:

  - From Activity log, use quick insights:

  Activity Log is for control-plane events (create/update/delete), not VM-to-VM traffic flows.

  - From Metrics, create a chart:

  Metrics are time-series numeric data; they are not well-suited to "traffic flow between VMs" visualization that depends on connection/flow records.

  - From Workbooks, create a workbook:

  Workbooks are excellent for dashboards, but you still need the underlying Logs query to produce the traffic-flow dataset.

  -------------------------------------------------------------------------------- References:

  1. Microsoft. (n.d.). Azure Monitor Logs overview. https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-query-overview Date Modified: Unable to locate date modified Date Accessed: 01/25/2026 2. Microsoft. (2025, July 10). Use a Notebook and Kqlmagic to analyze data in Azure Data Explorer (includes KQL render/visualization patterns). https://learn.microsoft.com/en-us/azure/data-explorer/kqlmagic Date Modified: 07/10/2025 Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: For "flow/traffic" style questions, first decide whether you need control-plane logs (Activity Log) or data-plane telemetry (Logs).

  - If the answer mentions "graph visualization," verify that the option provides the query layer (Logs) or the dashboard layer (Workbooks).

  -------------------------------------------------------------------------------- Summary:

  Using Azure Monitor Logs to query traffic/flow telemetry as the basis for graph/visualizations.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10?5%) |__ 5.1 Monitor resources in Azure |__ 5.1.3 Query and analyze logs in Azure Monitor

• Question 583:

  You need to identify which storage account to use for the flow logging of IP traffic from VM5. The solution must meet the retention requirements.

  Which storage account should you identify?

  A. storage4
  B. storage1
  C. storage2
  D. storage3
  C. storage2

  ---

  Explanation

  For at least two reasons, storage2 is the only candidate:

  - Location: The storage account used must be in the same region as the NSG.

  - Retention is available only if you use General Purpose v2 Storage accounts (GPv2).

  https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-nsg-flow-logging-overview

• Question 584:

  HOTSPOT

  You have an Azure subscription named Subscription1 that contains the resources in the following table.

  

  VM1 and VM2 run the websites in the following table.

  

  AppGW1 has the backend pools in the following table.

  

  DNS resolves site1.contoso.com, site2.contoso.com, and site3.contoso.com to the IP address of AppGW1.

  AppGW1 has the listeners in the following table.

  

  AppGW1 has the rules in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Requests to site1.contoso.com directed to VM1: No Requests to site2.contoso.com directed to VM1: Yes Requests to site3.contoso.com directed to VM1: No

  Explanation (Why this is correct)

  - Hostname-based routing depends on the listener’s hostname and the rule that maps that listener to a backend pool.

  - site2 has a listener/rule path to the backend pool that contains VM1, so it routes to VM1.

  - site1 has no rule path to VM1, and site3 is routed via a different listener/rule to a pool that is not VM1.

  Explanation (Why the other options are not correct)

  - If a listener/rule maps to a different backend pool, it won’t reach VM1.

  Exam Tip

  - App Gateway = **Listener (host) --> Rule --> Backend pool**. Trace that chain.

  References (APA)

  - Microsoft. (n.d.). Application Gateway components. https://learn.microsoft.com/en-us/azure/application-gateway/configuration-overview

  AZ-104 Exam Objective Hierarchy 4.0 Implement and manage virtual networking (15–20%) |__4.3 Configure name resolution and load balancing |__|__4.3.2 Configure load balancing

• Question 585:

  You have an Azure subscription. You need to transfer 34TB of data from an on-premise Windows 2016 server to your Azure storage account. You need to ensure that the data transfer has zero impact on the network, preserves your existing drives and is the fastest and most secure method.

  What should be your first step?

  A. Start an Import Job via the Azure Portal
  B. Order an Azure Databox via the Azure Portal
  C. Open a ticket with Microsoft Support
  D. Prepare your hard drives using the WAImportExport tool
  B. Order an Azure Databox via the Azure Portal

  ---

  Explanation

  --------------------------------------------------------------------------------

  Order an Azure Databox via the Azure Portal

  --------------------------------------------------------------------------------

  You must transfer 34 TB from on-premises to an Azure Storage account with **zero impact to the network**, while **preserving existing drives**, and using the **fastest/most secure** method.

  - **Azure Data Box** is purpose-built for large offline transfers: Microsoft ships you a tamper-resistant device, you copy the data locally (no WAN usage), and ship it back for ingestion into your storage account. This meets "zero network impact" and is generally faster and more operationally straightforward than shipping your own drives (1).

  - Therefore, the best "first step" is to **order the Azure Data Box in the Azure portal** so Microsoft can ship the appliance and generate the job details.

  Why the other options are not correct:

  - Start an Import Job via the Azure Portal: Import/Export requires you to ship your own drives; it does not align as well with "preserves your existing drives" and "fastest" compared to Data Box for this size.

  - Open a ticket with Microsoft Support: Not required to begin Data Box; ordering is self-service.

  - Prepare your hard drives using the WAImportExport tool: This is for Import/Export (shipping your drives), not the Data Box device workflow.

  -------------------------------------------------------------------------------- References:

  1. Azure Data Box Disk FAQ (ordering and portal workflow concepts apply to Data Box family) https://learn.microsoft.com/en-us/azure/databox/data-box-disk-faq Date Modified: 03/24/2025 Date Accessed: 01/25/2026

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - For multi-terabyte migrations with "no network impact," think **Data Box/Data Box Heavy** first.

  - Import/Export is "ship your drives"; Data Box is "Microsoft ships the device."

  - AZ-104 commonly tests selecting the right migration method based on size/time/network constraints.

  -------------------------------------------------------------------------------- Summary:

  Select Azure Data Box for large offline data transfer to Azure Storage with no WAN impact.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15?0%) | |__ 2.2 Configure and manage storage accounts | |__ 2.2.5 Manage data by using Azure Storage Explorer and AzCopy

• Question 586:

  Your company has three offices. The offices are located in Miami, Los Angeles, and New York. Each office contains datacenter.

  You have an Azure subscription that contains resources in the East US and West US Azure regions. Each region contains a virtual network. The virtual networks are peered.

  You need to connect the datacenters to the subscription. The solution must minimize network latency between the datacenters.

  What should you create?

  A. three virtual WANs and one virtual hub
  B. three virtual hubs and one virtual WAN
  C. three On-premises data gateways and one Azure Application Gateway
  D. three Azure Application Gateways and one On-premises data gateway
  B. three virtual hubs and one virtual WAN

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  three virtual hubs and one virtual WAN

  ----------------------------------------------------------------------------------------------------

  Azure Virtual WAN is a managed hub-and-spoke connectivity service. A virtual WAN provides the global construct, and virtual hubs (deployed per region) provide the transit/termination points for branches/sites to connect using VPN/ ExpressRoute. Using multiple virtual hubs helps place each office's connectivity into the closest hub region to minimize latency and also supports optimized any-to-any connectivity between sites through the Virtual WAN fabric.

  Why the other selections are not correct:

  - three virtual WANs and one virtual hub:

  Virtual WAN is the global container; hubs are deployed into regions. This reverses the intended architecture.

  - three on-premises data gateways and one Azure Application Gateway:

  Application Gateway is for inbound HTTP(S) load balancing; it is not the solution for site-to-site enterprise WAN connectivity.

  - three Azure Application Gateways and one on-premises data gateway:

  Same issue: Application Gateway is not for connecting datacenters/branches to Azure VNets.

  References:

  1. What is Azure Virtual WAN?

  https://learn.microsoft.com/en-us/azure/virtual-wan/virtual-wan-about Date Modified: Unable to locate date modified Date Access: 01/24/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - "Connect multiple offices/datacenters and minimize latency" commonly points to Virtual WAN + regional hubs.

  - Don't confuse inbound web traffic components (Application Gateway) with site connectivity components (VPN/ExpressRoute/Virtual WAN).

  Summary:

  Designing low-latency multi-site connectivity to Azure using Virtual WAN architecture.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) | |__ 4.1 Configure and manage virtual networks in Azure | |__ 4.1.5 Troubleshoot network connectivity

• Question 587:

  HOTSPOT

  You have a hybrid deployment of Azure Active Directory (Azure AD) that contains the users shown in the following table.

  

  You need to modify the JobTitle and UsageLocation attributes for the users.

  For which users can you modify the attributes from Azure AD? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  JobTitle can be modified for: User1 and User3 only
  
  UsageLocation can be modified for: User1, User2, and User3

  Why these answers are correct:

  • For synced (hybrid) users, many profile attributes are mastered on-premises and are read-only in Azure AD (for example, JobTitle).
  • UsageLocation is commonly editable in Azure AD because it is required for licensing and is treated as a cloud-managed property.
  • Cloud-only users (User1) and guest users (User3) can have properties such as JobTitle edited in Azure AD.

  Why the other options are not correct:

  • Including the synced user for JobTitle contradicts directory mastering rules.

  Exam Tips:

  • Hybrid rule of thumb: if it is synced from on-premises, you often cannot edit it in Azure AD - except for certain cloud-managed fields such as UsageLocation.

  AZ-104 Exam Objective Hierarchy
  
  1.0 Manage Azure identities and governance (20–25%)
  
  └── 1.1 Manage Microsoft Entra users and groups
  
    └── 1.1.2 Manage user and group properties

• Question 588:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You deploy an Azure Kubernetes Service (AKS) cluster named AKS1.

  You need to deploy a YAML file to AKS1.

  Solution: From the Azure CLI, you run the kubectl client.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  --------------------------------------------------------------------------------

  Yes

  --------------------------------------------------------------------------------

  Why "Yes" is correct:

  - The goal is: "deploy a YAML file to AKS1."

  - The proposed solution says: "From the Azure CLI, you run the kubectl client."

  - kubectl is the standard Kubernetes CLI used to apply manifests. Once kubectl is configured to talk to the AKS cluster (credentials/context), deploying YAML is done with kubectl apply -f <manifest>. Because the solution explicitly uses kubectl (the correct tool for applying YAML), it meets the goal. (1)

  Why the other choice is incorrect:

  - No "No" would only be correct if the solution used a tool that does not apply manifests (for example, azcopy) or if it omitted kubectl entirely.

  References:

  1. Quickstart: Deploy an Azure Kubernetes Service (AKS) cluster using Azure PowerShell (shows deploying via kubectl apply -f) https://learn.microsoft.com/en-us/azure/aks/learn/quick-kubernetes-deploy-powershell Date Modified: Unable to locate date modified (page returned an authorization notice in this view) Date Accessed: 01/25/2026

  Microsoft Exam Tips:

  - If you see "deploy YAML to AKS," the fastest mental match is "kubectl apply -f".

  Summary:

  - Using kubectl is the correct mechanism to deploy Kubernetes YAML manifests to AKS.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.3 Provision and manage containers in the Azure portal

• Question 589:

  You have an Azure subscription that contains 10 virtual machines and the resources shown in the following table.

  

  You need to ensure that Bastion1 can support 100 concurrent SSH users. The solution must minimize administrative effort.

  What should you do first?

  A. Resize the subnet of Bastion1
  B. Configure host scaling.
  C. Create a network security group (NSG)
  D. Upgrade Bastion1 to the Standard SKU
  D. Upgrade Bastion1 to the Standard SKU

  ---

  Explanation

  --------------------------------------------------------------------------------

  Upgrade Bastion1 to the Standard SKU

  --------------------------------------------------------------------------------

  Azure Bastion **Standard** supports host scaling and higher concurrency planning versus Basic. To meet the requirement of **100 concurrent SSH users** with minimal administrative effort, the first step is to upgrade from **Basic** to

  **Standard** so scaling/capacity options are available to reach that concurrency target.

  Why other selections are not correct:

  - Resize the subnet: Subnet sizing is important for Bastion deployment, but it doesn't directly provide the concurrency/capacity increase required here.

  - Configure host scaling: Host scaling is a Standard/Premium capability; you typically must be on the correct SKU to use it as intended.

  - Create an NSG: NSGs don't increase Bastion concurrency capacity.

  -------------------------------------------------------------------------------- References:

  1. About Azure Bastion configuration settings (instances/host scaling context) https://learn.microsoft.com/en-us/azure/bastion/configuration-settings Modified: 12/19/2025 Date Access: 01/24/2026

  2. Choose the right Azure Bastion SKU to meet your needs https://learn.microsoft.com/en-us/azure/bastion/bastion-sku-comparison Modified: 12/19/2025 Date Access: 01/24/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - If the requirement mentions "many concurrent sessions," look for **Standard** (host scaling) vs **Basic** limitations.

  - "Do first" questions often test the prerequisite step (SKU upgrade) before configuration (scaling).

  -------------------------------------------------------------------------------- Summary:

  Selecting the correct Azure Bastion SKU to support high concurrent SSH demand.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.2 Configure secure access to virtual networks |__ 4.2.3 Implement Azure Bastion

• Question 590:

  HOTSPOT

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  The subscription contains a storage account named contoso2024 as shown in the following exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  

  

  ---

  VM1 can connect to contoso2024 by using 131.107.10.10 - Yes VM2 can connect to contoso2024 by using 150.120.10.10 - Yes VM3 must use its private IP address to connect to contoso2024 - No

  The storage account is configured for public network access from selected virtual networks and IP addresses. When a VM’s outbound public IP is explicitly allowed in the storage account firewall rules, that VM can reach the storage account’s public endpoint. In the exhibit, the public IPs 131.107.10.10 and 150.120.10.10 are included in the allowed IP list, so VM1 and VM2 can connect using those IPs. VM3’s public IP is also listed, so it is not required to use its private IP address;

  therefore the 'must use private IP' statement is false.

  Proof points:

  Azure Storage firewall rules can allow access from specific public IP ranges and from selected virtual networks (service endpoints).

  If a client’s public IP is in the allowed list, requests to the storage account public endpoint are permitted; otherwise they are denied.

  Microsoft. (n.d.). *Azure Storage firewall and virtual network rules*. Retrieved January 30, 2026, from https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security

  <pdf2txt-u>2.0 Implement and manage storage (15–20%)</pdf2txt-u> <pdf2txt-u>|__2.1 Configure access to storage</pdf2txt-u> <pdf2txt-u>|__|__2.1.1 Configure Azure Storage firewalls and virtual networks</pdf2txt-u>