Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 591:

  You plan to create the Azure web apps shown in the following Table.

  

  What is the minimum number of App Service plans you should create for the web apps?

  A. 1
  B. 2
  C. 3
  D. 4
  B. 2

• Question 592:

  You have an Azure subscription that contains a storage account named storage1. The storage1 account contains blob data.

  You need to assign a role to a user named User1 to ensure that the user can access the blob data in storage1. The role assignment must support conditions.

  Which two roles can you assign to User1? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. Owner
  B. Storage Account Contributor
  C. Storage Account Backup Contributor
  D. Storage Blob Data Contributor
  E. Storage Blob Data Owner
  F. Storage Blob Delegator
  D. Storage Blob Data Contributor
  E. Storage Blob Data Owner

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  Storage Blob Data Contributor Storage Blob Data Owner

  ----------------------------------------------------------------------------------------------------

  The requirement is (1) access to blob data (data plane) and (2) the role assignment must support **conditions** (ABAC conditions in Azure RBAC). The Storage Blob Data roles are the appropriate *data plane* roles for blobs, and these assignments can be configured with conditions to scope access more precisely.

  Why the other choices are not correct:

  - Owner: Broad management-plane role; excessive privilege and not the intended least-privilege data access role for blobs.

  - Storage Account Contributor: Management-plane role for the storage account; does not grant blob data-plane permissions.

  - Storage Account Backup Contributor: Backup-related permissions; not intended for general blob data access with conditions.

  - Storage Blob Delegator: Delegation capability; not a standard role for direct blob data access.

  ---------------------------------------------------------------------------------------------------- References:

  1. What is Azure role-based access control (Azure RBAC)x (Conditions / ABAC overview)

  https://learn.microsoft.com/en-us/azure/role-based-access-control/conditions-overview Date Modified: 07/08/2025 Date Access: 01/26/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - Data-plane vs management-plane is a recurring AZ-104 theme for Storage.

  - If the question mentions "role assignment must support conditions," think RBAC **conditions** (ABAC) and choose roles that are commonly used with conditional access scoping.

  ---------------------------------------------------------------------------------------------------- Summary:

  Storage blob data-plane RBAC roles and role assignment conditions.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.2 Manage access to Azure resources |__ 1.2.1 Manage built-in Azure roles

• Question 593:

  HOTSPOT

  You have the App Service plans shown in the following table.

  

  You plan to create the Azure web apps shown in the following table.

  

  You need to identify which App Service plans can be used for the web apps.

  What should you identify? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  WebApp1 can use: ASP1 and ASP3 only

  WebApp2 can use: ASP1 only

  Why this is correct:

  - Apps must run on an App Service plan in the same region.

  - The app’s runtime/stack must be supported by the plan’s OS:

  - WebApp1 (.NET Core) can run on Windows or Linux --> ASP1 (Windows, West US) and ASP3 (Linux, West US) only.

  - WebApp2 (ASP.NET 4.7) requires Windows --> ASP1 only. (ASP2 is Windows but is in a different region.)

  Exam Tips:

  - Always check both: Region match + OS compatibility.

  AZ-104 Exam Objective Hierarchy

  3.0 Deploy and manage Azure compute resources (20–25%)
  └── 3.4 Create and configure Azure App Service
    └── 3.4.1 Create an App Service plan
    └── 3.4.3 Create a web app

• Question 594:

  You have an Azure subscription that contains a storage account named storage. The storage account contains a blob that stores images.

  Client access to storage1 is granted by using a shared access signature (SAS).

  You need to ensure that users receive a warning message when they generate a SAS that exceeds a seven-day time period.

  What should you do for storage?

  A. Enable a read-only lock.
  B. Configure an alert rule.
  C. Add a lifecycle management rule.
  D. Set Allow recommended upper limit for shared access signature (SAS) expiry interval to Enabled.
  D. Set Allow recommended upper limit for shared access signature (SAS) expiry interval to Enabled.

  ---

  Set Allow recommended upper limit for shared access signature (SAS) expiry interval to Enabled.

  The goal is to warn users when generating a SAS that exceeds a seven-day period. Enabling the "recommended upper limit" (SAS expiration policy guidance) is the control that triggers warnings in the portal experience when users attempt to create SAS tokens beyond the configured recommended duration.

  Why the other choices are not correct:

  - Enable a read-only lock: Prevents changes to the storage account/resource, not SAS issuance durations.

  - Configure an alert rule: Alerts are reactive and do not provide immediate interactive warnings during SAS creation.

  - Add a lifecycle management rule: Manages blob lifecycle; does not control SAS creation or warn on SAS expiry.

  Microsoft Exam Tips:

  - For SAS governance, remember: RBAC controls "who," SAS policy controls "how long," and Key Vault can help manage secrets/keys.

  - Warnings at creation time are different from alerts after-the-fact.

  Summary:

  Configuring SAS expiration policy guidance/warnings.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15?0%) |__ 2.1 Configure access to storage |__ 2.1.2 Create and use shared access signature (SAS) tokens

• Question 595:

  DRAG DROP

  Your company has an Azure subscription that includes a number of Azure virtual machines (VMs), which are all part of the same virtual network.

  Your company also has an on-premises Hyper-V server that hosts a VM, named VM1, which must be replicated to Azure.

  Which of the following objects that must be created to achieve this goal? Answer by dragging the correct option from the list to the answer area.

  Select and Place:

  

  

  ---

  Box 1: Hyper-V site

  Box 2: Azure Recovery Services Vault

  Box 3: Replication policy

  Explanation:

  You’re replicating an on-premises Hyper-V VM (VM1) to Azure using Azure Site Recovery (ASR). The core objects you must create include the vault to orchestrate ASR, the Hyper-V site to represent the source environment, and a replication policy to define replication behavior.

  Why these selections are correct:

  - Hyper-V site

  - In ASR (Hyper-V to Azure), you create a **Hyper-V site** and add Hyper-V hosts to it so ASR can manage replication for VMs on those hosts. :contentReference[oaicite:3]{index=3}

  - Azure Recovery Services Vault

  - The vault is the ASR control plane resource where you configure Site Recovery and manage replication/failover. :contentReference[oaicite:4]{index=4}

  - Replication policy

  - Policies define settings such as recovery point retention and replication frequency; the Hyper-V tutorial flow includes creating a replication policy. :contentReference[oaicite:5]{index=5}

  Why the other options are not correct:

  - Storage account

  - Not required as a distinct “must create” object in this question’s expected ASR setup (the key focuses on the ASR infrastructure objects).

  - Azure Traffic Manager instance

  - Traffic Manager is for DNS-based traffic distribution, not for VM replication.

  - Endpoint

  - Generic “endpoint” is not an ASR prerequisite object for Hyper-V replication.

  References:

  1. Microsoft Learn. Set up disaster recovery of on-premises Hyper-V VMs to Azure (create Hyper-V site; create replication policy; enable replication).

  https://learn.microsoft.com/en-us/azure/site-recovery/hyper-v-azure-tutorial Last updated: Sep 16, 2025. Date Accessed: 01/26/2026. :contentReference[oaicite:6]{index=6}

  Microsoft Exam Tips:

  - ASR “on-prem Hyper-V to Azure” often tests the objects: **Recovery Services vault + Hyper-V site + replication policy**.

  - Don’t confuse DR orchestration (ASR) with traffic distribution services (Traffic Manager).

  Summary:

  ASR prerequisites for replicating an on-prem Hyper-V VM to Azure: define the source site, configure the vault, and set a replication policy.

  AZ-104 Exam Objective Hierarchy:

  5 - Monitor and maintain Azure resources (10–15%) |__ 5.2 - Implement backup and recovery |__ 5.2.5 - Configure Azure Site Recovery for Azure resources

• Question 596:

  You have an Azure subscription that contains a web app named webapp1.

  You need to add a custom domain named www.contoso.com to webapp1.

  What should you do first?

  A. Upload a certificate.
  B. Add a connection string.
  C. Stop webapp1.
  D. Create a DNS record.
  D. Create a DNS record.

  ---

  Create a DNS record.

  Before you can add (bind) a custom domain such as www.contoso.com to an App Service web app, Azure must be able to verify domain ownership and/or confirm that DNS for the hostname points to the app. The required first step is to create the appropriate DNS record(s) with your DNS host/registrar:

  - For a subdomain like www.contoso.com, you typically create a CNAME that maps www to <webappname>.azurewebsites.net.

  - Azure may also require or strongly recommend a TXT verification record (for example, asuid.www) to prove ownership and reduce subdomain takeover risk.

  Only after the DNS record(s) exist (and have propagated) can you complete the custom domain mapping in the web app.

  Why the other options are not correct:

  - Upload a certificate:

  TLS certificates are configured after the domain is mapped (or at least after verification requirements are satisfied). Certificate upload is not the first step to add the hostname.

  - Add a connection string:

  Connection strings are app configuration settings and unrelated to custom domain binding.

  - Stop webapp1:

  Stopping the app is not required to add a custom domain.

  Microsoft Exam Tips:

  - "Add custom domain to App Service" almost always starts with "Create DNS record" (CNAME for subdomain; A record for apex).

  - For www-hostnames, expect CNAME --> <app>.azurewebsites.net plus (often) a TXT verification record (asuid.www) during validation.

  - Certificates come after the hostname is successfully added (custom domain binding), not before.

  Summary:

  - App Service custom domain onboarding

  - DNS prerequisites for domain ownership/validation (CNAME/A and optional/required TXT verification)

  - Order of operations: DNS first, then add hostname, then TLS binding

  AZ-104 Exam Objective Alignment (Hierarchy)

  3.0 Deploy and manage Azure compute resources (20?5%) | 3.4 Create and configure Azure App Service | 3.4.5 Map an existing custom DNS name to an App Service

• Question 597:

  You have an Azure subscription named Subscription1 and two Azure Active Directory (Azure AD) tenants named Tenant1 and Tenant2.

  Subscription1 is associated to Tenant1. Multi-factor authentication (MFA) is enabled for all the users in Tenant1.

  You need to enable MFA for the users in Tenant2. The solution must maintain MFA for Tenant1.

  What should you do first?

  A. Change the directory for Subscription1.
  B. Configure the MFA Server setting in Tenant1.
  C. Create and link a subscription to Tenant2.
  D. Transfer the administration of Subscription1 to a global administrator of Tenant2.
  C. Create and link a subscription to Tenant2.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Create and link a subscription to Tenant2.

  --------------------------------------------------------------------------------

  Creating/linking a subscription to Tenant2 is the first step that enables you to manage Azure resources and tenant-scoped identity settings (including MFA configuration) within Tenant2, while leaving Tenant1 unchanged.

  Why the other choices are not correct:

  - Change the directory for Subscription1:

  This moves the existing subscription's directory association away from Tenant1, which risks breaking the requirement to maintain MFA for Tenant1.

  - Configure the MFA Server setting in Tenant1:

  This does not enable MFA in Tenant2; it only affects Tenant1.

  - Transfer the administration of Subscription1 to a global administrator of Tenant2:

  This is an administrative handoff and does not, by itself, establish Tenant2 as a tenant context for enabling MFA for Tenant2's users.

  -------------------------------------------------------------------------------- References:

  1. Microsoft. (n.d.). Transfer an Azure subscription to a different Microsoft Entra directory. https://learn.microsoft.com/en-us/azure/role-based-access-control/transfer-subscription Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: Distinguish tenant-scoped identity configuration (Entra ID) from subscription-scoped resource management.

  - "Change directory" and "transfer subscription" are common distractors-validate which tenant must remain unaffected.

  -------------------------------------------------------------------------------- Summary:

  Tenant/subscription association and how to enable tenant-specific identity configuration without disrupting another tenant.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.3 Manage Azure subscriptions and governance |__ 1.3.5 Manage subscriptions

• Question 598:

  HOTSPOT

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  You have the virtual machines shown in the following table.

  

  You have the virtual network interfaces shown in the following table.

  

  Server1 is a DNS server that contains the resources shown in the following table.

  

  You have an Azure private DNS zone named contoso.com that has a virtual network link to VNET2 and the records shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Statement 1: No Statement 2: Yes Statement 3: Yes

  Explanation (Why this is correct)

  - Server2 uses a custom DNS server (10.10.0.4 / Server1). Because Server1 is the DNS resolver for Server2, Server2 will resolve names based on what Server1 can resolve (not directly from the private DNS zone link).

  - Server3 uses Azure-provided DNS (168.63.129.16), so it can use the Azure Private DNS zone link to VNET2 for name resolution.

  Explanation (Why the other options are incorrect)

  - Statement 1 is No because Server2 is not using Azure-provided DNS; it is using Server1 (custom DNS). Unless Server1 is configured to forward/resolve via the private zone, Server2 won’t automatically resolve host2 to that private DNS mapping.

  Exam Tip

  - Private DNS zone links help when clients use Azure-provided DNS; if you point a VNet/NIC to a custom DNS server, you must configure that DNS server to resolve/forward appropriately.

  References

  - Microsoft. (n.d.). Name resolution for resources in Azure virtual networks. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-name-resolution-for-vms-and-role-instances

  - Microsoft. (n.d.). Azure Private DNS overview. https://learn.microsoft.com/en-us/azure/dns/private-dns-overview

  AZ-104 Exam Objective Hierarchy 4.0 Implement and manage virtual networking (20–25%) |__4.3 Configure name resolution |__|__4.3.1 Configure Azure DNS

• Question 599:

  You have an Azure subscription that contains the following resources:

  1. 100 Azure virtual machines 2. 20 Azure SQL databases 3. 50 Azure file shares

  You need to create a daily backup of all the resources by using Azure Backup.

  What is the minimum number of backup policies that you must create?

  A. 1
  B. 2
  C. 3
  D. 150
  E. 170
  C. 3

  ---

  Explanation

  --------------------------------------------------------------------------------

  --------------------------------------------------------------------------------

  In Azure Backup, a backup policy is workload-specific. You can apply one policy to many protected items of the same workload type, but you generally need different policies for different workload types.

  Given the resources:

  - Azure virtual machines (IaaS VMs) --> requires a VM backup policy

  - Azure SQL databases (Azure Backup workload for SQL) --> requires a SQL backup policy

  - Azure file shares (Azure Files) --> requires an Azure Files backup policy

  Therefore, the minimum number of backup policies is 3 (one per workload type).

  Why the other options are not correct:

  - 1 or 2: A single policy cannot cover all three different workload types because policy templates and configuration options differ by workload.

  - 150 or 170: Policies are not created per resource. You can protect multiple VMs (or multiple file shares) under the same policy when the schedule/retention requirements are the same.

  Important clarification for real-world accuracy:

  - Azure Backup's "SQL" workload in a Recovery Services vault is for SQL Server running in Azure VMs. If the intent were Azure SQL Database (PaaS), those databases have built-in backups and are not protected by Azure Backup in the same way. The question's "using Azure Backup" phrasing implies the SQL workload supported by Azure Backup.

  --------------------------------------------------------------------------------

  References (Microsoft Learn):

  (1) Guidance and best practices - Azure Backup (Backup policy considerations; policy depends on workload type such as VM, database, files) https://learn.microsoft.com/en-us/azure/backup/guidance-best-practices Date accessed: 2026-01-22 Page last updated: (see Microsoft Learn page header)

  (2) Overview of Recovery Services vaults - Azure Backup (vault supports Azure IaaS VMs and SQL Server in Azure VMs) https://learn.microsoft.com/en-us/azure/backup/backup-azure-recovery-services-vault-overview Date accessed: 2026-01-22 Page last updated: (see Microsoft Learn page header)

  (3) Back up Azure Files in the Azure portal - Azure Backup (Azure Files uses its own backup policy configuration) https://learn.microsoft.com/en-us/azure/backup/backup-azure-files Date accessed: 2026-01-22 Page last updated: (see Microsoft Learn page header)

  (4) Tutorial: Back up a SQL Server database on an Azure VM (SQL workload uses its own protection/policy flow) https://learn.microsoft.com/en-us/azure/backup/tutorial-sql-backup Date accessed: 2026-01-22 Page last updated: (see Microsoft Learn page header)

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - "Minimum number of policies" usually maps to "number of workload types," not "number of resources."

  - If all items of a given type have the same schedule/retention, one policy can cover many items.

  - For AZ-104, know which workloads Azure Backup protects via Recovery Services vault (VMs, Azure Files, SQL Server in Azure VMs).

  --------------------------------------------------------------------------------

  Summary:

  This question tests how Azure Backup policies are organized and applied: policies are workload-specific and can be reused across multiple protected items of the same type.

  --------------------------------------------------------------------------------

  AZ-104 Exam Objective Alignment (Hierarchy)

  ------------------------------------------ 5.0 Monitor and maintain Azure resources (10?5%) | 5.2 Implement backup and recovery | 5.2.3 Create and configure a backup policy

• Question 600:

  Note: This question is part of a series of questions that present the same scenario. Each question in theseries contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have a Microsoft Entra tenant named contoso.com.

  You have a CSV file that contains the names and email addresses of 500 external users.

  You need to create a guest user account in contoso.com for each of the 500 external users.

  Solution; From Microsoft Entra ID in the Azure portal, you use the Bulk invite users' operation.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Yes

  The Bulk invite users feature in Microsoft Entra ID (Azure AD) is designed to invite external users in bulk by using a CSV file, which creates guest user objects and sends invitations. Therefore, using the “Bulk invite users” operation satisfies the goal of creating guest accounts for the 500 external users.

  Why the other option is not correct:

  • No: Incorrect because Bulk invite is explicitly intended for bulk creation and invitation of B2B guest users.

  Exam Tips:

  • AZ-104: “Bulk invite” = B2B guest onboarding; “Bulk create users” = internal or member user creation.
  • Guest creation often implies an invitation flow (unless using direct APIs or other automation processes).

  Summary:
  
  Creating guest users in bulk by using Microsoft Entra ID Bulk invite.

  AZ-104 Exam Objective Hierarchy:
  
  1.0 Manage Azure identities and governance (20–25%)
  └── 1.1 Manage Microsoft Entra users and groups
    └── 1.1.4 Manage external users