Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 611:

  You have an Azure subscription that contains an Azure Stream Analytics job named Job1.

  You need to monitor input events for Job1 to identify the number of events that were NOT processed.

  Which metric should you use?

  A. Out-of-Order Events
  B. Output Events
  C. Late Input Events
  D. Backlogged Input Events
  D. Backlogged Input Events

  ---

  Backlogged Input Events

  Backlogged Input Events represents input events that the Stream Analytics job hasn't processed yet (the job is "falling behind" and events are waiting to be read/processed). Therefore, it directly indicates the count of input events not yet processed.

  Why the other options are not correct:

  - Out-of-Order Events: Tracks events that arrive out of timestamp order, not whether they were processed.

  - Output Events: Counts events produced by the job (processed output), not the unprocessed backlog.

  - Late Input Events: Tracks events arriving later than the configured lateness tolerance, not the total unprocessed backlog.

  Microsoft Exam Tips:

  - AZ-104 commonly expects you to recognize which Azure Monitor metric indicates backlog/processing lag for a managed service.

  - If backlog grows, typical remediation includes increasing Streaming Units (SUs) and/or improving query parallelism.

  Summary:

  - Monitoring Stream Analytics job health using metrics; identifying unprocessed (backlogged) input events.

  AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources  | |__ 5.1 Monitor resources in Azure | |__ 5.1.1 Interpret metrics in Azure Monitor

• Question 612:

  You have 100 Azure subscriptions. All the subscriptions are associated to the same Azure Active Directory (Azure AD) tenant named contoso.com.

  You are a global administrator.

  You plan to create a report that lists all the resources across all the subscriptions.

  You need to ensure that you can view all the resources in all the subscriptions.

  What should you do?

  A. From the Azure portal, modify the profile settings of your account.
  B. From Windows PowerShell, run the Add-AzureADAdministrativeUnitMember cmdlet.
  C. From Windows PowerShell, run the New-AzureADUserAppRoleAssignment cmdlet.
  D. From the Azure portal, modify the properties of the Azure AD tenant.
  D. From the Azure portal, modify the properties of the Azure AD tenant.

  ---

  Explanation

  --------------------------------------------------------------------------------

  From the Azure portal, modify the properties of the Azure AD tenant.

  --------------------------------------------------------------------------------

  Being a Global Administrator in Microsoft Entra ID (Azure AD) does not automatically grant access to Azure subscriptions/resources. To view and report across all subscriptions, you must elevate your access by enabling "Access management for Azure resources" (an elevation that grants permissions at the tenant root scope so you can then assign appropriate Azure RBAC roles such as Reader across scopes).

  Why other options are not correct:

  - Modifying profile settings does not change RBAC permissions across subscriptions.

  - Add-AzureADAdministratorToUnifiedGroup adds a directory role assignment to a group context and does not grant Azure RBAC access across subscriptions.

  - New-AzureADUserAppRoleAssignment assigns application roles (service principal/app roles), not Azure RBAC permissions to subscriptions.

  -------------------------------------------------------------------------------- References:

  1. Elevate access to manage all Azure subscriptions and management groups https://learn.microsoft.com/en-us/azure/role-based-access-control/elevate-access-global-admin Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  2. Manage access to Azure resources (Access management for Azure resources) https://learn.microsoft.com/en-us/entra/fundamentals/how-to-manage-access-to-azure-resources Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104 commonly tests the distinction between Entra directory roles and Azure RBAC.

  - "Global Administrator" automatic "Owner/Reader" on subscriptions; you often must elevate access or explicitly assign RBAC at the right scope (management group/subscription).

  -------------------------------------------------------------------------------- Summary:

  Elevating Global Administrator access to gain visibility/management capability across Azure subscriptions using tenant-level elevation for Azure resources.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.2 Manage access to Azure resources |__ 1.2.2 Assign roles at different scopes

• Question 613:

  HOTSPOT

  You have an Azure AD tenant.

  You need to create a Microsoft 365 group that contains only members of a marketing department in France.

  How should you complete the dynamic membership rule? To answer, select the appropriate options in the answer area.

  NOTE: Each correct answer is worth one point.

  

  

  ---

  Why this is correct

  - Dynamic membership rules support multiple expressions joined by -and/-or.

  - user.department and user.country are supported string properties, and -eq is the equals operator for string comparisons.

  Explanation (Why the other options are incorrect)

  - Using -or would include users who match only one of the attributes (too broad).

  - Using -match is regex-based and unnecessary for exact equality comparisons.

  Exam Tip For “only users in department X in country Y,” use **-and** and **-eq** on both properties.

  Multiple expressions with -and: The doc explicitly shows rules can combine expressions using -and, and provides an example of user.department … -and user.country ….

  Supported properties: user country and department are listed as supported string properties.

  AZ-104 Exam Objective Hierarchy

  1.0 Manage Azure identities and governance  |__1.1 Manage Microsoft Entra users and groups |__|__1.1.2 Manage user and group properties

• Question 614:

  You have an Azure subscription that contains a resource group named RG1. RG1 contains 100 virtual machines.

  Your company has three cost centers named Manufacturing, Sales, and Finance.

  You need to associate each virtual machine to a specific cost center.

  What should you do?

  A. Add an extension to the virtual machines.
  B. Modify the inventory settings of the virtual machine.
  C. Assign tags to the virtual machines.
  D. Configure locks for the virtual machine.
  C. Assign tags to the virtual machines.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Assign tags to the virtual machines.

  --------------------------------------------------------------------------------

  To associate each VM to a cost center (Manufacturing, Sales, Finance), you should use **resource tags** (for example, `CostCenter=Manufacturing`). Tags are the standard Azure mechanism for classification and are commonly used for

  **cost allocation, reporting, and chargeback/showback**.

  Why other selections are incorrect:

  - Add an extension to the virtual machines.: Extensions add functionality to a VM; they are not used for cost-center classification.

  - Modify the inventory settings of the virtual machine.: Not an Azure-native cost allocation approach; tags are the appropriate mechanism.

  - Configure locks for the virtual machine.: Locks prevent accidental deletion/modification; they do not associate resources to cost centers.

  --------------------------------------------------------------------------------

  References:

  1. Use tags to organize your Azure resources (tagging strategy) https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources Date Modified: Unable to locate Date Accessed: 01/25/2026

  2. Cost Management: use tags for cost allocation (common approach) https://learn.microsoft.com/en-us/azure/cost-management-billing/costs/understand-cost-mgt-data Date Modified: Unable to locate Date Accessed: 01/25/2026

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - If the question is about "associate resources to departments/cost centers," the default answer is **tags**.

  - Tags can be applied at scale (policy, ARM/Bicep, scripting), which is important when managing many resources.

  --------------------------------------------------------------------------------

  Summary:

  Tags are the correct Azure mechanism for associating resources with organizational metadata such as cost centers.

  --------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) 1.3 Manage Azure subscriptions and governance 1.3.3 Apply and manage tags on resources

• Question 615:

  You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource Manager template.

  You need to ensure that NGINX is available on all the virtual machines after they are deployed.

  What should you use?

  A. the New-AzConfigurationAssignment cmdlet
  B. a Desired State Configuration (DSC) extension
  C. Azure Active Directory (Azure AD) Application Proxy
  D. Azure Application Insights
  B. a Desired State Configuration (DSC) extension

  ---

  Explanation

  --------------------------------------------------------------------------------

  a Desired State Configuration (DSC) extension

  --------------------------------------------------------------------------------

  - To ensure NGINX is present on every VM in a scale set after deployment (via ARM template), you use a VM extension that can install/configure software automatically.

  - DSC extension is designed to enforce configuration state across VMs at deployment time and post-deployment.

  Why the other options are incorrect:

  - the New-AzConfigurationAssignment cmdlet: This is for Azure Policy guest configuration assignments, not the typical mechanism to install NGINX on VMSS instances via ARM.

  - Azure AD Application Proxy: Remote access publishing for on-prem apps, unrelated.

  - Azure Application Insights: Monitoring/telemetry, not software installation.

  References:

  1. Microsoft. (n.d.). Azure subscription and service limits, quotas, and constraints. Microsoft Learn.

  https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits Date Updated: Unable to locate in this capture (see page footer) Date Accessed: 01/26/2026

  Microsoft Exam Tips:

  - For "install software on all VMSS instances," think "VM extensions" (DSC/Custom Script) rather than monitoring or identity features.

  Summary:

  VM Scale Set configuration management using extensions.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.2 Create and configure virtual machines |__ 3.2.7 Deploy and configure an Azure Virtual Machine Scale Sets

• Question 616:

  DRAG DROP

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to load balance HTTPS connections to vm1 and vm2 by using lb1.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: Remove the public IP addresses from vm1 and vm2.

  Step 2: Create a health probe and backend pool on lb1.

  Step 3: Create a load balancing rule on lb1.

  Why:

  Goal: load balance HTTPS connections to vm1 and vm2 by using lb1. The answer key’s intent is to ensure lb1 is the only public entry point, then configure the core load balancer objects in the dependency order (backend pool/probe before the rule).

  Why the steps are correct (and why order matters):

  Step 1: Remove the public IP addresses from vm1 and vm2.

  - Removing the public IPs prevents direct inbound Internet access to the individual VMs so inbound HTTPS flows through lb1 as the single public endpoint.

  Step 2: Create a health probe and backend pool on lb1.

  - The backend pool defines the set of instances that will receive traffic.

  - The health probe determines which backend instances are considered healthy and eligible to receive traffic.

  Step 3: Create a load balancing rule on lb1.

  - The rule ties together the frontend (public IP on lb1), the backend pool, and the health probe to distribute HTTPS traffic to healthy instances.

  Why the other actions are not correct:

  - Remove nsg1.

  - Not required. You typically keep the NSG and ensure it allows the necessary HTTPS traffic from the load balancer.

  - Create an availability set.

  - Not required for load balancing existing VMs. Availability sets affect resiliency/placement but do not configure lb1.

  Exam Tips:

  - For Azure Load Balancer configuration, memorize the dependency chain: Backend pool + Probe --> then Rule.

  - If the question emphasizes “load balance Internet traffic,” the exam often expects the backends not to be individually Internet-exposed.

  Summary:

  Configured an Azure Standard Load Balancer to distribute HTTPS traffic by removing direct VM public exposure, creating the backend pool/probe, and then creating the load balancing rule.

  AZ-104 Exam Objective Hierarchy:

  4.0 - Implement and manage virtual networking (15–20%) |__ 4.3 - Configure name resolution and load balancing |__ 4.3.2 - Configure an internal or public load balancer

• Question 617:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates.

  You need to view the date and time when the resources were created in RG1.

  Solution: From the RG1 blade, you click Deployments.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  Yes

  ----------------------------------------------------------------------------------------------------

  Yes - this meets the goal.

  Why:

  - RG1 contains resources that were deployed by using templates. In the Azure portal, the **Resource group > Deployments** view shows the deployment history, including the deployment timestamp and deployment details. Those deployment records provide the date/time context for when the template deployment occurred (and therefore when the template-deployed resources in RG1 were created). (1)(2)

  Why the alternative approach (Subscription > Programmatic deployment) is not the best fit:

  - "Programmatic deployment" at the subscription level is oriented around subscription-scope deployments and does not directly target "resources created in RG1" the way the **RG1 > Deployments** blade does. The question asks specifically about resources created in **RG1**, so the resource-group deployment history is the most direct path. (2)

  ---------------------------------------------------------------------------------------------------- References:

  1. View deployment history https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deployment-history Date Modified: 2025-04-28 Date Access: 01/24/2026

  2. Deploy resources with ARM templates and Azure portal (deployment history note) https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-portal Date Modified: 2025-04-28 Date Access: 01/24/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - For template-based deployments, remember: **Resource group > Deployments** is the primary place to validate *when* a deployment ran and *what* resources were created/updated by that deployment.

  - If you're asked for deployment timing/evidence tied to a specific RG, prefer the RG's deployment history over subscription-wide views.

  ---------------------------------------------------------------------------------------------------- Summary:

  - ARM template (or portal-generated template) deployment history

  - Where to find deployment timestamps and deployment details in the Azure portal (RG > Deployments)

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.1 Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files |__ 3.1.1 Interpret an Azure Resource Manager template or a Bicep file

  

  3. Select one of the deployments from the deployment history.

  

  4. You will see a history of deployment for the resource group, including the correlation ID.

  

• Question 618:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription.

  Solution: You assign the Owner role at the subscription level to Admin1.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Yes

  Owner is a superset role that includes permissions required to use Network Watcher capabilities. Since Traffic Analytics is a Network Watcher capability, Owner at the subscription scope meets the requirement. :contentReference[oaicite:14]

  {index=14}

  Why the other selection is not correct:

  - No:

  Owner is explicitly listed as sufficient for Network Watcher capabilities.

  Exam Tips:

  - If a feature requires Contributor-level permissions, Owner will always satisfy it.

  - Don't overthink "Yes/No" items-map the role to the required capability.

  Summary:

  Confirming that Owner permissions satisfy Traffic Analytics enablement requirements.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20–25%)
  └── 1.2 Manage access to Azure resources
    └── 1.2.2 Assign roles at different scopes

• Question 619:

  HOTSPOT

  You have the Azure management groups shown in the following table:

  

  You add Azure subscriptions to the management groups as shown in the following table:

  

  You create the Azure policies shown in the following table:

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Answer Area (Statements left-to-right, top-to-bottom):

  1. You can create a virtual network in Subscription1: No 2. You can create a virtual machine in Subscription2: No 3. You can add Subscription1 to ManagementGroup11: No

  Explanation (Why this is correct) 1) **No** - A policy at **Tenant Root Group** denying `virtualNetworks` applies to all child management groups/subscriptions, so Subscription1 cannot create VNets.

  2) **No** - The “Allowed resource types” policy scoped to **ManagementGroup12** effectively allows only `virtualNetworks`. Since a VM is not `virtualNetworks`, VM creation is denied in Subscription2.

  3) **No** - A subscription can have **only one parent management group at a time**. Subscription1 is already in ManagementGroup21, so you can’t “add” it to ManagementGroup11 without moving it (the statement as written is false).

  Explanation (Why the other options are not correct)

  - Any “Yes” for (1) ignores inheritance from the Tenant Root Group.

  - Any “Yes” for (2) ignores the allowlist nature of “Allowed resource types”.

  - Any “Yes” for (3) assumes a subscription can be attached to multiple management groups simultaneously.

  References (APA; full URL)

  - Microsoft Learn. (n.d.). What are Azure management groups? Last updated: Unable to locate on page. https://learn.microsoft.com/en-us/azure/governance/management-groups/overview Date accessed: 2026-01-27.

  - Microsoft Learn. (n.d.). Azure Policy definition structure and effects. Last updated: Unable to locate on page. https://learn.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure Date accessed: 2026-01-27.

  Microsoft Exam Tips

  - Policies assigned at **Tenant Root Group** are “top-down.” Always evaluate inheritance before local exceptions.

  Summary

  - Hot Area Tracking (delta): Attempted +1 | Correct +1 | Incorrect +0 | Skipped +0

  - Mismatch/Duplicate Tracking (delta): Mismatch +0 | Duplicate +0

  AZ-104 Exam Objective Hierarchy 1.0 Manage Azure identities and governance (20–25%) └─ 1.3 Manage Azure subscriptions and governance └─ 1.3.1 Implement and manage Azure Policy

• Question 620:

  You have an Azure subscription that contains a policy-based virtual network gateway named GW1 and a virtual network named VNet1.

  You need to ensure that you can configure a point-to-site connection from an on-premises computer to VNet1.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Add a service endpoint to VNet1
  B. Reset GW1
  C. Create a route-based virtual network gateway
  D. Add a connection to GW1
  E. Delete GW1
  F. Add a public IP address space to VNet1
  C. Create a route-based virtual network gateway
  E. Delete GW1

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  Delete GW1 Create a route-based virtual network gateway

  ----------------------------------------------------------------------------------------------------

  Point-to-site (P2S) connectivity requires a route-based VPN gateway for the relevant configurations. A policy-based gateway can't be converted in-place to route-based. Therefore, you must remove the existing policy-based gateway and create a new route-based gateway.

  Other options (resetting the gateway, adding a "connection" object, service endpoints, or adding public IP *address space* to the VNet) do not address the gateway type requirement.

  References:

  1. Azure VPN Gateway configuration settings https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-gateway-settings Date Modified: 03/31/2025 Date Access: 01/24/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - "You can't convert policy-based to route-based" is a common test point. Expect "delete and recreate."

  - P2S questions usually test gateway type, client address pools, auth method, and routing behavior (AZ-104).

  Summary:

  P2S requires route-based gateway; policy-based must be deleted and recreated.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) | |__ 4.1 Configure and manage virtual networks in Azure | |__ 4.1.5 Troubleshoot network connectivity