Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 621:

  HOTSPOT

  You have an Azure subscription that contains the container images shown in the following table.

  

  You plan to use the following services:

  1. Azure Container Instances 2. Azure Container Apps 3. Azure App Service

  In which services can you run the images? To answer, select the options in the answer area.

  NOTE: Each correct answer is worth one point.

  

  

  ---

  - Image1 (Windows Server): Azure Container Instances and App Services only

  - Image2 (Linux): Azure Container Instances, Azure Container Apps, and App Services

  Why this is correct:

  - Azure Container Instances (ACI) supports both Windows and Linux containers.

  - Azure Container Apps requires Linux-based container images (linux/amd64).

  - Azure App Service supports running containerized apps, including Windows container scenarios, and also supports Linux containers.

  Evidence (Excerpts)

  - ACI: “offers the fastest and simplest way to run Linux or Windows containers…” and “can schedule both Windows and Linux containers…”

  - Container Apps: “Linux-based (linux/amd64) container images are required.”

  AZ-104 Exam Objective Hierarchy

  3.0 Deploy and manage Azure compute resources (20–25%) |__3.3 Provision and manage containers in Azure |__|__3.3.2 Create and configure Azure Container Instances |__|__3.3.3 Create and configure Azure Container Apps |__3.4 Provision and manage application hosting for web apps |__|__3.4.1 Create and configure App Service plans |__|__3.4.3 Configure App Service

• Question 622:

  Your company has an Azure Active Directory (Azure AD) subscription.

  You need to deploy five virtual machines (VMs) to your company's virtual network subnet.

  The VMs will each have both a public and private IP address. Inbound and outbound security rules for all of these virtual machines must be identical.

  Which of the following is the least amount of security groups needed for this configuration?

  A. 4
  B. 3
  C. 2
  D. 1
  D. 1

  ---

  Explanation

  --------------------------------------------------------------------------------

  --------------------------------------------------------------------------------

  If inbound and outbound security rules must be identical across all five VMs, the minimum number of NSGs is one. You can associate a single NSG at the subnet level (or apply the same NSG to each NIC). With identical rules required, one NSG satisfies the requirement with the least number of security groups.

  References:

  1. Microsoft Learn. "Network security groups." https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview. Accessed 2026-01-25.

  2. Microsoft Learn. "Associate NSGs to subnets and NICs." https://learn.microsoft.com/en-us/azure/virtual-network/tutorial-filter-network-traffic. Accessed 2026-01-25.

  Microsoft Exam Tips:

  - If the question says "identical rules," think "reuse the same NSG," ideally at the subnet if all VMs share the same segment and policy.

  Summary:

  Minimum NSG count when all VMs require identical inbound/outbound rules.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.2 Configure secure access to virtual networks |__ 4.2.1 Create and configure network security groups (NSGs) and application security groups

• Question 623:

  You have an Azure subscription named Subscription1 that has the following providers registered:

  1. Authorization 2. Automation 3. Resources 4. Compute 5. KeyVault 6. Network 7. Storage 8. Billing 9. Web

  Subscription1 contains an Azure virtual machine named VM1 that has the following configurations:

  1. Private IP address: 10.0.0.4 (dynamic) 2. Network security group (NSG): NSG1 3. Public IP address: None 4. Availability set: AVSet 5. Subnet: 10.0.0.0/24 6. Managed disks: No 7. Location: East US

  You need to record all the successful and failed connection attempts to VM1.

  Which three actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Register the Microsoft.Insights resource provider
  B. Add an Azure Network Watcher connection monitor
  C. Register the Microsoft.LogAnalytics provider
  D. Enable Azure Network Watcher in the East US Azure region
  E. Create an Azure Storage account
  F. Enable Azure Network Watcher flow logs
  A. Register the Microsoft.Insights resource provider
  E. Create an Azure Storage account
  F. Enable Azure Network Watcher flow logs

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  Register the Microsoft.Insights resource provider Create an Azure Storage account Enable Azure Network Watcher flow logs

  ----------------------------------------------------------------------------------------------------

  To record all successful and failed connection attempts to VM1, you use NSG flow logs (a Network Watcher capability). NSG flow logs capture allowed and denied flows (based on NSG rule evaluation) for the NIC/subnet, which provides the record of connection attempts.

  Why each selected action is required:

  - Register the Microsoft.Insights resource provider:

  Network Watcher/flow logs depend on the Insights provider being registered so the platform can emit and manage these monitoring artifacts.

  - Create an Azure Storage account:

  NSG flow logs are written to a Storage account (the destination for the logs).

  - Enable Azure Network Watcher flow logs:

  This turns on collection of the NSG flow log records for VM1's effective NSG scope.

  Why the other selections are not correct:

  - Add an Azure Network Watcher connection monitor:

  Connection Monitor is for active probing/monitoring connectivity (latency/availability) between endpoints. It does not provide a complete record of every successful/failed inbound attempt the way NSG flow logs do.

  - Register the Microsoft.LogAnalytics provider:

  Log Analytics is not required to record NSG flow logs to a Storage account. (It becomes relevant for Traffic Analytics scenarios, not simply capturing the flow log records.)

  - Enable Azure Network Watcher in the East US Azure region:

  While Network Watcher must be enabled in the region to use features, enabling flow logs typically enables/uses Network Watcher as needed. The key "record all attempts" requirement is satisfied by configuring flow logs with a storage destination and required provider registration.

  ---------------------------------------------------------------------------------------------------- References:

  1. Manage NSG flow logs (prerequisites, storage destination, enablement) http://learn.microsoft.com/en-us/azure/network-watcher/nsg-flow-logs-manage Date Modified: Unable to locate date modified Date Access: 01/24/2026

  2. Network Watcher overview (feature scope incl. NSG flow logs / Connection Monitor distinctions) http://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-monitoring-overview Date Modified: Unable to locate date modified Date Access: 01/24/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - If the requirement is "record allowed/denied connection attempts," think NSG Flow Logs (Network Watcher), not Connection Monitor.

  - If "Traffic Analytics" is mentioned, then Log Analytics becomes part of the solution; if it's only "record attempts," Storage + Flow Logs is usually sufficient.

  ---------------------------------------------------------------------------------------------------- Summary:

  Use Network Watcher NSG flow logs (stored in a Storage account) to record successful and failed connection attempts to a VM.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10?5%) | |__ 5.1 Monitor resources in Azure | |__ 5.1.6 Use Azure Network Watcher and Connection Monitor

• Question 624:

  HOTSPOT

  Your network contains an on-premises Active Directory Domain Services (AD DS) domain named contoso.com. The domain contains the servers shown in the following table.

  

  You plan to migrate contoso.com to Azure.

  You create an Azure virtual network named VNET1 that has the following settings:

  1. Address space: 10.0.0.0/16 2. Subnet:

  3. Name: Subnet1 4. IPv4: 10.0.1.0/24

  You need to move DC1 to VNET1. The solution must ensure that the member servers in contoso.com can resolve AD DS DNS names.

  How should you configure DO? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  IP address: Obtain an IP address automatically
  Name resolution: Configure VNET1 to use a custom DNS server

  Why this is correct:

  • In Azure, you typically leave the VM’s OS network adapter set to DHCP (“Obtain automatically”). Azure assigns the private IP via DHCP, and you control stability by setting a static private IP at the NIC level (not by hard-coding it inside the OS).
  • For AD DS–integrated DNS name resolution (contoso.com) from Azure VMs, VNET1 must use the domain controller/DNS server(s) as custom DNS servers. Azure-provided DNS cannot resolve on-premises/AD DS zones unless forwarded appropriately.

  Why the other options are incorrect:

  • Configure VNET1 to use the default Azure-provided DNS server: This will not resolve AD DS internal records (contoso.com) by itself.
  • Create Azure Private DNS zone contoso.com: Private DNS zones do not replace AD DS–integrated DNS for domain-joined workloads.
  • Create Azure public DNS zone contoso.com: Public DNS is not used for internal AD DS name resolution.
  • Create an A record: This does not solve the broader AD DS/DNS resolution requirement for the domain namespace.

  Exam Tips:

  • For domain controllers in Azure: keep the guest OS NIC set to DHCP; set a “static” private IP at the Azure NIC if you need it to remain stable.
  • Always point VNets hosting domain-joined resources to your DC/DNS servers (custom DNS), not the default Azure DNS.

  AZ-104 Exam Objective Hierarchy
  4.0 Implement and Manage Virtual Networking (15–20%)
  |__ 4.1 Configure and Manage Virtual Networks in Azure
  || 4.1.1 Create and Configure Virtual Networks and Subnets
  |__ 4.3 Configure Name Resolution and Load Balancing
  || 4.3.1 Configure Azure DNS

• Question 625:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You deploy an Azure Kubernetes Service (AKS) cluster named AKS1.

  You need to deploy a YAML file to AKS1.

  Solution: From the Azure CLI, you run azcopy.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  Why "No" is correct:

  - The goal is: "deploy a YAML file to AKS1."

  - The proposed solution says: "From the Azure CLI, you run azcopy."

  - AzCopy is a data transfer utility for Azure Storage (blobs/files). It does not apply Kubernetes manifests and does not deploy resources into an AKS cluster. Therefore, it does not meet the goal. (1)

  Why the other choice is incorrect:

  - Yes "Yes" would only be correct if the tool used can apply Kubernetes manifests (kubectl) or otherwise creates Kubernetes objects in the cluster.

  References:

  1. AzCopy v10: Use the azcopy copy command to upload data (AzCopy is used for Storage data transfer, not Kubernetes deployment) https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-upload Date Modified: Unable to locate date modified (authorization notice in this view) Date Accessed: 01/25/2026

  Microsoft Exam Tips:

  - Distinguish "cluster deployment tooling" (kubectl/helm) from "data movement tooling" (AzCopy/Storage Explorer).

  Summary:

  - AzCopy is for Azure Storage data transfer, not for deploying Kubernetes YAML manifests.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.3 Provision and manage containers in the Azure portal

• Question 626:

  You have an Azure subscription that contains an Azure SQL database named DB1.

  You plan to use Azure Monitor to monitor the performance of DB1. You must be able to run queries to analyze log data.

  Which destination should you configure in the Diagnostic settings of DB1?

  A. Send to a Log Analytics workspace.
  B. Archive to a storage account.
  C. Stream to an Azure event hub.
  A. Send to a Log Analytics workspace.

  ---

  Send to a Log Analytics workspace.

  To run queries against diagnostic log data in Azure Monitor, you send the logs to a Log Analytics workspace, where you can use KQL (Kusto Query Language) to analyze the data. Archiving to a storage account is intended for retention and offline processing, and streaming to an event hub is for forwarding to external systems/stream processing-not for interactive log queries in Azure Monitor Logs.

  Why the other options are not correct:

  - Archive to a storage account: Supports retention and external analytics, but not Azure Monitor Logs querying experience.

  - Stream to an Azure event hub: Designed for routing to SIEM/stream processing; not the primary destination for KQL log queries in Azure Monitor.

  Microsoft Exam Tips:

  - AZ-104: If the question says "run queries on log data," default to Log Analytics workspace.

  - Know the three common Diagnostic settings destinations and their typical uses:

  - Log Analytics: query/alert/dashboards

  - Storage: archival/retention

  - Event Hub: streaming/integration

  Summary:

  - Selecting the correct diagnostic log destination to support KQL querying in Azure Monitor.

  AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources  | |__ 5.1 Monitor resources in Azure | |__ 5.1.3 Query and analyze logs in Azure Monitor

• Question 627:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant that contains three global administrators named Admin1, Admin2, and Admin3.

  The tenant is associated to an Azure subscription. Access control for the subscription is configured as shown in the Access control exhibit. (Click the Exhibit tab.)

  

  You sign in to the Azure portal as Admin1 and configure the tenant as shown in the Tenant exhibit.

  (Click the Exhibit tab.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  - Admin1 can add Admin2 as an owner of the subscription: Yes

  - Admin3 can add Admin2 as an owner of the subscription: Yes

  - Admin2 can create a resource group in the subscription: No

  Why this is correct:

  - Admin3 already has the "Owner" role at subscription scope, so Admin3 can assign Owner to Admin2.

  - The tenant setting shown allows Global Admins to manage Azure subscriptions/management groups; Admin1 (Global Admin) can elevate and assign roles, enabling adding Admin2 as Owner.

  - Admin2 (Global Admin) still does not automatically have Azure RBAC permissions to create resource groups unless granted an appropriate Azure role (e.g., Contributor/Owner) at the subscription or RG scope.

  Why the other options are incorrect:

  - “Yes” for Admin2 creating a resource group would require RBAC permissions that are not shown as assigned to Admin2.

  Exam Tips

  - "Directory roles ≠ Azure RBAC" by default. Watch for when “elevate access” is enabled vs actually used/granted.

  AZ-104 Exam Objective Hierarchy

  1.0 Manage Azure identities and governance (20–25%) |__1.2 Manage access to Azure resources |__|__1.2.2 Assign roles at different scopes

• Question 628:

  You have an Azure subscription named Subscription1 that is used be several departments at your company. Subscription1 contains the resources in the following table:

  

  Another administrator deploys a virtual machine named VM1 and an Azure Storage account named storage2 by using a single Azure Resource Manager template.

  You need to view the template used for the deployment.

  From which blade can you view the template that was used for the deployment?

  A. RG1
  B. VM1
  C. Storage1
  D. Container1
  A. RG1

  ---

  RG1

  ARM template deployments are recorded at the scope where the deployment occurred (commonly the resource group). To view the template used for a deployment that created VM1 and storage2, you open the resource group (RG1), go to the deployment history (Deployments), and view the deployment details (including the template and parameters).

  Why the other selections are not correct:

  - VM1:

  The VM blade does not provide the authoritative "deployment history for the entire ARM deployment" the way the resource group Deployments view does.

  - storage1:

  The question asks where to view the template used for the deployment (which deployed multiple resources). That is best viewed from the deployment scope (resource group).

  - container1:

  A blob container blade is not where ARM deployment templates are reviewed.

  Microsoft Exam Tips:

  - AZ-104 expects you to know the "Deployments" blade under a resource group for ARM template history and troubleshooting.

  - Multi-resource deployments are easiest to audit at the deployment scope (RG/subscription).

  Summary:

  Where to find and review an ARM template used for a deployment (resource group deployment history).

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance |__ 1.3 Manage Azure subscriptions and governance |__ 1.3.4 Manage resource groups

• Question 629:

  You have the Azure virtual networks shown in the following table.

  

  To which virtual networks can you establish a peering connection from VNet1?

  A. VNet2 and VNet3 only
  B. VNet2 only
  C. VNet3 and VNet4 only
  D. VNet2, VNet3, and VNet4
  C. VNet3 and VNet4 only

  ---

  VNet3 and VNet4 only

  - VNet peering requires that the virtual network address spaces "do not overlap".

  - VNet1 is 10.11.0.0/16.

  - VNet2 is 10.11.0.0/17, which overlaps with VNet1 (it's a subset of VNet1), so peering is not possible.

  - VNet3 (10.10.0.0/22) and VNet4 (192.168.16.0/22) do not overlap with 10.11.0.0/16, so peering is possible (region differences are allowed).

  Why the other selections are incorrect:

  - VNet2 and VNet3 only

  - Includes VNet2, which overlaps with VNet1.

  - VNet2 only

  - Overlaps with VNet1.

  - VNet2, VNet3, and VNet4

  - Includes VNet2, which overlaps with VNet1.

  Microsoft Exam Tips:

  - AZ-104 peering questions often hinge on "overlapping CIDR" and "gateway transit" requirements.

  - If the address spaces overlap, peering is blocked even if subnets differ.

  Summary:

  Virtual network peering eligibility based on non-overlapping address spaces.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking |__ 4.1 Configure and manage virtual networks in Azure |__ 4.1.2 Create and configure virtual network peering

• Question 630:

  HOTSPOT

  You have an Azure virtual machine named VM1 that connects to a virtual network named VNet1. VM1 has the following configurations:

  1. Subnet: 10.0.0.0/24 2. Availability set: AVSet 3. Network security group (NSG): None 4. Private IP address: 10.0.0.4 (dynamic) 5. Public IP address: 40.90.219.6 (dynamic)

  You deploy a standard, Internet-facing load balancer named slb1.

  You need to configure slb1 to allow connectivity to VM1.

  Which changes should you apply to VM1 as you configure slb1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  A records for VM1: Private IP address only A records for VM2: Private IP address only

  Explanation (Why this is correct)

  - Private DNS zone auto-registration (when enabled on the virtual network link) registers VMs using their private IP addresses in the private DNS zone.

  - Public IP addresses are not used for A records in an Azure Private DNS zone.

  Exam Tip

  - Private DNS zone auto-registration = A records for private IPs.

  References (APA)

  - Microsoft. (n.d.). Azure Private DNS overview. Microsoft Learn. https://learn.microsoft.com/en-us/azure/dns/private-dns-overview

  AZ-104 Exam Objective Hierarchy 4.0 Implement and manage virtual networking (15–20%) |__4.3 Configure name resolution and load balancing |__|__4.3.1 Configure Azure DNS