Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 631:

  You have an Azure subscription that contains a storage account named storage1.

  The storage1 account contains a file share named share1.

  The subscription is linked to a hybrid Azure Active Directory (Azure AD) tenant that contains a security group named Group1.

  You need to gram Group! the Storage File Data SMB Share Elevated Contributor role for share1.

  What should you do first?

  A. Enable Active Directory Domain Service (ADDS) authentication for storage1.
  B. Grant share-level permissions by using File Explorer.
  C. Mount share! by using File Explorer.
  D. Create a private endpoint.
  A. Enable Active Directory Domain Service (ADDS) authentication for storage1.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Enable Active Directory Domain Service (ADDS) authentication for storage1.

  --------------------------------------------------------------------------------

  The "Storage File Data SMB Share Elevated Contributor" role is used with identity-based authorization over SMB for Azure Files. To use Azure AD DS / AD DS-based authentication for Azure Files over SMB, the storage account must first be configured for AD DS (or Azure AD DS) authentication. Only after enabling the directory-based authentication can you grant the SMB share data roles to groups/users and have them take effect for SMB access. Therefore, enabling AD DS authentication is the first action. (1)(2)

  Why the other options are not correct:

  - Grant share-level permissions by using File Explorer: you cannot correctly apply identity-based SMB authorization until directory authentication is configured. (1)

  - Mount share1 by using File Explorer: mounting is a client action and does not configure authorization.

  - Create a private endpoint: changes network path/private access, but does not enable SMB identity-based authentication.

  -------------------------------------------------------------------------------- References:

  1. Microsoft. (n.d.). Azure Files identity-based authentication and authorization (AD DS/Azure AD DS). Microsoft Learn.

  Last modified: Unable to locate in tool output Date accessed: 01/25/2026

  2. Microsoft. (n.d.). Storage permissions for Azure Files over SMB (role and identity-based requirements). Microsoft Learn. https://learn.microsoft.com/en-us/fslogix/azure-storage-permissions Last modified: Unable to locate in tool output Date accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - For Azure Files SMB with Entra/AD integration: "Enable directory-based auth" first, then assign SMB share roles.

  - Don't confuse "private endpoint" (network) with "identity-based SMB auth" (authN/authZ).

  -------------------------------------------------------------------------------- Summary:

  Covers Azure Files SMB identity-based access prerequisites and sequencing.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15?0%) | |__ 2.1 Configure access to storage | |__ 2.1.5 Configure identity-based access for Azure Files

• Question 632:

  You have an Azure App Service plan named AdatumASP1 that hosts several Azure web apps.

  You discover that the web apps respond slowly.

  You need to provide additional memory and CPU resources to each instance of the web apps.

  What should you do?

  A. Add continues WebJob that use the multi-instance scale
  B. Scale out AdatumASP1
  C. Add a virtual machine scale set
  D. Scale up AdatumASP1
  D. Scale up AdatumASP1

  ---

  Explanation

  --------------------------------------------------------------------------------

  Scale up AdatumASP1

  --------------------------------------------------------------------------------

  Scaling up an App Service plan increases the resources (CPU/memory) available to each instance. The requirement is to provide additional memory and CPU resources to each instance, which is scale up (vertical scaling), not scale out.

  Why other options are not correct:

  - Scaling out adds more instances but does not increase CPU/memory per instance.

  - A WebJob does not address App Service plan capacity.

  - A VM scale set is a different compute model and not how you add per-instance resources to App Service plan instances.

  -------------------------------------------------------------------------------- References:

  1. Scale up an app in Azure App Service https://learn.microsoft.com/en-us/azure/app-service/manage-scale-up Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - Scale up = bigger worker (more CPU/RAM per instance).

  - Scale out = more workers (more instances).

  -------------------------------------------------------------------------------- Summary:

  Improving web app performance by vertically scaling the App Service plan to increase per-instance resources.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.4 Create and configure Azure App Service |__ 3.4.2 Configure scaling for an App Service plan

• Question 633:

  HOTSPOT

  You have an Azure subscription that contains an Azure Backup vault named Backup1, a Recovery Services vault named Recovery1, and the resources shown in the following table.

  

  You plan to back up the resources.

  Which resource can be backed up to Backup1, and which resource can be backed up to Recovery1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Backup1 (Backup vault): Disk1
  
  Recovery1 (Recovery Services vault): VM1

  A Backup vault is used for newer Azure Backup scenarios such as Azure Disk Backup (and other modern workloads supported by Backup vaults).

  A Recovery Services vault is used for Azure VM backups (and other legacy or RSV workloads).

  App Service backup is configured at the App Service level, and Azure SQL Database has built-in backup and restore features; neither is protected by using these vault selections in this question.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10–15%) |__ 5.2 Implement backup and recovery |__ 5.2.1 Create a Recovery Services vault |__ 5.2.3 Create and configure a backup policy |__ 5.2.4 Perform backup and restore operations by using Azure Backup

• Question 634:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription named Subscription1. Subscription1 contains a resource group named RG1. RG1 contains resources that were deployed by using templates.

  You need to view the date and time when the resources were created in RG1.

  Solution: From the RG1 blade, you click Automation script.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  No

  ----------------------------------------------------------------------------------------------------

  The goal is to view the **date and time when the resources were created in RG1** (resources were deployed by using templates).

  The proposed solution is:

  - Go to the **Subscriptions** blade --> select the subscription --> click **Programmatic deployment**

  Why this does NOT meet the goal:

  - **Programmatic deployment** is a subscription-level view intended for deployment/programmatic artifacts, but it is **not the correct place to view the resource-group deployment records and timestamps** for resources created in **RG1**.

  - To see when template-deployed resources were created in **RG1**, you should use either:

  1) **RG1 --> Deployments** (deployment history, with timestamps and per-resource operations), or 2) **Activity log** on the resource group/resources (shows "create/update/delete" operations with timestamps).

  Therefore, the proposed navigation does **not** meet the goal.

  ----------------------------------------------------------------------------------------------------

  References:

  1. Deploy resources with ARM templates and Azure CLI https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-cli Date Modified: 04/28/2025 Date Access: 01/24/2026 Excerpt: "The deployment is added to the deployment history for the resource group."

  2. Monitor Azure resources with Azure Monitor (Activity log section) https://learn.microsoft.com/en-us/azure/azure-monitor/platform/monitor-azure-resource Date Modified: 07/19/2025 Date Access: 01/24/2026 Excerpt: "These are subscription-level events that track operations for each Azure resource, for example, creating a new resource..."

  ----------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - If the question mentions **resources deployed by templates**, think **Resource group --> Deployments** to review deployment timestamps and operations.

  - If the question asks **when a resource was created/changed**, think **Activity log** (create/update/delete events + timestamps).

  - For "Does this meet the goal?" items, verify the proposed blade/path is the *exact* one that exposes the required data.

  ----------------------------------------------------------------------------------------------------

  Summary:

  - ARM template deployment history vs. subscription "Programmatic deployment"

  - Using **RG Deployments** or **Activity log** to find resource creation time

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.1 Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files |__ 3.1.1 Interpret an Azure Resource Manager template or a Bicep file

  1. On the Azure portal menu, select Monitor, or search for and select Monitor from any page

  

  2. Select Activity Log.

  

  3. You see a summary of recent operations. A default set of filters is applied to the operations. Notice the information on the summary includes who started the action and when it happened.

  

  https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/view-activity-logs

• Question 635:

  You have an Azure subscription.

  You enable multi-factor authentication for all users.

  Some users report that the email applications on their mobile device cannot connect to their Microsoft Exchange Online mailbox.

  The users can access Exchange Online by using a web browser and from Microsoft Outlook 2016 on their computer.

  You need to ensure that the users can use the email applications on their mobile device.

  What should you instruct the users to do?

  A. Create an app password
  B. Reset the Azure Active Directory (Azure AD) password
  C. Enable self-service password reset
  D. Reinstall the Microsoft Authenticator app
  A. Create an app password

  ---

  Explanation

  --------------------------------------------------------------------------------

  Create an app password

  --------------------------------------------------------------------------------

  Mobile email apps that use legacy authentication (or otherwise can't complete interactive MFA challenges) often fail after MFA is enforced. App passwords are specifically designed to allow these legacy clients to authenticate when MFA is enabled. Users can still sign in via browser/modern Outlook because those support modern authentication and MFA prompts, which matches the symptoms described. (1)

  Why the other options are not correct:

  - Reset the Azure Active Directory (Azure AD) password: Password reset doesn't address a client's inability to perform MFA.

  - Enable self-service password reset: SSPR is a password recovery feature, not a solution for legacy client MFA limitations.

  - Reinstall the Microsoft Authenticator app: The issue is legacy client authentication, not the authenticator installation itself.

  References:

  1. Configure app passwords for Microsoft Entra multifactor authentication

  https://learn.microsoft.com/en-us/entra/identity/authentication/howto-mfa-app-passwords Date Modified: 03/04/2025 Date Accessed: 01/25/2026

  Microsoft Exam Tips:

  - AZ-104: If "MFA enabled" + "legacy/older mail client can't connect" appears, the typical fix is an app password (when allowed) or switching to modern-auth capable clients.

  - Always reconcile the client types: browser/modern clients work; legacy apps fail.

  Summary:

  This question covered MFA impacts on legacy authentication and the use of app passwords.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.2 Manage user and group properties

• Question 636:

  HOTSPOT

  You have an Azure subscription that uses Azure Container Instances.

  You have a computer that has Azure Command-Line Interface (CLI) and Docker installed.

  You create a container image named image1.

  You need to provision a new Azure container registry and add image1 to the registry.

  Which command should you run for each requirement? To answer, select the options in the answer area.

  NOTE: Each correct answer is worth one point.

  

  

  ---

  Provision a new container registry: az acr create

  Add image1 to the registry: docker push

  To provision an Azure Container Registry, you create the registry resource using Azure CLI (az acr create).

  To upload a local container image to the registry, you push the image to the registry using Docker (docker push) after tagging it with the registry’s login server name.

  Microsoft. (n.d.). Quickstart: Build and run a container image using Docker CLI and Azure Container Registry. Microsoft Learn. https://learn.microsoft.com/en-us/azure/container-registry/container-registry-get-started-docker-cli (Last updated:2025-08-28; Accessed: 2026-01-30).

  3.0 Deploy and manage Azure compute resources (20–25%) |__3.3 Provision and manage containers in the Azure portal |__|__3.3.1 Create and manage an Azure container registry

• Question 637:

  You have an Azure subscription.

  You create an Azure container registry and a container image

  You need to push the container image to the container registry by using the Azure Command-Line Interface (CU).

  You sign in to the container registry.

  Which action should you perform next?

  A. lag a container image with the name of the container registry's login server.
  B. List the images in the container registry.
  C. Deploy a container group.
  D. Configure a YAML file.
  A. lag a container image with the name of the container registry's login server.

  ---

  tag a container image with the name of the container registry's login server

  To push a local container image to Azure Container Registry (ACR), the image must be tagged with the registry's fully qualified login server name (for example, myregistry.azurecr.io/repo/image:tag). Tagging creates the correct destination reference so the subsequent push uploads the image to your ACR.

  Why the other options are not correct:

  - List the images in the container registry: This is typically a post-push verification (or used to view existing repos). It doesn't prepare the local image for upload.

  - Deploy a container group: Deployment consumes an image that already exists in a registry; it doesn't push the image into ACR.

  - Configure a YAML file: YAML is used for orchestrators (AKS, ACI configs, pipelines), but it's not the next required step for pushing an image after signing in.

  Exam Tips:

  - AZ-104: Know the end-to-end flow: authenticate -> tag with <loginServer> -> push.

  - Prefer Entra ID-based auth (az acr login) for interactive use; avoid long-lived admin credentials where possible.

  Summary:

  ACR image push workflow; why tagging with the registry login server is required before pushing.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources

  3.3 Provision and manage containers in the Azure portal

  3.3.1 Create and manage an Azure container registry

• Question 638:

  You have an Azure subscription that contains a virtual machine named VM1 and two users named User1 and User2.

  You assign User1 the Contributor role for VM1.

  Which two actions can User1 perform on VM1? Each correct answer presents a complete solution.

  A. Add a data disk.
  B. Configure a daily backup.
  C. Assign User2 the Contributor role for VM1.
  D. Upload an image of VM1 to an Azure compute gallery.
  E. Assign User2 the Reader role for VM1.
  A. Add a data disk.
  D. Upload an image of VM1 to an Azure compute gallery.

  ---

  Add a data disk.

  Upload an image of VM1 to an Azure compute gallery

  - Add a data disk: The Contributor role can manage the VM resource, including VM configuration changes such as attaching data disks.

  - Upload an image of VM1 to an Azure compute gallery: Creating an image version from a VM requires write permission on the VM (and on the source managed disk). A Contributor assignment provides broad "manage resources" capability at the assigned scope, which is sufficient for VM write operations needed for image capture/version creation.

  Why the other options are not correct:

  - Configure a daily backup: Enabling/managing Azure Backup is primarily controlled through Recovery Services vault/backup roles and permissions (for example, Backup Operator/Backup Contributor at the vault scope). VM-level permissions alone are not the full set typically required to configure backup policy and vault operations.

  - Assign User2 the Contributor role for VM1 / Assign User2 the Reader role for VM1: Assigning RBAC roles requires Microsoft.Authorization/roleAssignments/write. The Contributor role explicitly does not grant the ability to assign access to others.

  Microsoft Exam Tips:

  - AZ-104: Memorize the RBAC boundary: Contributor manages resources but cannot grant access (no role assignment writes).

  - For backup scenarios, separate "VM management" permissions from "vault/backup management" permissions.

  Summary:

  RBAC scope and capabilities for Contributor; VM management actions vs role-assignment and backup management boundaries.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance  | |__ 1.2 Manage access to Azure resources | |__ 1.2.1 Manage built-in Azure roles

• Question 639:

  DRAG DROP

  You have an on-premises file server named Server1 that runs Windows Server 2016.

  You have an Azure subscription that contains an Azure file share.

  You deploy an Azure File Sync Storage Sync Service, and you create a sync group.

  You need to synchronize files from Server1 to Azure.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: Install the Azure File Sync agent on Server1

  Step 2: Register Server1

  Step 3: Add a server endpoint

  Explanation:

  You already have the Azure-side prerequisites completed (Storage Sync Service and a sync group). To synchronize files from the on-premises server (Server1) to the Azure file share, you must onboard Server1 into Azure File Sync and then define what path will sync.

  Why the correct steps are correct (and why order matters):

  Step 1: Install the Azure File Sync agent on Server1

  - The agent is required on the Windows Server to participate in Azure File Sync. Without it, the server cannot be registered or sync data.

  Step 2: Register Server1

  - Registration associates Server1 with the Storage Sync Service so Azure can manage it as a registered server.

  Step 3: Add a server endpoint

  - A server endpoint defines the local path on Server1 that participates in the sync group. Once created, the agent can begin syncing that path with the cloud endpoint (Azure file share) in the sync group.

  Why the other actions are not correct:

  - Create an Azure on-premises data gateway

  - Used for some data integration scenarios (Power BI, Power Platform, etc.), not Azure File Sync.

  - Create a Recovery Services vault

  - Used for Azure Backup/Site Recovery, not for file synchronization.

  - Install the DFS Replication server role on Server1

  - DFS-R is a separate replication technology; Azure File Sync does not require DFS-R to sync with Azure Files.

  References:

  1. Microsoft Learn. Deploy Azure File Sync.

  https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-deployment-guide Last updated: 10/10/2025. Date Accessed: 01/26/2026.

  2. Microsoft Learn. Manage registered servers with Azure File Sync (server registration).

  https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-server-registration Last updated: 08/07/2024. Date Accessed: 01/26/2026.

  3. Microsoft Learn. Create an Azure File Sync server endpoint.

  https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-server-endpoint-create Last updated: 07/16/2025. Date Accessed: 01/26/2026.

  Microsoft Exam Tips:

  - Azure File Sync “server-side” flow is: Install agent --> Register server --> Create server endpoint (local path) in the sync group.

  - Watch for distractors like Recovery Services vault (backup) and DFS-R (different replication tech). They’re not required for Azure File Sync.

  - If the question says the Storage Sync Service + sync group already exist, your next steps are almost always agent install, registration, then server endpoint.

  Summary:

  This question covered onboarding an on-prem Windows Server into Azure File Sync and enabling synchronization by installing the agent, registering the server, and creating a server endpoint (local path) in the sync group.

  AZ-104 Exam Objective Hierarchy:

  2.0 - Implement and manage storage (15–20%) |__ 2.3 - Configure Azure Files and Azure Blob Storage |__ 2.3.1 - Create and configure a file share in Azure Storage

  Step 1: Install the Azure File Sync agent on Server1 The Azure File Sync agent is a downloadable package that enables Windows Server to be synced with an Azure file share

  Step 2: Register Server1.

  Register Windows Server with Storage Sync Service Registering your Windows Server with a Storage Sync Service establishes a trust relationship between your server (or cluster) and the Storage Sync Service.

  Step 3: Add a server endpoint Create a sync group and a cloud endpoint.

  A sync group defines the sync topology for a set of files. Endpoints within a sync group are kept in sync with each other. A sync group must contain one cloud endpoint, which represents an Azure file share and one or more server endpoints.

  A server endpoint represents a path on registered server.

  https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide

• Question 640:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure Storage account named storage1.

  You need to enable a user named User1 to list and regenerate storage account keys for storage1.

  Solution: You assign the Reader and Data Access role to User1.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  Goal: User1 must be able to list AND regenerate storage account keys.

  - The Reader and Data Access role is primarily a read role; while it can include key *listing* capability in some contexts, it does not provide the permissions required to regenerate keys.

  - To regenerate keys, you need a role that includes key regeneration actions (for example, Storage Account Key Operator Service Role, Storage Account Contributor, or Owner).

  Why the other option is incorrect:

  - Yes: The proposed role assignment does not satisfy the "regenerate keys" requirement.

  References:

  1. Microsoft. (n.d.). Azure built-in roles: Storage. Microsoft Learn.

  https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage Date Updated: Unable to locate in this capture (see page footer) Date Accessed: 01/26/2026

  Microsoft Exam Tips:

  - "List keys" and "regenerate keys" are frequently split across permissions. AZ-104 expects you to recognize when a role is insufficient for key regeneration.

  Summary:

  RBAC and permissions needed to manage (list/regenerate) storage account access keys.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15?0%) |__ 2.1 Configure access to storage |__ 2.1.4 Manage access keys