Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 641:

  You plan to automate the deployment of a virtual machine scale set that uses the Windows Server 2016 Datacenter image.

  You need to ensure that when the scale set virtual machines are provisioned, they have web server components installed.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Modify the extensionProfile section of the Azure Resource Manager template.
  B. Create a new virtual machine scale set in the Azure portal.
  C. Create an Azure policy.
  D. Create an automation account.
  E. Upload a configuration script.
  A. Modify the extensionProfile section of the Azure Resource Manager template.
  E. Upload a configuration script.

  ---

  Modify the extensionProfile section of the Azure Resource Manager template.

  Upload a configuration script.

  You want VM Scale Set instances (Windows Server 2016) to automatically get web server components installed during provisioning. The standard approach is to use a VM extension (commonly Custom Script Extension or DSC) applied through the VMSS model.

  Why the answers are correct:

  - Modify the extensionProfile section of the Azure Resource Manager template.

  - The VMSS "model" is defined in the ARM template. Adding a VM extension to the VMSS model is done via the extensionProfile so every instance applies the extension at provision time (and on reimage/scale events, depending on settings).

  - Upload a configuration script.

  - VM extensions such as Custom Script Extension/DSC need a script/configuration payload (often stored in a location the VM can retrieve, such as a storage URI). Uploading the script provides what the extension executes to install IIS/web components.

  Why the other answers are incorrect:

  - Create a new virtual machine scale set in the Azure portal.

  - The requirement is automation via provisioning; the correct mechanism is to update the template/model, not manually rebuild a new VMSS.

  - Create an Azure policy.

  - Azure Policy can audit/deny/append certain properties, but it does not reliably perform in-guest software installation like IIS on VMSS instances.

  - Create an automation account.

  - Automation Accounts can run runbooks, but this is not the standard per-instance provisioning method for VMSS; it adds operational complexity and is not as deterministic at provision time as an extension in the model.

  Exam Tips:

  - For "install software during VM/VMSS provisioning," think: Custom Script Extension or DSC via template/Bicep.

  - VMSS "model" changes (template) are the repeatable way to ensure every instance gets the same configuration.

  Summary:

  Automating VM Scale Set in-guest configuration using VM extensions defined in an ARM template.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (15–20%)

  └── 3.2 Create and configure virtual machines
    └── 3.2.7 Deploy and configure an Azure Virtual Machine Scale Sets

• Question 642:

  HOTSPOT

  You configure the custom role shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  - To ensure users can sign in to VMs assigned role1, modify: dataActions

  - To ensure role1 can be assigned only to RG1, modify: assignableScopes

  Why this is correct:

  - “Sign in to VM” is a data-plane style permission for VM login; those are represented as dataActions in role definitions.

  - assignableScopes constrains *where* the role definition can be assigned (subscription, resource group, etc.). Setting it to the RG scope limits assignment to RG1.

  Exam tip:

  - If the action is “read/write Azure resource configuration” --> actions.

  - If the action is “use the resource / perform a data-plane operation (like login)” --> dataActions.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20–25%) |__1.2 Manage access to Azure resources |__|__1.2.1 Manage built-in Azure roles |__|__1.2.2 Assign roles at different scopes |__|__1.2.3 Interpret access assignments

  References (APA; full URL only):

  Microsoft. (n.d.). Azure custom roles. https://learn.microsoft.com/en-us/azure/role-based-access-control/custom-roles Microsoft. (n.d.). Azure Arc-enabled servers RBAC overview (dataActions vs actions). https://learn.microsoft.com/en-us/azure/azure-arc/servers/azure-rbac

• Question 643:

  You have an Azure subscription that contains two virtual machines as shown in the following table.

  

  You perform a reverse DNS lookup for 10.0.0.4 from VM2.

  Which FQDN will be returned?

  A. vm1.core.windows.net
  B. vm1.internal.cloudapp.net
  C. vm1.westeurope.cloudapp.azure.com
  D. vm1.azure.com
  B. vm1.internal.cloudapp.net

  ---

  Explanation

  --------------------------------------------------------------------------------

  vm1.internal.cloudapp.net

  --------------------------------------------------------------------------------

  With **Azure-provided DNS** enabled in a VNet, Azure supplies internal name resolution. For reverse DNS scenarios in Azure-provided DNS, the internal host naming uses the **internal.cloudapp.net** suffix for VM hostnames (1). Therefore, a reverse lookup for VM1's private IP (10.0.0.4) will return an internal FQDN in the form:

  - vm1.internal.cloudapp.net

  Why the other options are not correct:

  - vm1.core.windows.net: not the Azure-provided internal VM DNS suffix.

  - vm1.westeurope.cloudapp.azure.com: resembles public cloudapp patterns, not the internal suffix returned by Azure-provided DNS reverse lookups in this context.

  - vm1.azure.com: not used for Azure VM internal naming.

  -------------------------------------------------------------------------------- References:

  1. Azure Private DNS FAQ (documents internal.cloudapp.net usage for Azure-provided DNS / reverse DNS scenarios) https://learn.microsoft.com/en-us/azure/dns/private-dns-faq Date Modified: 11/18/2024 Date Accessed: 01/25/2026

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - Azure-provided DNS internal suffix commonly tested: **internal.cloudapp.net**.

  - DNS objective questions often mix "public" vs "private/internal" naming patterns.

  -------------------------------------------------------------------------------- Summary:

  Azure-provided DNS returns internal FQDNs using the internal.cloudapp.net suffix.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) | |__ 4.3 Configure name resolution and load balancing | |__ 4.3.1 Configure Azure DNS

• Question 644:

  You have an Azure subscription named Subscription1. Subscription1 contains the resource groups in the following table.

  

  RG1 has a web app named WebApp1. WebApp1 is located in West Europe.

  You move WebApp1 to RG2.

  What is the effect of the move?

  A. The App Serviceplan for WebApp1remains in WestEurope. Policy2applies to WebApp1.
  B. The App Service plan for WebApp1 moves to North Europe. Policy2 applies to WebApp1.
  C. The App Serviceplan for WebApp1remains in WestEurope. Policy1applies to WebApp1.
  D. The App Service plan for WebApp1 moves to North Europe. Policy1 applies to WebApp1.
  A. The App Serviceplan for WebApp1remains in WestEurope. Policy2applies to WebApp1.

  ---

  The App Serviceplan for WebApp1 remains in WestEurope. Policy2 applies to WebApp1.

  Moving a web app to a different resource group does not change its region; the underlying App Service plan remains in the same location. After the move, Azure Policy assignment evaluation is based on the new scope (RG2), so Policy2 applies (assuming Policy2 is assigned to RG2).

  Why the other options are incorrect:

  - Any option claiming the App Service plan "moves" regions is incorrect; region does not change just from a resource-group move.

  - Any option claiming Policy1 applies after the move conflicts with the scope change described.

  Exam Tips:

  - AZ-104: Location/region is a property of the resource; moving resource group changes management scope, not geography.

  - Policy assignment scope matters (MG/subscription/RG/resource).

  Summary:

  Resource group moves, App Service plan location behavior, Azure Policy scope effects.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources  |__ 3.2 Create and configure virtual machines |__ 3.2.3 Move a virtual machine to another resource group, subscription, or region

• Question 645:

  HOTSPOT

  You have an Azure subscription that contains three virtual networks named VNET1, VNET2, and VNET3.

  Peering for VNET1 is configured as shown in the following exhibit.

  

  Peering for VNET2 is configured as shown in the following exhibit.

  

  Peering for VNET3 is configured as shown in the following exhibit.

  

  How can packets be routed between the virtual networks? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Packets from VNET1 can be routed to: VNET2 and VNET3 Packets from VNET2 can be routed to: VNET1 only

  Explanation (Why this is correct):

  - VNET1 has direct peerings to both VNET2 and VNET3, so VNET1 can route to both.

  - VNET peering is not transitive. Even though VNET2 is peered to VNET1 and VNET1 is peered to VNET3, VNET2 does not automatically gain routing to VNET3 through VNET1.

  Explanation (Why the other options are incorrect):

  - Any option implying VNET2 can route to VNET3 (without additional routing/NVA) is incorrect because peering does not provide transitive routing.

  Exam Tips:

  - Remember: **VNet peering is non-transitive**.

  - Hub-and-spoke “spoke-to-spoke” needs additional routing (NVA/Azure Firewall/Route Server) if you want it.

  Summary:

  VNET1 reaches both spokes directly; VNET2 only reaches VNET1.

  References:

  [1] Microsoft. (n.d.). Virtual network peering. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview (Accessed January 28, 2026).

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (20–25%) |__4.1 Configure and manage virtual networks |__|__4.1.2 Configure VNet peering

• Question 646:

  You have a virtual network named VNet1 as shown in the exhibit. (Click the Exhibit tab.)

  

  No devices are connected to VNet1.

  You plan to peer VNet1 to another virtual network named VNet2 in the same region. VNet2 has an address space of 10.2.0.0/16.

  You need to create the peering.

  What should you do first?

  A. Configure a service endpoint on VNet2.
  B. Modify the address space of VNet1.
  C. Add a gateway subnet to VNet1.
  D. Create a subnet on VNet1 and VNet2.
  B. Modify the address space of VNet1.

  ---

  Additional stored access policies: 3 Additional immutable blob storage policies: 1

  Modify the address space of VNet1

  Virtual network peering cannot be enabled if the VNets have overlapping address spaces. The exhibit shows VNet1 has 10.2.0.0/16, and VNet2 is also 10.2.0.0/16, which overlaps completely.

  Therefore, the first prerequisite is to change one VNet's address space (here: VNet1) to a non-overlapping CIDR range before creating the peering.

  Exam Tips:

  - Peering prerequisites: non-overlapping CIDRs, bidirectional peering objects, and correct permissions.

  - If you see identical/overlapping CIDRs, the fix is address space changes-not gateways or subnets (AZ-104).

  Summary:

  VNet peering requires non-overlapping address spaces.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking  |__ 4.1 Configure and manage virtual networks in Azure | |__ 4.1.2 Create and configure virtual network peering

• Question 647:

  HOTSPOT

  Your network contains an on-premises Active Directory Domain Services (AD DS) domain.

  The domain contains the identities shown in the following table.

  

  You have an Azure subscription that contains a storage account named storage1. The file shares in storage1 have an identity source of AD DS and Default share-level permissions set to Enable permissions for all authenticated users and groups.

  You create an Azure Files share named share1 that has the roles shown in the following table.

  

  You have a Microsoft Entra tenant that contains a cloud-only user named User3.

  You use Microsoft Entra Connect to sync OU1 from the AD DS domain to the Microsoft Entra tenant.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  User1 can access content in share1: Yes

  User2 can access content in share1: Yes

  User3 can access content in share1: No

  The scenario indicates an on-premises Active Directory Domain Services (AD DS) domain is the identity source for the Azure Files share and that permissions are enabled for authenticated users and groups.

  User1 and User2 are AD DS users (and can be synchronized to Microsoft Entra ID via Entra Connect), so they can authenticate using AD DS and access the share based on the configured default share-level permissions.

  User3 is explicitly described as a cloud-only Microsoft Entra user. Cloud-only identities do not authenticate to Azure Files shares that are configured to use AD DS as the identity source. Therefore, User3 cannot access share1.

• Question 648:

  You have an Azure Storage account that contains 5,000 blobs accessed by multiple users.

  You need to ensure that the users can view only specific blobs based on blob index tags.

  What should you include in the solution?

  A. a role assignment condition
  B. a stored access policy
  C. just-in-time (JIT) VM access
  D. a shared access signature (SAS)
  A. a role assignment condition

  ---

  a role assignment condition

  Blob index tags are attributes on blobs. To restrict which blobs users can access based on those attributes, you need an authorization mechanism that can evaluate attributes as part of access checks. Azure RBAC conditions (role assignment conditions / ABAC) provide that capability for Blob data access, including scenarios based on blob index tags.

  Why the other options are not correct:

  - a stored access policy: Applies to SAS token constraints; it's not a directory-based per-user authorization mechanism tied to blob tag evaluation.

  - just-in-time (JIT) VM access: Unrelated; controls VM management access.

  - a shared access signature (SAS): Can limit access but does not provide per-user RBAC-based filtering on blob index tags in the way required here.

  Exam Tips:

  - AZ-104: If the question requires filtering blob access by attributes/tags, think "RBAC conditions / ABAC," not SAS.

  - Know the difference: SAS = token-based delegation; RBAC conditions = directory/RBAC-based attribute evaluation.

  Summary:

  This question tested fine-grained blob authorization using Azure RBAC conditions tied to blob index tags.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20–25%)
  └── 1.2 Manage access to Azure resources
    └── 1.2.2 Assign roles at different scopes

• Question 649:

  You have an Azure Storage account named storage1 that contains a blob container named container1.

  You need to prevent new content added to container1 from being modified for one year.

  What should you configure?

  A. the access tier
  B. an access policy
  C. the Access control (IAM) settings
  D. the access level
  B. an access policy

  ---

  an access policy

  To prevent blobs (including newly added content) from being modified for a fixed period, you use Immutable Blob Storage (WORM). In the Azure portal, this is configured on the container under policies (often surfaced from the container's policy/settings area), where you can set a time-based retention policy (for example, 1 year). During the retention period, protected blobs can't be modified or deleted (subject to the policy configuration and legal/locked state).

  Why the other options are not correct:

  - the access tier: Only affects cost/performance characteristics, not write immutability.

  - the Access control (IAM) settings: Controls who can access, but does not enforce WORM immutability for all writers once enabled.

  - the access level: Controls public access level (private/blob/container), not write immutability.

  Microsoft Exam Tips:

  - If the requirement is "cannot be modified for X time," think "immutability / WORM," not IAM.

  - Retention policies are enforced by the platform, not by client behavior.

  Summary:

  Use immutable blob storage (time-based retention) configured via container policy/access policy settings.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage | |__ 2.3 Configure Azure Files and Azure Blob Storage | |__ 2.3.2 Create and configure a container in Blob Storage

• Question 650:

  HOTSPOT

  You have an Azure subscription that contains an Azure Directory (Azure AD) tenant named contoso.com. The tenant is synced to the on-premises Active Directory domain. The domain contains the users shown in the following table.

  

  You enable self-service password reset (SSPR) for all users and configure SSPR to have the following authentication methods:

  1. Number of methods required to reset: 2 2. Methods available to users: Mobile phone, Security questions 3. Number of questions required to register: 3 4. Number of questions required to reset: 3

  You select the following security questions:

  1. What is your favorite food?

  2. In what city was your first job?

  3. What was the name of your first pet?

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  SecAdmin1 must answer the following question if he wants to reset his password:

  “In what city was your first job?”: No

  BillAdmin1 must answer the following question if he wants to reset his password:

  “What is your favorite food?”: No

  User1 must answer the following question if he wants to reset his password:

  “What was the name of your first pet?”: Yes

  This question is testing how **SSPR security questions** work and (critically) who is allowed to use them.

  Key rule:

  - "Security questions are NOT available for administrator accounts" in Microsoft Entra ID SSPR. When an admin resets a password, their policy enforces stronger methods (for example, Microsoft Authenticator) and explicitly prohibits security questions.

  Apply that to the users:

  - SecAdmin1 (Security administrator) = admin x security questions can’t be used x the statement “must answer <specific security question>” is "No".

  - BillAdmin1 (Billing administrator) = admin x security questions can’t be used x "No".

  - User1 (Reports reader) = not an admin x security questions ARE allowed.

  And because the policy requires 3 questions to reset and exactly 3 questions are configured, User1 would have to answer all three-including “What was the name of your first pet?”-when using the security questions method x "Yes".

  Microsoft Exam Tips:

  - Watch for “administrator” roles (Security admin, Global admin, Billing admin, etc.). On the exam, that often changes what authentication/reset methods are permitted.

  - If security questions are involved, remember they’re generally weaker and often disallowed for admins.

  Summary:

  SSPR security questions can be used by standard users, but are not available for administrator accounts; therefore only the non-admin user can be forced to answer a specific configured question.

  AZ-104 Exam Objective Hierarchy:

  1.0 - Manage Azure identities and governance  |__ 1.1 - Manage Microsoft Entra users and groups |__ 1.1.5 - Configure self-service password reset (SSPR)