Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 651:

  You have the Azure virtual networks shown in the following table.

  

  Which virtual networks can you peer with VNet1?

  A. VNet2, VNet3, and VNet4
  B. VNet2 only
  C. VNet3 and VNet4 only
  D. VNet2 and VNet3 only
  C. VNet3 and VNet4 only

  ---

  Explanation

  ----------------------------------------------------------------------

  VNet3 and VNet4 only

  ----------------------------------------------------------------------

  VNet peering requires that the **address spaces do not overlap**. From the table:

  - VNet1 = 10.11.0.0/16

  - VNet2 = 10.11.0.0/17 (this overlaps with VNet1 because it is a subset of 10.11.0.0/16) --> cannot peer

  - VNet3 = 10.10.0.0/22 (no overlap) --> can peer

  - VNet4 = 192.168.16.0/22 (no overlap) --> can peer (including across regions via global peering). (Reference 1). :contentReference[oaicite:1]{index=1}

  Why the other options are not correct:

  - VNet2, VNet3, and VNet4: includes VNet2 (overlaps) so invalid.

  - VNet2 only: overlaps.

  - VNet2 and VNet3 only: includes VNet2 (overlaps).

  ---------------------------------------------------------------------- References:

  1. Virtual network peering overview. https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  ----------------------------------------------------------------------

  Microsoft Exam Tips:

  - If you see CIDRs, always check overlap first; overlap is a frequent AZ-104 trap.

  - Global VNet peering supports cross-region peering, but overlap rules still apply.

  Summary:

  Peering eligibility based on non-overlapping VNet address spaces.

  ---------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.1 Configure and manage virtual networks in Azure |__ 4.1.2 Create and configure virtual network peering

• Question 652:

  Your on-premises network contains an SMB share named Share1.

  You have an Azure subscription that contains the following resources:

  1. A web app named webapp1

  2. A virtual network named VNET1

  You need to ensure that webapp1 can connect to Share1.

  What should you deploy?

  A. an Azure Application Gateway
  B. an Azure Active Directory (Azure AD) Application Proxy
  C. an Azure Virtual Network Gateway
  C. an Azure Virtual Network Gateway

  ---

  An Azure Virtual Network Gateway

  To allow an Azure App Service (webapp1) to reach on-premises resources (such as an SMB share) over private network paths, you typically:

  1) Integrate the web app with a VNet (VNet integration), and

  2) Provide connectivity from that VNet to on-premises via site-to-site VPN (or ExpressRoute).

  An Azure Virtual Network Gateway is the Azure-side component used for site-to-site VPN connectivity to on-premises networks.

  - Application Gateway is for inbound HTTP(S) load balancing/WAF, not for outbound SMB access to on-prem.

  - Azure AD Application Proxy publishes internal web apps externally; it is not used for SMB share access.

  Exam Tips:

  - For App Service to reach on-prem: think VNet integration + S2S VPN/ExpressRoute.

  - If the question asks what to *deploy* for on-prem connectivity, VPN Gateway is a frequent answer (AZ-104).

  Summary:

  Providing hybrid connectivity so App Service can access an on-prem SMB share.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources  | |__ 3.4 Create and configure Azure App Service | |__ 3.4.7 Configure networking settings for an App Service

• Question 653:

  HOTSPOT

  You have an Azure subscription that contains the resources shown in the following table.

  

  You plan to create a data collection rule named DCR1 in Azure Monitor.

  Which resources can you set as data sources in DCR1, and which resources can you set as destinations in DCR1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Data sources: VM1 only

  Destinations: Workspace1 only

  Why this is correct:

  - A Data Collection Rule (DCR) is used by Azure Monitor (typically via Azure Monitor Agent) to define what data to collect from machines and where to send it.

  - In this set, VM1 is the valid machine data source, and a Log Analytics workspace (Workspace1) is a valid destination.

  Why the other options are incorrect:

  - storage1 (Storage account) and DB1 (Azure SQL database) are not selected as DCR data sources in this context.

  - Storage accounts are not the standard destination choice for the DCR log pipeline shown in these options; the workspace is.

  Exam Tips:

  - DCRs are most commonly tied to Azure Monitor Agent on VMs and send to Log Analytics workspaces.

  - If the question is “logs/queries in Azure Monitor,” expect the destination to be a Log Analytics workspace.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10–15%) |__5.1 Monitor resources by using Azure Monitor |__|__5.1.2 Configure log settings

• Question 654:

  You have a Microsoft 365 tenant and an Azure Active Directory (Azure AD) tenant named contoso.com.

  You plan to grant three users named User1, User2, and User3 access to a temporary Microsoft SharePoint document library named Library1.

  You need to create groups for the users. The solution must ensure that the groups are deleted automatically after 180 days.

  Which two groups should you create? Each correct answer presents a complete solution.

  NOTE: Each correct selection is worth one point.

  A. a Microsoft 365 group that uses the Assigned membership type
  B. a Security group that uses the Assigned membership type
  C. a Microsoft 365 group that uses the Dynamic User membership type
  D. a Security group that uses the Dynamic User membership type
  E. a Security group that uses the Dynamic Device membership type
  A. a Microsoft 365 group that uses the Assigned membership type
  C. a Microsoft 365 group that uses the Dynamic User membership type

  ---

  Explanation

  {------------------------------------------------------------------------------------}

  a Microsoft 365 group that uses the Assigned membership type a Microsoft 365 group that uses the Dynamic User membership type

  {------------------------------------------------------------------------------------}

  Microsoft 365 groups support expiration (group lifetime) policies so they can be automatically deleted after a configured period (for example, 180 days). Both assigned membership and dynamic user membership are valid ways to manage membership while still using a Microsoft 365 group.

  Not selected:

  - Security groups (assigned/dynamic user/dynamic device): group expiration policies are targeted at Microsoft 365 groups in this context.

  References:

  1. Microsoft 365 group expiration policy (group lifetime) https://learn.microsoft.com/en-us/microsoft-365/admin/create-groups/expiration-policies Date Modified: Unable to locate date modified Date Accessed: 01/24/2026

  Microsoft Exam Tips:

  - If you need automatic deletion after N days for collaboration resources (Teams/SharePoint), think "Microsoft 365 group expiration."

  Summary:

  Use Microsoft 365 groups (assigned or dynamic) with expiration policy for automatic cleanup.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) | |__ 1.1 Manage Microsoft Entra users and groups | |__ 1.1.2 Manage user and group properties

• Question 655:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json.

  You receive a notification that VM1 will be affected by maintenance.

  You need to move VM1 to a different host immediately.

  Solution: From the Overview blade, you move the virtual machine to a different resource group.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  No

  Moving a VM to a different resource group is an administrative/management operation; it does not move the VM to a different physical host. If the goal is to move the VM to a different host immediately (for maintenance impact), you use a redeploy/migrate-to-new-node action (for example, "Redeploy" in the VM's operations), which shuts down the VM, moves it to a new node, and restarts it.

  Therefore, the proposed solution does not meet the goal.

  Microsoft Exam Tips:

  - "Move to a different host/node" is not the same as "move to a different resource group."

  - Host/node movement is an operational action (redeploy), not a resource organization change.

  Summary:

  Moving a VM to another resource group does not change the underlying host; redeploy is required for host migration.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources  | |__ 3.2 Create and configure virtual machines | |__ 3.2.3 Move a virtual machine to another resource group, subscription, or region

• Question 656:

  HOTSPOT

  You plan to deploy the following Azure Resource Manager (ARM) template.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  LB1 will be connected to a subnet named VNET1/netname: No
  
  LB1 can be deployed only to the resource group that contains VNET1: Yes
  
  The value of the sku variable can be provided as a parameter when the template is deployed from a command prompt: No

  Why this is correct:

  The template’s resourceId() or reference() patterns determine whether the subnet name exactly matches “VNET1/netname” (it does not in this case).

  When a template references a virtual network or subnet without specifying an explicit resource group scope, it assumes the referenced virtual network is in the same resource group as the deployment, making the statement effectively true for this template.

  Variables are not input parameters. Unless the template exposes a parameter and uses it (instead of a variable), you cannot supply that value directly at deployment time.

  Why the other options are incorrect:

  “Yes” for the subnet name would require an exact match to the specified subnet resource name path.

  “No” for the same resource group constraint would require the template to reference the virtual network across resource groups explicitly.

  “Yes” for the sku variable would require sku to be modeled as a parameter.

  Exam Tips:

  If a template uses resourceId() without a resource-group-qualified form, assume the same resource group.

  Only parameters are supplied at deployment time; variables are computed inside the template.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (20–25%)
  
  |__ 4.3 Configure and manage network traffic
  
  |__ 4.3.2 Configure an internal or public load balancer

• Question 657:

  You have a registered DNS domain named contoso.com.

  You create a public Azure DNS zone named contoso.com.

  You need to ensure that records created in the contoso.com zone are resolvable from the internet.

  What should you do?

  A. Create NS records in contoso.com.
  B. Modify the SOA record in the DNS domain registrar.
  C. Create the SOA record in contoso.com.
  D. Modify the NS records in the DNS domain registrar.
  D. Modify the NS records in the DNS domain registrar.

  ---

  Modify the NS records in the DNS domain registrar

  When you create a public Azure DNS zone (contoso.com), records in that zone are only resolvable from the Internet after the domain is delegated to Azure DNS.

  Delegation is done at the domain registrar by updating the domain's NS records to the Azure DNS name servers assigned to the zone. Without updating registrar NS records, public resolvers will continue using the prior authoritative name servers and won't find the records in Azure DNS.

  Why the other options are not correct:

  - Create NS records in contoso.com (zone): Delegation must occur at the registrar; adding NS records inside the zone does not change who is authoritative for the domain on the Internet.

  - Modify the SOA record in the registrar / Create the SOA record in the zone: SOA does not delegate authority; NS delegation does.

  Microsoft Exam Tips:

  - "Publicly resolvable" + "created DNS zone" almost always implies "update NS at the registrar."

  - NS records in the registrar control the authoritative DNS hosting.

  Summary:

  Public DNS delegation to Azure DNS requires updating NS records at the registrar.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking | |__ 4.3 Configure name resolution and load balancing | |__ 4.3.1 Configure Azure DNS

• Question 658:

  Your network contains an on-premises Active Directory forest named contoso.com that contains two domains named contoso.com and east.contoso.com.

  The forest contains the users shown in the following table.

  

  You plan to sync east.contoso.com to an Azure Active Directory (Azure AD) tenant by using Azure AD Connect.

  You need to select an account for Azure AD Connect to use to connect to the forest.

  Which account should you select?

  A. User1
  B. User2
  C. User3
  D. User4
  A. User1

  ---

  Explanation

  --------------------------------------------------------------------------------

  User1 (member of Enterprise Admins)

  --------------------------------------------------------------------------------

  Your cited Microsoft Learn content supports the conclusion that **Enterprise Admin credentials are used by the installation wizard during setup** to connect to/configure Windows Server AD across the forest (including all domains), especially when the wizard is creating/configuring the AD DS Connector account and its permissions.

  Key points from Microsoft Learn (why User1 fits):

  1) Microsoft Learn states that an **"AD DS Enterprise Administrator account"** is (optionally) used during installation to create the required AD DS Connector account. :contentReference[oaicite:0]{index=0} 2) For **Express settings**, Microsoft Learn explicitly indicates the wizard collects **"AD DS Enterprise Administrator credentials"** and uses them to configure Windows Server AD. :contentReference[oaicite:1]{index=1} 3) Microsoft Learn's wizard summary table states (Connect to AD DS): credentials must be **"Member of the Enterprise Admins group"**, used to create the AD DS Connector account and grant permissions; this is particularly relevant when permissions must be set across **multiple domains in the same forest**. :contentReference[oaicite:2]{index=2}

  Why the other options do NOT fit the requirement implied by the wizard-based "connect to the forest" prompt:

  - User2 / User3 (Domain Admins): Domain Admin is scoped to a single domain; it does not inherently provide forest-wide authority needed to easily set permissions across all domains in a multi-domain forest scenario.

  - User4 (Domain Users): Insufficient privileges for the install wizard path that connects to the forest and configures the necessary connector permissions.

  Least-privilege best practice nuance (important):

  - Microsoft Learn also warns that you **cannot** use an Enterprise Admin or Domain Admin account **as the AD DS Connector account** for "Use existing account" (wizard blocks it). In other words, **Enterprise Admin is for setup**, not for ongoing sync operations. :contentReference[oaicite:3]{index=3}

  - Best practice is: use Enterprise Admin credentials **temporarily during install** (if needed), but ensure the **actual AD DS Connector account** used for synchronization is a **normal user** with only the delegated permissions required for the enabled features. :contentReference[oaicite:4]{index=4}

  -------------------------------------------------------------------------------- References:

  1. Microsoft Entra Connect: Accounts and permissions https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/reference-connect-accounts-permissions Date Modified: Unable to locate date modified Date Access: 01/23/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - On Entra Connect questions, distinguish between:

  (a) the **temporary elevated credentials** used by the wizard during installation, and (b) the **AD DS Connector account** used for ongoing synchronization (should be least privilege).

  - AZ-104 commonly tests role/scope thinking: forest vs domain scope mirrors Azure RBAC "scope matters."

  -------------------------------------------------------------------------------- Summary:

  - Microsoft Entra Connect setup in a multi-domain forest

  - Why Enterprise Admin credentials may be required during installation

  - Least-privilege separation between install-time credentials and the ongoing sync connector account

  ----------------------------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.1 Create users and groups

• Question 659:

  DRAG DROP

  You have an Azure subscription that contains a resource group named RG1.

  You plan to create an Azure Resource Manager (ARM) template to deploy a new virtual machine named VM1. VM1 must support the capture of performance data.

  You need to specify resource dependencies for the ARM template.

  In which order should you deploy the resources? To answer, move all resources from the list of resources to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: virtual network

  Step 2: network interface

  Step 3: virtual machine

  Step 4: Azure Monitor extension

  You’re deploying a new VM from an ARM template and it must support capturing performance data.

  Why this order is correct:

  - virtual network

  - Networking foundation. Other network resources (like NICs) must attach to a subnet in a VNet.

  - network interface

  - The VM depends on the NIC because the NIC is attached to the VM at creation time.

  - virtual machine

  - Once the NIC exists, the VM can be deployed.

  - Azure Monitor extension

  - VM extensions are deployed to an existing VM, so the extension must come after the VM exists. The Azure Monitor extension is what enables performance/monitoring data collection on the VM (per the item’s requirement).

  Exam Tips:

  - ARM deployments: let dependencies “cascade” naturally (VNet --> NIC --> VM) and then add extensions after the VM.

  - If a question says “capture performance data,” look for Azure Monitor agent/extension/VM Insights-type enablement.

  Summary:

  ARM dependency ordering for VM deployment plus post-deployment monitoring enablement via an Azure Monitor extension.

  AZ-104 Exam Objective Hierarchy:

  3.0 - Deploy and manage Azure compute resources (20–25%)

  3.1 - Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files

  3.1.4 - Deploy resources by using an Azure Resource Manager template or a Bicep file

• Question 660:

  You have an Azure subscription that contains the resources shown in the following table.

  

  All virtual machines run Windows Server 2016.

  On VM1, you back up a folder named Folder1 as shown in the following exhibit.

  

  You plan to restore the backup to a different virtual machine.

  You need to restore the backup to VM2.

  What should you do first?

  A. From VM1, install the Windows Server Backup feature.
  B. From VM2, install the Microsoft Azure Recovery Services Agent.
  C. From VM1, install the Microsoft Azure Recovery Services Agent.
  D. From VM2, install the Windows Server Backup feature.
  B. From VM2, install the Microsoft Azure Recovery Services Agent.

  ---

  Explanation

  --------------------------------------------------------------------------------

  From VM2, install the Microsoft Azure Recovery Services Agent.

  --------------------------------------------------------------------------------

  The exhibit shows a **Windows Server backup schedule (files/folders)** on VM1, which aligns with Azure Backup's **MARS (Microsoft Azure Recovery Services) agent** file/folder backup approach (not "Azure VM backup" where the VM is protected as an IaaS workload in the vault).

  To restore a MARS-based backup to a **different machine** (VM2), the destination machine must have the **Microsoft Azure Recovery Services (MARS) Agent** installed and registered (or otherwise authorized) to access the vault/recovery point and perform the restore. Therefore, the first step is to **install the MARS agent on VM2**.

  Why the other options are not correct:

  - From VM1, install the Windows Server Backup feature: VM1 already has a backup schedule; this does not enable restoring to VM2.

  - From VM1, install the Microsoft Azure Recovery Services Agent: the restore target is VM2; VM2 needs access to the vault via MARS.

  - From VM2, install the Windows Server Backup feature: Windows Server Backup alone does not connect VM2 to the Recovery Services vault to pull MARS recovery points.

  -------------------------------------------------------------------------------- References:

  1. About the Microsoft Azure Recovery Services (MARS) agent (file/folder backup and restore) https://learn.microsoft.com/en-us/azure/backup/backup-azure-about-mars Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  2. Back up files and folders on Windows Server to Azure (MARS agent workflow; restore prerequisites) https://learn.microsoft.com/en-us/azure/backup/backup-files-to-azure-windows-server Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - Identify the backup type:

  - **MARS agent** = file/folder backup (Windows Server Backup-style schedules; restore can be to same or alternate machine with MARS installed).

  - **Azure VM backup** = protect the VM resource via the vault (restore VM/disks).

  - If the question says "restore to a different VM/machine" for file/folder backups, the destination typically must have the **MARS agent installed** and be able to authenticate to the vault.

  - Exam: AZ-104 often tests choosing between **MARS vs VM backup vs ASR** based on what's being protected and restored.

  -------------------------------------------------------------------------------- Summary:

  To restore an Azure Backup (MARS) file/folder backup to a different VM, install the Recovery Services (MARS) agent on the destination VM first.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10?5%) | |__ 5.2 Implement backup and recovery | |__ 5.2.4 Perform backup and restore operations by using Azure Backup