Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 671:

  HOTSPOT

  You need to implement the planned changes for the new containers.

  Which Azure services can you use for each image? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Correct Answer:

  image1: App Service, Azure Container Apps, or Azure Container Instances image2: App Service, Azure Container Apps, or Azure Container Instances

  Explanation: The planned changes require deploying container images and the technical requirements do not restrict the solution to a single container runtime. App Service (Web App for Containers), Azure Container Apps, and Azure Container Instances are all valid services for running container images, so both images can use any of these services.

  Proof / Reasoning:

  Each of the listed services supports running container images; no additional constraints in the case study exclude any of them for the new containers.

  References (APA):

  Microsoft. (n.d.). Azure Container Apps overview. Retrieved 2026-01-31, from https://learn.microsoft.com/en-us/azure/container-apps/overview Microsoft. (n.d.). Azure Container Instances overview. Retrieved 2026-01-31, from https://learn.microsoft.com/en-us/azure/container-instances/container-instances-overview Microsoft. (n.d.). Deploy a custom container to Azure App Service. Retrieved 2026-01-31, from https://learn.microsoft.com/en-us/azure/app-service/quickstart-custom-container

  AZ-104 Exam Objective Hierarchy: 3.0 Deploy and manage Azure compute resources (20–25%) |__3.3 Provision and manage containers in the Azure portal |__|__3.3.1 Create and manage an Azure container registry

• Question 672:

  You have an Azure virtual machine named VM1.

  You need VM1 to access an Azure Key Vault without storing any credentials in code or configuration.

  What should you do?

  A. Enable a system-assigned managed identity on the virtual machine.
  B. Generate a shared access signature (SAS) token for the Key Vault.
  C. Use a storage account access key to authenticate to Key Vault.
  D. From Azure Cloud Shell, run Select- AzSubscription.
  A. Enable a system-assigned managed identity on the virtual machine.

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  Enable a system-assigned managed identity on the virtual machine.

  ----------------------------------------------------------------------------------------------------

  Why the correct selection is correct:

  - Enable a system-assigned managed identity on the virtual machine.

  - A system-assigned managed identity provides an identity for VM1 in Microsoft Entra ID. VM1 can then request tokens to access Azure resources (like Key Vault) without managing secrets in code. You grant access by assigning permissions/ RBAC to that identity.

  Why the other selections are incorrect:

  - Generate a shared access signature (SAS) token for the Key Vault.

  - SAS tokens apply to Azure Storage services, not Key Vault.

  - Use a storage account access key to authenticate to Key Vault.

  - Storage keys are for Azure Storage authentication, not Key Vault.

  - Create a client secret for an app registration and store it on VM1.

  - This explicitly introduces a secret to manage and store, which violates the "no credentials stored" requirement. Managed identities eliminate this secret management.

  ---------------------------------------------------------------------------------------------------- References:

  1. Enable a system-assigned managed identity on an Azure VM (concept and steps) https://learn.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/qs-configure-portal-windows-vm Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - "No credentials stored" almost always points to Managed Identities.

  - Remember: Managed identity must still be granted access (RBAC/Key Vault permissions) after enabling it.

  ---------------------------------------------------------------------------------------------------- Summary:

  Using managed identities to access Azure services securely without embedded secrets.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.2 Manage access to Azure resources |__ 1.2.2 Assign roles at different scopes

• Question 673:

  HOTSPOT

  You plan to deploy an Azure virtual machine named VM1 by using an Azure Resource Manager template.

  You need to complete the template.

  What should you include in the template? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  West US public IPs: 2 Total public IPs created: 4

  Explanation (Why this is correct)

  - The template uses resourceGroup().location (not the “location” parameter) to set the public IP location.

  - Two deployments target RG1 (West US) --> two IPs in West US.

  - Two deployments target RG2 (East US) --> two IPs in East US.

  - Total created = 4 across both resource groups.

  Explanation (Why the other options are incorrect)

  - Answers that treat the “location parameter” as the resource location ignore the variable assignment that forces resourceGroup().location.

  Exam Tip

  - Always check whether the template uses **parameters('location')** vs **resourceGroup().location**.

  References

  - Microsoft. (n.d.). ARM template functions: resourceGroup. https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/template-functions-resource#resourcegroup

  - Microsoft. (n.d.). Public IP address resource. https://learn.microsoft.com/en-us/azure/templates/microsoft.network/publicipaddresses

  AZ-104 Exam Objective Hierarchy 3.0 Deploy and manage Azure compute resources (20–25%) |__3.1 Automate deployment of resources by using templates |__|__3.1.1 Create and execute an Azure Resource Manager template

• Question 674:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json.

  You receive a notification that VM1 will be affected by maintenance.

  You need to move VM1 to a different host immediately.

  Solution: From the resource group blade, move VM1 to another subscription.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  No

  Moving a VM to another subscription (resource move) does not move the VM to a different physical host. It changes administrative ownership or billing scope, not the underlying host placement. Therefore, it does not meet the requirement to move the VM to a different host immediately.

  The Azure operation intended to move a VM to a different host is typically “Redeploy,” which forces the VM onto a new node in the Azure infrastructure.

  Microsoft Exam Tips:

  “Move to another host immediately” usually maps to VM Redeploy, not subscription or resource moves.

  Summary:

  VM maintenance impact mitigation: host move via redeploy.

  AZ-104 Exam Objective Hierarchy:
  
  3.0 Deploy and manage Azure compute resources (20–25%)
  
  3.2 Create and configure virtual machines
  
  3.2.3 Move a virtual machine to another resource group, subscription, or region

• Question 675:

  You create an App Service plan named plan1 and an Azure web app named webapp1. You discover that the option to create a staging slot is unavailable. You need to create a staging slot for plan1.

  What should you do first?

  A. From webapp1, modify the Application settings.
  B. From webapp1, add a custom domain.
  C. From plan1, scale up the App Service plan.
  D. From plan1, scale out the App Service plan.
  C. From plan1, scale up the App Service plan.

  ---

  Explanation

  --------------------------------------------------------------------------------

  From plan1, scale up the App Service plan.

  --------------------------------------------------------------------------------

  Deployment slots are a capability that depends on the App Service plan tier. If the option is unavailable, the plan is typically on a tier that doesn't support slots. "Scale up" changes the pricing tier to one that supports deployment slots (for example, Standard or higher). (1)

  Why the other selections are not correct:

  - From webapp1, modify the Application settings: App settings do not enable a missing plan-tier feature like slots.

  - From webapp1, add a custom domain: Custom domains are unrelated to slot availability.

  - From plan1, scale out the App Service plan: Scale-out adds instances; it does not change tier-based feature availability such as deployment slots. (1)

  -------------------------------------------------------------------------------- References:

  { 1. Azure App Service Plans (scaling up changes tier/capabilities) https://learn.microsoft.com/en-us/azure/app-service/overview-hosting-plans Date Modified: Nov 18, 2025 Date Accessed: 01/25/2026

  }

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - "Scale up" = change SKU/tier (features/capabilities).

  - "Scale out" = add instances (capacity), not features like slots.

  Summary:

  App Service plan tier governs feature availability (deployment slots).

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.4 Create and configure Azure App Service |__ 3.4.2 Configure scaling for an App Service plan

• Question 676:

  HOTSPOT

  You purchase a new Azure subscription.

  You create an Azure Resource Manager (ARM) template named deploy.json as shown in the following exhibit.

  

  You connect to the subscription and run the following command.

  New-AzDeployment –Location westus –TemplateFile “deploy.json”

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  - Three resource groups are created when you run the script: No

  - A resource group named RGGroup5 is created: No

  - All the resource groups are created in the East US Azure region: Yes

  Explanation (Why this is correct) From the template:

  - Resource group #1 uses a copy loop with "count": 2 and name concat('RGs', copyIndex()) --> creates RGs0 and RGs1 (2 RGs).

  - Resource group #2 name concat('ResGrp','8') --> creates ResGrp8 (1 RG).

  - Resource group #3 name concat('RGroup', length(parameters('obj1'))) --> obj1 has 4 top-level properties --> creates RGroup4 (1 RG).

  Total = 2 + 1 + 1 = 4 RGs --> therefore “Three resource groups …” is No.

  No RG is named RGGroup5 --> second statement is No.

  All locations resolve to eastus (explicit eastus, last(var1)=eastus, and part1 default=eastus) --> third statement is Yes.

  Evidence (Excerpts)

  - Subscription-scope deployments use a deployment location parameter, but resources still use their own "location" values in the template.

  - Copy iteration creates multiple instances based on the specified count/index behavior.

  AZ-104 Exam Objective Hierarchy 3.0 Deploy and manage Azure compute resources (20–25%)

  |__3.1 Automate deployment of resources by using ARM templates or Bicep |__|__3.1.1 Interpret an Azure Resource Manager template or a Bicep file |__|__3.1.4 Deploy resources by using Azure Resource Manager templates or Bicep

  References (APA; full URL only) Microsoft. (n.d.). Deploy resources to subscription - Azure Resource Manager. Last updated 2025-08-01. Accessed 2026-01-29. https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-to-subscription Microsoft. (n.d.). Copy resources in ARM templates. Last updated 2025-08-05. Accessed 2026-01-29. https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/copy-resources

• Question 677:

  You need to meet the technical requirement for VM4. What should you create and configure?

  A. an Azure Notification Hub
  B. an Azure Event Hub
  C. an Azure Logic App
  D. an Azure services Bus
  C. an Azure Logic App

  ---

  Explanation

  To automate notifications based on VM changes, a common pattern is: Event Grid captures the VM resource event and triggers a Logic App, which can then send email or post messages (for example to Teams) without requiring custom code.

  References Monitor changes to a virtual machine using Event Grid and Logic Apps. (Last updated 2025-08-11). Retrieved 2026-01-31 from https://learn.microsoft.com/en-us/azure/event-grid/monitor-virtual-machine-changes-event-grid-logic-app AZ-104 Exam Objective Hierarchy (Mapped to this question) 5.0 Monitor and maintain Azure resources (10–15%) |__5.1 Monitor resources in Azure |__|__5.1.4 Set up alert rules, action groups, and alert processing rules in Azure Monitor

• Question 678:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the following users in an Azure Active Directory tenant named contoso.onmicrosoft.com:

  

  User1 creates a new Azure Active Directory tenant named external.contoso.onmicrosoft.com.

  You need to create new user accounts in external.contoso.onmicrosoft.com.

  Solution: You instruct User4 to create the user accounts.

  Does that meet the goal?

  A. yes
  B. No
  B. No

  ---

  Explanation

  ------------------------------------------------------------------------------------------------------------------------

  No

  ------------------------------------------------------------------------------------------------------------------------

  The goal is to create new user accounts in the NEW Microsoft Entra (Azure AD) tenant: external.contoso.onmicrosoft.com.

  User4 is only an **Owner** at the **Azure Subscription** scope (Azure RBAC). That permission applies to managing **Azure resources** in the subscription and does **not** grant directory permissions in the new tenant to create users.

  Creating user accounts in a tenant requires an appropriate **Microsoft Entra directory role** in that tenant (for example, **User Administrator** or **Global Administrator**). Microsoft Learn also states that the person who creates a new tenant becomes a **Global Administrator** of that tenant by default-so User1 (the tenant creator) can create the users, but User4 cannot unless explicitly granted a directory role in external.contoso.onmicrosoft.com. (1) (2)

  ------------------------------------------------------------------------------------------------------------------------

  References:

  1. Microsoft Learn - "How an Azure subscription is associated with Microsoft Entra ID" https://learn.microsoft.com/en-us/entra/fundamentals/how-subscriptions-associated-directory Date Modified: 08/28/2025 Date Access: 01/23/2026

  2. Microsoft Learn - "Microsoft Entra built-in roles (Permissions reference)" (See: **User Administrator** role permissions, including "Create users") https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference Date Modified: 01/22/2026 Date Access: 01/23/2026

  ------------------------------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - AZ-104 commonly tests the boundary between **Azure RBAC (subscription/resource roles)** and **Microsoft Entra ID directory roles**. Do not assume "Owner" in Azure can manage Entra users.

  - When a scenario says "create users in the directory/tenant," think **User Administrator / Global Administrator** (directory roles), not subscription roles.

  ------------------------------------------------------------------------------------------------------------------------

  Summary:

  This question tested the difference between Azure subscription RBAC roles and Microsoft Entra ID directory roles, and which roles can create users in a newly created tenant.

  ------------------------------------------------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.1 Create users and groups

• Question 679:

  DRAG DROP

  You have an Azure subscription that contains a virtual machine name VM1.

  VM1 has an operating system disk named Disk1 and a data disk named Disk2.

  You need to back up Disk2 by using Azure Backup.

  Which three actions should you perform in sequence? To answer, move the appropriate actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Step 1: Create an Azure Backup vault
  
  Step 2: Create a backup policy and configure the backup
  
  Step 3: Configure a managed identity
  
  You need to back up Disk2 (a managed disk) by using Azure Backup. For Azure Disk Backup (managed disks), you use a Backup vault (not a Recovery Services vault). The vault’s managed identity is used to access the disk and manage snapshots, and you then create and configure the backup according to the policy.

  Why this order is correct:
  
  Create an Azure Backup vault
  
  Establishes the vault resource used for disk backup and the control plane for the backup configuration.

  Create a backup policy and configure the backup
  
  The policy defines the schedule and retention, and configuring the backup on Disk2 makes it protected by Azure Backup.

  Configure a managed identity
  
  Disk Backup relies on a managed identity for RBAC-based access to the source disk and snapshot resource group; configuring or enabling the vault identity is a required part of enabling protection.

  Why the other actions are not selected:

  Create a Recovery Services vault
  
  This vault type is used for Azure VM backup and several other workloads; disk backup specifically uses Backup vaults.

  Delegate permissions for the vault
  
  While permissions are required, the expected action in this item is explicitly “Configure a managed identity” (the mechanism used for RBAC with a Backup vault).

  Microsoft Exam Tips:
  
  Disk Backup = Backup vault (Data Protection), not Recovery Services vault.

  If you see “managed disks” + “Azure Backup vault,” assume managed identity + RBAC roles are part of the enablement process.

  Summary:
  
  Protect a managed data disk by using Azure Disk Backup with a Backup vault, a backup policy, and a vault managed identity for RBAC-based access.

  AZ-104 Exam Objective Hierarchy:
  
  5 - Monitor and maintain Azure resources (10–15%)
  
  |__ 5.2 - Implement backup and recovery
  
  |__ 5.2.2 - Create an Azure Backup vault
  
  |__ 5.2.3 - Create and configure a backup policy
  
  |__ 5.2.4 - Perform backup and restore operations by using Azure Backup

• Question 680:

  You have an Azure subscription that uses the public IP addresses shown in the following table.

  

  You need to create a public Azure Standard Load Balancer.

  Which public IP addresses can you use?

  A. IP1, IP2, and IP3
  B. IP2 only
  C. IP3 only
  D. IP1 and IP3 only
  C. IP3 only

  ---

  IP3 only

  A Public Standard Load Balancer requires a Standard SKU public IP address for its frontend configuration, and Standard public IP addresses used with load balancers are typically configured with static assignment. From the table, only IP3 is Standard SKU and Static, so it is the only valid choice.

  Why the other options are not correct:

  • IP1 and IP2 are Basic SKU public IP addresses; Basic and Standard SKUs cannot be mixed for a Standard Load Balancer frontend.
  • IP2 is also Dynamic, which is not appropriate for the Standard Load Balancer frontend scenario.

  Exam Tips:

  • Standard Load Balancer → Standard Public IP (SKU alignment matters).
  • In exam questions, “Standard Load Balancer” is a strong signal to verify SKU and allocation method constraints.

  Summary:
  
  Selecting compatible Public IP SKU and allocation settings for a Standard Load Balancer frontend.

  AZ-104 Exam Objective Hierarchy:
  
  4.0 Implement and manage virtual networking (15–20%)
  └── 4.3 Configure name resolution and load balancing
    └── 4.3.2 Configure an internal or public load balancer