Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 681:

  You have the Azure virtual machines shown in the following table.

  

  You have a Recovery Services vault that protects VM1 and VM2.

  You need to protect VM3 and VM4 by using Recovery Services.

  What should you do first?

  A. Configure the extensions for VM3 and VM4.
  B. Create a new Recovery Services vault.
  C. Create a storage account.
  D. Create a new backup policy.
  B. Create a new Recovery Services vault.

  ---

  Create a new Recovery Services vault

  A Recovery Services vault must be in the same Azure region as the data source (for Azure VMs, the VM region). Your existing vault is protecting West Europe VMs (VM1/VM2). VM3 and VM4 are in North Europe, so you need a Recovery Services vault in North Europe to protect them. Creating the correct-region vault is the first required step before enabling protection and assigning backup policy.

  Exam Tips:

  - Backup is region-scoped. If VM regions differ, expect multiple vaults (one per region).

  - Read tables carefully; region mismatches are a classic AZ-104 trap (AZ-104).

  Summary:

  Recovery Services vault region requirements for protecting VMs in different regions.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources  | |__ 5.2 Implement backup and recovery | |__ 5.2.1 Create a Recovery Services vault

• Question 682:

  HOTSPOT

  You have an Azure Active Directory (Azure AD) tenant named contoso.com.

  You have two external partner organizations named fabrilcam.com and litwareinc.com. FabtAam.com is configured as a connected organization.

  You create an access package as shown in the Access package exhibit. (Click the Access package lab.)

  

  You configure the external user lifecycle settings as shown in the Lifecycle exhibit. (Click the lifecycle tab)

  

  For each of the following statements, select Yes if the statement is true Otherwise, select No

  Note: Each correct selection is worth one point.

  

  

  ---

  Litwareinc.com users can be assigned to package1: No

  After 365 days, fabrikam.com users will be removed from Group1: No

  After 395 days, fabrikam.com users will be removed from the contoso.com tenant: Yes

  Why these are correct:

  Access packages allow assignments only from the connected organizations configured for the package. If Litwareinc is not included or allowed in the access package configuration, its users cannot be assigned.

  Group membership removal aligns with the access package assignment lifecycle; if the package settings do not expire or revoke access at 365 days, the “365 days” statement is false.

  The lifecycle configuration shown indicates removal of external users from the tenant occurs at 395 days, making the final statement true.

  Why the other options are incorrect:

  Allowing Litwareinc users would require Litwareinc to be part of the connected organization settings for the package (or otherwise explicitly allowed).

  “365 days removed from Group1” would be true only if the package policy or lifecycle revokes group access at that point.

  Exam Tips:

  Entitlement Management is driven by connected organizations and access package policy.

  Watch the difference between “removed from resources” (such as groups) and “removed from tenant” (guest lifecycle).

  Summary:

  Litwareinc is not eligible, 365-day removal from Group1 does not occur, and 395-day removal from the tenant does occur.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20–25%)
  |__ 1.1 Manage Microsoft Entra users and groups
  |__ 1.1.4 Manage external users

• Question 683:

  You have an Azure subscription that contains an Azure container registry named ContReg1.

  You enable the Admin user for ContReg1.

  Which username can you use to sign in to ContReg1?

  A. root
  B. admin
  C. administrator
  D. ContReg1
  D. ContReg1

  ---

  Explanation

  ----------------------------------------------------------------------

  ContReg1

  ----------------------------------------------------------------------

  When the **Admin user** is enabled on an Azure Container Registry (ACR), the registry provides admin credentials where the **username is the registry name**. Therefore, the username used to sign in is **ContReg1**.

  Why the other options are not correct:

  - root / admin / administrator: these are not the ACR admin username format; ACR uses the registry name as the admin username.

  ---------------------------------------------------------------------- References:

  1. Azure Container Registry authentication (admin user concept). https://learn.microsoft.com/en-us/azure/container-registry/ Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  ----------------------------------------------------------------------

  Microsoft Exam Tips:

  - AZ-104: Prefer Microsoft Entra ID / RBAC where possible; "Admin user" is typically a quick-access option and less ideal for production.

  - Know the difference between ACR admin user vs. service principals / managed identity.

  Summary:

  ACR admin user credentials-username equals registry name.

  ---------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.3 Provision and manage containers in the Azure portal |__ 3.3.1 Create and manage an Azure container registry

• Question 684:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  You deploy a load balancer that has the following configurations:

  1. Name: LB1 2. Type: Internal 3. SKU: Standard 4. Virtual network: VNET1 You need to ensure that you can add VM1 and VM2 to the backend pool of LB1.

  Solution: You disassociate the public IP address from the network interface of VM2.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  Yes

  ----------------------------------------------------------------------------------------------------

  This solution meets the goal.

  You need to add VM1 and VM2 to the backend pool of **LB1 (Internal, Standard SKU)**. VM2 currently has a **Basic** public IP SKU. Disassociating the Basic public IP from VM2's NIC removes an SKU mismatch/compatibility blocker that can prevent backend pool association with Standard load-balancing components.

  Why "No" is incorrect:

  - Removing the Basic public IP from VM2 does not prevent backend pool membership; it enables compatibility with Standard scenarios.

  ---------------------------------------------------------------------------------------------------- References:

  1. Azure Load Balancer SKUs (Basic vs Standard) https://learn.microsoft.com/en-us/azure/load-balancer/skus Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - If you see **Standard LB** and a **Basic public IP** in the same scenario, expect a SKU-alignment fix (remove/replace Basic).

  - Internal LB backend pool membership is about NIC configuration + compatibility.

  ---------------------------------------------------------------------------------------------------- Summary:

  Standard internal Load Balancer backend pool membership and resolving Basic public IP compatibility issues.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) | |__ 4.3 Configure name resolution and load balancing | |__ 4.3.2 Configure an internal or public load balancer

• Question 685:

  HOTSPOT

  You plan to use Azure Network Watcher to perform the following tasks:

  1. Task1: Identify a security rule that prevents a network packet from reaching an Azure virtual machine.

  2. Task2: Validate outbound connectivity from an Azure virtual machine to an external host.

  Which feature should you use for each task? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Task 1: IP flow verify
  Task 2: Connection troubleshoot

  Why this is correct:

  • IP flow verify checks whether a packet is allowed or denied to or from a VM based on NSG rules and effective security rules. That directly answers whether traffic is being blocked.
  • Connection troubleshoot helps identify why a VM cannot communicate with a target (including Azure service endpoints) by validating connectivity and surfacing common causes such as NSG, UDR, or DNS issues.

  Exam Tip:

  • Think “Allowed or Denied?” → IP flow verify.
  • Think “Why can’t I reach X?” → Connection troubleshoot.

  AZ-104 Exam Objective Hierarchy
  
  4.0 Implement and manage virtual networking (15–20%)
  └── 4.1 Configure and manage virtual networks
    └── 4.1.5 Troubleshoot network connectivity

• Question 686:

  You have an Azure subscription named Subscription1.

  You have 5 TB of data that you need to transfer to Subscription1.

  You plan to use an Azure Import/Export job.

  What can you use as the destination of the imported data?

  A. an Azure Cosmos DB database
  B. Azure Blob Storage
  C. Azure SQL Database
  D. the Azure File Sync Storage Sync Service
  B. Azure Blob Storage

  ---

  Azure Blob Storage

  Azure Import/Export import jobs support importing data into Azure Storage, including Azure Blobs (Blob Storage). Therefore, Azure Blob Storage is a valid destination.

  Not selected:

  - an Azure Cosmos DB database: not a supported Import/Export import destination.

  - Azure SQL Database: not a supported Import/Export import destination.

  - the Azure File Sync Storage Sync Service: not an Import/Export destination.

  Microsoft Exam Tips:

  - Import/Export is "ship disks" to get data into Storage (Blobs/Files), not PaaS databases.

  Summary:

  Supported destination for Azure Import/Export imported data.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage | |__ 2.2 Configure and manage storage accounts | |__ 2.2.5 Manage data by using Azure Storage Explorer and AzCopy

• Question 687:

  You have a subnet named Subnet1 that contains Azure virtual machines. A network security group (NSG) named NSG1 is associated to Subnet1. NSG1 only contains the default rules.

  You need to create a rule in NSG1 to prevent the hosts on Subnet1 form connecting to the Azure portal. The hosts must be able to connect to other internet hosts.

  To what should you set Destination in the rule?

  A. Application security group
  B. IP Addresses
  C. Service Tag
  D. Any
  C. Service Tag

  ---

  Service Tag

  To block access to the Azure portal while still allowing access to other internet hosts, you use an NSG rule whose destination is a Service Tag (for example, the AzurePortal service tag). Service tags represent a set of IP prefixes for a given Azure service and let you target those endpoints without manually maintaining IP ranges.

  Why other options are not correct:

  • Application security group: Used to group NICs/VMs as sources or destinations inside your VNet, not to represent Azure platform endpoints.
  • IP Addresses: You could attempt to block specific IPs, but Azure portal IP ranges change; this is not maintainable.
  • Any: Would block all internet destinations, violating the requirement.

  Exam Tips:

  • “Block one Azure service but allow general internet” is a strong hint to use Service Tags.
  • Know common tags: AzureCloud, Storage, AzureMonitor, AzureActiveDirectory, AzurePortal (as applicable).

  Summary:

  Target Azure service endpoints in NSG rules by using service tags.

  AZ-104 Exam Objective Hierarchy:
  4.0 Implement and Manage Virtual Networking (15–20%)
  |__ 4.2 Configure Secure Access to Virtual Networks
  |__ 4.2.1 Create and Configure Network Security Groups (NSGs) and Application Security Groups

• Question 688:

  HOTSPOT

  You have an Azure subscription named Sub1 that contains the Azure resources shown in the following table.

  

  You assign an Azure policy that has the following settings:

  1. Scope: Sub1 2. Exclusions: Sub1/RG1/VNET1 3. Policy definition: Append a tag and its value to resources 4. Policy enforcement: Enabled 5. Tag name: Tag4 6. Tag value: value4

  You assign tags to the resources as shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Statement 1: Yes Statement 2: No Statement 3: No

  Explanation (Why this is correct)

  - The policy uses an “append/modify tag” behavior at the scope it is assigned (RG1), so RG1 can end up with Tag2:IT applied.

  - Tags are not “inherited” from a resource group to resources automatically; resources must be explicitly tagged (or modified by policy).

  - The policy includes an exclusion for VNET1, so VNET1 will not get the tag via policy.

  Explanation (Why the other options are incorrect)

  - Storage1 won’t automatically get all RG tags unless the policy explicitly modifies Storage1 (and unless it’s not excluded).

  - VNET1 is excluded, so it won’t receive Tag2/Tag3 through this policy assignment.

  Exam Tip

  - Remember: **Resource group tags do not automatically propagate** to contained resources unless you use policy/automation to enforce it.

  References

  - Microsoft. (n.d.). Azure Policy overview. https://learn.microsoft.com/en-us/azure/governance/policy/overview

  - Microsoft. (n.d.). Use Azure Policy to enforce tag governance. https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#tags

  AZ-104 Exam Objective Hierarchy 1.0 Manage Azure identities and governance (20–25%) |__1.3 Manage Azure subscriptions and governance |__|__1.3.1 Implement and manage Azure Policy |__|__1.3.3 Apply and manage tags on resources

• Question 689:

  You plan to deploy several Azure virtual machines that will run Windows Server 2019 in a virtual machine scale set by using an Azure Resource Manager template.

  You need to ensure that NGINX is available on all the virtual machines after they are deployed.

  What should you use?

  A. Azure Custom Script Extension
  B. Deployment Center in Azure App Service
  C. the New-AzConfigurationAssignment cmdlet
  D. a Microsoft Endpoint Manager device configuration profile
  A. Azure Custom Script Extension

  ---

  Azure Custom Script Extension

  To ensure NGINX is installed on all instances of a VM scale set deployed via an ARM template, you use the "Custom Script Extension". It runs scripts (for example, PowerShell on Windows) after deployment to install and configure software consistently across all VM instances.

  Why other selections are not correct:

  - Deployment Center in Azure App Service: Applies to App Service deployments, not VMSS software installation.

  - New-AzConfigurationAssignment cmdlet: Azure Policy/Guest Configuration path; not the direct "install software during deployment" mechanism expected here.

  - Microsoft Endpoint Manager device configuration profile: Endpoint management approach, not the ARM/VMSS deployment-time installation method.

  Microsoft Exam Tips:

  - "Install software post-deploy on VMs/VMSS" --> Custom Script Extension is a frequent answer.

  - For VMSS, extensions can be baked into the model so new instances inherit the configuration automatically.

  Summary:

  Automating software installation on VM scale sets using VM extensions.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources  |__ 3.2 Create and configure virtual machines |__ 3.2.7 Deploy and configure an Azure Virtual Machine Scale Sets

• Question 690:

  You recently created a new Azure subscription that contains a user named Admin1.

  Admin1 attempts to deploy an Azure Marketplace resource by using an Azure Resource Manager template. Admin1 deploys the template by using Azure PowerShell and receives the following error message: "User failed validation to purchase resources. Error message: "Legal terms have not been accepted for this item on this subscription. To accept legal terms, please go to the Azure portal (http://go.microsoft.com/fwlink/?LinkId=534873) and configure programmatic deployment for the Marketplace item or create it there for the first time."

  You need to ensure that Admin1 can deploy the Marketplace resource successfully.

  What should you do?

  A. From Azure PowerShell, run the Set-AzApiManagementSubscription cmdlet
  B. From the Azure portal, register the Microsoft.Marketplace resource provider
  C. From Azure PowerShell, run the Set-AzMarketplaceTerms cmdlet
  D. From the Azure portal, assign the Billing administrator role to Admin1
  C. From Azure PowerShell, run the Set-AzMarketplaceTerms cmdlet

  ---

  Explanation

  --------------------------------------------------------------------------------

  From Azure PowerShell, run the Set-AzMarketplaceTerms cmdlet

  --------------------------------------------------------------------------------

  The deployment failed because the Azure Marketplace offer's legal terms have not been accepted for this subscription. When you deploy certain Marketplace resources (especially VM images/offers) via ARM templates, PowerShell, or CLI, the subscription must first have the Marketplace terms accepted, otherwise you receive a "Legal terms have not been accepted..." validation error. The PowerShell path is to retrieve the terms (Get-AzMarketplaceTerms) and then accept them (Set-AzMarketplaceTerms) so subsequent programmatic deployments succeed. (1)(2)

  Why the other selections are not correct:

  - From Azure PowerShell, run the Set-AzApiManagementSubscription cmdlet:

  This manages API Management subscriptions, not Marketplace purchase eligibility or legal terms.

  - From the Azure portal, register the Microsoft.Marketplace resource provider:

  Provider registration is not the same thing as accepting an offer's legal terms; the error is specifically about legal terms acceptance.

  - From the Azure portal, assign the Billing administrator role to Admin1:

  The error indicates missing Marketplace legal terms acceptance, not a billing RBAC role assignment.

  --------------------------------------------------------------------------------

  References:

  1. Set-AzMarketplaceTerms (Az.MarketplaceOrdering) https://learn.microsoft.com/en-us/powershell/module/az.marketplaceordering/set-azmarketplaceterms?view=azps-15.1.0 Date Modified: Unable to locate date modified on this page in the available view (PowerShell cmdlet pages do not consistently display it) Date Access: 01/24/2026 2. Programmatic deployment of Microsoft Marketplace products https://learn.microsoft.com/en-us/marketplace/programmatic-deploy-of-marketplace-products Date Modified: 09/25/2025 Date Access: 01/24/2026

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - AZ-104 frequently tests "programmatic deployment prerequisites." Marketplace-based deployments can fail until the subscription accepts legal terms.

  - Remember the common pattern: Get-AzMarketplaceTerms --> Set-AzMarketplaceTerms -Accept.

  Summary:

  Accepting Azure Marketplace legal terms to enable successful ARM/PowerShell deployment.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  (Note: Only a partial hierarchy is available in this chat. Mapping below is best-fit to the visible objective set.) 3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.1 Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files |__ 3.1.x Deploy resources by using an Azure Resource Manager template (ARM deployment prerequisites)