Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 691:

  HOTSPOT

  You have an Azure subscription named Subscription1 that contains the quotas shown in the following table.

  

  You deploy virtual machine to Subscription1 as shown in the following table.

  

  You plan to deploy the virtual machines shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Yes

  Box 2: No

  Box 3: No

  Explanation:

  Key idea: **vCPU quotas apply to deployed cores in the region/family**, not just “running” cores.

  Existing deployed VMs in West US:

  - VM1 = Standard_B2ms = 2 vCPUs

  - VM20 = Standard_B16ms = 16 vCPUs (even if stopped/deallocated, the deployed VM resource still counts toward core quota)

  Total already deployed (B-family and regional) = 2 + 16 = 18 vCPUs.

  Quotas:

  - Standard BS Family vCPUs: 20 total --> remaining = 2

  - Total Regional vCPUs: 20 total --> remaining = 2

  Planned deployments:

  - VM3 = Standard_B2ms = 1 vCPU --> fits (remaining becomes 1) --> Box 1 Yes

  - VM4 = Standard_D4s_v3 = 4 vCPUs --> exceeds remaining regional cores (only 2 left) --> Box 2 No

  - VM5 = Standard_B16ms = 16 vCPUs --> exceeds remaining BS-family cores (only 2 left) --> Box 3 No

  Why the other options are not correct:

  - “Yes” for VM4 assumes you have 4 regional vCPUs available, but you only have 2 remaining.

  - “Yes” for VM5 assumes you have 16 BS-family vCPUs available, but you only have 2 remaining.

  References:

  Microsoft. (n.d.). Azure subscription and service limits, quotas, and constraints (Compute cores). Last updated: Unable to locate on page. Date accessed: 2026-01-27. https://learn.microsoft.com/en-us/azure/azure-resource-manager/ management/azure-subscription-service-limits Microsoft. (n.d.). Increase vCPU quotas. Last updated: Unable to locate on page. Date accessed: 2026-01-27. https://learn.microsoft.com/en-us/azure/quotas/per-subscription

  Microsoft Exam Tips:

  - Core quotas are a very common deployment blocker. If a VM won’t deploy, check regional/family vCPU quota first.

  - Deallocated VMs can still count toward quota in exam scenarios focused on “deployed capacity.”

  Summary:

  This question tested compute quota math across family and regional vCPU limits.

  AZ-104 Exam Objective Hierarchy:

  3.0 - Deploy and manage Azure compute resources (20–25%) |__ 3.2 - Create and configure virtual machines |__ |__ 3.2.1 - Create a virtual machine

• Question 692:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You need to ensure that an Azure Active Directory (Azure AD) user named Admin1 is assigned the required role to enable Traffic Analytics for an Azure subscription.

  Solution: You assign the Traffic Manager Contributor role at the subscription level to Admin1.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  Traffic Analytics is part of Network Watcher/NSG flow logs analytics. Assigning the Traffic Manager Contributor role does not grant the permissions required to configure/enable Traffic Analytics at the subscription scope. Traffic Analytics requires appropriate Network Watcher permissions, typically via Owner/Contributor/Network Contributor at the required scope.

  Why the proposed solution fails:

  - Traffic Manager Contributor is for Traffic Manager resources (profiles/endpoints), not Network Watcher/Traffic Analytics configuration.

  -------------------------------------------------------------------------------- References:

  1. Traffic Analytics - Required RBAC permissions https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics Date Modified: 12/06/2024 Date Access: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: Don't confuse similarly named services (Traffic Manager vs Traffic Analytics).

  - Validate role requirements before assuming a "Contributor"-named role applies.

  -------------------------------------------------------------------------------- Summary:

  Traffic Manager Contributor does not satisfy RBAC needs for enabling Traffic Analytics.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.2 Manage access to Azure resources |__ 1.2.2 Assign roles at different scopes

• Question 693:

  You have a Microsoft Entra tenant.

  You plan to perform a bulk import of users.

  You need to ensure that imported user objects are added automatically as the members of a specific group based on each user's department. The solution must minimize administrative effort.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. Create groups that use the Assigned membership type.
  B. Create an Azure Resource Manager (ARM) template.
  C. Create groups that use the Dynamic User membership type.
  D. Write a PowerShell script that parses an import file.
  E. Create an XML file that contains user information and the appropriate attributes.
  F. Create a CSV file that contains user information and the appropriate attributes.
  C. Create groups that use the Dynamic User membership type.
  F. Create a CSV file that contains user information and the appropriate attributes.

  ---

  Create groups that use the Dynamic User membership type.

  Create a CSV file that contains user information and the appropriate attributes.

  To automatically add imported users to a group based on department with minimal admin effort:

  1) Import users in bulk using a CSV that includes the department attribute.

  2) Use a Dynamic User membership group with a rule based on the department value(s). Membership is then maintained automatically.

  Why other selections are not correct:

  - Assigned membership: requires manual membership management.

  - ARM template: not the standard mechanism for bulk user import and dynamic membership rules.

  - PowerShell parsing scripts / XML: higher effort than the built-in CSV import path and unnecessary here.

  Exam Tips:

  - "Automatically add users based on attributes" almost always means "Dynamic User group rule."

  Summary:

  - Bulk user import + dynamic group membership based on attributes

• Question 694:

  HOTSPOT

  You have an Azure AD tenant named adatum.com that contains the groups shown in the following table.

  

  Adatum.com contains the users shown in the following table.

  

  You assign an Azure Active Directory Premium P2 license to Group1 as shown in the following exhibit.

  

  Group2 is NOT directly assigned a license.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point

  

  

  ---

  You can assign User1 the Microsoft Defender for Cloud Apps Discovery license. -> No

  You can remove the Azure Active Directory Premium P2 license from User1. -> No

  User2 is assigned the Azure Active Directory Premium P2. -> No

  Why this is correct:

  - “Microsoft Defender for Cloud Apps Discovery” is not assigned as an independent license in the way the statement implies.

  - If User1 receives Azure AD Premium P2 via group-based licensing, you don’t remove it directly from the user; you change group membership or licensing assignment rules.

  - Nested group membership does not result in license assignment to User2 when the license is assigned to Group1 and User2 is only in Group2 (nested).

  Why the other options are incorrect:

  - “Yes” to statement 3 assumes nested groups inherit group-based licenses automatically in this configuration.

  Exam Tips:

  - Group-based licensing typically evaluates direct membership for assignment; nested groups can be a trap.

  - “Remove from a user” usually means remove from the assignment source (group), not toggle it off per-user.

  Summary:

  No, No, No.

• Question 695:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure virtual machine named VM1 that runs Windows Server 2016.

  You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour.

  Solution: You create an Azure storage account and configure shared access signatures (SASs). You install the Microsoft Monitoring Agent on VM1. You create an alert in Azure Monitor and specify the storage account as the source.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  The proposed solution does not meet the goal.

  To alert when "more than two error events are logged to the System event log on VM1 within an hour," Azure Monitor typically requires collecting Windows Event Logs into a Log Analytics workspace (or equivalent ingestion path) and then creating a log query alert (scheduled query rule) over that workspace data.

  In the proposed solution:

  - A storage account with SAS is not the correct "source" for Windows Event Log-based alerting in Azure Monitor.

  - Installing an agent alone is insufficient if you are not sending event logs to a supported data store (commonly Log Analytics workspace) and alerting from that workspace.

  Why the solution fails:

  - Specifying a storage account as the source for this type of event-log threshold alert is not the standard/valid approach for Azure Monitor log alerts.

  -------------------------------------------------------------------------------- References:

  1. Azure Monitor log alerts (scheduled query rules) overview https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-log Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  2. Collect Windows event logs with Azure Monitor (agent + data collection concepts) https://learn.microsoft.com/en-us/azure/azure-monitor/agents/data-collection-windows-events Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - If the requirement is "count events in Windows Event Log over time," it's usually a Log Analytics ingestion + log query alert pattern.

  - Storage accounts are common for diagnostics logs archival, not for event-log threshold alerting.

  -------------------------------------------------------------------------------- Summary:

  The proposed storage account + SAS "source" is not the correct method to alert on Windows System event log counts; therefore, the solution does not meet the goal.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10?5%) |__ 5.1 Monitor resources in Azure |__ 5.1.4 Set up alert rules, action groups, and alert processing rules in Azure Monitor

• Question 696:

  You need to create an Azure Storage account named storage1. The solution must meet the following requirements:

  1. Support Azure Data Lake Storage.

  2. Minimize costs for infrequently accessed data.

  3. Automatically replicate data to a secondary Azure region.

  Which three options should you configure for storage1? Each correct answer presents part of the solution.

  NOTE: Each correct answer is worth one point.

  A. zone-redundant storage (ZRS)
  B. the Cool access tire
  C. geo-redundant storage (GRS)
  D. the Hot access tier
  E. hierarchical namespace
  B. the Cool access tire
  C. geo-redundant storage (GRS)
  E. hierarchical namespace

  ---

  the Cool access tier

  geo-redundant storage (GRS)

  hierarchical namespace

  - hierarchical namespace: Required to enable Azure Data Lake Storage Gen2 capabilities on the storage account.

  - the Cool access tier: Designed for infrequently accessed data at lower storage cost than Hot.

  - geo-redundant storage (GRS): Replicates data to a paired secondary region for regional durability.

  Why the other options are not correct:

  - zone-redundant storage (ZRS): Replicates across zones within the same region, not to a secondary region.

  - the Hot access tier: Optimized for frequent access; higher storage cost than Cool for infrequent access.

  Microsoft Exam Tips:

  - AZ-104 expects you to map: ADLS Gen2 --> hierarchical namespace.

  - Regional replication requirement --> GRS/RA-GRS (not ZRS).

  - Cost optimization for infrequent access --> Cool (or Archive when explicitly stated and supported).

  Summary:

  - Storage account configuration for ADLS Gen2 + cost tiering + cross-region redundancy.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage  | |__ 2.2 Configure and manage storage accounts | |__ 2.2.1 Create and configure storage accounts

• Question 697:

  HOTSPOT

  You have an Azure subscription that contains the storage accounts shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Premium file share: contoso104 only Archive access tier: contoso101 and contoso103 only

  Why this is correct:

  - Premium file shares require a FileStorage account (premium performance for Azure Files). In the table, that’s contoso104.

  - Archive tier is supported for blob data in accounts that support blob tiering (StorageV2 and BlobStorage). In the table, those are contoso101 (StorageV2) and contoso103 (BlobStorage).

  - General-purpose v1 (Storage) doesn’t support Archive tiering, and FileStorage is for premium Azure Files (not blob archive tiering).

  Exam Tips:

  - Premium Azure Files --> FileStorage.

  - Archive tier --> blob tiering --> StorageV2 or BlobStorage.

• Question 698:

  You create an Azure Storage account.

  You plan to add 10 blob containers to the storage account.

  For one of the containers, you need to use a different key to encrypt data at rest.

  What should you do before you create the container?

  A. Generate a shared access signature (SAS).
  B. Modify the minimum TLS version.
  C. Rotate the access keys.
  D. Create an encryption scope.
  D. Create an encryption scope.

  ---

  Create an encryption scope

  To use a different key to encrypt data at rest for one specific blob container, you use an encryption scope. Encryption scopes let you define an encryption configuration at the storage account level (Microsoft-managed key or customer- managed key via Azure Key Vault) and then apply that scope to a specific container (as the default encryption scope) or to individual blobs. Therefore, before creating the container, you create the required encryption scope so it can be selected as the container's default encryption scope.

  Why other selections are not correct:

  - Generate a shared access signature (SAS): SAS controls delegated access (authorization) to storage resources; it does not change how data at rest is encrypted.

  - Modify the minimum TLS version: TLS affects encryption in transit for client connections; it does not control encryption at rest keys per container.

  - Rotate the access keys: Rotating account access keys impacts authentication for shared key/SAS signing; it does not control per-container encryption keys.

  Exam Tips:

  - If the requirement is "different key for some blobs/one container," think encryption scope (granular encryption at rest).

  - Don't confuse: TLS (in transit), SAS/keys (access), encryption scopes/CMK (encryption at rest).

  Summary:

  Using Azure Storage encryption scopes to apply a distinct encryption key at rest to a specific container/blobs.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage  |__ 2.2 Configure and manage storage accounts |__ 2.2.4 Configure storage account encryption

• Question 699:

  DRAG DROP

  You need to configure the alerts for VM1 and VM2 to meet the technical requirements.

  Which three actions should you perform in sequence? To answer, move all actions from the list of actions to the answer area and arrange them in the correct order.

  Select and Place:

  

  

  ---

  Correct answer 1) Create a Log Analytics workspace.

  2) Collect Windows performance counters from the Log Analytics agents.

  3) Create an alert rule.

  Detailed explanation Log search alerts (KQL-based) require a Log Analytics workspace to store and query the telemetry.

  After the workspace exists, you must configure data collection so that the required Windows performance counters are ingested into that workspace (via agent/DCR configuration).

  Only after data is available in the workspace should you create the alert rule that queries the workspace data and triggers actions.

  Proof / references used Case study (Contoso, Ltd. 2 Case Study.pdf), “Technical requirements – Monitoring”.

  Microsoft Learn – Create Azure Monitor log search alert rules. URL: https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-create-log-alert-rule. Retrieved January 31, 2026. (Last updated 2025-12-08.) Microsoft Learn – Log Analytics workspace overview. URL: https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-analytics-workspace-overview. Retrieved January 31, 2026. (Last updated 2025-08-29.)

  Exam tips

  - For log alerts, always build the pipeline in order: workspace → ingestion (agent/DCR) → query/alert.

  - Order matters when the task depends on a target resource existing (you can’t send data or alert on data without a workspace).

  AZ-104 exam objective mapping Monitor and maintain Azure resources (10–15%) |__5.1 Monitor resources in Azure |__|__5.1.2 Configure log settings in Azure Monitor |__|__5.1.4 Set up alert rules, action groups, and alert processing rules in Azure Monitor

• Question 700:

  You have an Azure Active Directory (Azure AD) tenant named contoso.onmicrosoft.com.

  The User administrator role is assigned to a user named Admin1.

  An external partner has a Microsoft account that uses the [email protected] sign in.

  Admin1 attempts to invite the external partner to sign in to the Azure AD tenant and receives the following error message: "Unable to invite user [email protected] ?Generic authorization exception."

  You need to ensure that Admin1 can invite the external partner to sign in to the Azure AD tenant.

  What should you do?

  A. From the Roles and administrators blade, assign the Security administrator role to Admin1.
  B. From the Organizational relationships blade, add an identity provider.
  C. From the Custom domain names blade, add a custom domain.
  D. From the Users blade, modify the External collaboration settings.
  D. From the Users blade, modify the External collaboration settings.

  ---

  From the Users blade, modify the External collaboration settings.

  Admin1 (User administrator) receives: "Unable to invite user [email protected]. Generic authorization exception." This is consistent with the tenant's B2B invitation capability being restricted by Microsoft Entra External collaboration settings (for example, guest invitations disabled, limited to certain roles, or blocked by collaboration restrictions).

  Modifying External collaboration settings resolves the issue by allowing Admin1 (or the appropriate role set) to invite external users, and by ensuring the target external identity (such as outlook.com) is permitted if domain restrictions are configured.

  What you typically change in External collaboration settings to meet the goal:

  - Guest invite settings: ensure invitations are enabled for admins (and/or specifically include the User Administrator role as allowed inviters), and not set to "No one can invite guest users."

  - Collaboration restrictions (if configured): ensure the external partner's domain/identity type (for example, outlook.com) is not blocked.

  Why the other options are not correct:

  - From the Roles and administrators blade, assign the Security administrator role to Admin1:

  Security Administrator does not address B2B invitation enablement/guest invite restrictions.

  - From the Organizational relationships blade, add an identity provider:

  Adding an identity provider is not required for standard B2B invitations to Microsoft accounts (like outlook.com). The problem is authorization to invite, not the absence of an identity provider.

  - From the Custom domain names blade, add a custom domain:

  Adding a custom domain does not enable guest invitations or change who can invite external users.

  Microsoft Exam Tips:

  - When an invite fails with a generic authorization error, check tenant-level B2B controls first: External collaboration settings (guest invite settings and collaboration restrictions).

  - Do not confuse "identity provider configuration" with "permission to send invitations." Most B2B invitations (including Microsoft accounts) work without adding an identity provider.

  - AZ-104 often tests where the setting lives in the portal: Entra ID > Users > User settings / External collaboration settings.

  Summary:

  - Microsoft Entra B2B collaboration invitations

  - External collaboration settings (who can invite guests; domain/collaboration restrictions)

  - Troubleshooting guest invitation authorization failures

  AZ-104 Exam Objective Alignment (Hierarchy)

  1.0 Manage Azure identities and governance (20?5%) | 1.1 Manage Microsoft Entra users and groups | 1.1.4 Manage external users