Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 711:

  HOTSPOT

  You have an Azure subscription that contains a user named User1 and a storage account named storage1. The storage1 account contains the resources shown in the following table.

  

  User1 is assigned the following roles for storage1:

  1. Storage Blob Data Reader 2. Storage Table Data Contributor 3. Storage File Data SMB Share Contributor

  For storage1, you create a shared access signature (SAS) named SAS1 that has the settings shown in the following exhibit. (Click the Exhibit tab.)

  

  To which resources can User1 write by using SAS1 and key1? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  key1: folder1 and Table1 only

  SAS1: Table1 only

  Why this is correct:

  - SAS tokens are scoped to specific services/resources and permissions. Based on the SAS1 configuration shown, the SAS permits writes only to the Table service scope in this scenario.

  - Using key1 (account key) enables data-plane access consistent with the allowed operations and the services intended in the question’s exhibit, resulting in write capability to the file share (folder1) and table (Table1) per the provided configuration.

  Why the other options are incorrect:

  - Options that include container1 would require write capability to the Blob service under the conditions shown; the exhibits/roles+SAS scope do not support that outcome for this question.

  Exam Tips:

  - For SAS questions, always anchor on: (1) SAS type (account/service/user delegation), (2) allowed services/resource types, and (3) permissions (r/w/d/l/a/c/u/p).

  - Account keys generally bypass RBAC, but exam items may still constrain outcomes via “SAS settings” and scoped service selection in the exhibit.

  Summary:

  key1 allows writes to folder1 and Table1; SAS1 allows writes to Table1 only.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15–20%) |__2.1 Configure access to storage

• Question 712:

  You need to configure an Azure web app named contoso.azurewebsites.net to host www.contoso.com.

  What should you do first?

  A. Create a TXT record named wwsv.contoso.com that has a value of contosoazurewebsites.net.
  B. Create a TXT record named asuid that contains the domain verification ID.
  C. Create a CNAME record named asuid that contains the domain verification ID.
  D. Create A records named www.contoso.com and asuid.contoso.com.
  B. Create a TXT record named asuid that contains the domain verification ID.

  ---

  Create a TXT record named asuid that contains the domain verification ID.

  When adding a custom domain to an App Service app, App Service provides a domain verification ID. You create a DNS TXT record named asuid.<domain> containing that verification ID to prove domain ownership and help prevent subdomain takeover. Therefore, the first step is creating the TXT record named asuid with the verification ID.

  Why the other options are not correct:

  - Create a CNAME record named asuid: The verification method is a TXT record for ownership validation, not a CNAME.

  - Create A records for www.contoso.com and asuid.contoso.com: That does not satisfy the verification requirement described.

  - Create a TXT record named www...: The required hostname for verification is asuid.<domain> (as provided by App Service), not an arbitrary TXT record name.

  Exam Tips:

  - AZ-104: Custom domain flow: verify ownership (TXT asuid) --> add mapping (CNAME/A) --> validate.

  - "Verification ID" in App Service questions almost always means the asuid TXT record.

  Summary:

  App Service custom domain ownership verification using asuid TXT record.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources |__ 3.4 Create and configure Azure App Service |__ 3.4.5 Map an existing custom DNS name to an App Service

• Question 713:

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  You need to ensure that all the traffic between VNet1 and VNet2 traverses the Microsoft backbone network.

  What should you configure?

  A. a private endpoint
  B. peering
  C. Express Route
  D. a route table
  B. peering

  ---

  peering

  To ensure traffic between two Azure virtual networks stays on the Microsoft backbone (and not the public internet), you configure virtual network peering. VNet peering enables private connectivity between VNets (including across regions with global VNet peering) and uses Microsoft's backbone for that connectivity. (Reference 1). :contentReference[oaicite:0]{index=0}

  Why the other options are not correct:

  - a private endpoint: Private Endpoint is for privately accessing a specific PaaS resource (like Storage) via Private Link, not for full VNet-to-VNet routing.

  - Express Route: ExpressRoute is for on-premises-to-Azure (or intersite) private connectivity, not required for Azure VNet-to-VNet within Azure.

  - a route table: A UDR (route table) can influence routing, but it does not itself create private interconnectivity between VNets.

  Microsoft Exam Tips:

  - AZ-104 commonly tests that VNet peering uses the Microsoft backbone and supports cross-region peering (global VNet peering).

  - Remember: peering requires compatible routing and non-overlapping address spaces.

  Summary:

  VNet-to-VNet private connectivity using virtual network peering.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking |__ 4.1 Configure and manage virtual networks in Azure |__ 4.1.2 Create and configure virtual network peering

• Question 714:

  HOTSPOT

  You have an Azure subscription that contains the vaults shown in the following table.

  

  You deploy the virtual machines shown in the following table.

  

  You have the backup policies shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  1) VM1 can be backed up by using Policy1. --> Yes

  2) VM2 can be backed up by using Policy3. --> No

  3) VM2 can be backed up by using Policy2. --> Yes

  Why these are correct:

  - Azure VM backup policies (Standard/Enhanced) are associated with Recovery Services vaults (common AZ-104 expectation).

  - Azure Backup vault policies labeled “Not applicable” indicate that policy doesn’t apply to Azure VM backup in this scenario.

  - VM encryption/security posture (e.g., Azure Disk Encryption / Trusted launch) is supported by Azure VM backup when configured using the appropriate vault/policy type.

  Exam tip:

  - If the question contrasts “Recovery Services vault” vs “Azure Backup vault”, remember: ”VM backup is classically tied to Recovery Services vault” patterns.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10–15%) |__5.2 Implement backup and recovery |__|__5.2.1 Create and configure Recovery Services vaults |__|__5.2.2 Create and configure backup policies |__|__5.2.3 Perform backup and restore operations by using Azure Backup |__|__5.2.4 Configure and review backup reports

• Question 715:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company registers a domain name of contoso.com.

  You create an Azure DNS zone named contoso.com, and then you add an A record to the zone for a host named www that has an IP address of 131.107.1.10.

  You discover that Internet hosts are unable to resolve www.contoso.com to the 131.107.1.10 IP address.

  You need to resolve the name resolution issue.

  Solution: You add an NS record to the contoso.com Azure DNS zone.

  Does this meet the goal?

  A. Yes
  B. No
  B. No

  ---

  Explanation

  --------------------------------------------------------------------------------

  No

  --------------------------------------------------------------------------------

  Adding an NS record inside the contoso.com Azure DNS zone does not delegate the domain on the public Internet. Delegation must be done at the domain registrar by setting the domain's authoritative name servers to the Azure DNS name servers.

  Why this does not meet the goal:

  - Internal zone records do not change the parent/registrar delegation chain used by public resolvers.

  -------------------------------------------------------------------------------- References:

  1. Tutorial: Host your domain in Azure DNS

  https://learn.microsoft.com/en-us/azure/dns/dns-delegate-domain-azure-dns Date Modified: 06/11/2024 Date Access: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104: Parent delegation is external to the zone you created; it's controlled by the registrar.

  - Focus on registrar NS settings first, then validate A record.

  -------------------------------------------------------------------------------- Summary:

  NS records inside the zone don't replace registrar delegation.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.3 Configure name resolution and load balancing |__ 4.3.1 Configure Azure DNS

• Question 716:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure virtual machine named VM1 that runs Windows Server 2016.

  You need to create an alert in Azure when more than two error events are logged to the System log on VM1 within an hour.

  Solution: You create an Azure Log Analytics workspace and configure the data settings. You add an extension to VM1. You create an alert in Azure Monitor and specify the Log Analytics workspace as the source.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  ---------------------------------------------------------------------------------------------------- You have an Azure virtual machine named VM1 that runs Windows Server 2016.

  You need to create an alert in Azure when more than two error events are logged to the System event log on VM1 within an hour.

  Solution: You create an Azure Log Analytics workspace and configure the data settings.

  You add an extension to VM1.

  You create an alert in Azure Monitor and specify the Log Analytics workspace as the source.

  Does this meet the goal?

  Yes

  ----------------------------------------------------------------------------------------------------

  This meets the goal because it describes the standard pattern for alerting on Windows Event Log data:

  1) Collect System event log data into Log Analytics:

  - Create the Log Analytics workspace.

  - Configure Windows Event Log collection ("data settings") for the workspace.

  - Install the Log Analytics agent on the VM. Installing it via a VM extension is a valid/standard method to onboard the VM.

  2) Create a log alert in Azure Monitor:

  - Azure Monitor log alerts can use the Log Analytics workspace as the data source.

  - The alert query can count "Error" events in the System log over a 1-hour window and trigger when the count is > 2.

  Why "No" would be incorrect:

  - It would incorrectly assume "extension" cannot be used for onboarding/collecting event logs, even though VM extensions are a supported agent deployment mechanism.

  ---------------------------------------------------------------------------------------------------- References:

  1. Log Analytics agent (installed via VM extension) and Windows event log collection capability https://learn.microsoft.com/en-us/azure/azure-monitor/agents/log-analytics-agent Date Modified: November 14, 2024 Date Access: 01/23/2026

  2. Create a log alert rule (Azure Monitor log alerts using Log Analytics data) https://learn.microsoft.com/en-us/azure/azure-monitor/alerts/alerts-create-log-alert-rule Date Modified: Unable to locate date modified Date Access: 01/23/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - For "event log alert" questions: think "collect to Log Analytics" + "log alert (scheduled query)" in Azure Monitor.

  - Wording like "add an extension to the VM" often refers to installing the monitoring/Log Analytics agent via extension.

  Summary:

  - Windows Event Log collection into Log Analytics and Azure Monitor log alerting.

  AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10?5%) |__ 5.1 Monitor resources in Azure |__ 5.1.4 Set up alert rules, action groups, and alert processing rules in Azure Monitor

• Question 717:

  HOTSPOT

  You have an Azure subscription that contains the resources in the following table.

  

  You install the Web Server server role (IIS) on VM1 and VM2, and then add VM1 and VM2 to LB1.

  LB1 is configured as shown in the LB1 exhibit. (Click the LB1 tab.)

  

  Rule1 is configured as shown in the Rule1 exhibit. (Click the Rule1 tab.)

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  VM1 is in the same availability set as VM2: Yes If Probe1.htm is present on VM1 and VM2, LB1 will balance TCP port 80 between VM1 and VM2: Yes If you delete Rule1, LB1 will balance all the requests between VM1 and VM2 for all the ports: No

  Explanation (Why this is correct)

  - A Basic Load Balancer backend pool requires the backend VMs to be in a single availability set or a single VM scale set. Since VM1 and VM2 are both in the backend pool of a Basic SKU load balancer, they must be in the same availability

  set --> Yes.

  - Load balancing only occurs for traffic that matches a configured load-balancing rule and where the health probe marks the backend instances healthy. With Rule1 configured for TCP 80 and Probe1.htm healthy on both VMs, LB1 balances port 80 --> Yes.

  - Deleting the load-balancing rule removes the rule that defines which ports/protocols are load balanced. The load balancer does not automatically “balance all ports” --> No.

  Exam Tip

  - Load balancers don’t “just balance everything.” No rule = no port/protocol mapping to balance.

  References (APA)

  - Microsoft. (n.d.). Azure Load Balancer SKUs. Microsoft Learn. https://learn.microsoft.com/en-us/azure/load-balancer/skus

  - Microsoft. (n.d.). Azure Load Balancer overview. Microsoft Learn. https://learn.microsoft.com/en-us/azure/load-balancer/load-balancer-overview

  AZ-104 Exam Objective Hierarchy 4.0 Implement and manage virtual networking (15–20%) |__4.3 Configure name resolution and load balancing |__|__4.3.2 Configure internal or public load balancer |__|__4.3.3 Troubleshoot load balancing

• Question 718:

  You have an Azure virtual machine named VM1.

  The network interface for VM1 is configured as shown in the exhibit. (Click the Exhibit tab.)

  

  You deploy a web server on VM1, and then create a secure website that is accessible by using the HTTPS protocol. VM1 is used as a web server only.

  You need to ensure that users can connect to the website from the Internet.

  What should you do?

  A. Create a new inbound rule that allows TCP protocol 443 and configure the protocol to have a priority of 501.
  B. For Rule5, change the Action to Allow and change the priority to 401.
  C. Delete Rule1.
  D. Modify the protocol of Rule4.
  B. For Rule5, change the Action to Allow and change the priority to 401.

  ---

  Explanation

  --------------------------------------------------------------------------------

  For Rule5, change the Action to Allow and change the priority to 401.

  --------------------------------------------------------------------------------

  - The goal is to allow inbound HTTPS (TCP 443) from the Internet to VM1.

  - In the exhibit, Rule2 denies ports 80 and 443 from Any to Any at priority 500. With NSGs, rules are evaluated in priority order (lower number = higher precedence). (1)

  - By changing Rule5 to Allow and moving it to priority 401, traffic on TCP 443 matches the new allow rule *before* the priority-500 deny rule, so HTTPS succeeds.

  Why the other selections are incorrect:

  - Create a new inbound rule that allows TCP protocol 443 and configure the protocol to have a priority of 501.

  - Priority 501 is evaluated *after* the existing deny at priority 500 for ports 80/443, so 443 would still be denied.

  - Delete Rule1.

  - Rule1 denies only port 80; it does not address the deny on 443 (Rule2).

  - Modify the protocol of Rule4.

  - Rule4 is UDP and unrelated to HTTPS (TCP 443).

  -------------------------------------------------------------------------------- References:

  1. Azure network security groups overview (rule priority processing) https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview Date Modified: Unable to locate date modified on page Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - AZ-104 frequently tests NSG rule evaluation: **lowest priority number wins**, then the first matching rule is applied.

  - When troubleshooting "works for one port but not another," scan for **a broader deny** (like Any/Any) with a higher precedence.

  Summary:

  NSG inbound rule evaluation and priority ordering for enabling HTTPS access.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.2 Configure secure access to virtual networks |__ 4.2.1 Create and configure network security groups (NSGs) and application security groups |__ 4.2.2 Evaluate effective security rules in NSGs

• Question 719:

  You have an Azure Resource Manager template named Template1 that is used to deploy an Azure virtual machine.

  Template1 contains the following text:

  

  The variables section in Template1 contains the following text:

  "location": "westeurope"

  The resources section in Template1 contains the following text:

  

  You need to deploy the virtual machine to the West US location by using Template1.

  What should you do?

  A. Modify the location in the resource section to westus
  B. Select West US during the deployment
  C. Modify the location in the variables section to westus
  A. Modify the location in the resource section to westus

  ---

  Modify the location in the resource section to westus

  In the provided ARM template excerpt, the virtual machine resource in the resources section is explicitly set to:

  "location": "westeurope"

  Even though parameters/variables exist (and "westus" is in allowedValues), the deployment will still use the location specified on the resource itself if it is hard-coded. Selecting a location during deployment will not override a hard-coded resource location.

  Why other selections are not correct:

  - Select West US during the deployment: Does not override a hard-coded resource location in the template.

  - Modify the location in the variables section to westus: Does not help unless the resource location is actually referencing that variable.

  - If a resource has a literal "location": "X", that wins.

  - Best practice: set resource location to a parameter (often [parameters('location')]).

  Summary:

  To deploy the VM to West US, you must change the VM resource's "location" property in the resources section to westus (or reference a parameter set to westus).

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources |__ 3.1 Automate deployment of resources by using Azure Resource Manager (ARM) templates or Bicep files |__ 3.1.2 Modify an existing Azure Resource Manager template

• Question 720:

  HOTSPOT

  You are evaluating the connectivity between the virtual machines after the planned implementation of the Azure networking infrastructure.

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.