Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 721:

  You have an Azure virtual machine named VM1.

  The network interface for VM1 is configured as shown in the exhibit. (Click the Exhibit tab.)

  

  You deploy a web server on VM1, and then create a secure website that is accessible by using the HTTPS protocol VM1 is used as a web server only.

  You need to ensure that users can connect to the website from the Internet.

  What should you do?

  A. Change the priority of Rule3 to 450.
  B. Change the priority of Rule6 to 100
  C. DeleteRule1.
  D. Create a new inbound rule that allows TCP protocol 443 and configure the protocol to have a priority of 501.
  E. For Rule5, change the Action to Allow and change the priority to 401
  A. Change the priority of Rule3 to 450.

  ---

  Explanation

  -------------------------------------------------------------------------------- You deploy a web server on VM1 and then create a secure website that is accessible by using the HTTPS protocol.

  VM1 is used as a web server only.

  You need to ensure that users can connect to the website from the Internet.

  (Exhibit shows NSG inbound rules, including denies for TCP 80/443.)

  --------------------------------------------------------------------------------

  Change the priority of Rule3 to 450.

  --------------------------------------------------------------------------------

  Goal: Allow inbound HTTPS (TCP/443) from the Internet to VM1.

  From the exhibit:

  - There is a deny rule at priority 500 for TCP ports 80 and 443 (this blocks HTTPS).

  - Rule3 is an allow rule for ports 60?00 with protocol Any, source Any, destination VirtualNetwork, currently at priority 4000.

  NSG evaluation is priority-based: lower numbers are evaluated first, and once a match occurs, processing stops. (1)

  If Rule3 is moved to priority 450:

  - It will be evaluated BEFORE the deny rule at priority 500.

  - TCP/443 matches Rule3 (443 is within 60?00; protocol Any includes TCP; source Any includes Internet).

  - Destination VirtualNetwork matches the VM's private IP because VirtualNetwork represents the virtual network address space (and related connected address spaces). (2)

  Therefore, HTTPS (TCP/443) will be allowed before the deny at 500 can block it, meeting the goal.

  Why the other options do not meet the goal:

  - Changing the priority of Rule6 to 100 won't help because Rule6 only covers ports 150?00, which does not include 443.

  - Deleting the TCP 80 deny rule does not remove the TCP 443 deny at priority 500, so HTTPS remains blocked.

  - Creating a new allow rule at priority 501 would still be evaluated AFTER the deny at 500, so it would not take effect.

  Least-privilege note (why this is better than allowing Rule5):

  Another available option would effectively allow a much larger port range (50?000). Changing Rule3 is the narrower change (60?00) and reduces the incremental attack surface versus allowing thousands of ports.

  -------------------------------------------------------------------------------- References:

  1. NSG rule processing and priority order https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview Date Modified: Unable to locate date modified Date Access: 01/23/2026 2. Service tag definition for VirtualNetwork (what the tag represents) https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview Date Modified: 2025-07-15 Date Access: 01/23/2026 3. AZ-104 Study Guide (objective domain mapping) https://learn.microsoft.com/en-us/credentials/certifications/resources/study-guides/az-104 Date Modified: Unable to locate date modified Date Access: 01/23/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - NSG troubleshooting is usually "first-match wins": identify the first rule (lowest priority number) that matches the traffic five-tuple.

  - For Internet-to-VM traffic, ensure an ALLOW for TCP/443 exists at a higher priority than any DENY affecting 443.

  - Prefer narrowly-scoped allow rules (single port, specific source IP) over wide port ranges whenever possible.

  -------------------------------------------------------------------------------- Summary:

  This question tested NSG priority evaluation and how to unblock HTTPS by ensuring an allow rule for TCP/443 is processed before a deny rule.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15?0%) |__ 4.2 Configure secure access to virtual networks |__ 4.2.2 Create and configure network security groups (NSGs) and security rules

• Question 722:

  You have an azure subscription named Subscription that contains the resource groups shown in the following table.

  

  In RG1, you create a virtual machine named VM1 in the East Asia location.

  You plan to create a virtual network named VNET1.

  You need to create VNET, and then connect VM1 to VNET1.

  What are two possible ways to achieve this goal? Each correct answer presents a complete a solution.

  NOTE: Each correct selection is worth one point.

  A. Create VNET1 in RG2, and then set East Asia as the location.
  B. Create VNET1 in a new resource group in the West US location, and then set West US as the location.
  C. Create VNET1 in RG1, and then set East Asia as the location
  D. Create VNET1 in RG1, and then set East US as the location.
  E. Create VNET1 in RG2, and then set East US as the location.
  A. Create VNET1 in RG2, and then set East Asia as the location.
  C. Create VNET1 in RG1, and then set East Asia as the location

  ---

  Explanation

  ---------------------------------------------------------------------------------------------------------------------------------

  - Create VNET1 in RG2, and then set East Asia as the location.

  - Create VNET1 in RG1, and then set East Asia as the location.

  ---------------------------------------------------------------------------------------------------------------------------------

  Goal: Create VNET1 and connect VM1 (located in East Asia) to VNET1.

  Both selected options meet the goal because:

  - To connect a VM to a virtual network, the VM's NIC must be in the same location as the VM, and the NIC must connect to a virtual network in the same location as the NIC. This effectively requires the VM and the target VNet to be in the same Azure region (East Asia in this scenario). (1)

  - A resource group's "region" is where the resource group metadata is stored; resources within a resource group can be created in different regions. Therefore, you can create VNET1 in either RG1 or RG2 as long as you set the VNET location to East Asia. (2)

  Why the other options are not correct:

  - Create VNET1 in a new resource group in the West US location, and then set West US as the location:

  A West US VNet cannot be directly attached to a VM in East Asia because the VM/NIC and VNet must be in the same region for direct connection. (1)

  - Create VNET1 in RG1, and then set East US as the location:

  East US VNet cannot be used to connect VM1 in East Asia for the same region-mismatch reason. (1)

  - Create VNET1 in RG2, and then set East US as the location:

  Same issue-East US VNet cannot be directly attached to the VM in East Asia. (1)

  ---------------------------------------------------------------------------------------------------------------------------------

  References:

  (1) Microsoft Learn - Virtual networks and virtual machines in Azure (NIC and VNet location constraints) Link: https://learn.microsoft.com/en-us/azure/virtual-network/network-overview Date accessed: 2026-01-22 Last updated on: 2025-04-15

  (2) Microsoft Learn - Manage resource groups by using the Azure portal (resource group location stores metadata; resources can be in different regions) Link: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/manage-resource-groups-portal Date accessed: 2026-01-22 Last updated on: 2025-02-10

  ---------------------------------------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - Treat "resource group region" as a frequent distractor: it does not force all contained resources into that region. (2)

  - For "connect VM to VNet" questions, validate the regional rule first: VM/NIC and the VNet must be in the same region for direct attachment. (1)

  - Multi-answer items often pair one "same RG" and one "different RG" option to test whether you understand that RG choice is mostly organizational, while resource location is functional. (1)(2)

  ---------------------------------------------------------------------------------------------------------------------------------

  Summary:

  - Resource group location vs. resource location (metadata vs. deployment region)

  - Regional requirement to directly connect a VM (NIC) to a virtual network

  - Two valid deployment patterns: VNet in same RG or different RG, as long as the VNet is in the VM's region

  ---------------------------------------------------------------------------------------------------------------------------------

  AZ-104 Exam Objective Alignment (Hierarchy)

  ------------------------------------------ 4.0 Implement and manage virtual networking (15?0%) | 4.1 Configure and manage virtual networks in Azure | 4.1.1 Create and configure virtual networks and subnets

• Question 723:

  HOTSPOT

  You have an Azure Active Directory tenant named Contoso.com that includes following users:

  

  Contoso.com includes following Windows 10 devices:

  

  You create following security groups in Contoso.com:

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: User1 can add Device2 to Group1 -> No

  Box 2: User2 can add Device1 to Group1 -> Yes

  Box 3: User2 can add Device2 to Group2 -> No

  - Box 1 (No): Group1 is an Assigned (static) group. However, User1’s role shown is Cloud device administrator, which focuses on device-related management rather than group membership administration. In this scenario’s constraints, User1 is not treated as having sufficient permissions to add a device object (Device2) into a security group membership.

  - Box 2 (Yes): User2 is a User administrator. In many AZ-104 exam scenarios, User Administrator is treated as having delegated administrative capability to manage directory objects (including adding members to groups), so User2 can add Device1 to Group1.

  - Box 3 (No): Group2 is a Dynamic Device group. Dynamic membership is rule-based and automatically evaluated; you cannot manually add Device2 (or any device) to a dynamic device group.

  Exam Tips:

  - If the group is Dynamic (User/Device), think: “membership is computed” -> manual add/remove is not allowed.

  - For static (Assigned) groups, focus on whether the actor has a directory role that can manage groups/membership (or is explicitly granted that capability in the scenario).

  Summary:

  - Microsoft Entra group membership management

  - Static (Assigned) vs Dynamic Device group behavior

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20–25%)

  └── 1.1 Manage Microsoft Entra users and groups
    └── 1.1.2 Manage user and group properties

• Question 724:

  You have an Azure subscription.

  You need to receive an email alert when a resource lock is removed from any resource in the subscription.

  What should you use to create an activity log alert in Azure Monitor?

  A. a resource, a condition, and an action group
  B. a resource, a condition, and a Microsoft 365 group
  C. a Log Analytics workspace, a resource, and an action group
  D. a data collection endpoint, an application security group, and a resource group
  A. a resource, a condition, and an action group

  ---

  a resource, a condition, and an action group

  An Azure Monitor "activity log alert" is created by selecting:

  - the "scope/resource" (what to monitor),

  - a "condition" (which activity log event to match, such as a lock delete operation),

  - an "action group" (what notification/action to execute, such as sending email).

  Why other selections are not correct:

  - Microsoft 365 group: Not the required construct for Azure Monitor alert execution; action groups are.

  - Log Analytics workspace: Activity log alerts do not require Log Analytics as the core requirement to trigger an email for a management-plane event.

  - data collection endpoint / ASG / resource group: These are unrelated to activity log alert rule composition for this requirement.

  Microsoft Exam Tips:

  - For Azure Monitor alerts: memorize the triad "Scope --> Condition --> Action group".

  - "Activity log alert" is for control-plane events (create/delete/update operations), not metrics.

  Summary:

  Creating an activity log alert rule to email on resource lock removal events.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources  |__ 5.1 Monitor resources in Azure |__ 5.1.4 Set up alert rules, action groups, and alert processing rules in Azure Monitor

• Question 725:

  DRAG DROP

  You have an Azure subscription named Sub1 that contains two users named User1 and User2.

  You need to assign role-based access control (RBAC) roles to User1 and User2. The users must be able to perform the following tasks in Sub1:

  x User1 must view the data in any storage account.

  x User2 must assign users the Contributor role for storage accounts.

  The solution must use the principle of least privilege.

  Which RBAC role should you assign to each user? To answer, drag the appropriate roles to the correct users. Each role may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  User1: Reader and Data Access

  User2: Owner

  You must grant the minimum permissions required.

  User1 requirement: “must be able to view the data in any storage account”

  - "Reader and Data Access" allows read-only access to the resource (control plane read) plus the ability to read data (data plane). This matches “view data” without granting write or full management.

  User2 requirement: “must assign users the Contributor role to storage accounts”

  - Assigning RBAC roles requires permissions like "Owner" (or User Access Administrator). Since “User Access Administrator” is not an option here, "Owner" is the only choice that enables managing access (role assignments).

  Why other roles are not selected:

  - Contributor: can manage resources but typically cannot grant RBAC access (no role assignment rights).

  - Storage Account Contributor: manages storage account settings but does not inherently grant role assignment permissions at scope and doesn’t cover generic access management needs.

  Microsoft Exam Tips:

  - “Who can assign roles?” --> "Owner" or "User Access Administrator" (if available).

  - “Read data in storage” often implies a role that includes "data access", not just Reader.

  Summary:

  Mapped RBAC roles to least-privilege requirements: data viewing vs role assignment.

  AZ-104 Exam Objective Hierarchy:

  1.0 - Manage Azure identities and governance (20–25%) |__ 1.2 - Manage access to Azure resources |__ 1.2.2 - Assign roles at different scopes

• Question 726:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  Your company has an Azure Active Directory (Azure AD) tenant that is configured for hybrid coexistence with the on-premises Active Directory domain.

  You have implemented Azure Backup to protect on-premises virtual machines (VMs).

  A user accidentally deletes a file from an on-premises VM named VM1.

  You need to recover the deleted file to an on-premises computer as quickly as possible.

  Solution: You use Instant Restore to recover the file.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Explanation

  --------------------------------------------------------------------------------

  Yes

  --------------------------------------------------------------------------------

  "Instant Restore" (in Azure Backup contexts) refers to restoring quickly from available recovery points and is a valid restore approach for recovering deleted data when Azure Backup is configured for the workload. Using a supported restore method (Instant Restore/restore operation) is aligned with the requirement to recover as quickly as possible. (1)(2)

  Why the other selection is not correct:

  - No: The restore method described is within the Azure Backup restore toolset and can satisfy the objective of fast recovery. (1)(2)

  -------------------------------------------------------------------------------- References:

  { 1. Restore options with Microsoft Azure Recovery Services (MARS) agent https://learn.microsoft.com/en-us/azure/backup/about-restore-microsoft-azure-recovery-services Date Modified: Sep 24, 2025 Date Accessed: 01/25/2026

  2. Tutorial: Recover files from Azure to a Windows Server https://learn.microsoft.com/en-us/azure/backup/tutorial-backup-restore-files-windows-server Date Modified: Apr 30, 2025 Date Accessed: 01/25/2026

  }

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - For on-prem restore scenarios, look for "restore wizard/restore options" language.

  - If the solution describes an Azure Backup restore operation (not data copy tooling), it usually aligns.

  Summary:

  Using Azure Backup restore mechanisms to recover files quickly.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10?5%) |__ 5.2 Implement backup and recovery |__ 5.2.4 Perform backup and restore operations by using Azure Backup

• Question 727:

  You have an Azure subscription named Subscription1 that contains an Azure virtual machine named VM1. VM1 is in a resource group named RG1.

  VM1 runs services that will be used to deploy resources to RG1.

  You need to ensure that a service running on VM1 can manage the resources in RG1 by using the identity of VM1.

  What should you do first?

  A. From the Azure portal, modify the Managed Identity settings of VM1
  B. From the Azure portal, modify the Access control (IAM) settings of RG1
  C. From the Azure portal, modify the Access control (IAM) settings of VM1
  D. From the Azure portal, modify the Policies settings of RG1
  A. From the Azure portal, modify the Managed Identity settings of VM1

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  From the Azure portal, modify the Managed Identity settings of VM1

  ----------------------------------------------------------------------------------------------------

  This is the correct **first** step.

  To allow a service running on VM1 to manage resources in RG1 **using the identity of VM1**, you must use a **system-assigned managed identity** (or user-assigned, but the question implies VM1's identity). The sequence is:

  1) **Enable the managed identity on VM1** (Identity blade / Managed Identity settings).

  2) Assign the managed identity an Azure RBAC role at the correct scope (RG1) via **RG1 > Access control (IAM)**.

  Because the question asks what you do **first**, enabling the managed identity on the VM is the first required step.

  Why the other selections are not correct:

  - Modify the Access control (IAM) settings of RG1: You cannot assign the VM's identity permissions until the managed identity exists/enabled on VM1.

  - Modify the Access control (IAM) settings of VM1: RBAC for managing RG resources should be assigned at the **RG scope**, not on the VM resource, for this requirement.

  - Modify the Policies settings of RG1: Azure Policy does not grant runtime permissions to the VM/service.

  ---------------------------------------------------------------------------------------------------- References:

  1. Managed identities for Azure resources (concepts and configuration) https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview Date Modified: Unable to locate date modified Date Accessed: 01/25/2026 2. Assign Azure roles using the Azure portal (RBAC role assignments at scopes such as resource groups) https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - Managed Identity questions are usually a **two-step**: enable identity, then grant RBAC at the correct scope.

  - "Using the identity of the VM" typically means **system-assigned managed identity**.

  ---------------------------------------------------------------------------------------------------- Summary:

  Enable a VM managed identity first, then assign RBAC at the resource group scope.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) | |__ 1.2 Manage access to Azure resources | |__ 1.2.2 Assign roles at different scopes

• Question 728:

  HOTSPOT

  You have a virtual network named VNet1 that has the configuration shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  {Dropdown 1}: Add an address space
  {Dropdown 2}: Add a subnet

  Why this is correct:

  • A VM can only receive IP addresses from subnets that exist within a VNet’s address space.
  • To use 192.168.1.0/24, VNet1 must first include that prefix in its address space → add an address space.
  • To use 10.2.1.0/24, the VNet address space (10.2.0.0/16) already covers that range, but you still need a subnet with that prefix → add a subnet.

  Why the other options are not correct:

  • “Add a subnet” for 192.168.1.0/24 is invalid until the VNet address space includes 192.168.1.0/24.
  • “Add an address space” for 10.2.1.0/24 is unnecessary because 10.2.0.0/16 already includes 10.2.1.0/24.

  Exam Tips:

  • If the requested prefix is outside the VNet’s address space, you must add address space before you can add any subnet that uses it.

  Summary:

  • Hot Area Tracking (delta): Attempted +1 | Correct +1 | Incorrect +0 | Skipped +0
  • Mismatch/Duplicate Tracking (delta): Mismatch +0 | Duplicate +0

  AZ-104 Exam Objective Hierarchy
  4.0 – Implement and Manage Virtual Networking (15–20%)
  |__ 4.1 – Configure and Manage Virtual Networks in Azure
  |__ |__ 4.1.1 – Create and Configure Virtual Networks and Subnets

• Question 729:

  You plan to move a distributed on-premises app named App1 to an Azure subscription.

  After the planned move, App1 will be hosted on several Azure virtual machines.

  You need to ensure that App1 always runs on at least eight virtual machines during planned Azure maintenance.

  What should you create?

  A. one virtual machine scale set that has 10 virtual machines instances
  B. one Availability Set that has three fault domains and one update domain
  C. one Availability Set that has 10 update domains and one fault domain
  D. one virtual machine scale set that has 12 virtual machines instances
  A. one virtual machine scale set that has 10 virtual machines instances

  ---

  one virtual machine scale set that has 10 virtual machines instances

  A Virtual Machine Scale Set (VMSS) is designed for deploying and managing a set of identical VMs with built-in scaling and high availability characteristics. During planned platform maintenance, Azure updates instances in a way that is aligned with update domains (and/or zones if configured). With 10 instances, you can maintain the requirement that at least 8 VMs remain available during typical maintenance cycles (the common exam intent here is that no more than a subset is impacted at once).

  Why other selections are not correct:

  - Availability set options: Availability sets distribute VMs across fault/update domains but do not provide the same unified scaling/management construct as VMSS for ensuring a minimum running instance count with scale operations.

  - VMSS with 12 instances: Could meet the goal, but the question's expected solution is the minimal VMSS instance count option presented (10).

  Microsoft Exam Tips:

  - If the question emphasizes "always at least N instances," VMSS is commonly the tested service.

  - Availability sets help with resiliency, but VMSS is the standard pattern for "minimum instance count" + scaling.

  Summary:

  Create a VM scale set with 10 instances to maintain at least 8 running VMs during planned maintenance.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources |__ 3.2 Create and configure virtual machines |__ 3.2.7 Deploy and configure an Azure Virtual Machine Scale Sets

• Question 730:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure container registry named Registry1 that contains an image named image1.

  You receive an error message when you attempt to deploy a container instance by using image1.

  You need to be able to deploy a container instance by using image1.

  Solution: You set Admin user to Enable for Registry1.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Yes

  - Enabling the Admin user on an Azure Container Registry allows username/password authentication to pull images from the private registry.

  - If the container instance deployment was failing due to missing registry credentials, enabling the admin user can satisfy the goal (though it is not the most security-hardened approach).

  Why the other option is incorrect:

  - No: The admin user provides a workable authentication method to pull from ACR.

  Microsoft Exam Tips:

  - AZ-104 often contrasts "works but less secure" (admin user) vs "best practice" (managed identity + AcrPull). If the question only asks whether it meets the goal, admin-user enablement can be acceptable.

  Summary:

  ACR authentication basics for pulling images.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources

  3.3 Provision and manage containers in the Azure portal

  3.3.1 Create and manage an Azure container registry

  3.3.2 Provision a container by using Azure Container Instances