Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 731:

  HOTSPOT

  You have an Azure subscription that contains several virtual machines and an Azure Log Analytics workspace named Workspace1. You create a log search query as shown in the following exhibit.

  

  Use the drop-down menus to select the answer choice that completes each statement based on the information presented in the graphic.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Time range: the last 14 days Graph Y axis: Avg(CounterValue)

  Explanation (Why this is correct)

  - The query specifies the last 14 days, so the visualization scope is the last 14 days.

  - The chart plots the aggregation shown (Avg(CounterValue)), which appears as the y-axis metric.

  Explanation (Why the other options are not correct)

  - Different time ranges or aggregations would not match the query + visualization settings.

  Exam Tip

  - In Log Analytics charts: **x-axis = time**, **y-axis = the selected measure/aggregation**.

  References (APA)

  - Microsoft. (n.d.). Log queries in Azure Monitor. https://learn.microsoft.com/en-us/azure/azure-monitor/logs/log-query-overview

  AZ-104 Exam Objective Hierarchy 5.0 Monitor and maintain Azure resources (10–15%) |__5.1 Monitor resources by using Azure Monitor |__|__5.1.3 Analyze logs by using Kusto Query Language (KQL)

• Question 732:

  You have an Azure subscription.

  You plan to deploy the Azure container instances shown in the following table.

  

  Which instances can you deploy to a container group?

  A. Instance1 only
  B. Instance2 only
  C. Instance1 and Instance2 only
  D. Instance3 and Instance4 only
  D. Instance3 and Instance4 only

  ---

  Explanation

  --------------------------------------------------------------------------------

  Instance3 and Instance4 only

  --------------------------------------------------------------------------------

  A container group must run containers with a compatible OS type. In Azure Container Instances, multi-container groups are supported for **Linux** containers; Windows container deployments are constrained such that you can't form the intended multi-container group using Windows entries in this scenario. Therefore, you can deploy the **two Linux instances** (Instance3 and Instance4) together to a container group.

  Why other selections are not correct:

  - Instance1 only / Instance2 only: These do not satisfy forming a multi-container group with the set shown.

  - Instance1 and Instance2 only: These are Windows-based and do not align with the multi-container grouping constraints tested here.

  -------------------------------------------------------------------------------- References:

  1. Container groups in Azure Container Instances https://learn.microsoft.com/en-us/azure/container-instances/container-instances-container-groups Modified: 11/17/2025 Date Access: 01/24/2026

  2. Introduction to container groups (Windows vs Linux multi-container constraint) https://learn.microsoft.com/en-us/azure/container-instances/container-instances-container-groups Modified: 11/17/2025 Date Access: 01/24/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - For ACI: "container group" implies shared lifecycle/network; ensure the OS-type constraints are satisfied.

  - When choices include mixed Windows/Linux, the safe exam move is to group same-OS containers.

  -------------------------------------------------------------------------------- Summary:

  ACI container group OS constraints; selecting compatible instances for a container group deployment.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.3 Provision and manage containers in the Azure portal |__ 3.3.2 Provision a container by using Azure Container Instances

• Question 733:

  You have an Azure subscription that contains a storage account named account1.

  You plan to upload the disk files of a virtual machine to account1 from your on-premises network. The on-premises network uses a public IP address space of 131.107.1.0/24.

  You plan to use the disk files to provision an Azure virtual machine named VM1. VM1 will be attached to a virtual network named VNet1. VNet1 uses an IP address space of 192.168.0.0/24.

  You need to configure account1 to meet the following requirements:

  1. Ensure that you can upload the disk files to account1.

  2. Ensure that you can attach the disks to VM1.

  3. Prevent all other access to account1.

  Which two actions should you perform? Each correct answer presents part of the solution.

  NOTE: Each correct selection is worth one point.

  A. From the Networking blade of account1, select Selected networks.
  B. From the Networking blade of account1, select Allow trusted Microsoft services to access this storage account.
  C. From the Networking blade of account1, add the 131.107.1.0/24 IP address range.
  D. From the Networking blade of account1, add VNet1.
  E. From the Service endpoints blade of VNet1, add a service endpoint.
  A. From the Networking blade of account1, select Selected networks.
  C. From the Networking blade of account1, add the 131.107.1.0/24 IP address range.

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  - From the Networking blade of account1, select Selected networks.

  - From the Networking blade of account1, add the 131.107.1.0/24 IP address range.

  ----------------------------------------------------------------------------------------------------

  You must lock down the storage account's public endpoint so only explicitly allowed sources can reach it. Selecting "Selected networks" switches the default from "allow all" to "deny by default," satisfying the "prevent all other access" requirement. Adding the on-premises public IP range then allows uploads from the on-premises network.

  Why the other choices are not correct:

  - "Allow trusted Microsoft services..." broadens access beyond the stated on-prem upload requirement and is not "deny by default."

  - Adding VNet1 and/or enabling a service endpoint is used when you want resources in that VNet/subnet to access the storage account via virtual network rules; it is not required for the on-prem upload requirement as stated.

  References:

  1. Storage network security (firewalls and virtual networks) https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security Date Modified: Unable to locate date modified Date Access: 01/24/2026

  ----------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - AZ-104 often tests "Selected networks" + explicit allow rules as the pattern for "permit only X, deny everything else."

  ----------------------------------------------------------------------------------------------------

  Summary:

  - Storage account network access restrictions (firewall) and allowing specific public IP ranges.

  ----------------------------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15?0%) |__ 2.1 Configure access to storage |__ |__ 2.1.1 Configure Azure Storage firewalls and virtual networks

• Question 734:

  HOTSPOT

  You have an Azure subscription that contains the Azure virtual machines shown in the following table.

  

  You add inbound security rules to a network security group (NSG) named NSG1 as shown in the following table.

  

  You run Azure Network Watcher as shown in the following exhibit.

  

  You run Network Watcher again as shown in the following exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  - NSG1 limits VM1 traffic: No

  - NSG1 applies to VM2: No

  - VM1 and VM2 connect to the same virtual network: Yes

  Explanation (Why this is correct)

  - NSG rules only affect traffic for resources where the NSG is **associated to a subnet or NIC**. Since the scenario only shows rules being created (not an association), you cannot conclude NSG1 applies to VM2 or limits VM1.

  - VM1 and VM2 are in different subnets (172.16.1.0/24 and 172.16.2.0/24) but those can be subnets of the **same VNet**, and the scenario is using private RFC1918 subnets consistent with a single VNet design.

  Explanation (Why the other options are incorrect)

  - Marking “Yes” for NSG1 applying/limiting would require explicit evidence that NSG1 is associated with VM1/VM2’s subnet/NIC.

  References (APA)

  - Microsoft. (n.d.). Network security groups overview. Retrieved January 27, 2026, from https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

  Exam Tip

  - On exam items: **creating NSG rules ≠ enforcing them**. Enforcement requires **association** (subnet or NIC).

  AZ-104 Exam Objective Hierarchy 5.0 Monitor and back up Azure resources (10–15%) |__5.1 Monitor resources by using Azure Monitor |__|__5.1.6 Use Azure Network Watcher and Connection Monitor

• Question 735:

  You create an Azure Storage account named contosostorage.

  You plan to create a file share named data.

  Users need to map a drive to the data file share from home computers that run Windows 10. Which port should be open between the home computers and the data file share?

  A. 80
  B. 443
  C. 445
  D. 3389
  C. 445

  ---

  Explanation

  -----------------------------------------------------------------------

  -----------------------------------------------------------------------

  Mapping a drive to an Azure file share from Windows uses SMB. SMB over TCP requires port 445. Therefore, port 445 must be open between the client computers and the Azure file share endpoint.

  Why the other selections are incorrect:

  - 80 and 443: These are HTTP/HTTPS ports and are not used for SMB drive mapping.

  - 3389: This is RDP (Remote Desktop), unrelated to Azure Files SMB access.

  ----------------------------------------------------------------------- References:

  1. Azure Files networking considerations (SMB port 445) (Microsoft Learn)

  https://learn.microsoft.com/en-us/azure/storage/files/storage-files-networking-overview Date Modified: 01/10/2025 Date Accessed: 01/25/2026

  ----------------------------------------------------------------------- Microsoft Exam Tips:

  - Azure Files + Windows drive mapping --> SMB --> TCP 445.

  - If 445 is blocked by an ISP, consider VPN/ExpressRoute or Azure File Sync alternatives.

  ----------------------------------------------------------------------- Summary:

  This tests required network port access for Azure Files SMB from Windows clients.

  ----------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15?0%) 2.3 Configure Azure Files and Azure Blob Storage 2.3.1 Create and configure a file share in Azure Storage

• Question 736:

  You have a Standard Azure App Service plan named Plan1.

  You need to ensure that Plan1 will scale automatically when the CPU usage of the web app exceeds 80 percent.

  What should you select for Plan1?

  A. Automatic in the Scale out method settings
  B. Rules Based in the Scale out method settings
  C. Premium P1 in the Scale up (App Service plan) settings
  D. Standard S1 in the Scale up (App Service plan) settings
  E. Manual in the Scale out method settings
  B. Rules Based in the Scale out method settings

  ---

  Rules Based in the Scale out method settings

  To automatically scale an App Service plan when CPU exceeds a threshold (80% in this scenario), you configure autoscale rules. "Rules based" autoscale allows you to define metric-based conditions (CPU percentage threshold) that trigger scale-out actions. This directly meets the requirement.

  Why the other options are not correct:

  - Automatic in the Scale out method settings: Autoscale still relies on rules/conditions; "automatic" is not the configuration construct used to define a CPU threshold trigger.

  - Premium P1 in the Scale up settings / Standard S1 in the Scale up settings: That changes SKU (scale up), not autoscale behavior (scale out).

  - Manual in the Scale out method settings: Manual does not satisfy "scale automatically."

  Exam Tips:

  - "Scale up" = change SKU/tier. "Scale out" = change instance count. CPU-threshold automation = autoscale rules (scale out).

  Summary:

  - App Service autoscale: metric-triggered scale out via rules.

  AZ-104 Exam Objective Hierarchy:
  3.0 Deploy and Manage Azure Compute Resources (20–25%)
  3.4 Create and Configure Azure App Service
  3.4.2 Configure Scaling for an App Service Plan

• Question 737:

  HOTSPOT

  You have an Azure subscription named Subscription1 that contains a virtual network named VNet1.

  You add the users in the following table.

  

  To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Box 1: Add a subnet to VNet1: User1 and User3 only

  Box 2: Assign a user the Reader role to VNet1: User1 only

  Roles given:

  - User1: **Owner**

  - User2: **Security Admin**

  - User3: **Network Contributor**

  - Box 1 (Add a subnet): Adding a subnet is a network management operation requiring write permissions on the virtual network/subnet resource. **Owner** and **Network Contributor** can perform network configuration (including subnet creation). A “Security Admin” role does not grant network configuration permissions on the VNet.

  - Box 2 (Assign Reader role): Assigning Azure RBAC roles requires permission to create role assignments (Microsoft.Authorization/roleAssignments/write). **Owner** can assign roles. **Network Contributor** cannot assign roles, and “Security Admin” does not grant role assignment permissions.

  Why the other options are not correct:

  - Including User2 for subnet creation: Security-focused role ≠ network write permissions on VNet resources.

  - Including User3 for role assignment: Network Contributor can manage network resources but cannot grant access (RBAC assignment).

  References:

  Microsoft. (n.d.). Azure built-in roles (Owner, Reader, Network Contributor). Last updated: Unable to locate on page. Date accessed: 2026-01-27. https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles Microsoft. (n.d.). Assign Azure roles (RBAC). Last updated: Unable to locate on page. Date accessed: 2026-01-27. https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-portal

  Microsoft Exam Tips:

  - Network Contributor = manage network resources (VNets/subnets/NSGs), but cannot assign RBAC roles.

  - Owner = full management + can grant access (role assignments).

  Summary:

  This question tested least-privilege RBAC for network configuration vs role assignment.

  AZ-104 Exam Objective Hierarchy:

  1.0 - Manage Azure identities and governance (20–25%) |__ 1.2 - Manage access to Azure resources |__ |__ 1.2.2 - Assign roles at different scopes

• Question 738:

  You have an Azure subscription that contains a virtual machine named VM1 and an Azure function named App1.

  You need to create an alert rule that will run App1 if VM1 stops.

  What should you create for the alert rule?

  A. an application security group
  B. a security group that has dynamic device membership
  C. an action group
  D. an application group
  C. an action group

  ---

  an action group

  Alert rules in Azure Monitor use "action groups" to define what happens when an alert fires (email, SMS, webhook, Logic App, Azure Function, Automation runbook, etc.). To run App1 (an Azure Function) when VM1 stops, you configure an alert rule that triggers an "action group" containing the appropriate action.

  Why other options are not correct:

  - an application security group: Used for NSG rule targeting, not alert execution.

  - a security group that has dynamic device membership: Entra ID device grouping is unrelated to Azure Monitor alert actions.

  - an application group: Not the construct used to execute alert responses; action groups are.

  Microsoft Exam Tips:

  - For Azure Monitor: "Alert rule detects"; "action group acts".

  - If the stem says "run something when X happens," look for "action group" (and then the action type inside it).

  Summary:

  Alert rule execution using action groups (triggering automation on VM state changes).

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources |__ 5.1 Monitor resources in Azure |__ 5.1.4 Set up alert rules, action groups, and alert processing rules in Azure Monitor

• Question 739:

  You have an on-premises network that contains a Hyper-V host named Host1. Host1 runs Windows Server 2016 and hosts 10 virtual machines that run Windows Server 2016.

  You plan to replicate the virtual machines to Azure by using Azure Site Recovery.

  You create a Recovery Services vault named ASR1 and a Hyper-V site named Site1.

  You need to add Host1 to ASR1.

  What should you do?

  A. Download the installation file for the Azure Site Recovery Provider.Download the vault registration key.Install the Azure Site Recovery Provider on Host1 and register the server.
  B. Download the installation file for the Azure Site Recovery Provider.Download the storage account key.Install the Azure Site Recovery Provider on Host1 and register the server.
  C. Download the installation file for the Azure Site Recovery Provider.Download the vault registration key.Install the Azure Site Recovery Provider on each virtual machine and register the virtual machines.
  D. Download the installation file for the Azure Site Recovery Provider.Download the storage account key.Install the Azure Site Recovery Provider on each virtual machine and register the virtual machines.
  A. Download the installation file for the Azure Site Recovery Provider.Download the vault registration key.Install the Azure Site Recovery Provider on Host1 and register the server.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Download the installation file for the Azure Site Recovery Provider.

  Download the vault registration key.

  Install the Azure Site Recovery Provider on Host1 and register the server.

  --------------------------------------------------------------------------------

  To replicate Hyper-V VMs to Azure using Azure Site Recovery, the Hyper-V host (or VMM infrastructure, depending on architecture) must be onboarded to the Recovery Services vault. The required onboarding path is to install the **Azure Site Recovery Provider** on the Hyper-V host and **register** it to the vault using the **vault registration key**.

  Why the other selections are incorrect:

  Using a storage account key: ASR host registration uses a vault registration key, not a storage account key.

  Installing the provider on each VM: ASR provider is installed/registered on the Hyper-V host (or appropriate server role), not individually on each VM for this scenario.

  Registering "the VMs" directly: The platform registration is performed first; VM replication is configured after the host/site is registered.

  -------------------------------------------------------------------------------- References:

  1. Set up disaster recovery of on-premises Hyper-V VMs to Azure (Azure Site Recovery) https://learn.microsoft.com/en-us/azure/site-recovery/hyper-v-azure-tutorial Date Modified: Unable to locate exact date in this session Date Access: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - ASR onboarding frequently tests: **Provider + vault registration key** (not storage keys).

  Summary:

  Azure Site Recovery prerequisites for adding a Hyper-V host/site.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and back up Azure resources |__ 5.2 Implement backup and recovery |__ 5.2.5 Configure Azure Site Recovery (best fit)

  Below are the steps you need to perform in this scenario. Refer the link mentioned in the reference section.

  Download the installation file for the Azure Site Recovery Provider To set up the source environment, you create a Hyper-V site and add to that site the Hyper-V hosts containing VMs that you want to replicate. Then, you download and install the Azure Site Recovery Provider and the Azure Recovery Services agent on each host, and register the Hyper-V site in the vault.

  

  Download the vault registration key Download the Vault registration key. You need this when you install the Provider. The key is valid for five days after you generate it.

  

  Install the Azure Site Recovery Provider on Host1.

  Install the downloaded setup file (AzureSiteRecoveryProvider.exe) on each Hyper-V host that you want to add to the Hyper-V site. Setup installs the Azure Site Recovery Provider and Recovery Services agent on each Hyper-V host.

  Register the server In Registration, after the server is registered in the vault, select Finish.

  References:

  https://docs.microsoft.com/en-us/azure/site-recovery/hyper-v-azure-tutorial

• Question 740:

  HOTSPOT

  You have an Azure subscription named Sub1 that contains the resources shown in the following table.

  

  The subscription contains the users shown in the following table.

  

  You have the following Bicep file named Deploy.bicep.

  

  You run the following command.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Admin1 can delete VNet2. → Yes
  Admin2 can add a subnet to VNet1. → No
  Admin1 can add a subnet to VNet2. → Yes

  Why:
  
  This question uses an Azure Resource Manager deployment stack command that enables deny settings (DenyWriteAndDelete) and sets ActionOnUnmanage=DetachAll.

  • Deny settings are implemented through deny assignments on managed resources to prevent write and delete operations outside the stack’s managed lifecycle.
  • RBAC still determines what each administrator could do at their assigned scope (subscription vs. resource group), but deny settings can restrict write and delete operations on resources managed by the stack.

  The answer selections reflect that Admin2 (Contributor scoped to RG1) is blocked from making the requested modification, while Admin1 (Owner at the subscription scope) can perform the requested actions.

  AZ-104 Exam Objective Hierarchy (map for this question):
  1.0 Manage Azure Identities and Governance
  1.2 Manage Access to Azure Resources
  1.2.1 Manage Built-In Azure Roles
  1.2.2 Assign Roles at Different Scopes
  1.3 Manage Azure Subscriptions and Governance
  1.3.4 Manage Resource Groups