Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 751:

  HOTSPOT

  You have an Azure subscription that contains the virtual machines shown in the following table.

  

  You create an Azure Compute Gallery named ComputeGallery1 as shown in the Azure Compute Gallery exhibit. (Click the Azure Compute Gallery tab.)

  

  In ComputeGallery1, you create a virtual machine image definition named Image1 as shown in the image definition exhibit. (Click the Image Definition tab.)

  

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No,

  NOTE: Each correct selection is worth one point.

  

  

  ---

  The operating system disk of VM1 can be used as a source for a version of Image1. -> No

  The operating system disk of VM2 can be used as a source for a version of Image1. -> Yes

  The operating system disk of VM3 can be used as a source for a version of Image1. -> Yes

  Why:

  - Your Image1 definition is configured for VM generation “V1” (Gen1).

  - VM1 is Generation 2, so it cannot be used as the source for an image version that requires Gen1.

  - VM2 and VM3 are Generation 1, so they can be used.

  AZ-104 Exam Objective Hierarchy (from your uploaded objectives):

  3.0 Deploy and manage Azure compute resources |__3.2 Create and configure virtual machines |__|__3.2.5 Manage virtual machine disks

• Question 752:

  You have the Azure virtual machines shown in the following table.

  

  VNET1 is linked to a private DNS zone named contoso.com that contains the records shown in the following table.

  

  You need to ping VM2 from VM1.

  Which DNS names can you use to ping VM2?

  A. comp2.contoso.com and comp4.contoso.com only
  B. comp1.contoso.com, comp2.contoso.com, comp3.contoso.com, and comp4.contoso.com
  C. comp2.contoso.com only
  D. comp1.contoso.com and comp2.contoso.com only
  E. comp1.contoso.com, comp2.contoso.com, and comp4.contoso.com only
  C. comp2.contoso.com only

  ---

  comp2.contoso.com only

  For VM1 to ping VM2 using a DNS name, the name must resolve (forward lookup) to VM2's IP address (10.0.0.5). In the private DNS zone, only the A record named comp2 maps directly to 10.0.0.5, so comp2.contoso.com resolves correctly and can be used.

  The other names do not work for forward name-to-IP resolution:

  - comp1 is a TXT record, which doesn't map a hostname to an IP address for ping/ICMP resolution.

  - comp3 is a CNAME pointing to comp1.contoso.com, but comp1 doesn't have an A/AAAA record, so an A-record lookup for comp3 cannot ultimately resolve to an IP.

  - comp4 is a PTR record type intended for reverse lookups; it is not used as a forward A/AAAA mapping for pinging by name.

  Microsoft Exam Tips:

  - AZ-104 often tests which DNS record types support forward resolution (A/AAAA/CNAME) vs reverse resolution (PTR) and which are metadata (TXT).

  - If the question is about "ping by name," look for A/AAAA resolution to an IP.

  Summary:

  Private DNS record types and forward name resolution behavior.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking  |__ 4.3 Configure name resolution and load balancing |__ 4.3.1 Configure Azure DNS

• Question 753:

  You need to ensure that all resources deployed to a subscription have a tag named Department.

  The solution must also be able to apply the tag to existing resources that are missing it.

  Which Azure Policy effect should you use?

  A. Audit
  B. Deny
  C. Append
  D. Modify
  D. Modify

  ---

  Explanation

  {------------------------------------------------------------------------------------}

  Modify

  {------------------------------------------------------------------------------------}

  To ensure resources get a required tag and to also bring existing resources into compliance automatically, use an Azure Policy definition with the Modify effect. Modify can add or update tag properties during create/update, and-together with a remediation task-can apply the same corrections to existing non-compliant resources.

  Not selected:

  - Deny: blocks creation/updates when the tag is missing, but does not automatically fix existing resources.

  - Audit: reports noncompliance but does not enforce or remediate.

  - Append: can add fields during create/update, but Microsoft recommends Modify for tags, and remediation of existing resources is aligned to Modify.

  References:

  1. Policy definitions for tagging resources (Modify + remediation applies to existing resources) https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies Date Modified: 09/15/2025 Date Accessed: 01/24/2026

  2. Tutorial: Manage tag governance with Azure Policy (Modify for new and existing resources) https://learn.microsoft.com/en-us/azure/governance/policy/tutorials/govern-tags Date Modified: 03/04/2025 Date Accessed: 01/24/2026

  3. Azure Policy definitions ?modify effect https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effect-modify Date Modified: 03/04/2025 Date Accessed: 01/24/2026

  4. Remediate non-compliant resources (Modify supports remediation tasks) https://learn.microsoft.com/en-us/azure/governance/policy/how-to/remediate-resources Date Modified: 03/04/2025 Date Accessed: 01/24/2026

  Microsoft Exam Tips:

  - If the requirement includes "auto-apply tags" and "fix existing resources," look for Modify (with remediation).

  - If the requirement is "block deployments without tags," that is Deny.

  Summary:

  Azure Policy effect selection for tag governance and remediation.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) | |__ 1.3 Manage Azure subscriptions and governance | |__ 1.3.1 Implement and manage Azure Policy

• Question 754:

  HOTSPOT

  You have an Azure subscription that contains an Azure Storage account storageaccount1.

  You export storage account as an Azure Resource Manager template. The template contains the following sections.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Statement 1: Yes Statement 2: Yes Statement 3: No

  Explanation (Why this is correct)

  - Statement 1 (Yes): The template explicitly allows inbound traffic to the storage account from the public IP 131.107.103.10 via an IP rule.

  - Statement 2 (Yes): In supported storage account types, individual blobs can be moved to the Archive access tier.

  - Statement 3 (No): Being a Microsoft Entra (Azure AD) Global Administrator does not automatically grant data-plane access to an Azure file share; Azure Files identity-based access must be configured and authorized appropriately.

  Exam Tip

  - “Directory role” (Global Admin) ≠ “Azure RBAC role” (Owner/Contributor) and ≠ “data-plane permission.” Always separate these three in your head.

  References (APA)

  - Microsoft. (n.d.). Configure Azure Storage firewalls and virtual networks. Microsoft Learn. https://learn.microsoft.com/en-us/azure/storage/common/storage-network-security

  - Microsoft. (n.d.). Blob access tiers. Microsoft Learn. https://learn.microsoft.com/en-us/azure/storage/blobs/access-tiers-overview

  - Microsoft. (n.d.). Azure Files identity-based authorization overview. Microsoft Learn. https://learn.microsoft.com/en-us/azure/storage/files/storage-files-active-directory-overview

  AZ-104 Exam Objective Hierarchy 2.0 Implement and manage storage (15–20%) |__2.1 Configure access to storage |__|__2.1.1 Configure network access to storage accounts |__2.3 Configure Azure Files and Azure Blob Storage |__|__2.3.1 Configure Azure Files |__|__2.3.3 Configure Azure Blob Storage

• Question 755:

  You have an Azure subscription that has the public IP addresses shown in the following table.

  

  You plan to deploy an Azure Bastion Basic SKU host named Bastion1.

  Which IP addresses can you use?

  A. IP1 only
  B. IP1 and IP2 only
  C. IP3, IP4, and IP5 only
  D. IP1, IP2, IP4, and IP5 only
  E. IP1, IP2, IP3, IP4, and IP5
  A. IP1 only

  ---

  IP1 only

  Azure Bastion (Basic SKU) requires a Standard SKU, static, IPv4 public IP for the Bastion host. From the table:

  IP1 is IPv4, Standard, Regional, Static → valid.
  
  IP2 is Standard but Global tier → not used for this Bastion requirement.
  
  IP3 and IP4 are Basic SKU → not supported.
  
  IP5 is IPv6 → not supported for this Bastion requirement.

  Microsoft Exam Tips:

  Bastion almost always implies Standard, Static public IP.

  Watch for distractors using Basic SKU or IPv6.

  Summary:

  Selecting a compatible public IP for an Azure Bastion deployment.

  AZ-104 Exam Objective Hierarchy:

  4.0 Implement and manage virtual networking (15–20%)
  
  |__ 4.2 Configure secure access to virtual networks
  
  |__ 4.2.3 Implement Azure Bastion

• Question 756:

  You plan to back up an Azure virtual machine named VM1.

  You discover that the Backup Pre-Check status displays a status of Warning.

  What is a possible cause of the Warning status?

  A. VM1 is stopped.
  B. VM1 does not have the latest version of the Azure VM Agent (WaAppAgent.exe) installed.
  C. VM1 has an unmanaged disk.
  D. A Recovery Services vault is unavailable.
  B. VM1 does not have the latest version of the Azure VM Agent (WaAppAgent.exe) installed.

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  VM1 does not have the latest version of the Azure VM Agent (WaAppAgent.exe) installed

  ----------------------------------------------------------------------------------------------------

  Azure Backup for Azure VMs depends on the VM extension/agent framework. A Backup Pre-Check status of Warning commonly indicates an agent/extension-related issue, including an outdated Azure VM Agent. Keeping WaAppAgent.exe current helps ensure snapshot/extension operations used by backup complete successfully.

  Why the other options are not correct:

  - VM1 is stopped: Backup pre-check can warn for multiple reasons; "stopped" isn't a typical root cause by itself for the pre-check warning described.

  - VM1 has an unmanaged disk: Azure Backup supports managed disks broadly; unmanaged disks are not the canonical "pre-check warning" cause compared to agent issues.

  - A Recovery Services vault is unavailable: That would usually be an error/operational issue rather than the VM's pre-check warning cause.

  ---------------------------------------------------------------------------------------------------- References:

  1. Troubleshoot Azure VM backup issues (agent/extension considerations) https://learn.microsoft.com/en-us/azure/backup/backup-azure-vm-troubleshoot Date Modified: Unable to locate date modified (page access limited in tool) Date Access: 01/24/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - For VM backup warnings, think: VM Agent + extensions + snapshot permissions/health.

  - Always separate "vault configuration" issues from "VM/agent" issues.

  ---------------------------------------------------------------------------------------------------- Summary:

  Backup pre-check warnings often point to VM agent/extension prerequisites; update the Azure VM Agent.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10?5%) | |__ 5.2 Implement backup and recovery | |__ 5.2.4 Perform backup and restore operations by using Azure Backup

• Question 757:

  HOTSPOT

  You have an on premises data center and an Azure subscription. The data center contains two VPN devices. The subscription contains an Azure virtual network named VNet1. VNet1 contains a gateway subnet.

  You need to create a site-to-site VPN. The solution must ensure that if a single instance of an Azure VPN gateway fails, or a single on-premises VPN device fails, the failure will not cause an interruption that is longer than two minutes.

  What is the minimum number of public IP addresses, virtual network gateways, and local network gateways required in Azure? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Public IP addresses: 2 Virtual network gateways: 1 Local network gateways: 2

  Explanation (Why this is correct)

  - To tolerate a single VPN gateway instance failure with minimal interruption, deploy the Azure VPN gateway in active-active mode (two instances).

  - An active-active VPN gateway uses two public IP addresses (one per instance) but is still a single virtual network gateway resource.

  - With two on-premises VPN devices, you model each device with its own Local network gateway (2 total) and build redundant tunnels.

  Explanation (Why the other options are incorrect)

  - 4 Public IP addresses / 2 Virtual network gateways: Not required for active-active; HA is achieved within one VPN gateway resource using two instances and two public IPs.

  - 1 Local network gateway: Would not represent two separate on-prem VPN endpoints for redundant connectivity.

  Exam Tip

  - “Active-active VPN gateway” = **1** gateway resource + **2** public IPs + redundant connections to multiple on-prem devices.

  References (APA)

  - Microsoft. (n.d.). About active-active VPN gateways. Microsoft Learn. https://learn.microsoft.com/en-us/azure/vpn-gateway/about-active-active-gateways

  AZ-104 Exam Objective Hierarchy 4.0 Implement and manage virtual networking (15–20%) |__4.2 Configure secure access to virtual networks

• Question 758:

  You have an Azure subscription that contains the resources shown in the following table.

  

  You need to perform the tasks shown in the following table.

  

  Which tasks can you perform by using Azure Storage Explorer?

  A. Task1 and Task3 only
  B. Task1. Task2 and Task3 only
  C. Task1Task2 and Task3 only
  D. Task2, Task3, and Task4 only
  E. Take1,Take2, Take3, and Take4
  D. Task2, Task3, and Task4 only

  ---

  Task2, Task3, and Task4 only

  Azure Storage Explorer is a client tool for managing data in storage services (blobs, file shares, queues, tables). It supports uploading blobs (including append blobs), creating file shares, and managing table data/entities. Creating a brand- new storage account (management-plane operation) is typically done via the Azure portal/CLI/ARM, not Storage Explorer.

  Why the other selections are not correct:

  - Any option including Task1 is incorrect because Storage Explorer is not the primary tool to create a new storage account resource.

  - Options that exclude Task4 are incorrect because Storage Explorer can manage table data. (General Storage Explorer capability; see Azure Files/Storage Explorer management patterns.)

  Microsoft Exam Tips:

  - Distinguish "manage data in storage" tools (Storage Explorer) from "create Azure resources" tools (Portal/CLI/ARM).

  Summary:

  Storage Explorer capabilities for blob/file/table data operations vs storage account creation.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage |__ 2.2 Configure and manage storage accounts |__ 2.2.1 Create and configure storage accounts |__ 2.3 Configure Azure Files and Azure Blob Storage |__ 2.3.1 Create and configure a file share in Azure Storage |__ 2.3.2 Create and configure a container in Blob Storage

• Question 759:

  You have an Azure subscription that contains an Azure Storage account.

  You plan to create an Azure container instance named container1 that will use a Docker image named Image1. Image1 contains a Microsoft SQL Server instance that requires persistent storage.

  You need to configure a storage service for Container1.

  What should you use?

  A. Azure Files
  B. Azure Blob storage
  C. Azure Queue storage
  D. Azure Table storage
  A. Azure Files

  ---

  Azure Files

  Azure Container Instances (ACI) are stateless by default. If the container restarts or is recreated, any data written to the container's local filesystem is lost. Because the SQL Server instance in Image1 requires "persistent" storage, you must mount an external volume that provides a durable file system.

  "Azure Files" is the correct choice because ACI supports mounting an "Azure file share" as a volume (SMB-backed file share) to persist data beyond the container lifecycle.

  Why the other options are NOT correct:

  - Azure Blob storage: Object storage (not a mountable SMB file share for ACI persistent volumes).

  - Azure Queue storage: Messaging service (no filesystem semantics).

  - Azure Table storage: NoSQL key/attribute store (no filesystem semantics).

  Microsoft Exam Tips:

  - For "Azure Container Instances", think: "stateless unless I mount a volume."

  - On AZ-104, when you see "container needs persistent storage," the expected answer is typically "Azure Files (volume mount)", not Blob/Queue/Table.

  Summary:

  This question tested knowledge of "persistent storage options for Azure Container Instances", specifically that "Azure Files" is used to mount a durable filesystem-backed volume.

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.3 Provision and manage containers in the Azure portal |__ 3.3.2 Provision a container by using Azure Container Instances

• Question 760:

  HOTSPOT

  You have an Azure subscription linked to a hybrid Microsoft Entra tenant. The tenant contains the users shown in the following table.

  

  You create the Azure Files shares shown in the following table.

  

  You configure identity-based access for contoso2024 as shown in the following exhibit.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  User1 can access the content in share1: No
  User2 can access the content in share2: Yes
  User2 can access the content in share3: No

  The exhibit shows identity-based access for Azure Files configured on the storage account contoso2024. SMB access by using identity-based authentication requires that the user can authenticate against the directory service configured for the storage account (for example, AD DS, Azure AD DS, or Microsoft Entra Kerberos, depending on the configuration).

  User1 is not an on-premises-synced (hybrid) identity. In the configuration view, Azure AD-only identities are indicated as not supported for this SMB authentication mode, so User1 cannot access share1.

  User2 is a synced (hybrid) identity and can authenticate for Azure Files on contoso2024, so User2 can access share2.

  Share3 is in a different storage account (contoso2025). Only contoso2024 is shown as configured for identity-based access, so User2 cannot access share3 based on the provided configuration.

  2.0 Implement and manage storage (15–20%)
  
  └── 2.1 Configure access to storage
    └── 2.1.5 Configure identity-based access for Azure Files
  └── 2.3 Configure Azure Files and Azure Blob Storage
    └── 2.3.1 Create and configure a file share in Azure Storage