Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 761:

  You have an Azure subscription that contains the storage accounts shown in the following table.

  

  Which storage account can be converted to zone-redundant storage (ZRS) replication?

  A. storage1 only
  B. storage2 only
  C. storage3 only
  D. storage2 and storage3
  E. storage1, storage2, and storage3
  A. storage1 only

  ---

  Explanation

  --------------------------------------------------------------------------------

  storage1 only

  --------------------------------------------------------------------------------

  - storage1 is a StorageV2 (general purpose v2) Standard account using LRS. Standard GPv2 accounts can be changed to ZRS (when ZRS is supported in the region).

  - storage2 is RA-GRS (read-access geo-redundant). That would convert to a geo-zone option (GZRS/RA-GZRS), not to single-region ZRS.

  - storage3 is shown as Premium. Premium storage account offerings generally have more limited redundancy options than Standard accounts and are not the typical "convert-to-ZRS" candidate in exam scenarios.

  Why the other options are incorrect:

  - storage2 only / storage2 and storage3 / all three: RA-GRS is geo-redundant; ZRS is single-region zone-redundant. The conversion path is not "RA-GRS --> ZRS."

  - storage3 only: Premium accounts are not the typical supported "convert to ZRS" option in the AZ-104 objective context.

  References:

  1. Microsoft. (n.d.). Change Azure Files redundancy configuration. Microsoft Learn.

  https://learn.microsoft.com/en-us/azure/storage/files/files-change-redundancy-configuration Date Updated: Unable to locate in this capture (see page footer) Date Accessed: 01/26/2026

  Microsoft Exam Tips:

  - AZ-104 frequently tests "what can be changed after deployment" for storage replication and the difference between single-region (LRS/ZRS) vs multi-region (GRS/RA-GRS, GZRS/RA-GZRS).

  Summary:

  Storage account replication and conversion paths (LRS/ZRS vs geo-redundant options).

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15?0%) |__ 2.2 Configure and manage storage accounts |__ 2.2.2 Configure Azure Storage redundancy

• Question 762:

  You have an existing Azure subscription that contains 10 virtual machines.

  You need to monitor the latency between your on-premises network and the virtual machines.

  What should you use?

  A. Service Map
  B. Connection troubleshoot
  C. Network Performance Monitor
  D. Effective routes
  C. Network Performance Monitor

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  Network Performance Monitor

  ----------------------------------------------------------------------------------------------------

  Network Performance Monitor (NPM) is designed to monitor network connectivity and performance, including hybrid connectivity between on-premises locations and Azure. It provides latency and performance visibility across network paths, which aligns with the requirement to monitor latency between on-premises and Azure VMs. :contentReference[oaicite:8]{index=8}

  Why the other selections are not correct:

  - Service Map:

  Focuses on application dependency mapping, not network latency measurement across hybrid paths.

  - Connection troubleshoot:

  Used for diagnosing connectivity issues, not continuous latency monitoring across hybrid networks.

  - Effective routes:

  Shows route tables and learned routes; it does not measure latency.

  References:

  1. Network monitoring overview (includes Network Performance Monitor capabilities) https://learn.microsoft.com/en-us/azure/networking/network-monitoring-overview Date Modified: 10/30/2023 :contentReference[oaicite:9]{index=9} Date Access: 01/24/2026 2. Connection monitor overview (references enabling Network Performance Monitor solution for hybrid monitoring) https://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-overview Date Modified: 12/29/2024 :contentReference[oaicite:10]{index=10} Date Access: 01/24/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - "Monitor latency" (ongoing) vs "troubleshoot connectivity" (point-in-time) are different tools.

  - For hybrid monitoring scenarios, know the Network Watcher / Azure Monitor integration points.

  Summary:

  Monitoring hybrid network latency using Network Performance Monitor.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources (10?5%) | |__ 5.1 Monitor resources in Azure | |__ 5.1.6 Use Azure Network Watcher and Connection Monitor

• Question 763:

  HOTSPOT

  You have an Azure subscription that contains a storage account named contoso?02 3. The Contoso 2023 storage account contains the resources shown in the following table.

  The Contoso 2023 storage account is configured as shown in the following exhibit.

  You have a Microsoft Entra tenant that contains the users shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  User1 can access the content in cont1 - No

  User2 can access the content in cont1 - No

  User3 can access the content in share1 - Yes

  This item compares different Shared Access Signature (SAS) token types. A user delegation SAS is issued with Microsoft Entra ID and is supported for Blob storage (and ADLS Gen2) scenarios; it is not used to authorize Azure Files operations. A service SAS is scoped to a single service (for example, Blob or File) and does not automatically grant access to resources outside that service or outside the signed resource scope. An account SAS can be scoped to multiple services and resource types within the storage account (including the File service), which is why it can be used for a file share scenario such as share1 in this question.

  Proof points:

  User delegation SAS is supported for Blob resources and is distinct from account/service SAS.

  Account SAS can grant access across multiple storage services (including Azure Files) when configured to include that service.

• Question 764:

  You have an Azure subscription named Subscription1 that contains a virtual network named VNet1. VNet1 is in a resource group named RG1.

  Subscription1 has a user named User1. User1 has the following roles:

  1. Reader 2. Security Admin 3. Security Reader

  You need to ensure that User1 can assign the Reader role for VNet1 to other users.

  What should you do?

  A. Remove User1 from the Security Reader role for Subscription1. Assign User1 the Contributor role for RG1.
  B. Assign User1 the Owner role for VNet1.
  C. Remove User1 from the Security Reader and Reader roles for Subscription1.
  D. Assign User1 the Network Contributor role for RG1.
  B. Assign User1 the Owner role for VNet1.

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  User1 and User2 only

  ----------------------------------------------------------------------------------------------------

  The action group is configured with the **Email Azure Resource Manager Role** notification type and set to email the **Monitoring Reader** role.

  In the provided identities:

  - **User1** is directly assigned the Monitoring Reader role --> has an email address --> can receive the email.

  - **Group1** is assigned the Monitoring Reader role --> the effective human recipients are the **users** in that group (here, User2 is the listed user member) --> User2 can receive the email.

  - **Principal1 / Principal2** are managed identities (service principals) --> they do not receive email notifications via this receiver type.

  Therefore, the recipients are **User1 and User2 only**.

  Why the other selections are not correct:

  - Any option including Principal1/Principal2 is incorrect because managed identities are not emailed.

  - "User1 only" is incorrect because Group1 is also assigned the role and contains User2.

  ---------------------------------------------------------------------------------------------------- References:

  1. Troubleshoot: Action group notifications (Email Azure Resource Manager Role behavior/limitations) https://learn.microsoft.com/en-us/troubleshoot/azure/azure-monitor/alerts/action-group-notifications Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  ---------------------------------------------------------------------------------------------------- Microsoft Exam Tips:

  - "**Email Azure Resource Manager Role**" targets *people* (users/groups), not managed identities.

  - If a role is assigned to a group, expect the **group's user members** to be the relevant recipients.

  ---------------------------------------------------------------------------------------------------- Summary:

  Determine action group role-based email recipients; users/groups receive notifications, not managed identities.

  ---------------------------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10?5%) | |__ 5.1 Monitor resources in Azure | |__ 5.1.4 Set up alert rules, action groups, and alert processing rules in Azure Monitor

• Question 765:

  You administer a solution in Azure that is currently having performance issues.

  You need to find the cause of the performance issues pertaining to metrics on the Azure infrastructure.

  Which of the following is the tool you should use?

  A. Azure Traffic Analytics
  B. Azure Monitor
  C. Azure Activity Log
  D. Azure Advisor
  B. Azure Monitor

  ---

  Explanation

  --------------------------------------------------------------------------------

  Azure Monitor

  --------------------------------------------------------------------------------

  You need to identify performance issues by analyzing metrics at the Azure infrastructure/resource level (CPU, memory, disk, network, etc.). Azure Monitor is the core service for collecting and analyzing metrics and telemetry for Azure resources. (1)

  Why the other selections are not correct:

  - Azure Traffic Analytics: Focuses on network traffic flow analytics (NSG flow logs) rather than general infrastructure performance metrics. (Not the primary tool for broad metrics troubleshooting.)

  - Azure Activity Log: Captures control-plane events (who/what changed resources), not performance metrics. (2)

  - Azure Advisor: Provides recommendations (cost, reliability, performance) but is not the primary tool to inspect and analyze live metrics to find root cause. (3)

  -------------------------------------------------------------------------------- References:

  { 1. Azure Monitor Metrics overview https://learn.microsoft.com/en-us/azure/azure-monitor/metrics/data-platform-metrics Date Modified: May 20, 2025 Date Accessed: 01/25/2026

  2. Azure Monitor activity log https://learn.microsoft.com/en-us/azure/azure-monitor/platform/activity-log Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  }

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - AZ-104 frequently tests choosing the right monitoring plane (metrics vs logs vs activity log).

  - When the prompt says "metrics," default to Azure Monitor Metrics (not Activity Log).

  Summary:

  Azure Monitor service selection; metrics vs logs vs control-plane auditing.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  5 Monitor and maintain Azure resources (10?5%) |__ 5.1 Monitor resources in Azure |__ 5.1.1 Interpret metrics in Azure Monitor

• Question 766:

  HOTSPOT

  You need to configure the Device settings to meet the technical requirements and the user requirements.

  Which two settings should you modify? To answer, select the appropriate settings in the answer area.

  

  

  ---

  Box 1: Selected Only selected users should be able to join devices

  Box 2: Yes Require Multi-Factor Auth to join devices.

  From scenario:

  Ensure that only users who are part of a group named Pilot can join devices to Azure AD Ensure that when users join devices to Azure Active Directory (Azure AD), the users use a mobile phone to verify their identity.

• Question 767:

  You have an Azure subscription that contains two Log Analytics workspaces named Workspace1 and Workspace2 and 100 virtual machines that run Windows Server.

  You need to collect performance data and events from the virtual machines. The solution must meet the following requirements:

  1. Logs must be sent to Workspace1 and Workspace 2.

  2. All Windows events must be captured.

  3. All security events must be captured.

  What should you install and configure on each virtual machine?

  A. the Azure Monitor agent
  B. the Windows Azure diagnostics extension (WAD)
  C. the Windows VM agent
  D. object replication
  A. the Azure Monitor agent

  ---

  the Azure Monitor agent

  To collect performance data and Windows event logs from Windows VMs and send the data to Log Analytics workspaces, you install the Azure Monitor agent (AMA) and configure data collection via data collection rules (DCRs). AMA is the current recommended agent for Azure Monitor and supports collecting Windows event logs (including security events) and performance counters.

  Why other options are incorrect:

  - Windows Azure diagnostics extension (WAD): Primarily for Azure VM diagnostics/legacy scenarios; not the preferred modern approach for Windows event collection to Log Analytics at scale.

  - Windows VM agent: Required for extensions, but it is not the telemetry collection solution by itself.

  - object replication: Storage feature; unrelated to VM monitoring.

  Microsoft Exam Tips:

  - For new exam items, assume AMA + DCR unless the question explicitly points to legacy agents.

  - Multi-workspace designs are typically implemented using DCRs (and associations).

  Summary:

  Using Azure Monitor Agent and DCRs to collect Windows events/performance data to Log Analytics.

  AZ-104 Exam Objective Hierarchy:

  5.0 Monitor and maintain Azure resources

  5.1 Monitor resources in Azure

  5.1.2 Configure log settings in Azure Monitor

• Question 768:

  Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that might meet the stated goals. Some question sets might have more than one correct solution, while others might not have a correct solution.

  After you answer a question in this section, you will NOT be able to return to it. As a result, these questions will not appear in the review screen.

  You have an Azure virtual machine named VM1. VM1 was deployed by using a custom Azure Resource Manager template named ARM1.json.

  You receive a notification that VM1 will be affected by maintenance.

  You need to move VM1 to a different host immediately.

  Solution: From the VM1 Redeploy + reapply blade, you select Redeploy.

  Does this meet the goal?

  A. Yes
  B. No
  A. Yes

  ---

  Yes

  Selecting Redeploy for a VM forces Azure to shut down the VM and move it to a new node, which satisfies the requirement to move the VM to a different host immediately.

  Microsoft Exam Tips:

  - Redeploy is a "move to new host" action; it is commonly tested alongside maintenance scenarios.

  Summary:

  - VM redeploy to change underlying host node

  AZ-104 Exam Objectives:

  3.0 Deploy and manage Azure compute resources

  3.2 Create and configure virtual machines

  3.2.3 Move a virtual machine to another resource group, subscription, or region

• Question 769:

  DRAG DROP

  You have an Azure subscription that contains an Azure file share.

  You have an on-premises server named Server1 that runs Windows Server 2016.

  You plan to set up Azure File Sync between Server1 and the Azure file share.

  You need to prepare the subscription for the planned Azure File Sync.

  Which two actions should you perform in the Azure subscription? To answer, drag the appropriate actions to the correct targets. Each action may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

  NOTE: Each correct selection is worth one point.

  Select and Place:

  

  

  ---

  First action: Create a Storage Sync Service Second action: Create a sync group

  Explanation:

  You need to prepare the Azure subscription for Azure File Sync between an on-premises Windows Server and an Azure file share. The Azure-side resources you must create first are:

  1) Create a Storage Sync Service

  - The Storage Sync Service is the top-level Azure resource for Azure File Sync. It’s the management plane that servers register with and where sync groups are created.

  2) Create a sync group

  - A sync group defines the synchronization relationship and is the container where you add:

  - the cloud endpoint (the Azure file share), and

  - one or more server endpoints (Windows Server paths) Creating the sync group is an Azure-side prerequisite before you can fully build the sync topology.

  Why the other actions are not part of “prepare the subscription”:

  - Install the Azure File Sync agent

  - This is performed on the Windows Server (on-premises), not in the Azure subscription.

  - Run Server Registration

  - This is also performed from the server (after the agent install) to register the server with the Storage Sync Service.

  References:

  1. Microsoft Learn. Deploy Azure File Sync.

  https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-deployment-guide Modified: 10/10/2025. Date Accessed: 01/26/2026.

  2. Microsoft Learn. Plan for an Azure File Sync deployment.

  https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-planning Modified: 09/26/2025. Date Accessed: 01/26/2026.

  3. Microsoft Learn. Tutorial: Extend Windows file servers with Azure File Sync.

  https://learn.microsoft.com/en-us/azure/storage/file-sync/file-sync-extend-servers Modified: 08/08/2024. Date Accessed: 01/26/2026.

  Microsoft Exam Tips:

  - Azure File Sync setup is commonly tested as: Storage Sync Service → Sync group (cloud endpoint) → install agent → register server → create server endpoint.

  - If the prompt says “in the Azure subscription” or “prepare the subscription,” focus on Azure resources (Storage Sync Service, sync group), not server-side steps.

  Summary:

  This question covered the Azure-side prerequisites for Azure File Sync: creating a Storage Sync Service and then creating a sync group to define the sync relationship.

  AZ-104 Exam Objective Hierarchy:

  2.0 - Implement and manage storage (15–20%) |__ 2.3 - Configure Azure Files and Azure Blob Storage |__ 2.3.1 - Create and configure a file share in Azure Storage

  As per the official MS doc:

  The recommended steps to onboard on Azure File Sync for the first with zero downtime while preserving full file fidelity and access control list (ACL) are as follows:

  1. Deploy a Storage Sync Service. --> This needs to be done on Azure .

  2. Create a sync group. --> This needs to be done on Azure 3. Install Azure File Sync agent on the server with the full data set. --> This needs to be done on server1.

  4. Register that server and create a server endpoint on the share. --> This needs to be done on server1.

  5. Let sync do the full upload to the Azure file share (cloud endpoint).

  6. After the initial upload is complete, install Azure File Sync agent on each of the remaining servers.

  7. Create new file shares on each of the remaining servers.

  8. Create server endpoints on new file shares with cloud tiering policy, if desired. (This step requires additional storage to be available for the initial setup.) 9. Let Azure File Sync agent do a rapid restore of the full namespace without the actual data transfer. After the full namespace sync, sync engine will fill the local disk space based on the cloud tiering policy for the server endpoint.

  10. Ensure sync completes and test your topology as desired.

  11. Redirect users and applications to this new share.

  12. You can optionally delete any duplicate shares on the servers.

  First action: Create a Storage Sync Service

  The deployment of Azure File Sync starts with placing a Storage Sync Service resource into a resource group of your selected subscription.

  

  Second action: Create a sync group A sync group defines the sync topology for a set of files. Endpoints within a sync group are kept in sync with each other. A sync group must contain one cloud endpoint, which represents an Azure file share and one or more server endpoints.

  A server endpoint represents a path on a registered server. A server can have server endpoints in multiple sync groups. You can create as many sync groups as you need to appropriately describe your desired sync topology.

  

  Third action: Run Server Registration Registering your Windows Server with a Storage Sync Service establishes a trust relationship between your server (or cluster) and the Storage Sync Service. A server can only be registered to one Storage Sync Service and can sync with other servers and Azure file shares associated with the same Storage Sync Service.)

  https://docs.microsoft.com/en-us/azure/storage/files/storage-sync-files-deployment-guide?tabs=azure-portal

• Question 770:

  You are building a custom Azure function app to connect to Azure Event Grid.

  You need to ensure that resources are allocated dynamically to the function app. Billing must be based on the executions of the app.

  What should you configure when you create the function app?

  A. the Windows operating system and the Consumption plan hosting plan
  B. the Windows operating system and the App Service plan hosting plan
  C. the Docker container and an App Service plan that uses the Bl1 pricing tier
  D. the Docker container and an App Service plan that uses the SI pricing
  A. the Windows operating system and the Consumption plan hosting plan

  ---

  Explanation

  --------------------------------------------------------------------------------

  The Windows operating system and the Consumption plan hosting plan

  --------------------------------------------------------------------------------

  The requirement is dynamic resource allocation with billing based on executions. Azure Functions on the Consumption plan scales automatically and charges primarily based on execution/resource consumption, matching the requirement.

  Why other options are not correct:

  - App Service plan hosting is dedicated capacity (always-on compute) and not billed purely per execution.

  - Container + fixed App Service tiers (B1/S1) are dedicated plans and do not match "billing per execution."

  -------------------------------------------------------------------------------- References:

  1. Azure Functions hosting options / plans (Consumption vs Premium vs Dedicated) https://learn.microsoft.com/en-us/azure/azure-functions/functions-scale Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - "Billed per execution" is a strong signal for the Functions Consumption plan.

  - Dedicated/App Service plans are for predictable load or Always On requirements.

  -------------------------------------------------------------------------------- Summary:

  Selecting the Azure Functions Consumption plan to meet per-execution billing and dynamic scaling requirements.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.4 Create and configure Azure App Service |__ 3.4.1 Provision an App Service plan