Microsoft AZ-104 Online Practice Questions and Exam Preparation

Microsoft AZ-104 Online Questions & Answers

• Question 771:

  You have an Azure AD tenant that contains the groups shown in the following table.

  

  You purchase Azure Active Directory Premium P2 licenses.

  To which groups can you assign a license?

  A. Group1 only
  B. Group1 and Group3 only
  C. Group3 and Group4 only
  D. Group1, Group2, and Group3 only
  E. Group1, Group2, Group3, and Group4
  D. Group1, Group2, and Group3 only

  ---

  Group1, Group2, and Group3 only

  Group-based licensing in Microsoft Entra ID supports assigning licenses to:

  - Security groups, and

  - Microsoft 365 groups that are security-enabled.

  In the table:

  - Group1 is a Security group (Enabled) -> eligible

  - Group2 is a Mail-enabled security group (Enabled) -> still a security group -> eligible

  - Group3 is a Microsoft 365 group (Enabled) -> eligible

  - Group4 is a Microsoft 365 group (Disabled) -> not eligible because it is not security-enabled

  Why the other options are not correct:

  - Group1 only: Excludes eligible Microsoft 365 (security-enabled) groups and other security groups.

  - Group1 and Group3 only: Incorrectly excludes a security-enabled mail-enabled security group.

  - Group3 and Group4 only: Group4 is not security-enabled.

  - All groups: Group4 is not security-enabled.

  Exam Tips:

  - AZ-104: Group-based licensing requires a group that can be security-enabled; Microsoft 365 groups must be "security enabled."

  - Do not confuse licensing eligibility (group type/security-enabled) with email features (mail-enabled).

  Summary:

  This question tested which Microsoft Entra group types can be used for group-based license assignment.

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance |__ 1.1 Manage Microsoft Entra users and groups |__ 1.1.3 Manage licenses in Microsoft Entra ID

• Question 772:

  HOTSPOT

  You have a Microsoft Entra tenant that contains the groups shown in the following table.

  

  The tenant contains the users shown in the following table.

  

  Which users and groups can you delete? To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  
  

• Question 773:

  Your company has a Microsoft Azure subscription.

  The company has datacenters in Los Angeles and New York.

  You are configuring the two datacenters as geo-clustered sites for site resiliency.

  You need to recommend an Azure storage redundancy option.

  You have the following data storage requirements:

  1. Data must be stored on multiple nodes.

  2. Data must be stored on nodes in separate geographic locations.

  3. Data can be read from the secondary location as well as from the primary location

  Which of the following Azure stored redundancy options should you recommend?

  A. Geo-redundant storage
  B. Read-only geo-redundant storage
  C. Zone-redundant storage
  D. Locally redundant storage
  B. Read-only geo-redundant storage

  ---

  Explanation

  --------------------------------------------------------------------------------

  Read-only geo-redundant storage

  --------------------------------------------------------------------------------

  The requirements are: (1) multiple nodes, (2) separate geographic locations, and (3) readable from the secondary as well as the primary. Read-access geo-redundant storage (RA-GRS) replicates data to a secondary region (geo-redundancy) and explicitly allows read access to the secondary endpoint. Therefore, "Read-only geo-redundant storage" (RA-GRS) is the correct choice. [1]

  Why the other selections are not correct:

  - Geo-redundant storage (GRS): Provides geo-replication, but does not include read access to the secondary unless configured as RA-GRS. [1]

  - Zone-redundant storage (ZRS): Replicates across availability zones within a single region, not separate geographic locations (regions). [1]

  - Locally redundant storage (LRS): Replicates within a single datacenter in one region; not geo-separated and no secondary read. [1]

  References:

  [1] Microsoft. "Data redundancy in Azure Storage." Microsoft Learn. (RA-GRS/RA-GZRS permit read access to secondary region.) Date modified: 2025-11-06. Date accessed: 2026-01-25. https://learn.microsoft.com/en-us/azure/storage/ common/storage-redundancy

  --------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - If the question says "read from the secondary," look for "RA-" (Read Access) variants.

  Summary:

  Selecting Azure Storage redundancy for cross-region replication with readable secondary.

  AZ-104 Exam Objective Hierarchy:

  2.0 Implement and manage storage (15?0%) |__ 2.2 Configure and manage storage accounts |__ 2.2.2 Configure Azure Storage redundancy

• Question 774:

  You have an Azure web app named App1 that streams video content to users. App1 is located in the East US Azure region.

  Users in North America stream the video content without any interruption.

  Users in Asia and Europe report that the video buffer often and do not play back smoothly.

  You need to recommend a solution to improve video streaming to the European and Asian users.

  What should you recommend?

  A. Scale out the App Service plan.
  B. Scale up the App Service plan.
  C. Configure an Azure Content Delivery Network (CDN) endpoint.
  D. Configure Azure File Sync.
  C. Configure an Azure Content Delivery Network (CDN) endpoint.

  ---

  Explanation

  --------------------------------------------------------------------------------

  Configure an Azure Content Delivery Network (CDN) endpoint.

  --------------------------------------------------------------------------------

  Users in distant geographies (Asia/Europe) experience buffering due to latency and distance from the origin (East US). Azure CDN caches content at edge locations closer to users, reducing latency and improving streaming performance.

  Why other options are not correct:

  - Scaling up/out the App Service plan improves server-side capacity but does not address global network latency and distance.

  - Azure File Sync is unrelated to public video content delivery performance.

  -------------------------------------------------------------------------------- References:

  1. Azure Content Delivery Network documentation https://learn.microsoft.com/en-us/azure/cdn/cdn-overview Date Modified: Unable to locate date modified Date Accessed: 01/25/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - If the issue is "far-away users + static/streaming content latency," think CDN first.

  - If the issue is "origin overloaded," think scale up/out.

  -------------------------------------------------------------------------------- Summary:

  Using Azure CDN to improve content delivery performance for geographically distributed users.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.4 Create and configure Azure App Service |__ 3.4.7 Configure networking settings for an App Service

  A content delivery network (CDN) is a distributed network of servers that can efficiently deliver web content to users. CDNs' store cached content on edge servers in point-of-presence (POP) locations that are close to end users, to minimize latency.

  Azure Content Delivery Network (CDN) offers developers a global solution for rapidly delivering high- bandwidth content to users by caching their content at strategically placed physical nodes across the world.

  

  https://docs.microsoft.com/en-us/azure/cdn/cdn-overview

• Question 775:

  HOTSPOT

  Your company purchases a new Azure subscription.

  You create a file named Deploy.json as shown in the following exhibit.

  

  You connect to the subscription and run the following cmdlet.

  New-AzDeployment -Location westus -TemplateFile “deploy.json”

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  - You can deploy a virtual machine to RG1: Yes

  - You can deploy a virtual machine to RG2: No

  - You can manually create a resource group named RG3: Yes

  Why:

  RG1 has a CanNotDelete lock (you can create/modify resources but cannot delete them). RG2 has a ReadOnly lock (you cannot create/update resources, so VM deployment fails). The locks apply only to RG1/RG2, so you can still create a new RG3 at the subscription scope.

  Evidence (short excerpts):

  - CanNotDelete: authorized users can read and modify a resource, but can’t delete it. (Microsoft Learn; last updated 2025-02-06).

  - ReadOnly: authorized users can read a resource, but can’t delete or update it. (Microsoft Learn; last updated 2025-02-06).

  AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20–25%) |__1.3 Manage Azure subscriptions and governance |__|__1.3.2 Configure resource locks |__|__1.3.4 Manage resource groups 3.0 Manage Azure compute resources (20–25%) |__3.1 Automate deployment of resources by using ARM templates or Bicep |__|__3.1.1 Interpret an Azure Resource Manager template or a Bicep file |__|__3.1.2 Modify an Azure Resource Manager template or a Bicep file

• Question 776:

  You need to resolve the Active Directory issue.

  What should you do?

  A. From Active Directory Users and Computers, select the user accounts, and then modify the User Principal Name value.
  B. Run idfix.exe, and then use the Edit action.
  C. From Active Directory Domains and Trusts, modify the list of UPN suffixes.
  D. From Azure AD Connect, modify the outbound synchronization rule.
  B. Run idfix.exe, and then use the Edit action.

  ---

  Explanation

  Run idfix.exe, and then use the Edit action.

  Explanation / Proof Microsoft guidance for objects failing to sync because of attribute formatting (including invalid characters) is to run IdFix to identify and remediate the problematic attributes prior to synchronization.

  References (APA) One or more objects don't sync when using Azure Active Directory Sync tool. (2024-10-28). https://learn.microsoft.com/en-us/troubleshoot/entra/entra-id/user-prov-sync/objects-dont-sync-ad-sync-tool (Accessed 2026-01-31).

  AZ-104 Exam Objective Hierarchy 1.0 Manage Azure identities and governance |__1.1 Manage Microsoft Entra users and groups |__|__1.1.2 Manage user and group properties

• Question 777:

  HOTSPOT

  You have an Azure Migrate project that has the following assessment properties:

  1. Target location: East US 2. Storage redundancy: Locally redundant 3. Comfort factor: 2.0 4. Performance history: 1 month 5. Percentile utilization: 95th 6. Pricing tier: Standard 7. Offer: Pay as you go

  You discover the following two virtual machines:

  1. A virtual machine named VM1 that runs Windows Server 2016 and has 10 CPU cores at 20 percent utilization 2. A virtual machine named VM2 that runs Windows Server 2012 and has four CPU cores at 50 percent utilization

  How many CPU cores will Azure Migrate recommend for each virtual machine?

  To answer, select the appropriate options in the answer area.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  VM1 recommended size: 4 VM2 recommended size: 4

  Explanation (Why this is correct)

  - The “right-size” recommendation from Azure Migrate is based on the assessment inputs (CPU/memory/utilization) shown in the exhibit; both VMs map to size 4 per the provided assessment output.

  Explanation (Why the other options are not correct)

  - Any other size would contradict the assessment recommendation shown.

  Exam Tip

  - For Azure Migrate sizing questions, treat the **assessment output** as authoritative for the answer.

  References (APA)

  - Microsoft. (n.d.). Assess servers with Azure Migrate. https://learn.microsoft.com/en-us/azure/migrate/concepts-assessment-calculation

  AZ-104 Exam Objective Hierarchy 3.0 Deploy and manage Azure compute resources (20–25%)

• Question 778:

  You have an Azure AD tenant named contoso.com.

  You have an Azure subscription that contains an Azure App Service web app named App1 and an Azure key vault named KV1. KV1 contains a wildcard certificate for contoso.com.

  You have a user named [email protected] that is assigned the Owner role for App1 and KV1.

  You need to configure App1 to use the wildcard certificate of KV1.

  What should you do first?

  A. Create an access policy for KV1 and assign the Microsoft Azure App Service principal to the policy.
  B. Assign a managed user identity to App1.
  C. Configure KV1 to use the role-based access control (RBAC) authorization system.
  D. Create an access policy for KV1 and assign the policy to User1.
  A. Create an access policy for KV1 and assign the Microsoft Azure App Service principal to the policy.

  ---

  Explanation

  ----------------------------------------------------------------------------------------------------

  - Create an access policy for KV1 and assign the Microsoft Azure App Service principal to the policy.

  ----------------------------------------------------------------------------------------------------

  For App Service to import/use a certificate stored in Key Vault, the App Service resource provider (service principal) must be authorized to read the secret/certificate material from the vault. Therefore, the first required step is granting Key Vault access to the App Service principal (via access policy, or equivalently RBAC if the solution is designed that way). The question explicitly targets the "first" step and provides the access policy option that enables App Service to retrieve the certificate.

  Why the other choices are not correct:

  - Assigning a managed identity to App1 can be useful in other Key Vault access patterns, but it is not the first step in the App Service Key Vault certificate import flow described in the provided options.

  - Switching KV1 to RBAC is a design choice, not required as the first step here; and it does not by itself grant App Service access.

  - Giving User1 an access policy doesn't help App Service retrieve and bind the certificate at runtime/import time.

  References:

  1. Configure an SSL certificate in Azure App Service (includes Key Vault certificate import scenario) https://learn.microsoft.com/en-us/azure/app-service/configure-ssl-certificate?tabs=apex Date Modified: Unable to locate date modified Date Access: 01/24/2026

  ----------------------------------------------------------------------------------------------------

  Microsoft Exam Tips:

  - Watch for "first" steps that establish permissions (Key Vault access) before configuration steps (binding cert to hostname).

  ----------------------------------------------------------------------------------------------------

  Summary:

  - App Service + Key Vault integration for TLS certificates; permission prerequisite to read cert/secret.

  ----------------------------------------------------------------------------------------------------

  AZ-104 Exam Objective Hierarchy:

  3.0 Deploy and manage Azure compute resources (20?5%) |__ 3.4 Create and configure Azure App Service |__ |__ 3.4.4 Configure certificates and Transport Layer Security (TLS) for an App Service

• Question 779:

  You need to delegate to a user the ability to assign Azure RBAC roles at the resource group scope.

  The user must not be able to create or modify resources in the resource group.

  A. Network Contributor
  B. Contributor
  C. User Access Administrator
  D. Reader
  C. User Access Administrator

  ---

  Explanation

  --------------------------------------------------------------------------------

  User Access Administrator

  --------------------------------------------------------------------------------

  This replacement question tests which built-in role can manage access (create role assignments) without granting full resource management. **User Access Administrator** is designed to manage user access to Azure resources (role assignments). By contrast, Contributor can manage resources but does not inherently grant role assignment rights unless explicitly permitted.

  Why other selections are not correct:

  - Reader: View-only; cannot create role assignments.

  - Contributor: Can manage resources, but role assignment (Microsoft.Authorization/roleAssignments/write) is not the purpose of Contributor.

  - Network Contributor: Scoped to network resource management; not intended for delegating access control via role assignments.

  -------------------------------------------------------------------------------- References:

  1. Delegate Azure RBAC role assignments (Owner and User Access Administrator can create role assignments) https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/role-based-access-control/delegate-role-assignments-overview.md Modified: Unable to locate date modified Date Access: 01/24/2026

  2. Steps to assign an Azure role (roleAssignments/write prerequisite) https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-steps Modified: 10/15/2025 Date Access: 01/24/2026

  -------------------------------------------------------------------------------- Microsoft Exam Tips:

  - If the stem is "grant someone the ability to assign roles," think **Owner** or **User Access Administrator** (least privilege is often User Access Administrator).

  - Separate "manage resources" (Contributor) from "manage access" (User Access Administrator).

  -------------------------------------------------------------------------------- Summary:

  Choosing the least-privilege role for delegating Azure RBAC role assignment capabilities.

  -------------------------------------------------------------------------------- AZ-104 Exam Objective Hierarchy:

  1.0 Manage Azure identities and governance (20?5%) |__ 1.2 Manage access to Azure resources |__ 1.2.1 Manage built-in Azure roles

• Question 780:

  HOTSPOT

  You have an Azure subscription that contains the virtual networks shown in the following table.

  

  The subscription contains the private DNS zones shown in the following table.

  

  You add virtual network links to the private DNS zones as shown in the following table.

  

  For each of the following statements, select Yes if the statement is true. Otherwise, select No.

  NOTE: Each correct selection is worth one point.

  

  

  ---

  Statement 1: Yes Statement 2: Yes Statement 3: Yes

  Explanation (Why this is correct)

  - Statement 1 (Yes): You can update a private DNS zone VNet link to enable auto-registration (registrationEnabled).

  - Statement 2 (Yes): VNets can be linked to private DNS zones regardless of region, so linking VNET1 to Zone3.com is valid.

  - Statement 3 (Yes): You can add a link from VNET2 to Zone1.com and enable auto-registration on that link.

  Exam Tip

  - Private DNS zone links are about name resolution scope, not VNet/zone region matching.

  References (APA)

  - Microsoft. (n.d.). Azure Private DNS overview. Microsoft Learn. https://learn.microsoft.com/en-us/azure/dns/private-dns-overview

  - Microsoft. (n.d.). Virtual Network Links - Update (Private DNS) - REST API. Microsoft Learn. https://learn.microsoft.com/en-us/rest/api/dns/privatedns/virtualnetworklinks/update

  AZ-104 Exam Objective Hierarchy 4.0 Implement and manage virtual networking (15–20%) |__4.3 Configure name resolution and load balancing |__|__4.3.1 Configure Azure DNS