AZ-104 Practice Exam 1

58 questions with the correct answer and an explanation for each. Topic: AZ-104. Free, no account needed.

These questions are written from Microsoft’s AZ-104 study guide and the Microsoft Learn modules and Azure documentation it points to. They are not real exam questions — those are confidential, and any site offering them is putting your certification at risk.

Take this test interactively

1. An administrator wants to be able to review the packets sent to and from a VM later, with the capture started remotely and filtered to a particular protocol and remote port. Which two statements about the capability that meets this need are correct? (Choose two.)

  1. Filters for the capture session are based on 5-tuple information.
  2. The captured data can be stored on the local disk or in a storage blob.
  3. The capture can only be started from the Azure portal.
  4. The capture records only inbound traffic to the VM.
  5. Captured data is stored only in a Log Analytics workspace.

Answer: A,B — Filters for the capture session are based on 5-tuple information. / The captured data can be stored on the local disk or in a storage blob.

Packet capture filters use the 5-tuple (protocol, local/remote IP, local/remote port), and results go to the local disk or a storage blob. It can also be triggered by PowerShell, CLI or REST API, and it records all traffic to and from the VM, not only inbound traffic.

2. An administrator wants to keep activity logs for a VM for up to two years and run complex queries and alerts against them. Which diagnostic settings destination meets both requirements?

  1. Azure Storage
  2. Azure Event Hubs
  3. Azure Monitor Logs
  4. Azure Monitor Metrics

Answer: C — Azure Monitor Logs

Azure Monitor Logs is the destination for more complex querying and alerting and for longer retention up to two years. Azure Storage is for cheaper long-term archiving, not complex querying and alerting, and Event Hubs forwards data outside Azure.

3. A company backs up a Windows Azure VM daily. An administrator needs the fastest possible recovery for an operational issue that occurred this morning, without waiting for data to be copied back from the vault. Which recovery source should be used?

  1. The vault tier recovery point
  2. The snapshot tier, using instant restore
  3. A Cross Region Restore from the secondary region
  4. A file-level restore through the iSCSI initiator

Answer: B — The snapshot tier, using instant restore

Snapshots are stored locally in the snapshot tier (up to five days) and restoring from them is faster; this is called instant restore. The vault tier requires data transfer from the vault and is not the recommended path for operational recoveries.

4. A VM in subnet A has outbound traffic that must pass both a NIC-level NSG and a subnet-level NSG. In which order does Azure evaluate the NSGs for this outbound traffic?

  1. Subnet NSG first, then NIC NSG
  2. NIC NSG first, then subnet NSG
  3. Both are evaluated simultaneously and the lowest priority number wins across both
  4. Only the NSG on the NIC is evaluated when one exists

Answer: B — NIC NSG first, then subnet NSG

For outbound traffic the order is reversed from inbound: NIC NSG rules first, then subnet NSG rules. Inbound is subnet first, then NIC.

5. A VM in a Recovery Services vault was corrupted and must be restored. The administrator wants to restore the disks to a specified resource group and then customize the VM configuration using a template or PowerShell settings that were not present at backup time. Which restore option fits?

  1. Create a new VM
  2. Replace existing
  3. Restore disk
  4. Cross Zonal Restore

Answer: C — Restore disk

Restore disk copies the disks to a chosen resource group and provides a template for customizing the VM, which suits adding settings configured via template or PowerShell. Create a new VM only gets a basic VM running, and Replace existing swaps disks on the current VM.

6. An administrator wants to see which VM sizes can be deployed in a specific Azure region by using the Azure CLI, with the results shown in a table. Which command should they run?

  1. az vm list --location <region> --output table
  2. az vm image list --location <region> --output table
  3. az account list-locations --output table
  4. az vm list-skus --location <region> --output table

Answer: D — az vm list-skus --location <region> --output table

The az vm list-skus command with --location identifies which machine sizes are available in a region. The other commands list existing VMs, images or regions rather than available sizes.

7. A company requires self-service password reset that follows the on-premises Active Directory password policy, and wants to define permanent and temporary administrators with an approval workflow when privileges are used. Which two features, available at the licensing levels indicated, meet these needs? (Choose two.)

  1. Password reset with writeback (Microsoft Entra ID P1)
  2. Microsoft Entra Privileged Identity Management (Microsoft Entra ID P2)
  3. Cloud App Discovery (Microsoft Entra ID P2 only)
  4. Microsoft Entra ID Protection sign-in policies (Microsoft Entra ID P1)
  5. Self-service group management (Microsoft Entra ID P2 only)

Answer: A,B — Password reset with writeback (Microsoft Entra ID P1) / Microsoft Entra Privileged Identity Management (Microsoft Entra ID P2)

Password reset with writeback is a P1 feature that follows the on-premises password policy, and Privileged Identity Management (P2) defines permanent and temporary administrators with a policy workflow. ID Protection is a P2 feature that manages risk, not admin activation.

8. A team deploys a public IP with domain name label scope set to SubscriptionReuse and the label contoso. They later delete the IP and redeploy it from the same template in the same subscription, and then deploy the same template in a different subscription. What happens to the generated domain name label?

  1. It stays the same in both deployments
  2. It stays the same in the original subscription and changes in the other subscription
  3. It changes in both deployments
  4. It stays the same in the other subscription and changes in the original subscription

Answer: B — It stays the same in the original subscription and changes in the other subscription

SubscriptionReuse gives objects with the same name in the same subscription the same label, so redeploying there keeps it, while a different subscription produces a different hash string.

9. Versioning is enabled on a storage account that holds page blobs and append blobs. An administrator must plan manual snapshots to capture changes that versioning does not record. Which two operations do not trigger the creation of a new version? (Choose two.)

  1. Put Blob
  2. Put Page
  3. Copy Blob
  4. Append Block
  5. Set Blob Metadata

Answer: B,D — Put Page / Append Block

Put Page (page blob) and Append Block (append blob) don't create versions, so a manual snapshot is needed. Put Blob, Copy Blob and Set Blob Metadata all trigger a version.

10. A company tags a resource group with `CostCenter = 1234` and expects every resource in it to carry the tag automatically so costs can be grouped. What is true about tag behavior here?

  1. Resources inherit the tag automatically, including resources added later.
  2. Resources inherit the tag only if a ReadOnly lock is on the resource group.
  3. Resources do not inherit the tag; a policy definition for tag compliance is needed to apply it to resources.
  4. Resources inherit the tag only when the resource group is moved to a management group.

Answer: C — Resources do not inherit the tag; a policy definition for tag compliance is needed to apply it to resources.

Resources don't inherit tags applied to a resource group or subscription; tag-compliance policy definitions can be used to apply them.

11. A company stores product catalog data in a storage account and requires that its applications can still read the data if the entire primary region becomes unavailable, without waiting for Microsoft to initiate a failover. The data must also stay available for reads and writes if a single availability zone fails. Which redundancy option meets both requirements?

  1. GZRS
  2. RA-GRS
  3. RA-GZRS
  4. ZRS

Answer: C — RA-GZRS

RA-GZRS replicates across three availability zones in the primary region and to a secondary region, and allows reads from the secondary regardless of failover. GZRS lacks read access to the secondary before failover, and RA-GRS does not replicate across zones in the primary region.

12. A company deploys a three-tier application on Azure VMs. An administrator wants a single rack-level power or switch failure to leave at least one VM in each tier running, and also wants the VMs in a tier to avoid being rebooted together during host OS maintenance. The VMs are being newly created. What should the administrator do?

  1. Place all VMs from every tier in one availability set so Azure spreads them across fault and update domains
  2. Place each tier's VMs in a separate availability set, with multiple VMs in each set
  3. Place each tier's VMs in a separate availability set with only one VM per set
  4. Deploy each tier as a single larger VM and scale it up when load increases

Answer: B — Place each tier's VMs in a separate availability set, with multiple VMs in each set

Each application tier should be in its own availability set, and multiple VMs per set give redundancy across fault and update domains. A single set for all tiers does not separate the tiers' single points of failure, and one VM per set gives no redundancy.

13. A web application runs on a single VM that is heavily used on weekdays and nearly idle on weekends. The administrator wants to reduce the monthly cost without adding more VMs and accepts a restart when the change is made. Which approach fits?

  1. Scale out by adding more VM instances on weekdays
  2. Scale in by removing VM instances on weekends
  3. Scale down by decreasing the VM size on weekends
  4. Move the VM into an availability set

Answer: C — Scale down by decreasing the VM size on weekends

Vertical scaling changes the VM size, and scaling down reduces cost for an under-utilized VM; it usually requires a stop and restart. Scale out/in changes the number of instances instead.

14. A custom role must let a team manage policy assignments across an entire management group hierarchy. The administrator defines it with the management group as an assignable scope and also wants to add a second management group to the same new role's assignable scopes. What is the outcome?

  1. Both are accepted, since a custom role may list any number of management groups.
  2. Only one management group can be defined in the assignable scopes of a new role.
  3. The second management group is accepted only if it is a child of the first.
  4. Both are accepted if the role includes DataActions.

Answer: B — Only one management group can be defined in the assignable scopes of a new role.

A new custom role can define only one management group in its assignable scopes to reduce disconnects between definitions and assignments. Roles with DataActions cannot be assigned at management group scope at all.

15. An SSPR policy currently requires one authentication method. Several users have registered exactly one method. The administrator changes the policy to require two methods. What happens to those users?

  1. They can still reset or unlock because their existing registration is grandfathered in.
  2. They can no longer reset or unlock until they register another method.
  3. They can reset their password but not unlock their account.
  4. They are automatically prompted to reconfirm and then allowed to reset.

Answer: B — They can no longer reset or unlock until they register another method.

With one method registered and two required, users are unable to reset or unlock.

16. A company is linking a new Azure virtual network to its on-premises datacenter to build a hybrid solution. The on-premises network already uses 10.0.0.0/16, and the administrator wants the connection to work without readdressing the on-premises side. Which design choice meets this requirement?

  1. Give the virtual network an address space whose CIDR block does not overlap with the on-premises CIDR block
  2. Give the virtual network the same 10.0.0.0/16 address space so that both networks are treated as one
  3. Split the 10.0.0.0/16 range so the virtual network and on-premises network each use half of the same subnet
  4. Define the address space as both on-premises and cloud so that it spans both environments

Answer: A — Give the virtual network an address space whose CIDR block does not overlap with the on-premises CIDR block

Virtual networks can be linked to on-premises infrastructure for hybrid solutions only when the CIDR blocks of the connecting networks don't overlap. The address space of a virtual network can be either on-premises or in the cloud, but not both, so option D is wrong.

17. A route table is associated with a subnet and traffic to 10.0.1.0/24 must go through an NVA with the private IP 10.0.2.4. Which user-defined route configuration meets the requirement?

  1. Address prefix 10.0.1.0/24, next hop type VirtualAppliance, next hop IP address 10.0.2.4
  2. Address prefix 10.0.2.0/24, next hop type VirtualNetwork, next hop IP address 10.0.1.4
  3. Address prefix 10.0.1.0/24, next hop type Internet, next hop IP address 10.0.2.4
  4. Address prefix 10.0.1.0/24, next hop type VirtualNetworkServiceEndpoint, next hop IP address 10.0.2.4

Answer: A — Address prefix 10.0.1.0/24, next hop type VirtualAppliance, next hop IP address 10.0.2.4

The route targets the destination prefix and uses the VirtualAppliance hop type with the NVA's private IP, as in the exercise. VirtualNetworkServiceEndpoint cannot be specified in user-defined routes.

18. An administrator needs a budget alert that triggers an action group and also sends mobile push notifications to the Azure app when the threshold is met. At which scopes can the budget be configured to call the action group? (Choose two.)

  1. Management group
  2. Subscription
  3. Resource group
  4. Billing profile
  5. Enrollment account

Answer: B,C — Subscription / Resource group

Action groups are supported only for subscription and resource group scopes. Management group, billing profile and enrollment account scopes are not supported for action groups.

19. A company has an A record pointing its custom domain at an app's current IP address. It then adds a certificate binding that uses IP based SSL. What must the administrator do so that the domain keeps resolving to the app?

  1. Remap the A record to the new dedicated IP address shown on the Custom domains page
  2. Change the CNAME record to point to sni.<app-name>.azurewebsites.net
  3. Delete the TXT asuid record so the IP address can be reassigned
  4. Nothing, because the app keeps its original shared IP address

Answer: A — Remap the A record to the new dedicated IP address shown on the Custom domains page

IP based SSL makes App Service create a new dedicated IP for the app, so an A record must be updated to that address. The sni. CNAME remap applies only to an existing SNI SSL binding on the azurewebsites.net name.

20. An administrator associates a route table with the public subnet that sends traffic for the private subnet through an NVA. No route table is associated with the private subnet. What path does traffic take from a VM in the private subnet to a VM in the public subnet?

  1. Through the NVA, because routes in a route table apply to both subnets in the virtual network
  2. Dropped, because the next hop type for the public subnet is None
  3. Through the NVA, because the NVA has IP forwarding enabled
  4. Directly to the public subnet, because the private subnet uses default system routes

Answer: D — Directly to the public subnet, because the private subnet uses default system routes

The route table applies only to the subnet it is associated with, so the private subnet keeps its default system routes and traffic goes directly. The traceroute test shows a direct path to 10.0.0.4.

21. An administrator has delegated a domain to Azure DNS and wants to confirm from a command line that the delegation took effect. Which query should be run?

  1. nslookup -type=NS www.wideworldimports.com
  2. nslookup -type=SOA wideworldimports.com
  3. nslookup -type=A wideworldimports.com
  4. nslookup -type=TXT wideworldimports.com

Answer: B — nslookup -type=SOA wideworldimports.com

Delegation is verified by querying the SOA record of the domain, which Azure DNS creates automatically. A and TXT records are not the reference for verifying delegation.

22. Before deploying a template to a production resource group, an administrator must see which resources would be created, updated or deleted, and which resource properties would change. Nothing may be deployed during this check. What should the administrator use?

  1. The ARM template tool kit (arm-ttk)
  2. The what-if operation
  3. The deployment history in the Azure portal
  4. Export template from the resource group

Answer: B — The what-if operation

The what-if operation previews the resources to create, update or delete and the properties to change. arm-ttk only checks that a template follows recommended guidelines, and deployment history only shows past deployments.

23. A load balancer health probe is configured against a web application on its back-end VMs. The application's health endpoint begins returning HTTP 204 instead of HTTP 200, although the web server is running and listening on the probe port. The administrator needs the probe to reflect only whether the instance responds with a successful health status. What is the result with the current probe type, and what probe type would not fail on this response?

  1. An HTTP probe marks the instance healthy because any 2xx status counts; no change is needed
  2. An HTTP probe marks the instance unhealthy because only HTTP 200 passes; a TCP probe would still succeed since the listener exists
  3. An HTTPS probe marks the instance healthy because it validates the certificate rather than the status code; no change is needed
  4. A TCP probe marks the instance unhealthy because it requires an HTTP 200; an HTTP probe would succeed

Answer: B — An HTTP probe marks the instance unhealthy because only HTTP 200 passes; a TCP probe would still succeed since the listener exists

HTTP/HTTPS probes treat any status other than HTTP 200 as a failure, whereas a TCP probe only needs a successful TCP session to the probe port, which succeeds if a listener exists.

24. An administrator peers two virtual networks in different regions. Virtual machines in one network must reach an internal load balancer front end in the other network, and VMs must resolve each other by name. Which two actions are required? (Choose two.)

  1. Use a Standard Load Balancer rather than a Basic Internal Load Balancer
  2. Rely on Azure's built-in name resolution across the peering
  3. Configure Azure Private DNS zones or custom DNS servers for name resolution
  4. Deploy a VPN gateway in each network to encrypt the traffic so the load balancer is reachable

Answer: A,C — Use a Standard Load Balancer rather than a Basic Internal Load Balancer / Configure Azure Private DNS zones or custom DNS servers for name resolution

Basic Internal Load Balancer IPs are not reachable across regionally peered VNets, so Standard is needed, and Azure's built-in name resolution does not work across peerings, so Private DNS or custom DNS is required.

25. An administrator wants to scale an App Service plan ahead of a known load increase every Saturday at 8:00 AM, rather than reacting to CPU usage. Which autoscale rule type should be used?

  1. A metric-based rule on CPU time
  2. A metric-based rule on Average response time
  3. A time-based (schedule-based) rule
  4. A notification setting with a webhook

Answer: C — A time-based (schedule-based) rule

Time-based rules let you scale when you see time patterns, before a load change occurs. Metric-based rules react to measured load, and notification settings only send alerts rather than scale.

26. After a ransomware scare, a security team requires that a deleted VM backup in a Recovery Services vault stays recoverable. They also want to set their own retention period for deleted backup data, and the protection must not be possible to switch off, even by someone with malicious intent who gains access. Which capability meets these requirements?

  1. Soft delete with its default settings
  2. Enhanced soft delete with soft delete set to always-on
  3. Cross Region Restore enabled on the vault
  4. Azure RBAC with the built-in Azure Backup roles

Answer: B — Enhanced soft delete with soft delete set to always-on

Enhanced soft delete lets you customize the soft delete retention period and make soft delete always-on, so it can't be disabled by malicious actors. Default soft delete keeps deleted data for a fixed 14 days and offers neither customization nor the always-on protection.

27. An administrator must be able to recover a container that was deleted by mistake, and also must guard against accidental deletion of the storage account itself. Blob versioning and blob soft delete are already enabled. Which two actions should they take? (Choose two.)

  1. Enable the Permanent Delete feature on the account
  2. Enable container soft delete
  3. Increase the blob soft delete retention period to 365 days
  4. Configure a resource lock on the storage account
  5. Take blob snapshots on a schedule

Answer: B,D — Enable container soft delete / Configure a resource lock on the storage account

Container soft delete restores deleted containers, and a lock on the storage account prevents accidental account deletion. Blob soft delete and versioning work at blob level only, and Permanent Delete removes protection rather than adding it.

28. A blob currently sits in the archive tier and has not been rehydrated. Which two operations can the administrator perform on it? (Choose two.)

  1. Write blob index tags by using Set Blob Tags.
  2. Download the blob's content.
  3. Create a snapshot of the blob.
  4. List the blob and read its properties.
  5. Overwrite the blob's metadata.

Answer: A,D — Write blob index tags by using Set Blob Tags. / List the blob and read its properties.

An archived blob's metadata, properties and index tags stay available, and blob index tags can be read or written, so listing the blob, reading its properties and setting tags work. The content can't be read or modified until rehydration, metadata is read-only, and snapshots aren't supported for archived blobs.

29. A help desk lead needs to add 40 users to an existing security group and later remove two of them. The lead is not a Global Administrator, and the organization wants to grant the narrowest role that still allows this work. Which role is documented as sufficient for managing group membership?

  1. Groups Administrator
  2. Privileged Role Administrator
  3. Helpdesk Administrator
  4. Authentication Administrator

Answer: A — Groups Administrator

User Administrator or Groups Administrator is the role required to manage group membership; Privileged Role Administrator is only needed to enable role-assignable groups, and the other roles are not listed for group membership management.

30. A company distributes SAS URIs to external developers so they can upload files to a container. The security team wants to be able to cut off a distributed SAS immediately if it leaks, without regenerating the storage account keys that other applications rely on. Which approach meets the requirement?

  1. Create each SAS with a very long expiry time and rely on clients to discard it
  2. Create service-level SAS tokens that reference a stored access policy
  3. Create ad hoc account-level SAS tokens signed with the primary access key
  4. Set the Secure transfer required property on the storage account

Answer: B — Create service-level SAS tokens that reference a stored access policy

Stored access policies let you revoke permissions without regenerating the storage account keys. Without a stored access policy, the document's only mitigation for a compromised SAS is a short validity period, so a long expiry or an ad hoc account-level SAS doesn't allow an immediate cut-off. Secure transfer required only enforces secure connections.

31. A VM encrypted with Azure Disk Encryption is backed up. A user deleted a single configuration file, and the administrator wants to recover only that file. What approach applies?

  1. Use file-level restore directly from the recovery point
  2. Use the Replace existing VM option to swap in only that file
  3. Restore the entire VM, then manually copy the file
  4. Mount the snapshot with the iSCSI initiator on the target machine

Answer: C — Restore the entire VM, then manually copy the file

File-level or folder-level restores aren't supported for encrypted VMs, so the entire VM has to be restored and the file copied manually. Replace existing VM is also unavailable for encrypted VMs.

32. A user needs to deploy a VM and has been assigned Virtual Machine Contributor on resource group RG-App. The VM must attach to a virtual network that lives in a different, shared resource group RG-Net. The deployment fails with an authorization error. What is the most likely reason, and the least-privilege fix?

  1. Virtual Machine Contributor doesn't manage virtual networks, and the assignment on RG-App doesn't cover RG-Net; obtain only the needed network permissions at the appropriate scope
  2. Virtual Machine Contributor can't be assigned at resource group scope; assign it at subscription scope
  3. The assignment hasn't been made Owner-level; assign Owner on RG-App
  4. Virtual Machine Contributor automatically covers shared networks; the user must be missing a Microsoft Entra role

Answer: A — Virtual Machine Contributor doesn't manage virtual networks, and the assignment on RG-App doesn't cover RG-Net; obtain only the needed network permissions at the appropriate scope

The role grants VM-management permissions but not management of the virtual network, and an assignment on one resource group doesn't extend to a shared network in another. Granting only the extra permissions at their scopes preserves least privilege.

33. A company wants to run a legacy line-of-business application on Azure VMs that requires LDAP and Kerberos authentication and Group Policy management. The company does not want to deploy, patch or monitor any domain controllers in Azure, and does not want authentication or replication traffic to depend on a site-to-site VPN. Which solution meets the requirements?

  1. Deploy replica domain controllers from the on-premises AD DS as Azure VMs
  2. Enable Microsoft Entra Domain Services
  3. Use a Microsoft Entra tenant alone and configure Application Proxy
  4. Deploy AD DS on an Azure VM with additional data disks

Answer: B — Enable Microsoft Entra Domain Services

Microsoft Entra Domain Services provides Group Policy, domain join, Kerberos and LDAP support without managing domain controllers or a VPN. Replica domain controllers in VMs still need management and replication traffic crossing a VPN.

34. An administrator wants to nest the security group 'MDM policy - West' inside the security group 'MDM policy - All org' so that membership and Conditional Access scoping can be reused. Which requirement or limitation applies to this design?

  1. Licenses assigned to the parent group will also be applied to members of the nested group.
  2. Members of the nested group automatically gain access to apps assigned to the parent group.
  3. The nested group can be added as a member of a role-assignable group.
  4. Nested groups can be used for membership and Conditional Access scopes, but don't gain access to resources and apps assigned to the parent group.

Answer: D — Nested groups can be used for membership and Conditional Access scopes, but don't gain access to resources and apps assigned to the parent group.

Nested groups can be used for membership and Conditional Access scopes, but do not inherit access to shared resources and apps, and license assignment to nested security groups and nesting in role-assignable groups are unsupported.

35. A team wants to run containerized microservices that scale automatically on HTTP traffic and on messages from queues, including scaling to zero. They do not need direct access to the Kubernetes APIs and want to avoid managing cluster infrastructure. Which service fits?

  1. Azure Container Instances
  2. Azure Kubernetes Service
  3. Azure Container Apps
  4. A virtual machine running Docker

Answer: C — Azure Container Apps

Azure Container Apps is serverless, supports HTTP and event-driven scale including scale to zero, and doesn't expose Kubernetes APIs. AKS gives full Kubernetes control but requires cluster operation.

36. An administrator needs the exact scope string of a storage blob container to use in a command-line role assignment. Which two approaches yield the scope? (Choose two.)

  1. Read the Resource ID shown in the resource's properties in the Azure portal
  2. Temporarily assign a role at the resource scope in the portal, then list the role assignment with Azure PowerShell or Azure CLI and read its scope property
  3. Open the Check access tab and select View my access to see the resource's scope string
  4. Look at the management group's name, since the resource scope is derived from it
  5. Use only the subscription ID, since it identifies every resource beneath it

Answer: A,B — Read the Resource ID shown in the resource's properties in the Azure portal / Temporarily assign a role at the resource scope in the portal, then list the role assignment with Azure PowerShell or Azure CLI and read its scope property

The documentation gives two ways to find a resource's scope: the Resource ID in the portal properties, or listing a temporary role assignment and reading its scope. Check access lists assignments, not scope strings, and a subscription ID or management group name identifies only those scopes.

37. An administrator configures autoscale for an App Service plan. The monitoring metrics may sometimes be unavailable, and the company wants costs to stay bounded and the app to remain available when there is no load. Which settings should be chosen? (Choose two.)

  1. Set a safe default instance count
  2. Set the minimum instance count to 0
  3. Set a maximum instance count to limit hourly cost
  4. Set identical minimum and maximum instance counts
  5. Configure only a scale-out rule to keep costs predictable

Answer: A,C — Set a safe default instance count / Set a maximum instance count to limit hourly cost

Autoscale scales to the default instance count when metrics aren't available, and the maximum instance count limits total possible hourly cost. Identical min/max removes scaling margin, and omitting scale-in causes unnecessary costs.

38. Traffic from a public subnet is routed to an NVA VM in a perimeter subnet, but the traffic never reaches the destination servers in the private subnet. The route table and route are correct. Which two actions must be taken so the NVA passes the traffic on? (Choose two.)

  1. Enable IP forwarding on the NVA's Azure network interface
  2. Create a second user-defined route with the same address prefix as the first
  3. Associate a second route table with the public subnet
  4. Enable IP forwarding within the NVA's operating system
  5. Delete the default system route 0.0.0.0/0

Answer: A,D — Enable IP forwarding on the NVA's Azure network interface / Enable IP forwarding within the NVA's operating system

IP forwarding must be enabled on the Azure NIC (--ip-forwarding true) and inside the appliance (net.ipv4.ip_forward=1), otherwise traffic routed through it never reaches its destination. Duplicate-prefix UDRs are not allowed, a subnet can only be associated with one route table, and system routes cannot be deleted.

39. A security team wants protection in case one encryption algorithm or key used by Azure Storage is ever compromised, so the administrator enables infrastructure encryption on a storage account whose service-level encryption uses customer-managed keys. Which two statements describe the result? (Choose two.)

  1. Data is encrypted twice, once at the service level and once at the infrastructure level, with two different keys.
  2. The infrastructure-level layer relies on Microsoft-managed keys, even though the service level uses customer-managed keys.
  3. The infrastructure-level layer can be configured to use a customer-managed key stored in Azure Key Vault.
  4. Both layers use the same key but apply two different encryption algorithms.
  5. Service-level encryption is turned off while infrastructure encryption is enabled.

Answer: A,B — Data is encrypted twice, once at the service level and once at the infrastructure level, with two different keys. / The infrastructure-level layer relies on Microsoft-managed keys, even though the service level uses customer-managed keys.

With infrastructure encryption, data is encrypted at both levels with two different algorithms and two different keys, and the infrastructure level relies on Microsoft-managed keys with its own separate key. Service-level encryption cannot be disabled, and the infrastructure layer does not use customer-managed keys.

40. An administrator wants to export a template that contains only one storage account from a resource group. The administrator plans to author their own parameters instead of using generated ones. Which two actions achieve this? (Choose two.)

  1. Open the storage account and select Export template in the left pane
  2. Clear the Include parameters checkbox
  3. Select Export template from the resource group's left menu
  4. Select the link under Deployments and choose a deployment's Template
  5. Leave Include parameters selected

Answer: A,B — Open the storage account and select Export template in the left pane / Clear the Include parameters checkbox

Exporting from the resource itself gives a template with only that single resource, and clearing Include parameters stops all parameters being generated. The resource group's left-menu export includes all resources in the group, and leaving the checkbox selected includes all parameters.

41. A team writes a log query in Log Analytics and wants to reuse it, unchanged, in a log search alert rule. The query currently uses the workspace() operator to read from another workspace, and also relies on cluster() and database() functions. Which statement is correct?

  1. workspace() is available only in Azure Monitor, while cluster() and database() are not supported there and must be removed
  2. workspace() is not supported in Azure Monitor, but cluster() and database() work as in Azure Data Explorer
  3. All three work unchanged because Azure Monitor Logs uses exactly the same KQL as Azure Data Explorer
  4. workspace() and database() are supported, but only cluster() is unsupported

Answer: A — workspace() is available only in Azure Monitor, while cluster() and database() are not supported there and must be removed

workspace(), app() and resource() are operators exclusive to Azure Monitor, whereas cluster() and database() are listed as not supported in Azure Monitor.

42. An administrator wants a container app to incur no usage charges while idle, so it must be able to scale to zero replicas. Which two scale rule metrics would prevent the app from scaling to zero? (Choose two.)

  1. CPU load
  2. Memory load
  3. Concurrent HTTP requests
  4. Azure Service Bus queue length
  5. Concurrent TCP connections

Answer: A,B — CPU load / Memory load

Apps that scale on CPU or memory load can't scale to zero. HTTP, TCP and event-driven rules such as Service Bus can scale in to zero replicas.

43. An administrator who owns a storage account will run many azcopy copy commands and wants to provide Microsoft Entra ID credentials once instead of appending a SAS token to every URL. Which AzCopy command should the administrator run first?

  1. azcopy env
  2. azcopy login status
  3. azcopy login
  4. azcopy set-properties

Answer: C — azcopy login

azcopy login signs in to Microsoft Entra ID so that credentials are provided once for later commands. azcopy login status only displays the current authentication status, and azcopy env only shows environment variables.

44. A company hosts an App Service app that includes a continuous WebJob and wants the app to remain loaded when there is no incoming traffic. Which TWO statements about the relevant configuration are correct? (Choose two.)

  1. Enable the Always On setting on the app
  2. Enable the HTTPS Only setting on the app
  3. Always On is required for WebJobs triggered by a CRON expression as well as continuous WebJobs
  4. Enable session affinity so the same instance keeps the app loaded
  5. Always On is a swapped setting that follows the content to production during a slot swap

Answer: A,C — Enable the Always On setting on the app / Always On is required for WebJobs triggered by a CRON expression as well as continuous WebJobs

Always On keeps the app loaded without traffic and is required for continuous WebJobs and for WebJobs triggered by a CRON expression. HTTPS Only only redirects HTTP to HTTPS, session affinity only routes clients to the same instance, and Always On is slot-specific, not swapped.

45. A company protects Azure Database for PostgreSQL servers in a Backup vault. The administrator enables Cross Region Restore so the team can run regional resiliency drills in the paired region while the primary region is healthy. At which storage rate will the PostgreSQL backups in this vault be charged?

  1. LRS rates
  2. ZRS rates
  3. GRS rates
  4. RA-GRS rates

Answer: D — RA-GRS rates

Backup vaults enabled with Cross Region Restore are automatically charged at RA-GRS rates for PostgreSQL backups. Plain GRS would only expose the secondary-region data after Microsoft declares an outage, which is why it is not the rate for the drill-capable setup.

46. A pay-as-you-go subscription has an invoice billing period that doesn't match the calendar month. An administrator wants the budget to reset in line with the invoice period and to be evaluated per quarter. Which reset period should be selected?

  1. Quarterly
  2. Billing quarter
  3. Billing month
  4. Annually

Answer: B — Billing quarter

Billing month, Billing quarter and Billing year align to the invoice period, while Monthly, Quarterly and Annually align to calendar periods. Quarterly would follow the calendar quarter, not the invoice period.

47. Before swaps, an app must be pinged at /statuscheck, and only during slot swaps, not on every restart. The swap must stop if the returned status code isn't 200. Which two app settings should be added? (Choose two.)

  1. WEBSITE_SWAP_WARMUP_PING_PATH
  2. WEBSITE_SWAP_WARMUP_PING_STATUSES
  3. WEBSITE_WARMUP_PATH
  4. WEBSITE_ADD_SITENAME_BINDINGS_IN_APPHOST_CONFIG
  5. WEBSITE_VNET_ROUTE_ALL

Answer: A,B — WEBSITE_SWAP_WARMUP_PING_PATH / WEBSITE_SWAP_WARMUP_PING_STATUSES

WEBSITE_SWAP_WARMUP_PING_PATH sets the ping path for swaps and WEBSITE_SWAP_WARMUP_PING_STATUSES lists valid response codes, stopping the swap otherwise. WEBSITE_WARMUP_PATH pings on every restart, not just swaps.

48. An administrator creates a peering from VNet1 to VNet2 in the portal and checks it right afterward. VMs in the two networks cannot yet communicate. No peering has been created from VNet2 back to VNet1. What status does VNet1's peering show, and why is connectivity not working?

  1. Connected, but NSG rules block traffic by default
  2. Initiated, because the peering is not established until both virtual networks show Connected
  3. Disconnected, because VNet1 and VNet2 are in separate subscriptions
  4. Initiated, because global peering requires a VPN gateway before it becomes Connected

Answer: B — Initiated, because the peering is not established until both virtual networks show Connected

The first network shows Initiated after the initial peering is created to the remote network, and the peering is only established once both sides show Connected. Option D is wrong because no gateway is required for the status to change.

49. An application connects to a storage account by using key1 in its connection strings. The administrator must rotate both access keys without the application losing access to storage at any point. Which sequence should the administrator follow?

  1. Update the connection strings to use key2, regenerate key1, update the connection strings to the new key1, then regenerate key2
  2. Regenerate key1, update the connection strings to the new key1, then regenerate key2
  3. Regenerate key2, then regenerate key1, then update the connection strings to the new key1
  4. Create a key expiration policy, which regenerates key1 and key2 automatically while the application keeps running

Answer: A — Update the connection strings to use key2, regenerate key1, update the connection strings to the new key1, then regenerate key2

The application is moved to the secondary key first, so regenerating the primary key doesn't cut off access. After the connection strings are updated to the new primary key, the secondary key is regenerated the same way. Regenerating a key the application still uses causes it to lose access, and a key expiration policy only sets a reminder.

50. A company wants one budget at management group scope covering subscriptions billed in different currencies. What is the consequence of this design?

  1. Costs are automatically converted to USD and the budget works normally.
  2. The budget is evaluated per subscription in each subscription's currency.
  3. Multi-currency evaluation isn't supported, so budget alerts might be missed.
  4. The budget can only be created if the subscriptions are in the same Enterprise Agreement department.

Answer: C — Multi-currency evaluation isn't supported, so budget alerts might be missed.

All subscriptions within the scope must operate under a single currency; multi-currency budget evaluations aren't supported and alerts might be missed.

51. An administrator manages dozens of web and database VMs whose count changes frequently. They want NSG rules that allow web-tier VMs to reach database-tier VMs on port 1433 without listing individual IP addresses or placing tiers in separate subnets. What should they configure?

  1. Application security groups for each tier, used as source and destination in the rule
  2. A service tag for each tier, used as source and destination in the rule
  3. One NSG per VM with the specific IP address of each peer
  4. An NSG on each subnet with the My IP address source value

Answer: A — Application security groups for each tier, used as source and destination in the rule

ASGs group VMs by workload and can be used as source or destination, so rules need no IP maintenance or subnet separation. Service tags represent IP prefixes of Azure services, not groups of your own VMs.

52. A staging slot uses a test database connection string. The administrator must ensure this value stays with the staging slot and never moves to production when the slots are swapped. What should be configured?

  1. Select Deployment slot setting for the connection string or app setting on the staging slot
  2. Set the Traffic % of the staging slot to 0
  3. Enable auto swap on the staging slot
  4. Add an applicationInitialization element to Web.config

Answer: A — Select Deployment slot setting for the connection string or app setting on the staging slot

Marking a setting as a Deployment slot setting makes it slot-specific so it isn't swapped. Traffic percentage, auto swap and custom warm-up don't control which settings are swapped.

53. A security policy requires that all access to a storage account's blob data be authorized through Microsoft Entra ID, so that no client can use an account access key or a key-signed token. Which action enforces this at the storage account?

  1. Regenerate the secondary access key
  2. Disable anonymous public access on the account
  3. Disable Shared Key authorization at the storage account level
  4. Enable infrastructure encryption on the account

Answer: C — Disable Shared Key authorization at the storage account level

Disabling Shared Key at the storage account level enforces Entra ID authorization. Disabling anonymous access doesn't block key-based access, and regenerating a key only replaces it.

54. An app uses virtual network integration, but only private (RFC1918) traffic currently enters the virtual network. The administrator needs all outbound internet calls from the app to be subject to the NSG and route table on the integration subnet. What should be configured?

  1. Enable outbound internet traffic routing for the app
  2. Add an inbound rule to the NSG on the integration subnet
  3. Create a private endpoint for the app in the integration subnet
  4. Add the WEBSITE_PRIVATE_IP setting to the app

Answer: A — Enable outbound internet traffic routing for the app

With outbound internet traffic routing disabled, only private traffic goes into the virtual network. Enabling it sends all outbound app traffic through the integration subnet, where NSGs and UDRs apply. Inbound NSG rules don't apply to virtual network integration.

55. An administrator wants an action group to authenticate to downstream services with managed identities instead of stored credentials (preview feature). Which two action types in the action group can use a managed identity? (Choose two.)

  1. Automation Runbook
  2. Secure webhook
  3. Webhook
  4. ITSM
  5. Event hubs

Answer: A,E — Automation Runbook / Event hubs

Automation Runbook and Event Hub actions support managed identity. ITSM, Secure webhook and Webhook don't.

56. A company has an existing on-premises AD DS environment and wants its domain users on Windows clients to access SMB Azure file shares with their current credentials, using AD DS as the identity source. Which two requirements must be met? (Choose two.)

  1. Exclude the storage account application from applicable multifactor authentication policies
  2. Sync the on-premises AD DS identities to Microsoft Entra ID by using Microsoft Entra Connect Sync or Microsoft Entra Connect cloud sync
  3. Join the clients to a Microsoft Entra Domain Services managed domain
  4. Ensure the clients have unimpeded network connectivity to the domain controllers
  5. Use NFS file shares so that identity-based authentication applies

Answer: B,D — Sync the on-premises AD DS identities to Microsoft Entra ID by using Microsoft Entra Connect Sync or Microsoft Entra Connect cloud sync / Ensure the clients have unimpeded network connectivity to the domain controllers

With AD DS, identities must be synced to Microsoft Entra ID because share-level permissions are configured against the Entra identity, and clients must reach the domain controllers. The MFA exclusion applies to Microsoft Entra Kerberos, joining a managed domain applies to Microsoft Entra Domain Services, and NFS shares don't support identity-based authentication.

57. A group was created as a Microsoft 365 group by mistake, and the team actually needs a security group with the same name. What must the administrator do?

  1. Edit the group's Properties and change the Group type to Security.
  2. Change the Membership type to Assigned, which converts the group type.
  3. Delete the group and create a new one with the correct type.
  4. Copy the Object ID to PowerShell and change the type there.

Answer: C — Delete the group and create a new one with the correct type.

The group type cannot be changed after creation; the group must be deleted and recreated. The Object ID can only be copied, not changed.

58. A company needs its Linux file-based workloads migrated to Azure. Existing partners also push files to the company using SFTP tools, and those files must land directly in blob storage with no change to the tools. Which setting must be enabled on the storage account to support the SFTP requirement?

  1. Default to Microsoft Entra authorization
  2. Hierarchical namespace
  3. Read-access to the secondary region
  4. A private endpoint

Answer: B — Hierarchical namespace

SFTP on Blob Storage requires hierarchical namespace (HNS), enabled on the Advanced tab at creation or later under Settings → Configuration. Default to Microsoft Entra authorization only changes the default authorization to RBAC rather than shared keys.

Take this test interactively

More Microsoft Azure Administrator (AZ-104) practice tests