AZ-104 Practice Exam 2

58 questions with the correct answer and an explanation for each. Topic: AZ-104. Free, no account needed.

These questions are written from Microsoft’s AZ-104 study guide and the Microsoft Learn modules and Azure documentation it points to. They are not real exam questions — those are confidential, and any site offering them is putting your certification at risk.

Take this test interactively

1. A Windows VM's OS disk uses the default MBR partitioning. An application on the VM now needs about 3 TiB of storage for its data. Which two approaches provide the required space? (Choose two.)

  1. Increase the OS disk to its 4,095 GiB maximum and keep the data on it without changing the partition style
  2. Create and attach a data disk and store the data on it
  3. Convert the OS disk to a GUID partition table (GPT) and store the data on it
  4. Store the data on the temporary disk (drive D)
  5. Enable encryption at host on the VM

Answer: B,C — Create and attach a data disk and store the data on it / Convert the OS disk to a GUID partition table (GPT) and store the data on it

MBR limits the usable size to 2 TiB, so you either attach data disks for data storage or convert the OS disk to GPT. Growing the OS disk alone doesn't lift the MBR limit, and temporary disk data can be lost during maintenance, redeploy or stop.

2. Two App Service plans in the same subscription must integrate with the same existing subnet through virtual network integration. Each plan scales out to several instances. What is the minimum subnet size that supports this configuration?

  1. /28
  2. /27
  3. /26
  4. /29

Answer: C — /26

Joining multiple App Service plans to one subnet (multi plan subnet join) requires a subnet of at least /26. A /28 suffices only for a single plan integrating with an existing subnet, and /27 is the portal minimum when creating a subnet.

3. A container app has a Service Bus scale rule with messageCount set to 5, minReplicas 0 and maxReplicas 20. It is running 1 replica when the queue length reaches 50. How many replicas will KEDA scale the app to on the next scaling decision?

  1. 1
  2. 4
  3. 10
  4. 20

Answer: B — 4

desiredReplicas is ceil(50/5) = 10, but the target is min(20, 10, max(4, 2*1)) = 4 because scale-up proceeds in steps. Jumping straight to 10 ignores the step limit.

4. An administrator creates a public DNS zone in Azure DNS. Which two statements about the records in the zone are correct? (Choose two.)

  1. The NS and SOA record sets are created automatically with the zone
  2. The SOA record set can contain multiple records
  3. The CNAME record set can contain multiple records
  4. An A record set can hold several IP addresses for the same host name
  5. The NS and SOA records must be created manually before the zone can be delegated

Answer: A,D — The NS and SOA record sets are created automatically with the zone / An A record set can hold several IP addresses for the same host name

NS and SOA record sets are created automatically when the zone is created, and an A record set keeps the same name with differing IP addresses. SOA and CNAME records can't contain record sets.

5. A storage account holds blobs that must be moved to the archive tier to reduce cost. The account must also be replicated to a secondary region, and applications must be able to read the data from that secondary region while the primary region is down. Which redundancy configuration should the administrator choose?

  1. Read-access geo-zone-redundant storage (RA-GZRS)
  2. Read-access geo-redundant storage (RA-GRS)
  3. Geo-redundant storage (GRS)
  4. Zone-redundant storage (ZRS)

Answer: B — Read-access geo-redundant storage (RA-GRS)

RA-GRS supports the archive tier and allows reads from the secondary region. RA-GZRS also allows secondary reads but does not support the archive tier. GRS supports the archive tier but gives no read access to the secondary without a failover, and ZRS has no secondary region.

6. A company is replacing an on-premises directory with a cloud identity service for web-based applications. An administrator proposes to keep using existing tooling that queries the directory with LDAP, authenticates with Kerberos, and arranges objects in OUs scoped by GPOs. Which of these can actually be used with Microsoft Entra ID?

  1. LDAP queries against the tenant
  2. REST API calls over HTTPS, with OpenID Connect for authentication
  3. Kerberos authentication to the tenant
  4. GPOs linked to OUs in the tenant

Answer: B — REST API calls over HTTPS, with OpenID Connect for authentication

Entra ID is queried by REST API over HTTP/HTTPS and authenticates with SAML, WS-Federation and OpenID Connect. It does not support LDAP, Kerberos, OUs or GPOs.

7. A team wants to introduce a new policy that restricts resource types, but existing autoscaling scripts must not be disrupted while the team learns how the policy affects current resources. Which approach is recommended?

  1. Start with the `deny` effect so violations are stopped immediately.
  2. Start with the `deployIfNotExists` effect so missing resources are created automatically.
  3. Start with the `audit` effect to track the impact before moving to an enforcement effect.
  4. Start with the `modify` effect so the properties are corrected on every request.

Answer: C — Start with the `audit` effect to track the impact before moving to an enforcement effect.

Audit or auditIfNotExists lets you observe the effect on resources without enforcing, whereas deny, modify and deployIfNotExists are enforcement effects that might hinder existing automation.

8. An administrator mounts an Azure file share over SMB from a server in a branch office. The share works from Azure VMs, but the mount from the branch office fails with a network connectivity error. Which cause should the administrator investigate first?

  1. Outbound TCP port 445 is blocked by the ISP
  2. The storage account has only two access keys
  3. The file share is using the Cool access tier
  4. The share is configured for HTTP instead of SMB

Answer: A — Outbound TCP port 445 is blocked by the ISP

SMB traffic uses port 445, and many ISPs block it outbound, which is the most common cause of on-premises mount failures. The tier and number of keys do not affect connectivity.

9. An administrator must test connectivity from an application gateway to a destination specified as an FQDN. The check should be a one-time, point-in-time test rather than continuous monitoring, and must report latency and the number of hops. Which tool meets the requirements?

  1. Connection monitor
  2. IP flow verify
  3. Connection troubleshoot
  4. NSG diagnostics

Answer: C — Connection troubleshoot

Connection troubleshoot tests a connection at a point in time from sources including an application gateway to an FQDN, returning latency and hops. Connection monitor monitors over time, so it fails the one-time requirement.

10. Virtual networks A and B are peered, and B and C are peered. A and C are not peered. Traffic from A must reach C through a network virtual appliance running on a virtual machine in B, without creating a new peering between A and C. Which approach meets the requirement?

  1. Rely on the existing peerings, because peering makes A, B and C operate as one network
  2. Enable Azure's built-in name resolution across the peered networks
  3. Configure a user-defined route in A whose next hop is the IP address of the virtual machine in B, to enable service chaining
  4. Configure a user-defined route in A whose next hop is the Internet

Answer: C — Configure a user-defined route in A whose next hop is the IP address of the virtual machine in B, to enable service chaining

Peering is nontransitive, so service chaining with UDRs that point to a virtual machine (or gateway) in a peered network as next hop is needed. Option A is wrong because peering between B and C does not extend to A.

11. A three-tier application is deployed from purpose-specific templates, and each tier has its own lifecycle. The tiers must still be able to reference each other's resources. Which two approaches fit these requirements? (Choose two.)

  1. Deploy each tier to its own resource group
  2. Create a main template that links the purpose-specific templates
  3. Keep all tiers in one resource group, because resources in separate resource groups can't be linked
  4. List the tiers' resources in the Variables section so that they are deployed
  5. Rely on state files to track dependencies between the resource groups

Answer: A,B — Deploy each tier to its own resource group / Create a main template that links the purpose-specific templates

Tiers with separate lifecycles can go to separate resource groups, and the resources can still be linked across groups. A main template links the purpose-specific templates. Resources to deploy go in the Resources section, not Variables, and no state files are used.

12. An administrator has failed over a VM to the secondary region and confirmed it runs correctly. They now want to use Re-Protect to replicate the VM back to the primary region. Which step must be completed first, and what is its consequence?

  1. Select Change recovery point, which keeps all existing recovery points available for reprotection
  2. Select Commit so the status becomes Failover committed, which deletes all available recovery points for the VM in Site Recovery
  3. Select Failover again with Shut down machine before beginning failover, which clears the recovery points
  4. Disable replication for the VM, which retains the recovery points for later use

Answer: B — Select Commit so the status becomes Failover committed, which deletes all available recovery points for the VM in Site Recovery

Reprotect requires the VM status to be Failover committed, which results from selecting Commit. Commit deletes all available recovery points in Site Recovery, so the recovery point can no longer be changed afterward.

13. An administrator deploys a container group in Azure Container Instances. A web container listens on port 80 and a sidecar container needs to be reached by external clients on a different port. The administrator plans to map external port 8080 to the sidecar's internal port 1433. What is the outcome?

  1. It works, as long as the port is also exposed on the group's IP address
  2. It works only if the group is deployed using YAML rather than an ARM template
  3. It fails because port mapping isn't supported; containers in a group share a port namespace
  4. It works only if each container is given its own public IP address

Answer: C — It fails because port mapping isn't supported; containers in a group share a port namespace

Containers in a group share a port namespace, so port mapping isn't supported; the port must be exposed directly on the IP address and the container.

14. A Linux VM fails to start correctly. An administrator wants to see what the VM displayed during startup and read the log messages produced during the boot sequence. Which two actions provide this information? (Choose two.)

  1. Enable boot diagnostics and select Screenshot to see a startup screenshot from the hypervisor
  2. Enable boot diagnostics and select Serial log to view the messages created when the VM started
  3. Open Metrics Explorer and plot Percentage CPU with the Max aggregation
  4. Open the Insights page and select the Map tab
  5. Run the Syslog query in Log Analytics against the VM before the Azure Monitor Agent is installed

Answer: A,B — Enable boot diagnostics and select Screenshot to see a startup screenshot from the hypervisor / Enable boot diagnostics and select Serial log to view the messages created when the VM started

Boot diagnostics provides a hypervisor screenshot and a serial log of the boot sequence for Linux VMs. Metrics Explorer and the Map tab show host metrics and process dependencies, not boot output.

15. A company must keep an application running if an entire datacenter in a region fails, and wants the VMs to be spread across locations with independent power, cooling and networking. Which design meets the requirement?

  1. Put the VMs in one availability set with the maximum number of fault domains
  2. Deploy VMs across three availability zones in the region
  3. Deploy the VMs on a larger VM size and rely on Live Migration
  4. Deploy VMs to a single zone and use zone-redundant managed disks

Answer: B — Deploy VMs across three availability zones in the region

Availability zones are physically separate locations within a region, each with independent power, cooling and networking, so they protect against datacenter failures. An availability set protects against rack-level issues, not datacenter failure.

16. A container app processes background work, has ingress disabled, and has no scale rules or minimum replica count defined. After an idle period it stops running and never starts again. What should the administrator do to fix this?

  1. Raise the maximum number of replicas to 1,000
  2. Set minReplicas to 1 or more, or create a scale rule
  3. Enable vertical scaling for the revision
  4. Switch the app to multiple revisions mode

Answer: B — Set minReplicas to 1 or more, or create a scale rule

With ingress disabled and no minReplicas or custom rule, the app scales to zero and cannot restart. Setting minReplicas to 1 or more, or adding a scale rule, fixes this. Raising the maximum does not help, and vertical scaling isn't supported.

17. An administrator starts a restore of a VM with the Replace existing option, and the operation fails with an error. The VM is currently allocated and running. What should the administrator do before retrying?

  1. Delete the VM so the disks can be replaced
  2. Stop the VM, then retry the restore
  3. Switch the vault to zone-redundant storage
  4. Disable the backup policy for the VM

Answer: B — Stop the VM, then retry the restore

A backup can't be restored if the VM is allocated and running, so it must be stopped first. Deleting the VM would also make Replace existing unusable since the current VM must exist.

18. A resource-type allowlist policy is assigned at a parent management group. A child subscription must be allowed to deploy additional resource types, and the administrator wants to assign a more permissive policy there. What must be done for this to work?

  1. Assign the more permissive policy on the child subscription; the most specific assignment wins.
  2. Exclude the child subscription from the management group-level assignment, then assign the more permissive definition on the child.
  3. Assign the more permissive policy on the child subscription and set its effect to audit to override the parent.
  4. Create an RBAC exemption for the subscription Owner so they can bypass the parent policy.

Answer: B — Exclude the child subscription from the management group-level assignment, then assign the more permissive definition on the child.

Azure Policy is an explicit deny system, so a child assignment cannot loosen a parent denial; the child must be excluded from the parent assignment first.

19. A virtual machine's network interface is in a subnet. Both the subnet and the NIC have an associated network security group. The subnet NSG has an allow rule for TCP 443 inbound, but the NIC NSG has no rule allowing that traffic. What happens to inbound HTTPS traffic to the VM?

  1. It is allowed, because the subnet NSG is evaluated first and its allow rule overrides the NIC NSG.
  2. It is denied, because an allow rule must exist at each level that has an associated NSG.
  3. It is allowed, because the NIC NSG is only used for outbound traffic.
  4. It is allowed, because the NIC NSG's default rules permit all traffic from the internet.

Answer: B — It is denied, because an allow rule must exist at each level that has an associated NSG.

When NSGs are associated at both the subnet and NIC, each is evaluated independently and an allow rule is needed at each level; otherwise traffic is denied at the level lacking one. The subnet allow does not override the NIC NSG.

20. A team has a Linux VM that must send both performance counters and event log data to a Log Analytics workspace. A colleague proposes sending everything to Azure Monitor Metrics to keep one destination. Why will this not meet the requirement?

  1. Azure Monitor Metrics can store only metrics data, while Azure Monitor Logs can store both metrics and event logs
  2. Azure Monitor Metrics retains data for only 24 hours
  3. Azure Monitor Metrics cannot receive data from a data collection rule
  4. Azure Monitor Metrics requires the Linux Diagnostics Agent for all data

Answer: A — Azure Monitor Metrics can store only metrics data, while Azure Monitor Logs can store both metrics and event logs

A DCR can send performance counters to Metrics or Logs, but event logs can go only to Azure Monitor Logs because Metrics stores only metrics data.

21. An administrator is setting up object replication for block blobs between two general-purpose v2 storage accounts. Which two actions are required for the configuration to work? (Choose two.)

  1. Enable change feed on the source account.
  2. Enable blob versioning on both the source and destination accounts.
  3. Enable a hierarchical namespace on both accounts.
  4. Enable blob versioning on the source account only.
  5. Encrypt all source blobs by using customer-provided keys.

Answer: A,B — Enable change feed on the source account. / Enable blob versioning on both the source and destination accounts.

Object replication requires change feed on the source account and blob versioning on both source and destination accounts. A hierarchical namespace isn't supported, and blobs encrypted with a customer-provided key can't be replicated.

22. An administrator needs to chart a platform metric for a virtual machine over the last 60 days to review a trend. Platform metrics are retained for 93 days, but the chart in the Metrics tile shows a blank or partial result when the time picker is set to 60 days. What should the administrator do to view the data?

  1. Select a 30-day interval in the time picker and then pan the chart to view the rest of the retention window
  2. Enable advanced platform metrics at the resource level to extend the chart range to 93 days
  3. Switch the chart to a PromQL query, which can span the full 93 days
  4. Move the resource to a new resource group so that the metric history is rebuilt

Answer: A — Select a 30-day interval in the time picker and then pan the chart to view the rest of the retention window

A single chart can query at most 30 days of data, but after selecting a 30-day interval you can pan to view the full retention window. PromQL queries apply to Prometheus metrics (max 32 days) and moving a resource may actually cause loss of metric history.

23. A load balancer is distributing requests for a stateful application. Requirements: successive requests from the same client IP address must reach the same back-end VM, and the load-balancing hash must be based on only the source IP and destination IP. Which session persistence setting should the administrator choose?

  1. None
  2. Client IP and protocol (3-tuple)
  3. Client IP (2-tuple)
  4. An inbound NAT rule that maps each client to a specific back-end VM

Answer: C — Client IP (2-tuple)

Client IP (2-tuple) uses source IP and destination IP so the same client IP reaches the same instance. The 3-tuple option also includes protocol type, None lets any healthy VM handle requests, and inbound NAT rules map a front-end port to a specific VM (for example TCP 3389 for remote desktop) rather than providing session persistence.

24. An administrator assigns a role at subscription scope to a user. The user later opens Access control (IAM) for a resource group in that subscription and for a management group above it. At which of these scopes does the role assignment apply to the user's permissions?

  1. Only the subscription itself, not the resource group
  2. The subscription and the resource group, but not the management group
  3. The management group and the subscription, but not the resource group
  4. All three: the management group, subscription and resource group

Answer: B — The subscription and the resource group, but not the management group

Lower levels inherit role permissions from higher levels, so a subscription assignment applies to resource groups beneath it. It does not flow upward to the management group, which is a level above subscriptions.

25. A team plans to deploy a new application release to an application that stores its data on an Azure file share. They want a quick way to roll the whole share back to a known-good state if the release corrupts data, and they want recovery points to be incremental to limit cost. What should they do before the release?

  1. Create a share snapshot of the file share
  2. Regenerate key1 for the storage account
  3. Generate a SAS token for the file share
  4. Enable soft delete on the storage account and then delete the share

Answer: A — Create a share snapshot of the file share

Share snapshots are incremental, read-only point-in-time copies that let you roll back after a bad deployment. Soft delete only recovers deleted shares, and keys or SAS tokens are for access, not recovery.

26. A retailer runs a web application deployed in several Azure regions. It needs global load balancing with fast failover, TLS/SSL offload, path-based routing, and a web application firewall. Which service meets these requirements, rather than Azure Load Balancer?

  1. Azure Front Door
  2. Azure Traffic Manager
  3. Azure Application Gateway
  4. Azure Load Balancer with high availability ports
  5. An internal load balancer with session persistence

Answer: A — Azure Front Door

Azure Front Door provides global load balancing with Layer 7 capabilities including TLS/SSL offload, path-based routing, fast failover, and a web application firewall, and is recommended for web apps deployed across multiple Azure regions. Application Gateway works within a region rather than globally, Traffic Manager is DNS-based and can't fail over as quickly as Front Door, and Azure Load Balancer operates only at Layer 4 and is not appropriate when web application firewall functionality is required.

27. An administrator needs to roll out a policy assignment that uses the `deployIfNotExists` effect. The assignment's managed identity must be given the permissions it needs to create the related resources. Which built-in role is necessary to grant those permissions to the managed identity?

  1. Contributor
  2. Resource Policy Contributor
  3. User Access Administrator
  4. Reader

Answer: C — User Access Administrator

User Access Administrator is needed to grant the managed identity on deployIfNotExists or modify assignments the necessary permissions. Contributor can trigger remediation but cannot create or update definitions and assignments.

28. An administrator must let a team lead create and delete management locks on a subscription. According to the guidance on who can create or delete locks, which two built-in roles are explicitly named as having the required access? (Choose two.)

  1. Contributor
  2. Owner
  3. Reader
  4. User Access Administrator
  5. Resource Policy Contributor

Answer: B,D — Owner / User Access Administrator

Creating or deleting locks requires Microsoft.Authorization/* or Microsoft.Authorization/locks/* actions, which the Owner and User Access Administrator roles have.

29. A connection monitor test has no thresholds specified. Its TCP checks show a round-trip time of 900 ms with 5 percent of checks failing. What state is the test reported in, and why?

  1. Pass, because the failed-check percentage is below 10 percent
  2. Warning, because the automatically assigned RTT threshold of 750 ms is exceeded
  3. Fail, because RTT exceeded the automatically assigned threshold
  4. Indeterminate, because no thresholds are configured

Answer: B — Warning, because the automatically assigned RTT threshold of 750 ms is exceeded

Without specified thresholds Connection monitor assigns defaults (750 ms RTT for TCP/ICMP, 10 percent checks failed) and exceeding one gives Warning; Fail occurs only when 100 percent of checks fail. Indeterminate means no data in the workspace.

30. A company needs a container registry that restricts access through private endpoints, signs image tags with content trust, and replicates images across geographies. Which registry tier should the administrator deploy?

  1. Basic
  2. Standard
  3. Premium
  4. Standard, with Microsoft Defender for Cloud enabled

Answer: C — Premium

Content trust and private endpoints are Premium security features, and geo-replication is a Premium feature. Basic and Standard share only the common features, and Defender for Cloud adds image scanning, not these capabilities.

31. A storage account holds a container whose public access level is set to Container. Anonymous requests to list and read its blobs are still being rejected, and the administrator has confirmed that the container's own access level setting is correct. Which account-level setting should be checked?

  1. The default access tier of the account
  2. The Allow Blob anonymous access setting
  3. The blob versioning setting
  4. The replication policy on the container

Answer: B — The Allow Blob anonymous access setting

The Blob and Container access levels have no effect unless the account's Allow Blob anonymous access setting is enabled; when disabled, all containers stay private. Access tier, versioning and replication policies do not govern anonymous access.

32. A generalized (Sysprep) VM has an OS disk and two data disks. An administrator wants to deploy many identical VMs that each include all three disks, without copying or managing any storage accounts. Which approach meets the requirement?

  1. Take a snapshot of the OS disk and create each VM from it
  2. Create a managed custom image from the generalized VM
  3. Take separate snapshots of each of the three disks and attach them to each new VM
  4. Upload the VHD of the OS disk directly to a new managed disk for each VM

Answer: B — Create a managed custom image from the generalized VM

A managed image captures all managed disks attached to the generalized VM (OS and data) in one image and lets you create hundreds of VMs without managing storage accounts. A snapshot contains a copy of only one disk and doesn't coordinate across multiple disks.

33. A company wants to replicate blobs from a container in one storage account to a container in another region for read-latency reduction. Which two statements describe requirements or behavior the administrator must plan for? (Choose two.)

  1. Blob versioning must be enabled on both the source and destination accounts.
  2. Snapshots on source blobs are replicated to the destination account.
  3. The source and destination accounts can be in different access tiers.
  4. The source and destination accounts must both be in the Hot tier.
  5. Replication is synchronous so the destination is always identical to the source.

Answer: A,C — Blob versioning must be enabled on both the source and destination accounts. / The source and destination accounts can be in different access tiers.

Object replication requires versioning on both accounts and works with Hot, Cool or Cold source and destination accounts, which may differ in tier. Snapshots are not replicated, both accounts need not be Hot, and replication is asynchronous.

34. A team needs to run a container that requires 6 vCPUs and 8 GB of memory in Azure Container Instances, and wants to change the allocation later without redeploying. Which statement describes what is possible?

  1. The CPU request exceeds the per-container range of 0.1 to 4 vCPU, and allocation is fixed for the life of the container group
  2. The CPU request is valid, and allocation can be resized at any time while the group runs
  3. The memory request exceeds the allowed range of 0.1 to 4 GB, but CPU can be changed later
  4. Both values are valid, but they can only be changed by deleting the container's image

Answer: A — The CPU request exceeds the per-container range of 0.1 to 4 vCPU, and allocation is fixed for the life of the container group

Each container can specify 0.1 to 4 vCPU and 0.1 to 16 GB, so 6 vCPUs is out of range, and resource allocation is fixed for the container group's lifetime.

35. A company must host applications from two competing customers on the same server cluster. A strong security boundary between the workloads is critical, and the isolation must be from the host operating system as well as from each other. Which deployment approach meets the requirement?

  1. Virtual machines, one per customer
  2. A single Azure Container Instances container group holding both customers' containers
  3. Separate containers on the same host using Docker from the command line
  4. Pods in a shared Kubernetes cluster node

Answer: A — Virtual machines, one per customer

A virtual machine provides complete isolation from the host operating system and other VMs, suited to competing companies on the same server; containers provide only lightweight isolation and a weaker security boundary.

36. A company runs a subnet whose outbound internet traffic is forced through an on-premises appliance by a user-defined route. VMs in the subnet must reach Azure SQL Database in the same region over the Azure backbone, without the appliance affecting that service traffic, and the company wants no additional charge. Which configuration meets the requirement?

  1. Enable a service endpoint for Microsoft.Sql on the subnet
  2. Assign a Standard SKU public IP to each VM
  3. Deploy a NAT gateway to the subnet
  4. Add a user-defined route with a next hop of Internet for the SQL address prefix

Answer: A — Enable a service endpoint for Microsoft.Sql on the subnet

Service endpoints add a more specific route (nextHopType VirtualNetworkServiceEndpoint) that overrides BGP and UDRs for the service prefix, keeps traffic on the backbone, and has no extra charge. A NAT gateway or public IPs are not described as providing this.

37. A storage account has blob versioning enabled. A cleanup operator assigned the Storage Blob Data Contributor role can delete blobs, but gets authorization errors when calling Delete Blob with a version ID to remove previous versions. Which change fixes this using Azure RBAC?

  1. Keep Storage Blob Data Contributor and omit the version ID from the Delete Blob request
  2. Assign the Storage Blob Data Owner role
  3. Keep Storage Blob Data Contributor and enable blob soft delete on the account
  4. Assign Storage Blob Data Contributor at the storage account scope instead of the container scope

Answer: B — Assign the Storage Blob Data Owner role

Deleting a previous version requires the deleteBlobVersion/action data action, which the table maps to Storage Blob Data Owner. Contributor only covers deleting the current version, and omitting the version ID targets the current version.

38. Before deploying new application code, an administrator takes a snapshot of an SMB Azure file share. The deployment corrupts data, and they need to recover the previous data. Which two approaches are supported? (Choose two.)

  1. Promote the share snapshot to become the base file share
  2. Edit the corrupted file directly inside the share snapshot and keep it as the live copy
  3. Copy the entire share snapshot to another storage account in a single operation
  4. In the portal, open the snapshot, right-click the file, select Restore, and choose Overwrite original file
  5. Copy files from the share snapshot over the base share, leaving the snapshot intact

Answer: D,E — In the portal, open the snapshot, right-click the file, select Restore, and choose Overwrite original file / Copy files from the share snapshot over the base share, leaving the snapshot intact

Files can be restored from a snapshot via the portal Restore option or by copying them over the base share, and the snapshot remains intact. Snapshots are read-only, can't be promoted to the base share, and can't be copied whole to another storage account.

39. An administrator wants to use encryption at host for VMs in a subscription where the feature has never been used. Which action must be completed before encryption at host can be enabled on a VM?

  1. Run az feature register --name EncryptionAtHost --namespace Microsoft.Storage
  2. Run az vm encryption enable on each VM while it's running
  3. Create a disk encryption set, because the feature can't be used with platform-managed keys
  4. Run az feature register --name EncryptionAtHost --namespace Microsoft.Compute and confirm the state is Registered

Answer: D — Run az feature register --name EncryptionAtHost --namespace Microsoft.Compute and confirm the state is Registered

The EncryptionAtHost feature must be registered for the subscription in the Microsoft.Compute namespace, and the registration state must show Registered. A disk encryption set is needed only for customer-managed keys; platform-managed keys work without one.

40. An administrator generates a SAS and sets its start time to the current moment. Clients that use the SAS intermittently receive authorization failures during the first few minutes, even though the SAS parameters are otherwise correct. Which change prevents these failures?

  1. Add an IP range with the sip parameter covering all client addresses
  2. Change the spr parameter from https to https,http
  3. Omit the start time or set it at least 15 minutes in the past
  4. Set the start time 15 minutes in the future so the SAS activates after propagation

Answer: C — Omit the start time or set it at least 15 minutes in the past

Clock skew of up to 15 minutes between machines causes intermittent failures when the start time is now. Omitting the start time makes the SAS valid immediately in all cases, or it can be set at least 15 minutes in the past.

41. A company hosts several web apps in one App Service plan. One app has become resource-intensive, and the team wants to scale it independently of the others without affecting them. What should the administrator do?

  1. Move the app into a new App Service plan
  2. Raise the maximum instance count in the existing plan's autoscale settings
  3. Scale up the existing plan to a larger VM size in the same tier
  4. Add a staging slot for the app in the existing plan

Answer: A — Move the app into a new App Service plan

The App Service plan is the scale unit, so all apps in a plan scale together; isolating a resource-intensive app that needs independent scaling requires a new plan. Scaling the existing plan (up or out) affects every app in it.

42. VMs in two Azure virtual networks must resolve each other by host names in the custom domain private.contoso.com. The name must not be visible on the internet and no domain registrar is to be involved. After creating the private DNS zone, what should the administrator do?

  1. Update the NS records at a domain registrar with the zone's name servers
  2. Add a virtual network link to the private zone for each virtual network
  3. Add a virtual network link only for one virtual network, because the other resolves through peering automatically
  4. Create an alias record set targeting each virtual network

Answer: B — Add a virtual network link to the private zone for each virtual network

A virtual network link record is added for each virtual network that needs private name resolution. Registrar delegation applies to public zones, not private ones.

43. A contractor needs to manage resources in a single resource group today, but the team expects the same contractor to be given access to a second subscription's resources later. An administrator wants to limit what is at risk if the contractor's account is ever compromised. At which scope should the role be assigned now?

  1. The management group that contains both subscriptions
  2. The subscription that contains the resource group
  3. The resource group the contractor works in
  4. Each individual resource in the resource group

Answer: C — The resource group the contractor works in

Limiting the scope limits which resources are at risk if the principal is compromised, so assigning at the resource group grants only the access needed now. Higher scopes such as the subscription or management group would be inherited by lower levels and expose far more resources.

44. An administrator enabled VM insights on a VM, which collects guest OS performance counters. They open Metrics Explorer to chart those guest counters but cannot find them. What is the reason, and where should they look?

  1. The counters are sent to Azure Monitor Logs, so view them in the VM insights Performance workbook or query Log Analytics
  2. The counters are sent to Azure Storage, so view them from the storage account
  3. The counters appear in Metrics Explorer only after boot diagnostics is enabled
  4. The counters are sent to Event Hubs, so view them from the Activity log blade

Answer: A — The counters are sent to Azure Monitor Logs, so view them in the VM insights Performance workbook or query Log Analytics

The VM insights DCR sends client performance counters to Azure Monitor Logs, so Metrics Explorer is not used to view them; the Insights Performance workbook shows them.

45. Which TWO statements about a rule's protocol and priority settings in a network security group are correct? (Choose two.)

  1. The ESP and AH protocols can be selected only through JSON templates and PowerShell.
  2. Priority values must be between 100 and 4,096 and unique among all rules within the NSG.
  3. The default protocol for a new rule is TCP only.
  4. The same priority value can be reused for an allow rule and a deny rule in the same NSG.
  5. ICMP is not a supported protocol option in a security rule.

Answer: A,B — The ESP and AH protocols can be selected only through JSON templates and PowerShell. / Priority values must be between 100 and 4,096 and unique among all rules within the NSG.

ESP and AH are available only via JSON templates and PowerShell, and priority must be a unique value from 100 to 4,096. The default protocol is Any, ICMP is supported, and priorities must be unique.

46. Before enabling Azure Site Recovery replication, an administrator restricts VM outbound traffic with service-tag based NSG rules (HTTPS, port 443). The rules must let the VM write replication data to the cache storage account and reach the Site Recovery service in any region. Which two service tags should be allowed? (Choose two.)

  1. Storage
  2. AzureSiteRecovery
  3. EventsHub
  4. GuestAndHybridManagement
  5. Microsoft Entra ID

Answer: A,B — Storage / AzureSiteRecovery

The Storage tag allows data to be written from the VM to the cache storage account, and the AzureSiteRecovery tag allows access to the Site Recovery service in any region. EventsHub covers monitoring, GuestAndHybridManagement is for automatic Mobility agent upgrades, and the Microsoft Entra ID tag provides authentication, so none of these meets the stated requirements.

47. A custom role is defined with Actions of ["*"] and a NotActions entry that excludes Microsoft.Authorization/*/Write. A user has this role and is also assigned another role that grants Microsoft.Authorization/*/Write at the same scope. What is the effect?

  1. The user can't perform the write operation, because NotActions denies it
  2. The user can perform the write operation, because the other role assignment grants it
  3. Both assignments are rejected as conflicting
  4. The user can perform the write operation only after signing out and back in

Answer: B — The user can perform the write operation, because the other role assignment grants it

NotActions only excludes operations from that role's Actions; it isn't a deny rule, so another applicable assignment can still grant the operation. Only a deny assignment would block it.

48. A CanNotDelete lock is applied to a storage account. A developer uses a data plane call (Delete Share) to remove a file share in that account, while another developer uses the control plane File Shares - Delete operation. What happens?

  1. Both deletions fail because the lock protects the whole storage account.
  2. Both deletions succeed because locks do not apply to file shares.
  3. The data plane deletion succeeds and the control plane deletion fails.
  4. The data plane deletion fails and the control plane deletion succeeds.

Answer: C — The data plane deletion succeeds and the control plane deletion fails.

Locks only apply to control plane operations, so Delete Share through the data plane succeeds while the control plane File Shares - Delete fails.

49. A tenant requires two authentication methods for SSPR. A user has registered only Microsoft Authenticator push notifications and a software OATH token. Which outcome is expected?

  1. The user can reset the password because two different methods are registered.
  2. The user can reset the password only by using the notification and not the code.
  3. The user can reset the password after confirming their authentication information.
  4. The user cannot satisfy the two-method requirement because Authenticator and OATH tokens count as a single method.

Answer: D — The user cannot satisfy the two-method requirement because Authenticator and OATH tokens count as a single method.

Microsoft Authenticator, software OATH tokens and hardware OATH tokens count as a single method, and a combination cannot satisfy a two-method requirement.

50. An application issues shared access signatures to client apps for blob access. The storage account keys are rotated every quarter, and the SAS tokens must keep working after a rotation. The developers also don't want the account key stored with the application code. Which type of SAS should the application issue?

  1. Service SAS associated with a stored access policy
  2. Account SAS with a long expiry time
  3. User delegation SAS
  4. Ad hoc service SAS signed with key1

Answer: C — User delegation SAS

A user delegation SAS is secured with Microsoft Entra credentials, so it needs no account key in code and is not affected by key rotation. Service and account SAS tokens are signed with the account key and are revoked when the key is rotated or regenerated.

51. A template deploys a role assignment as a resource nested in a resource group's deployment, and the author wants to know how the assignment's scope is determined without specifying a scope field. Which statement describes how the scope relates to the assignment?

  1. The scope is always the ID of the resource being extended, and can be read from the role assignment's own ID
  2. The scope always defaults to the subscription, regardless of where the assignment is created
  3. The scope is taken from the role definition ID in the assignment
  4. The scope is taken from the principal ID of the user receiving the role

Answer: A — The scope is always the ID of the resource being extended, and can be read from the role assignment's own ID

A role assignment is an extension resource, so its scope is always the ID of the resource it extends, which can be derived from the role assignment ID. It is not tied to the role definition or the principal.

52. A security team needs to apply one common set of traffic allow and deny rules to three subnets in one virtual network. They want to manage as few network security groups as possible while staying within what Azure allows. Which configuration is valid?

  1. Associate the same network security group with all three subnets
  2. Associate two network security groups with each subnet and merge their rules
  3. Create a different network security group for each subnet, because one network security group cannot be shared across subnets
  4. Associate a network security group with only the first subnet, because only one subnet per virtual network can have one

Answer: A — Associate the same network security group with all three subnets

Each subnet can have zero or one network security group, and the same or a different NSG can be associated with each subnet. One shared NSG is therefore valid and minimizes management; two NSGs per subnet is not allowed, sharing is permitted, and every subnet can have an NSG.

53. An organization with a tenant in the Azure global cloud needs mutual B2B collaboration with partners in a tenant hosted in Microsoft Azure Government. Which approach is documented?

  1. Only the global cloud tenant configures Microsoft cloud settings; the other tenant is unchanged.
  2. Both tenants configure Microsoft cloud settings to enable collaboration with the other cloud, then each configures inbound and outbound cross-tenant access with the other tenant.
  3. Enable self-service sign-up in both tenants and rely on email one-time passcodes.
  4. Set up B2B direct connect only, with no Microsoft cloud settings.

Answer: B — Both tenants configure Microsoft cloud settings to enable collaboration with the other cloud, then each configures inbound and outbound cross-tenant access with the other tenant.

Cross-cloud B2B requires both tenants to configure Microsoft cloud settings, followed by inbound and outbound cross-tenant access configuration in each tenant.

54. A team is evaluating Bicep to replace its JSON templates. Which two statements about Bicep are correct? (Choose two.)

  1. The dependsOn property can be omitted when the symbolic name of a resource is used in another resource declaration
  2. Parameters, variables and outputs can be declared anywhere in the file
  3. A state file must be stored and maintained for every deployment
  4. New resource types can be used only after the Bicep tooling is updated
  5. A Bicep file must be manually converted to JSON before it can be deployed

Answer: A,B — The dependsOn property can be omitted when the symbolic name of a resource is used in another resource declaration / Parameters, variables and outputs can be declared anywhere in the file

Bicep manages dependencies automatically from symbolic names, and its structure lets you declare parameters, variables and outputs anywhere. Azure stores all state, new resource types are supported immediately, and the Bicep CLI converts the file to JSON during deployment.

55. A company wants a project team to create and manage all types of Azure resources in a single resource group, but the team must not be able to grant other people access to those resources. Which role should be assigned at the resource group scope?

  1. Owner
  2. Contributor
  3. User Access Administrator
  4. Reader

Answer: B — Contributor

Contributor can create and manage all types of Azure resources but can't grant access to others. Owner also includes the right to delegate access, so it exceeds the requirement.

56. A company has registered its domain with a third-party registrar and created an Azure DNS zone for it. An administrator must complete delegation so that internet resolvers use Azure DNS for the domain. What must the administrator do at the registrar?

  1. Replace the NS records with all four name servers listed in the Azure DNS zone's NS record set
  2. Replace the NS records with any one of the Azure name servers, since they all serve the same zone
  3. Create a CNAME record for the apex that points to the Azure DNS zone name
  4. Copy the SOA record from the Azure DNS zone into the registrar's zone

Answer: A — Replace the NS records with all four name servers listed in the Azure DNS zone's NS record set

Changing the registrar's NS details is domain delegation, and all four Azure DNS name servers must be used. Using only one is wrong because the document requires all four.

57. A company stores critical data in one region because its governance rules forbid replicating the data outside that region. The workload must stay readable and writable if an entire availability zone becomes unavailable. Which redundancy option meets both requirements?

  1. Locally redundant storage (LRS)
  2. Geo-redundant storage (GRS)
  3. Zone-redundant storage (ZRS)
  4. Geo-zone-redundant storage (GZRS)

Answer: C — Zone-redundant storage (ZRS)

ZRS copies data synchronously across three or more availability zones in the primary region, so data survives the loss of a zone, and it is recommended for restricting replication to one region for governance. LRS does not survive the loss of a datacenter, and GRS and GZRS replicate to a secondary region.

58. A user has the Contributor role on a subscription. A colleague created a budget on that subscription and the budget amount must be raised. Which statement describes what the Contributor can do?

  1. Only view the budget, because budgets created by others are read-only for Contributors.
  2. Modify the budget amount, but not delete or fully manage the colleague's budget otherwise.
  3. Delete the budget and recreate it under their own name only.
  4. Nothing, because only Cost Management reader can modify budget amounts.

Answer: B — Modify the budget amount, but not delete or fully manage the colleague's budget otherwise.

Contributors can create, modify or delete their own budgets and can modify the budget amount of budgets created by others. Only Readers are limited to viewing.

Take this test interactively

More Microsoft Azure Administrator (AZ-104) practice tests