AZ-104 Practice Exam 3

58 questions with the correct answer and an explanation for each. Topic: AZ-104. Free, no account needed.

These questions are written from Microsoft’s AZ-104 study guide and the Microsoft Learn modules and Azure documentation it points to. They are not real exam questions — those are confidential, and any site offering them is putting your certification at risk.

Take this test interactively

1. A storage account firewall is enabled. Clients in an on-premises network reach Azure over ExpressRoute with Microsoft peering, and Azure VMs in a subnet that has a Microsoft.Storage service endpoint also need access to blobs. Which two configurations should the administrator make? (Choose two.)

  1. Create a resource instance rule for the on-premises network
  2. Add an IP network rule that contains the NAT IP addresses used for Microsoft peering
  3. Add the private IP addresses of the VMs as IP network rules
  4. Add a virtual network rule for the VM subnet
  5. Add a network security exception for the VM subnet

Answer: B,D — Add an IP network rule that contains the NAT IP addresses used for Microsoft peering / Add a virtual network rule for the VM subnet

On-premises traffic over ExpressRoute is allowed with an IP network rule for the NAT IP addresses used for Microsoft peering, and the subnet is allowed with a virtual network rule. IP rules for subnets with a service endpoint have no effect because that traffic uses private source IPs, resource instance rules are for Azure resources, and exceptions are for Azure services outside the network boundary.

2. A compliance team must report on RBAC changes from a period that began four months ago, and wants to be able to review activity for a full calendar quarter at a later audit date. Which statement best describes the situation for subscription Activity Log data?

  1. Events are kept for 90 days, so a diagnostic setting should route logs to a destination such as a Log Analytics workspace or Storage; it can't recover events already deleted
  2. Events are kept for 30 days, so exporting now recovers the earlier months
  3. Events are kept indefinitely by default, so no action is needed
  4. Events older than 90 days can be restored by enabling export now

Answer: A — Events are kept for 90 days, so a diagnostic setting should route logs to a destination such as a Log Analytics workspace or Storage; it can't recover events already deleted

Activity log events are retained for 90 days, and longer retention requires a diagnostic setting to an approved destination. Export doesn't recover events that have already been deleted.

3. An administrator must deploy a domain controller VM and a web VM in the same virtual network. The domain controller must keep the same private address so that DNS host records never need updating, while the web VM can take whatever address Azure provides. Which assignment approach fits both requirements?

  1. Use static private assignment for the domain controller and dynamic assignment, the default, for the web VM
  2. Use dynamic assignment for both, because dynamic is the default and addresses never change
  3. Use static assignment for both, because dynamic assignment is not available for VM network interfaces
  4. Use dynamic assignment for the domain controller and static for the web VM

Answer: A — Use static private assignment for the domain controller and dynamic assignment, the default, for the web VM

Static addresses don't change and suit role-based VMs such as Domain Controllers and DNS name resolution; dynamic is the default and suits the web VM. VM NICs support both dynamic and static private addresses, so option C is wrong.

4. A storage account is protected by a ReadOnly lock. An administrator tries to retrieve the account keys through the Azure portal, and the operation fails. What explains this behavior?

  1. The List Keys operation is a POST request, which a read-only lock blocks.
  2. The ReadOnly lock removes the Reader role from the administrator.
  3. Account keys can only be listed through data plane operations, which locks always block.
  4. The ReadOnly lock encrypts the keys so they can no longer be displayed.

Answer: A — The List Keys operation is a POST request, which a read-only lock blocks.

Locks prevent the POST method from sending data to the Resource Manager API, and the Storage List Keys operation uses a POST request.

5. An administrator must deploy a multi-container group together with a virtual network and a storage account in a single deployment. They want the most concise infrastructure-as-code language with full IntelliSense support, rather than JSON. Which should they use?

  1. Bicep
  2. YAML file
  3. Azure Resource Manager template
  4. Docker command line
  5. Azure Container Apps

Answer: A — Bicep

Bicep is Microsoft's recommended infrastructure-as-code language, more concise than Azure Resource Manager templates, with full IntelliSense support. ARM templates are JSON-based, which the requirement excludes, and YAML is ideal only for deployments that include just container instances.

6. An administrator has a route table with a user-defined route for 10.0.1.0/24 that points to a virtual appliance, and a system route for 10.0.0.0/16 that covers the virtual network. A packet is sent to 10.0.1.4. Which route does Azure use, and why?

  1. The 10.0.0.0/16 system route, because system routes are evaluated before user-defined routes
  2. The 10.0.1.0/24 user-defined route, because it has the longest prefix match
  3. The 10.0.0.0/16 system route, because it covers more addresses
  4. Neither; Azure load-balances the packet across both routes

Answer: B — The 10.0.1.0/24 user-defined route, because it has the longest prefix match

Azure selects the route with the longest prefix match, so the more specific 10.0.1.0/24 route wins. The /16 route is less specific and is not preferred.

7. A user's Virtual Machine Contributor assignment on a resource group was just created and appears in Access control (IAM), but the user still gets an authorization failure. Which two actions are appropriate before investigating further? (Choose two.)

  1. Have the user sign out and back in to refresh credentials
  2. Recreate the assignment at management group scope immediately
  3. Allow time for propagation, which can take up to 10 minutes
  4. Delete and recreate the resource group
  5. Assign the Global Administrator role in Microsoft Entra ID

Answer: A,C — Have the user sign out and back in to refresh credentials / Allow time for propagation, which can take up to 10 minutes

Role-assignment changes can take up to 10 minutes to take effect, and signing out and in refreshes credentials. Widening scope, deleting the resource group, or granting a directory role doesn't address propagation.

8. A finance team sets up a monthly budget on a subscription with an 80% actual-cost threshold. Their requirement is that spending alerts go to staff, and that the VMs in the subscription must keep running once the threshold is crossed. What happens when the threshold is reached?

  1. Notifications are triggered, but resources are not affected and consumption is not stopped.
  2. The subscription's resources are deallocated until the next budget period begins.
  3. New resource creation is blocked in the subscription, but existing resources keep running.
  4. The subscription is placed under a read-only lock until the budget amount is raised.

Answer: A — Notifications are triggered, but resources are not affected and consumption is not stopped.

Budget thresholds only trigger notifications; resources aren't affected and consumption isn't stopped. The other options describe enforcement that budgets don't perform.

9. An administrator starts moving a virtual machine to another resource group in the same subscription. While the move is in progress, a colleague tries to resize the VM and a user connects to an application on it. What is the result?

  1. The resize fails because the resource groups are locked, and the application continues to run without downtime.
  2. The resize succeeds, but the application is disconnected until the move completes.
  3. Both the resize and the application connection fail until the move completes.
  4. The resize is queued and applied automatically after the move completes.

Answer: A — The resize fails because the resource groups are locked, and the application continues to run without downtime.

Source and target resource groups are locked during the move, blocking property changes such as size, but existing resources keep operating and services don't experience downtime.

10. An administrator must back up an app's files and configuration to a storage account protected by a firewall. Which two requirements must be met? (Choose two.)

  1. The app is integrated with a virtual network, or is in a v3 App Service Environment
  2. The storage account allows access from the virtual network the app is integrated with
  3. The storage account is accessed by using a managed identity instead of SAS
  4. The backup includes the app's linked Azure SQL database
  5. The app uses automatic backups instead of custom backups

Answer: A,B — The app is integrated with a virtual network, or is in a v3 App Service Environment / The storage account allows access from the virtual network the app is integrated with

Backing up to a firewall-protected storage account requires VNet integration (or a v3 ASE) and a storage account that allows that virtual network. Managed identity isn't supported, linked databases can't be backed up over a virtual network, and the feature is for custom backups, not automatic ones.

11. Developers cannot open a remote PowerShell session over HTTPS from one IaaS VM to another VM on the same virtual network. An administrator suspects an NSG rule is dropping the traffic and wants a tool that checks a specific local/remote IP, port, protocol and direction, and names the security rule responsible. Which Network Watcher tool should be used?

  1. Next hop
  2. IP flow verify
  3. Topology
  4. Packet capture

Answer: B — IP flow verify

IP flow verify uses a 5-tuple check to determine whether traffic to or from a VM is allowed or denied and reports the rule responsible. Next hop only diagnoses routing, not security rules.

12. An administrator creates an availability set with the default settings for update domains and wants to later reduce the update domain count to 3 to speed up planned maintenance rollouts. Which statement describes what must be done?

  1. Edit the availability set and set the update domain count to 3; the VMs reboot one domain at a time
  2. Delete and recreate the availability set with the desired count, since the update domain count cannot be changed after creation
  3. Nothing can be done because the maximum number of update domains is 5
  4. Stop all VMs in the set, then change the count from the Azure portal

Answer: B — Delete and recreate the availability set with the desired count, since the update domain count cannot be changed after creation

The update domain count is immutable after creation, so the availability set must be deleted and recreated. The range is 1 to 20 (default 5), so 3 is valid at creation.

13. An administrator must peer a virtual network in West Europe with one in East US. The network in East US currently has the address space 10.1.0.0/16 and the one in West Europe has 10.1.0.0/16 as well. The administrator wants to keep both networks running while making the peering possible. What must be done?

  1. Create a global peering, because global peering permits overlapping address spaces across regions
  2. Change one network's address space so the ranges don't overlap, deleting any existing peering first and recreating it afterward
  3. Enable the Traffic forwarded from remote virtual network setting on both peerings
  4. Deploy a VPN gateway in each network, since gateways remove the non-overlapping requirement

Answer: B — Change one network's address space so the ranges don't overlap, deleting any existing peering first and recreating it afterward

Peered virtual networks must have non-overlapping address spaces and peering creation fails if ranges overlap; changing an address range requires deleting the peering, updating the space, and re-peering. Global peering has no exception for overlap, and forwarding settings do not affect it.

14. A subnet has a service endpoint enabled for Azure Storage. A storage account firewall currently allows only the Azure public IP addresses that the VMs in the subnet used before the endpoint was enabled. Users report that VMs in the subnet can no longer reach the storage account after the endpoint was configured. What is the cause?

  1. The DNS entry for the storage account now resolves to a private IP address
  2. Service traffic now uses the VMs' private addresses as source, so the public-IP firewall rules no longer match
  3. Service endpoint routes are overridden by the user-defined routes on the subnet
  4. The default NSG rules block traffic from the virtual network to Azure services

Answer: B — Service traffic now uses the VMs' private addresses as source, so the public-IP firewall rules no longer match

With service endpoints the source IP switches from public to private IPv4 addresses, so existing firewall rules based on Azure public IPs stop working. DNS entries remain unchanged, endpoint routes override UDRs rather than the reverse, and default NSG rules allow this traffic.

15. An organization plans to enable full multi-factor authentication through Microsoft Entra ID P1 for several workloads. Which workload can NOT be protected by it?

  1. An on-premises application published through a VPN or RADIUS
  2. Microsoft 365
  3. A third-party application from the Microsoft Entra gallery
  4. Microsoft Outlook, a non-browser off-the-shelf app

Answer: D — Microsoft Outlook, a non-browser off-the-shelf app

Full MFA works with on-premises apps via VPN/RADIUS, Azure, Microsoft 365, Dynamics 365 and gallery apps, but not with non-browser off-the-shelf apps such as Outlook.

16. A blob was moved to the archive tier 30 days ago. A team now needs its data in the hot tier, and the administrator wants to avoid the early deletion charge for the archived blob. Which approach should the administrator use?

  1. Call Copy Blob to copy the archived blob to a new blob in the hot tier.
  2. Call Set Blob Tier on the archived blob to change it to hot.
  3. Create a lifecycle management policy that rehydrates the blob to hot.
  4. Change the default account access tier to hot.

Answer: A — Call Copy Blob to copy the archived blob to a new blob in the hot tier.

Copy Blob is recommended for rehydrating from archive, and copying avoids the early deletion penalty if the required storage interval for the source blob hasn't elapsed (at the cost of paying for two blobs). Set Blob Tier moves the blob out of archive before 180 days and incurs the charge. Lifecycle policies can't rehydrate archived blobs.

17. An administrator wants to use Connection monitor to test connectivity from an on-premises server to an Azure storage endpoint. The on-premises server currently has only the legacy Log Analytics agent installed. Which action is required so the server can act as a source endpoint?

  1. Keep the Log Analytics agent and enable the Network Performance Monitoring solution only
  2. Install the Network Watcher extension directly on the on-premises server
  3. Enable the Azure Arc agent on the host, then enable the Azure Monitor Agent
  4. Add the server as a destination endpoint only, because on-premises hosts cannot be sources

Answer: C — Enable the Azure Arc agent on the host, then enable the Azure Monitor Agent

On-premises sources must be Azure Arc-enabled, followed by the Azure Monitor Agent; the Log Analytics agent is no longer supported. The Network Watcher extension is for Azure VMs and scale sets.

18. A team must monitor the health of virtual machines that are spread across several subscriptions and regions. All of the VMs send data to a single Log Analytics workspace. The team wants one alert rule, with a separate alert for each VM that meets the condition. Which approach meets the requirement?

  1. A single metric alert rule that targets all the VMs
  2. A log search alert rule on the workspace that uses Split by dimensions on the resourceId column
  3. An activity log alert rule scoped to the VMs
  4. A smart detection alert on an Application Insights resource

Answer: B — A log search alert rule on the workspace that uses Split by dimensions on the resourceId column

Log search alert rules can monitor all resources that send data to the workspace from any subscription or region, and splitting on resourceId gives one alert per resource. A single metric alert rule covers only resources of the same type in the same Azure region.

19. A user needs to connect Azure Storage Explorer to a storage account in a different subscription and has been given only the storage account name and key. A second requirement is that the account is in a national Azure cloud. Which action is required to make the connection?

  1. Select Other in the Storage endpoints domain drop-down and enter the custom endpoint domain
  2. Use the Azure Storage Emulator to attach the account
  3. Attach a service with a SAS and select blob container
  4. Regenerate key2 so Storage Explorer can use it

Answer: A — Select Other in the Storage endpoints domain drop-down and enter the custom endpoint domain

For a national Azure cloud with account name and key, you choose Other in the Storage endpoints domain drop-down and supply the custom endpoint domain. The emulator is for local storage and SAS attachment is a different method.

20. A storage account is switched from the Cool account tier to the Hot account tier, and a GPv2 account's tier is later switched from Hot to Cool. Which charges result from these changes?

  1. Cool to Hot costs the same as writing all data; Hot to Cool costs the same as reading all data
  2. Cool to Hot costs the same as reading all data; Hot to Cool costs the same as writing all data into Cool
  3. Both changes are free because only the per-gigabyte storage rate changes
  4. Both changes cost the same as reading all data in the account

Answer: B — Cool to Hot costs the same as reading all data; Hot to Cool costs the same as writing all data into Cool

Moving from Cool to Hot incurs a charge equal to reading all existing data, while Hot to Cool incurs a charge equal to writing all data into Cool (GPv2 only). The other options reverse or omit these charges.

21. A developer in another team requests a private endpoint to an Azure Storage account that the team does not own and for which they have no Azure RBAC permissions on the account. The storage owner must be able to review the request. The developer also needs access to both the blob and file data. Which two statements describe what must be done? (Choose two.)

  1. Create the private endpoint with the manual connection approval method so the owner can approve it
  2. Create one private endpoint targeting the blob subresource, which also gives access to file
  3. Create separate private endpoints for the blob and file subresources
  4. Create the private endpoint with automatic approval, which works without any permissions
  5. Place the private endpoint in a different region than the virtual network

Answer: A,C — Create the private endpoint with the manual connection approval method so the owner can approve it / Create separate private endpoints for the blob and file subresources

Without the required permissions, the manual method creates the connection in Pending state for the owner to approve, and each Storage subresource requires its own private endpoint. Automatic approval requires permissions, and the endpoint must be in the same region as the virtual network.

22. A team needs to run Bash scripts as part of a deployment so that the whole environment is configured from a single ARM template. The script must be referenced from an external location. Which template capability meets this requirement?

  1. User-defined functions
  2. Linked templates
  3. Deployment scripts
  4. The ARM template tool kit (arm-ttk)

Answer: C — Deployment scripts

Deployment scripts let you add PowerShell or Bash scripts to a template, stored inline or in an external source, so end-to-end setup completes in one template. User-defined functions only simplify template expressions, and arm-ttk only tests templates against guidelines.

23. A new NFS Azure file share was created and several snapshots were taken before the share was ever mounted. After mounting, listing the share's snapshots returns an empty list. What should the administrator do?

  1. Wait at least 30 seconds for the .snapshots directory to appear
  2. Delete the snapshots taken before the first mount and re-create them after mounting
  3. Enable Azure Backup on the share to repopulate the snapshot list
  4. Create new snapshots by using the file data plane API (AzStorageShare)

Answer: B — Delete the snapshots taken before the first mount and re-create them after mounting

Snapshots taken before the first mount aren't listed, so they must be deleted and re-created after mounting. The 30-second wait applies only to just-created snapshots, Azure Backup doesn't support NFS, and data plane APIs aren't supported for NFS snapshots.

24. A virtual machine in a subnet in one Azure region must reach a storage account in a different, non-paired region through the storage firewall. The subnet already has the Microsoft.Storage service endpoint enabled. What should the administrator do?

  1. Enable the Microsoft.Storage.Global endpoint on the subnet in addition to the existing Microsoft.Storage endpoint
  2. Add an IP network rule that contains the subnet's private IP address range
  3. Create a resource instance rule for the virtual machine
  4. Delete the Microsoft.Storage endpoint from the subnet, enable the Microsoft.Storage.Global endpoint, and add a virtual network rule for the subnet

Answer: D — Delete the Microsoft.Storage endpoint from the subnet, enable the Microsoft.Storage.Global endpoint, and add a virtual network rule for the subnet

Microsoft.Storage only covers storage accounts in the same region as the virtual network, while Microsoft.Storage.Global covers any region. Only one of the two endpoint types can be associated with a subnet, so the existing one must be deleted first, and a virtual network rule is still needed to allow the subnet.

25. An auditor asks for a report of role-assignment write and delete operations in a subscription for the previous month. The report must be limited to changes that actually completed. After downloading the Activity log as CSV filtered only by the four RBAC operations, what should the administrator do?

  1. Use the file as is, because it contains only successful changes
  2. Filter the exported records to the Succeeded status and reconcile related records by operation identifier and target scope
  3. Count every row as a separate completed change
  4. Replace the export with the Download role assignments file, which lists the operations performed

Answer: B — Filter the exported records to the Succeeded status and reconcile related records by operation identifier and target scope

Without a status filter the file includes attempted and failed operations and multiple records per operation, so it must be filtered to Succeeded and reconciled. Download role assignments gives a current inventory, not a history of operations.

26. A company must send traffic between two VMs in the same virtual network through a network virtual appliance for inspection. The administrator wants to use Azure's routing override to enforce this. How should the VMs be deployed?

  1. In the same subnet, associated with the same network security group
  2. In different subnets of the virtual network, overriding the default routing to pass through the appliance
  3. In the same subnet, with a dedicated gateway subnet for the appliance
  4. In separate virtual networks, with no changes to default routing

Answer: B — In different subnets of the virtual network, overriding the default routing to pass through the appliance

To require traffic between resources in the same virtual network to flow through a network virtual appliance, deploy the resources to different subnets; Azure's default routing between subnets can then be overridden to route traffic through the appliance. Options A and C keep both VMs in the same subnet, and option D moves them out of the same virtual network.

27. An administrator opens Access control (IAM) for a subscription and uses Check access for a user. The user holds a role assignment made only on one resource group in that subscription. The administrator also wants to see deny assignments created by Azure Blueprints. What will the assignments pane show for this user at the subscription scope?

  1. The resource group role assignment, because child scope assignments are listed
  2. Assignments at the subscription scope and inherited to it, so the resource group assignment is not listed
  3. Only deny assignments, since role assignments appear on a separate tab
  4. Nothing, because Check access works only at resource scope

Answer: B — Assignments at the subscription scope and inherited to it, so the resource group assignment is not listed

The pane shows access at this scope and inherited to this scope; assignments at child scopes aren't listed. It includes both Azure RBAC role assignments and deny assignments from Blueprints or managed apps.

28. A production web app must scale out on HTTP traffic without any scaling rules to configure, and must keep pre-warmed instances ready for sudden spikes. Which plan tier and scaling feature meet these requirements? (Choose two.)

  1. PremiumV3 tier
  2. Standard tier
  3. Automatic scaling (elastic scaling)
  4. Rule-based autoscale with a metric-based rule on Requests
  5. Basic tier with manual scale

Answer: A,C — PremiumV3 tier / Automatic scaling (elastic scaling)

Automatic scaling is platform-managed, HTTP traffic-based, keeps always-ready instances, and is available only on PremiumV2 and PremiumV3. Rule-based autoscale requires you to configure rules, and Standard and Basic do not offer automatic scaling.

29. An application writes continuous log entries to a blob, and the data grows as logging continues. The administrator creates the blob as a block blob but later decides a blob type optimized for append operations would be better. What must the administrator do?

  1. Change the blob type to append blob in the container's properties
  2. Set the blob tier to Hot to convert the type automatically
  3. Create a new append blob, because a blob's type cannot be changed after creation
  4. Convert the blob to a page blob first, then to an append blob

Answer: C — Create a new append blob, because a blob's type cannot be changed after creation

Append blobs suit logging, but a blob's type cannot be changed after it is created, so a new append blob is required. No property or tier change converts types.

30. A production storage account holds regulated data. Compliance requires that all traffic from the virtual network to the storage account stays on the Microsoft backbone, that the account is assigned an IP address from the virtual network, and that complete network isolation is provided. Which option should the administrator configure?

  1. A service endpoint; it keeps the storage account on its public endpoint while restricting access to specific VNets and subnets.
  2. A private endpoint; it assigns a private IP from the VNet to the storage account and keeps traffic within the Microsoft backbone.
  3. A service endpoint; it assigns a private IP from the VNet to the storage account.
  4. A private endpoint; it keeps the storage account on its public endpoint while restricting access to specific subnets.

Answer: B — A private endpoint; it assigns a private IP from the VNet to the storage account and keeps traffic within the Microsoft backbone.

A private endpoint uses a private IP from the VNet and keeps traffic on the Microsoft backbone, suiting production workloads needing complete isolation. Service endpoints leave the account on its public endpoint.

31. An administrator must move a virtual machine, its managed disk and its network interface to a different subscription in the same tenant. The VM is in resource group RG-A, while the NIC and disk are in RG-B. What is the correct approach?

  1. Move only the VM across subscriptions; the disk and NIC follow automatically as child resources.
  2. Move the VM, disk and NIC across subscriptions in separate operations, starting with the disk.
  3. Move the resource group RG-A to the target subscription, which carries its dependent resources.
  4. First consolidate the VM, disk and NIC into one resource group, then move them together to the target subscription.

Answer: D — First consolidate the VM, disk and NIC into one resource group, then move them together to the target subscription.

For cross-subscription moves, the resource and its dependents must be in the same resource group and moved together; consolidate first with a move across resource groups. A resource group itself can't be moved to another subscription.

32. An administrator needs a chart in Metrics Explorer that shows the highest CPU percentage reached by a VM, rather than the default mean value, alongside inbound flows. Which setting must they change for the Percentage CPU metric?

  1. Change Aggregation from Avg to Max
  2. Change Metric Namespace to a storage namespace
  3. Change Scope to a resource group
  4. Change Aggregation from Avg to Sum

Answer: A — Change Aggregation from Avg to Max

Aggregation defaults to Avg for Percentage CPU; switching to Max identifies the highest value. Sum would add all values rather than give the peak.

33. A hybrid organization uses password hash synchronization. Users whose passwords are managed on-premises open the SSPR portal, but they are told to contact their administrator. SSPR is enabled for them and they have registered the required methods. What is the most likely cause?

  1. The reconfirmation interval has been set to 0.
  2. SSPR writeback isn't deployed.
  3. Notify users on password resets is set to No.
  4. The user's browser locale is unsupported.

Answer: B — SSPR writeback isn't deployed.

If the password is managed on-premises and SSPR writeback is not deployed, the user is asked to contact their administrator.

34. A team runs a monitoring solution that scrapes Prometheus metrics from AKS clusters into an Azure Monitor workspace. They must keep the data for about 12 months for capacity planning and run a single PromQL query covering the longest span the service allows. Which statement correctly describes what they can do?

  1. Data is retained for 93 days and a PromQL query can span 30 days
  2. Data is retained for 18 months and a PromQL query can span a maximum of 32 days
  3. Data is retained for 18 months and a PromQL query can span the full 18 months
  4. Data is retained for 31 days by default and can be extended up to two years

Answer: B — Data is retained for 18 months and a PromQL query can span a maximum of 32 days

Prometheus metrics are stored for 18 months, but a single PromQL query is limited to 32 days. The 93-day/30-day figures apply to platform and custom metrics, and 31 days extendable to two years applies to Log Analytics agent data.

35. An administrator wants to prevent anyone, including users with the Owner role, from deleting a production resource group, but all resources inside must remain readable and modifiable. Which lock should be applied to the resource group?

  1. A CanNotDelete lock
  2. A ReadOnly lock
  3. An Azure Policy assignment with the Reader role
  4. A Reader role assignment for all users

Answer: A — A CanNotDelete lock

CanNotDelete lets authorized users read and modify resources but not delete them, and locks override user permissions. ReadOnly would also block updates.

36. An administrator must encrypt temp disks and disk caches, ensure data flowing between compute and storage is encrypted, avoid consuming the VM's CPU for encryption, and support VMs built from custom Linux images. Which option meets all of these requirements?

  1. Azure Disk Encryption with a key encryption key (KEK)
  2. Server-side encryption configured with a disk encryption set
  3. Encryption at host
  4. Confidential disk encryption

Answer: C — Encryption at host

Encryption at host encrypts temp disks, caches and data flows, doesn't use the VM's CPU, and works for custom images. ADE uses the VM CPU and doesn't work for custom Linux images, SSE doesn't encrypt temp disks or caches, and confidential disk encryption uses the VM CPU.

37. A company must restore a managed Azure VM into a different subscription in the same tenant. The recovery point to be used is in the vault tier. Which statements about this restore are correct? (Choose two.)

  1. The Cross Subscription Restore property must be enabled on the Recovery Services vault
  2. The recovery point can be a snapshot tier recovery point
  3. The restore can target a subscription in a different tenant
  4. The restore works for managed VMs, and it is not supported for VMs encrypted with ADE
  5. The restore is only possible for unmanaged VMs

Answer: A,D — The Cross Subscription Restore property must be enabled on the Recovery Services vault / The restore works for managed VMs, and it is not supported for VMs encrypted with ADE

Cross Subscription Restore is allowed only if the property is enabled on the vault, and it is unsupported for ADE-encrypted VMs while working for managed VMs. It is unsupported for snapshot tier recovery points, limited to the same tenant, and not for unmanaged VMs.

38. A company needs a plan for mission-critical apps that requires network isolation on top of compute isolation, with the highest scale-out capacity of the sample plans compared. Which tier fits?

  1. Premium P1V3, which supports up to 30 instances
  2. Standard S1, which supports up to 10 instances
  3. Basic B1, which supports up to 3 instances
  4. Isolated V2, which runs on dedicated virtual networks and supports up to 200 instances

Answer: D — Isolated V2, which runs on dedicated virtual networks and supports up to 200 instances

Isolated tiers run dedicated VMs on dedicated virtual networks, adding network isolation, and offer the maximum scale-out (200 instances for Isolated V2). Premium is dedicated compute only.

39. An action group is configured to notify the operations team when Azure Service Health alerts fire, but it never responds to those alerts. The action group was created with the processing region set to East US 2. What should the administrator change?

  1. Move the action group to a zone-redundant Regional option in West US 2
  2. Set the region of the action group to Global
  3. Enable the common alert schema on each notification
  4. Add an Event Hubs action to the action group

Answer: B — Set the region of the action group to Global

Service Health alerts are only supported in the global region, so the action group's region must be Global. Another Regional option doesn't fix this, and the common alert schema only affects the payload format.

40. A company wants users to reach blob data through www.contoso.com instead of the default storage endpoint. The administrator is asked to use direct mapping with the least additional configuration. What should be created in DNS?

  1. An A record that points the subdomain to the storage account's private IP address
  2. A CNAME record that points from the subdomain to the storage account's blob endpoint
  3. A TXT record that contains the storage account name
  4. A CNAME record that points from the storage account's blob endpoint to the subdomain

Answer: B — A CNAME record that points from the subdomain to the storage account's blob endpoint

Direct mapping uses a CNAME record pointing from the custom subdomain to the storage account's blob endpoint. Option D reverses the direction.

41. An administrator needs a spreadsheet of recent backup jobs for SQL Server workloads protected in a Recovery Services vault. Using Export jobs from the Backup Jobs menu with a filter applied fails. Which approach meets the requirement?

  1. Set the Item type filter to Azure workload, then select Export jobs
  2. Select both Backup and Restore in the Operation filter, then select Export jobs
  3. Enable a Log Analytics workspace and export the workload-specific jobs from it
  4. Open the Backup Pre-Check Status tile and export the results

Answer: C — Enable a Log Analytics workspace and export the workload-specific jobs from it

Exporting jobs with a filter applied isn't supported, and the operation fails for SQL and SAP HANA workloads. The documented alternative is to enable a Log Analytics workspace and export workload-specific jobs.

42. A company wants containers deployed into an Azure virtual network so they communicate privately with peered networks and receive no public exposure. They also need the containers to be Azure Container Instances groups. Which statements are true of this configuration? (Choose two.)

  1. Only Linux container groups can be deployed into the virtual network
  2. The containers receive no public IP address
  3. The containers receive a public IP address and an FQDN automatically
  4. Windows container groups are the only type supported in a virtual network
  5. Containers can communicate only with other containers in the same group

Answer: A,B — Only Linux container groups can be deployed into the virtual network / The containers receive no public IP address

Linux container groups can be deployed into a virtual network, and those containers get no public IP, communicating within the virtual network or peered networks. Communication isn't limited to the same group.

43. An administrator exports a resource group with `az group export --name "rg1" > main.json` and runs `az bicep decompile --file main.json`. A main.bicep file already exists in that directory and must be replaced by the new output. What should the administrator add to the decompile command?

  1. The --overwrite switch
  2. Nothing; run the command without az at the start
  3. A second az group export command
  4. The --force switch

Answer: D — The --force switch

The decompile command creates main.bicep next to main.json, and the --force switch overwrites an existing Bicep file. Dropping the az prefix only changes how the command is invoked, not its overwrite behavior.

44. A security team wants users to periodically re-verify their SSPR contact data, but also wants to avoid ever forcing re-confirmation for some pilot tenants. Which statement about the reconfirmation setting is correct?

  1. It accepts values from 1 to 365 days, and 1 disables prompts.
  2. It is available even when users are not required to register at sign-in.
  3. It accepts values from 0 to 730 days, where 0 means users are never asked to reconfirm.
  4. It accepts values from 0 to 730 days, where 0 means users are asked at every sign-in.

Answer: C — It accepts values from 0 to 730 days, where 0 means users are never asked to reconfirm.

Valid values are 0 to 730 days, with 0 meaning never prompted, and the option requires 'Require users to register when signing in' to be enabled.

45. An administrator needs to apply tags to resources across a subscription for a governance task, even though the administrator has no access to the resources themselves. Which access meets this requirement?

  1. Write access to the Microsoft.Resources/tags resource type, such as the Tag Contributor role
  2. The Reader role on the subscription
  3. The Management Group Reader role on the root management group
  4. The Resource Policy Contributor role on the subscription

Answer: A — Write access to the Microsoft.Resources/tags resource type, such as the Tag Contributor role

Write access to Microsoft.Resources/tags lets you tag any resource even without access to the resource itself, and the Tag Contributor role grants it.

46. A team is testing a web app on the Free tier. They then need a custom DNS name, then an SSL binding, and later staging environments. According to the scaling scenario in the module, which sequence of tiers does the plan move through as each feature is added?

  1. Shared, then Basic, then Standard
  2. Basic, then Standard, then Premium
  3. Shared, then Standard, then Premium
  4. Basic, then Basic, then Standard

Answer: A — Shared, then Basic, then Standard

The document describes scaling Free to Shared for a custom DNS name, to Basic for an SSL binding, and to Standard for staging environments.

47. A company needs a file share for a latency-sensitive workload that requires consistent SSD-backed performance. The company also wants the share to remain available if a single datacenter zone in the region fails. Which storage account type and redundancy option meet both requirements?

  1. FileStorage account with ZRS
  2. FileStorage account with GRS
  3. General-purpose v2 account with ZRS using the Hot tier
  4. General-purpose v2 account with GZRS using the Transaction Optimized tier

Answer: A — FileStorage account with ZRS

Premium (SSD-backed) shares are created in FileStorage accounts and support only LRS and ZRS, so FileStorage with ZRS gives SSD performance and zone resilience. GRS is not offered for premium, and GPv2 tiers are HDD-backed.

48. An administrator must map contoso.com, a root domain, to an App Service app. The domain registrar does not allow CNAME records for the root domain. Which DNS record should be created?

  1. A CNAME record pointing to webapp.azurewebsites.net
  2. An A record mapping the domain to the app's IP address
  3. A wildcard CNAME record pointing to the app
  4. An App Service Managed Certificate binding in place of a DNS record

Answer: B — An A record mapping the domain to the app's IP address

When the registrar disallows CNAME records for the root or wildcard domains, an A record must be used. The managed certificate secures the domain but does not map it, and a wildcard CNAME is also unsupported in this case.

49. A Windows VM currently uses only the default server-side encryption with platform-managed keys. Compliance now requires its temporary disk to be encrypted at rest. Which two actions meet this requirement? (Choose two.)

  1. Enable encryption at host on the VM
  2. Configure a disk encryption set with customer-managed keys for server-side encryption
  3. Use Azure Disk Encryption with the VolumeType parameter set to EncryptFormatAll
  4. Use Azure Disk Encryption with the VolumeType parameter set to All
  5. Convert the OS disk to a GUID partition table (GPT)

Answer: A,D — Enable encryption at host on the VM / Use Azure Disk Encryption with the VolumeType parameter set to All

The temporary disk isn't encrypted unless encryption at host is enabled or, for Azure Disk Encryption, VolumeType is set to All on Windows. Server-side encryption, even with a disk encryption set, doesn't encrypt temp disks, and EncryptFormatAll is the Linux value.

50. A company hosts its website behind an Azure load balancer with a public IP. The site must be reachable at the zone apex (contoso.com), and the DNS record must keep working automatically if the load balancer's public IP address changes. Which record should the administrator create?

  1. A record with alias record set set to Yes, targeting the public IP resource
  2. A record with alias record set set to No, containing the current IP address
  3. CNAME record at the zone apex pointing to the load balancer's DNS name
  4. A record with TTL set to 1 second and the current IP address

Answer: A — A record with alias record set set to Yes, targeting the public IP resource

An alias record links the apex to the Azure resource rather than a fixed IP, so changes to the IP are applied automatically. A static A record would go stale, and CNAME records for such resources aren't supported at the apex.

51. Adatum hosts a three-tier application in Azure. The web-tier VMs must be reachable from the internet, but the middle-tier VMs that perform data analysis must never be reachable from the internet. Traffic from the web tier must still be balanced across the middle-tier VMs. Which load balancer configuration meets the requirements?

  1. A public load balancer for the web tier and an internal load balancer with a private front-end IP for the middle tier
  2. A public load balancer for both tiers, with the middle-tier rules limited to private ports
  3. An internal load balancer for the web tier and a public load balancer for the middle tier
  4. A single public load balancer with two front-end IP addresses, one for each tier

Answer: A — A public load balancer for the web tier and an internal load balancer with a private front-end IP for the middle tier

A public load balancer balances internet traffic to the web tier, while an internal load balancer uses a private front-end IP that is never exposed to an internet endpoint and balances web-tier traffic across secondary VMs. The other options expose the middle tier or invert the roles.

52. A company connects to Azure over ExpressRoute and wants on-premises routes to be exchanged dynamically with Azure, without manually creating a user-defined route for each on-premises prefix. Which mechanism should the administrator configure?

  1. Service chaining between peered virtual networks
  2. A virtual network service endpoint
  3. Border Gateway Protocol (BGP)
  4. A system route with next hop type None

Answer: C — Border Gateway Protocol (BGP)

BGP lets an on-premises gateway exchange routes with an Azure virtual network gateway, typically over ExpressRoute or site-to-site VPN. Service chaining only overrides routes between peered networks, and None drops traffic.

53. An administrator must configure backup for a VM that has one OS disk and several large data disks. A separate database backup solution already protects the data, so the requirement is to back up only the OS disk to reduce cost. Which backup policy type must be used?

  1. Standard policy with the snapshot tier only
  2. Standard policy with weekly frequency
  3. Enhanced policy with selective disk backup
  4. Standard policy with selective disk backup

Answer: C — Enhanced policy with selective disk backup

Selective Disk backup and restore is provided using the Enhanced policy, allowing a subset of disks to be backed up, for example only the OS disk to reduce cost when a database backup solution protects the data. The Standard policy is not stated to provide selective disk backup.

54. An administrator needs to back up the production slot of an App Service app that runs in the Basic tier and uses an Azure SQL Database. The app's content plus database is about 4 GB. The intended destination storage account has a firewall enabled. What should the administrator conclude?

  1. Use the Basic tier, but choose a different storage account without a firewall in the same subscription as the app
  2. Use the Basic tier and keep the firewall-enabled storage account, since backups use a trusted Azure service path
  3. Use the Standard tier, because Basic does not support Backup and Restore
  4. Use the Basic tier, but split the backup, because backups are limited to 1 GB of content

Answer: A — Use the Basic tier, but choose a different storage account without a firewall in the same subscription as the app

Backup and Restore is supported in Basic (production slot only), and the 4 GB size is under the 10 GB limit. A storage account with a firewall enabled cannot be used as the backup destination, and the storage account must be in the same subscription as the app.

55. A SaaS provider keeps data for several customers in one storage account. It must encrypt each customer's container with a separate key that the provider controls and stores in Azure Key Vault. Which feature should the administrator use?

  1. Infrastructure encryption
  2. Customer-provided keys supplied on each request
  3. Client-side encryption v2
  4. Encryption scopes that use customer-managed keys

Answer: D — Encryption scopes that use customer-managed keys

Encryption scopes manage encryption with a key scoped to a container or an individual blob, create boundaries between customers' data in the same account, and can use customer-managed keys. Customer-provided keys are held in the customer's own key store and sent with requests, not stored in Key Vault.

56. A company deploys network virtual appliances (NVAs) in a virtual network and needs a single rule to load balance all TCP and UDP flows arriving on every port, without creating a rule per port. Which configuration meets the requirement?

  1. An outbound rule on a public load balancer that applies SNAT for the NVA instances
  2. An inbound NAT rule on a public load balancer mapping to each NVA
  3. A load-balancing rule on a public Standard load balancer using protocol TCP and port 0
  4. A high availability ports rule (protocol all, port 0) on an internal Standard load balancer

Answer: D — A high availability ports rule (protocol all, port 0) on an internal Standard load balancer

A rule with protocol all and port 0 is an HA ports rule that load balances all TCP and UDP flows on all ports of an internal standard load balancer, suited to NVAs. Inbound NAT and outbound rules do not provide this per-flow balancing.

57. A team runs a production web app in App Service and wants to validate each release before users see it. Requirements: no requests may be dropped during the cutover, and if the new release misbehaves, the previous version must be restorable immediately. Which approach meets both requirements?

  1. Deploy to a staging deployment slot, then swap it with production and, if needed, repeat the same swap
  2. Deploy directly to production with Always On enabled and restore from a backup if the release fails
  3. Deploy to a second App Service app and change the DNS CNAME record to point to it
  4. Enable session affinity on the production app and push the release to a single instance first

Answer: A — Deploy to a staging deployment slot, then swap it with production and, if needed, repeat the same swap

Swapping a warmed-up staging slot into production redirects traffic seamlessly with no dropped requests, and the slot then holds the previous production app so the same swap restores the last known good site. A backup restore overwrites content and is not an immediate, seamless rollback.

58. An administrator is creating a new group that will be used to assign Microsoft Entra roles to its members. The tenant has P1 licenses. Which statements about this configuration are correct? (Choose two.)

  1. The Membership type is automatically set to Assigned.
  2. The administrator must hold at least the Privileged Role Administrator role.
  3. The Membership type can later be changed to Dynamic User once the group exists.
  4. The group type must be Microsoft 365 so the Group email address option is enabled.
  5. The option is only available with a Microsoft Entra ID Free license.

Answer: A,B — The Membership type is automatically set to Assigned. / The administrator must hold at least the Privileged Role Administrator role.

Enabling 'Microsoft Entra roles can be assigned to the group' automatically selects Assigned and requires at least Privileged Role Administrator; the membership type cannot be changed afterwards and the option needs P1 or P2.

Take this test interactively

More Microsoft Azure Administrator (AZ-104) practice tests